Commit Graph

69740 Commits

Author SHA1 Message Date
Christian Stewart
0629895dbf package/docker-compose: bump version to v2.23.0
Significant update with new features & fixes.

Full release notes:

https://github.com/docker/compose/releases/tag/v2.23.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:04:31 +02:00
Julien Olivain
68689a6cbc package/rdma-core: bump to version v48.0
For change log, see:
https://github.com/linux-rdma/rdma-core/releases/tag/v48.0

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-25 21:54:26 +02:00
Peter Korsgaard
fefcfddc5e package/mxsldr: add .hash file
The host-mxsldr package was missing a hash file, add it now.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-25 21:52:00 +02:00
Fabrice Fontaine
de7bc4ada2 package/minizip-zlib: fix CVE-2023-45853
MiniZip in zlib through 1.3 has an integer overflow and resultant
heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long
filename, comment, or extra field. NOTE: MiniZip is not a supported part
of the zlib product.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:16:46 +02:00
Fabrice Fontaine
17ffb91551 package/libtommath: add LIBTOMMATH_CPE_ID_VENDOR
cpe:2.3🅰️libtom:libtommath is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/F0D99614-AA27-4713-ADD2-103647C8838B

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:16:22 +02:00
Fabrice Fontaine
07c44afc8d package/nghttp2: security bump to version 1.57.0
Fix CVE-2023-44487: The HTTP/2 protocol allows a denial of service
(server resource consumption) because request cancellation can reset
many streams quickly, as exploited in the wild in August through October
2023.

Fix CVE-2023-35945: nghttp2 fails to release memory when PUSH_PROMISE or
HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails
with a fatal error. For example, if GOAWAY frame has been received, a
HEADERS frame that opens new stream cannot be sent.

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6pcr-v3hg-752p
https://github.com/nghttp2/nghttp2/compare/v1.41.0...v1.57.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:15:52 +02:00
Fabrice Fontaine
7385c7f8b3 package/wireshark: security bump to version 4.0.10
https://www.wireshark.org/news/20231004.html
https://www.wireshark.org/news/20231004a.html

Fix CVE-2023-5371:
https://www.wireshark.org/security/wnpa-sec-2023-27.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:14:46 +02:00
Bernd Kuhls
d00881cad1 package/apache: security bump version to 2.4.58
Fixes CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802:
https://httpd.apache.org/security/vulnerabilities_24.html

Release notes:
https://lists.apache.org/thread/1qnr3jpk1mdnqc2c6foyjvg0ch636h1n

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:14:13 +02:00
Christian Stewart
a78bf295bc package/runc: bump version to v1.1.9
Bugfixes and riscv64 support.

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:13:38 +02:00
Alexey Romanov
75fa573ef9 package/pkg-kernel-module: add BR2_MAKE_HOST_DEPENDENCY
Commit 0b9efc991f ("linux: use BR2_MAKE") switched LINUX_MAKE to
$(BR2_MAKE) to avoid build issue with kernel version >= 6.2 and GNU
Make version < 3.82. However, the same issue is actual for kernel
modules as well.

Using $(BR2_MAKE) should guarantee a consistent behavior between
kernel and kernel-modules builds.

Signed-off-by: Alexey Romanov <avromanov@sberdevices.ru>
Signed-off-by: Sergey Bobrenok <SIBobrenok@sberdevices.ru>
[yann.morin.1998@free.fr: minor coding style]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-24 21:21:01 +02:00
Adam Duskett
e0cecc326a package/opkg: enable sha256sum support
Support for sha256 has no additional dependency, the size increase is
minimal, and sha256 is the smallest hash still not broken (md5 and sha1
are), so it makes sense to enable it unconditionally.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: make it unconditional and commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:42 +02:00
Adam Duskett
ef2aa9e6b5 package/opkg: add curl support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:39 +02:00
Adam Duskett
00583e1c16 package/opkg: add bzip2 support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:36 +02:00
Adam Duskett
3d9ba8c3f7 package/opkg: Add lz4 support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:33 +02:00
Adam Duskett
23a669456f package/opkg: add xz suspport
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:12 +02:00
Adam Duskett
6d55ba0f8a package/opkg: add zstd support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:06 +02:00
Yann E. MORIN
b3dd463442 package/opkg: move related code together
In commit d31db334c3 (opkg: Add gnupg signature checking support.),
the macro definition for the hook, and the hook assignment, got
separated by the then-newly introduced GPG handling.

Move the macro definition closer to the hook assignment. Since this is
a post-install hook, it is but logical that it comes further down in
the .mk file.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:17:14 +02:00
Adam Duskett
10e6449964 package/opkg-utils: bump version to 0.6.2
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:52:25 +02:00
Adam Duskett
4c761f459a package/opkg: bump version to 0.6.2
Tested in Fedora 39 and Debian 11 with:
./support/testing/run-tests tests.package.test_opkg.TestOpkg.test_run

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:52:19 +02:00
Titouan Christophe
b7267eab9a package/redis: security bump to v7.2.2
This fixes CVE-2023-45145, see the release notes:
https://raw.githubusercontent.com/redis/redis/7.2.2/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:50:10 +02:00
Thomas Petazzoni
7f1088f9ca package/tar: allowing building even on non-Y2038 compliant systems
Since the bump of tar to version 1.35 in Buildroot commit
d4d483451f ("package/tar: security bump
to version 1.35"), the build will fail on systems that are not Y2038,
such as uClibc configurations.

In order to preserve the previous behavior, pass --disable-year2038.
See the gnulib documentation for details [0]. Contrary to what the
option name might suggest, it doesn't really disable Y2038 support,
but only the check that the system is Y2038 compliant. So even with
--disable-year2038, if the system is Y2038 compliant (uses a 64-bit
arch, uses the musl C library, or uses the glibc C library with
BR2_TIME_BITS_64=y), tar will be Y2038 compliant.

[0] https://www.gnu.org/software/gnulib/manual/html_node/Avoiding-the-year-2038-problem.html

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:21:32 +02:00
Adam Duskett
bc8d214e98 package/python-django: bump version to 4.2.6
Tested with tests.package.test_python_django.TestPythonPy3Django.test_run in
Fedora 38 and Debian 11

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:37:13 +02:00
Fabrice Fontaine
5ef8369d98 package/suricata: security bump to version 6.0.15
This is a security release, fixing a number of important issues.

https://forum.suricata.io/t/suricata-6-0-15-released/4068/2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:36:16 +02:00
Fabrice Fontaine
9ccfb25dde package/vim: security bump to version 9.0.2053
Fix CVE-2023-5344, CVE-2023-5441 and CVE-2023-5535

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:32:40 +02:00
Bernd Kuhls
bf9583a502 package/elfutils: enable on musl
Buildroot commit eb60820c0a disabled
elfutils for musl toolchains in 2015. Current code builds fine with musl
so remove the exceptions.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[yann.morin.1998@free.fr:
  - move all libc-related conditional blocks together
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 18:02:32 +02:00
Bernd Kuhls
d8bcff69fc {linux, linux-headers}: bump 5.15.x / 6.{1, 5}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:26:53 +02:00
Bernd Kuhls
07aa4dcbfa package/libdrm: bump version to 2.4.117
Release notes:
https://lists.x.org/archives/xorg-announce/2023-October/003429.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:26:47 +02:00
Giulio Benetti
274ca1732f package/rtl8188eu: bump to 2023-07-29 version on v5.2.2.4 branch
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:16:36 +02:00
Francois Perrad
01c42d05bd package/perl-mojolicious: bump to version 9.34
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:08:55 +02:00
Gaël PORTAY
2c2d01ac0f package/libxmlrpc: bump version to 1.60.01 (code/advanced@r3176)
Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
[yann.morin.1998@free.fr: bump to 01.60.01 bug fix with openssl]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 14:05:09 +02:00
Yann E. MORIN
f685549b19 docs/manual: fix typo
Reported-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-21 23:30:27 +02:00
Yann E. MORIN
23edf9837c package/pkg-utils: teach per-package-rsync to copy or hardlink dest
commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) was recently reverted, so we
are back to a situation where it is possible for packages and post-build
scripts to modify files in-place, and thus impact files in any arbitrary
per-package directory, which may break things on rebuild for example.

21d52e52d8 was too big a hammer, but we can still apply the reasoning
from it, to the aggregation of the final target and host directories.

This solves the case for post-build scripts at least. We leave the case
of inter-package modification aside, as it is a bigger issue that will
need more than just copying files around.

We use --hard-links, so that hard-links in the source (the PPD), are
kept as new hard-links (i.e. "copy" of hard-links) in the destination.
This contributes to limiting the size of target/.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
2023-10-21 21:18:13 +02:00
Yann E. MORIN
8f1487d6fa Revert "package/pkg-utils.mk: break hardlinks in global {TARGET, HOST}_DIR on per-package build"
Commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) stopped hardlink the source and
destination when rsyncing per-package directory, on the rationale that
modifying files in-place after the rsync would also modify the original
file, and that break foo-rebuild and can cause issues with post-build
scripts.

However, what 21d52e52d8 did not envision, is that copying instead of
hard-linking has two nasty side effects:

  - the size increase for the build directory increase with the number
    of packages and with the depth of th dependency chains for those
    packages: a (relatively small) build that was previously totalling
    ~13GiB in output/, now totals north of 122GiB, an almost 10-time
    increase;

  - the build time increases, as it takes more time to read+write files
    than it takes to create a new link to a file; the same build saw an
    increase of build time from 5min 10s to 7min 30s, a 45% increase.

These regressions are both serious, so revert the change; we'll come up
with a stopgap measure in follow-up commits.

This reverts commit 21d52e52d8.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
2023-10-21 21:08:24 +02:00
Neal Frager
3f23277c41 configs/zynq_microzed_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_microzed_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:42:00 +02:00
Neal Frager
b0c46e2f91 configs/zynq_zed_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_zed_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:41:55 +02:00
Neal Frager
490b71f9f0 configs/zynq_zc706_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_zc706_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:41:48 +02:00
Neal Frager
032601efa7 package/bootgen: bump to xilinx_v2023.2
Bump bootgen to xilinx_v2023.2.

With version xilinx_v2023.2, the flexlexer patch has been fully applied:
8e6702bb50

Thus the flexlexer patch can finally be removed from buildroot.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:37:34 +02:00
Adrian Perez de Castro
487761a5b2 package/xdg-dbus-proxy: bump to version 0.1.5
Version 0.1.5 mainly fixes handling of paths with more than 255
characters. Release notes:

  https://github.com/flatpak/xdg-dbus-proxy/releases/tag/0.1.5

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:36:50 +02:00
Bernd Kuhls
f45fa3b405 package/vlc: bump version to 3.0.19
Rebased patch 0006 due to upstream commit
3f9fc44176

Release notes: https://code.videolan.org/videolan/vlc/-/blob/3.0.19/NEWS

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:36:23 +02:00
Bernd Kuhls
c239770d12 package/eudev: bump version to 3.2.14
Release notes:
https://github.com/eudev-project/eudev/releases/tag/v3.2.14

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:35:39 +02:00
Bernd Kuhls
2e1890db65 {linux, linux-headers}: bump 6.1.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:35:23 +02:00
Peter Korsgaard
bbf9a9ba7a .checkpackageignore: drop now removed network-manager patches
Commit 0455f957a3 (package/network-manager: bump to version 1.44.2)
dropped the two patches but forgot to update .checkpackageignore.

Fix that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-17 10:35:53 +02:00
Peter Korsgaard
1e39222b0c docs/website: Update for 2023.02.6
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-16 11:52:17 +02:00
Peter Korsgaard
4441118270 Update for 2023.02.6
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 593454c77e)
[Peter: drop Makefile/Vagrantfile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-16 11:46:01 +02:00
Peter Korsgaard
e077133a65 docs/website: Update for 2023.08.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-16 11:40:37 +02:00
Peter Korsgaard
cc31a8057a Update for 2023.08.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fe50c054bc)
[Peter: drop Makefile change]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-16 11:34:39 +02:00
Yann E. MORIN
6480774c43 package/pkg-generic: drop support for arch-specific patches
The last architecture-specific patch we had was removed 2015-02-14 with
commit 9863553fe8 (packages: all salute the passing of avr32), where
we eventually got rid of the avr32-specific patch for fbv.

Since then, we've only had common patches (that apply systematically),
or conditional patches, that are applied in an ad-hoc manner with
post-patch hooks. Currently, we even only have one such patch (for
Linux).

Since we do not advertise that possibility in the manual, and since we
do not want to have such patches, drop the support for it.

This has the potential for breaking existing br2-external trees, but
there is a workaround for those: they can provide a pre-patch ook that
copies the necessary per-arch patches if needed. We document this in the
manual.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-10-15 22:24:51 +02:00
James Hilliard
0455f957a3 package/network-manager: bump to version 1.44.2
Drop patches which are now upstream.

CONTRIBUTING.md hash changed due to text various text updates, most of
them outside of the section about licensing. The only change in that
section is:

@@ -39,26 +39,29 @@
 new contributions already must already agree to that.
 For more details see [RELICENSE.md](RELICENSE.md).

+Do not use "Signed-off-by:" lines in commits for NetworkManager. It has no meaning.
+

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-10-15 22:21:29 +02:00
Joachim Wiberg
560f9dbc88 package/libite: bump to v2.6.1
Changes:
 - New APIs introduced in v2.6.0, for details, see
   https://github.com/troglobit/libite/releases/tag/v2.6.0
 - FTBFS fix for uClibc and musl libc, v2.6.1
   https://github.com/troglobit/libite/releases/tag/v2.6.1

Packaging:
 - LICENSE hash changed due to bump in copyright years
 - Disable doxygen (html docs) in build, introduced in v2.4.1

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-10-15 22:14:51 +02:00
Joachim Wiberg
dc84952eb3 package/inadyn: bump to v2.12.0
New features and DDNS provider support (IPv64.net), but also a lot of
fixes to regressions introduced in v2.11.0, e.g.:

 - dynv6.com not working at all, regression in v2.11.0
 - Regression in DDNS provider names, introduced in v2.11.0:
   - dyndns@3322.org
   - dyndns@he.net
   - default@dynv6.com
   - ipv6tb@he.net

From https://github.com/troglobit/inadyn/releases/tag/v2.12.0

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
2023-10-15 22:13:21 +02:00