Fixes the following CVEs:
CVE-2024-24789: archive/zip: mishandling of corrupt central directory record
CVE-2024-24790: net/netip: unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
View the release notes for more information:
https://go.dev/doc/devel/release#go1.22.4
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Patch from upstream PR still being discussed:
https://github.com/kmod-project/kmod/pull/32Fixes: #16093
Signed-off-by: Fiona Klute <fiona.klute+wiwa@gmx.de>
[yann.morin.1998@free.fr:
- add upstream tag to the patch
- reference #16093
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
When using imx-mkimage 6.1.36_2.1.0 or later, an additional data structure
is inserted in the generated image. The FIT external data position passed
to the uboot mkimage program needs to be adjusted accordingly.
Fixes: https://bugs.busybox.net/show_bug.cgi?id=15973
Fixes: 72de789023 ("package/imx-mkimage: bump version to lf-6.1.36-2.1.0")
Tested-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
[Sébastien: Tested on i.MX8MM EVK and i.MX8MP EVK]
[Sébastien:
- fix subject
- add Tested-by tag
- fix Fixes tags
]
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
makedumpfile libc dependency is coming from elfutils. Commit
bf9583a502 ("package/elfutils: enable on musl") removed elfutils
libc dependency. makedumpfile now builds fine with musl libc. Remove
its libc dependency.
Cc: Alexander Egorenkov <egorenar-dev@posteo.net>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix pthread_detach() detection that is broken when building
with GCC 14.x:
checking for pthread_kill... yes
checking for pthread_rwlock_destroy with <pthread.h>... yes
checking for pthread_detach with <pthread.h>... no
configure: error: could not locate pthread_detach()
make[1]: *** [package/pkg-generic.mk:273:
/home/user/buildroot/bsp-barebox/build/ntp-4.2.8p17/.stamp_configured]
Error 1
make: *** [Makefile:82: _all] Error 2
Reference: https://bugs.ntp.org/show_bug.cgi?id=3926
Additionally, refresh patch 0002 to fix the offset of hunk 1.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
At91dataflashboot is an ancient (2006) fork of at91bootstrap1 specifically
for the Atmel/Microchip AT45 series (dataflash) of serial flashes.
The package hasn't seen any meaningful updates since, is not used by any
defconfigs and at91bootstrap3 nowadays has AT45 support - So remove the
package.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: update .checkpackageignore]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The upstream is no longer available, no defconfigs use it and the package
has been replaced 12 years ago with at91bootstrap3 with commit ca0d69c61c
(at91bootstrap3: new package), so remove it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: update .checkpackageignore]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
It has been well over 10 years since glibc 2.14 was released; the last
Debian version that had an earlier glibc was Wheezy, which Freexian
stopped to maintain as an ELTS in June 2020, 4 years ago, while the
oldest still maintained Ubuntu has glibc 2.21. It is now safe to assume
glibc 2.14 on all major, relevant distributions nowadays.
The distutils module is no longer bundled with python 3.12 so this
eliminates the need to install additional python modules under python
3.12.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr: add Debian and Ubuntu references]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
When systemd and tpm2-tss with fapi support are enabled, the fakeroot
script fail with:
<stdin>:35: Failed to resolve user 'tss': No such process.
When fapi support is enabled, tpm2-tss package install additional
configuration files that are expecting tss user and group exist [1].
/etc/sysusers.d/tpm2-tss.conf
/etc/tmpfiles.d/tpm2-tss-fapi.conf
The build fail in the fakeroot environment while handling tmpfiles
installed by tpm2-tss with fapi by host-systemd.
tss user and group is currently created by the tpm2-abrmd package but
tpm2-tss package also provide a udev rule file tpm-udev.rules [2] that
set the ownership of dev nodes /dev/tpmX and /dev/tpmrmX to tss
user/group. So tpm2-tss package must define TPM2_TSS_USERS to create
tss user and group, not tpm2-abrmd package.
So, move TPM2_ABRMD_USERS to TPM2_TSS_USERS.
Note: tpm2-abrmd is nowadays deprecated since the in-kernel Resource
Manager (available since kernel 4.12) is preferred [3].
[1] https://github.com/tpm2-software/tpm2-tss/blob/4.1.3/INSTALL.md?plain=1#L184
[2] https://github.com/tpm2-software/tpm2-tss/blob/4.1.3/dist/tpm-udev.rules
[3] https://github.com/tpm2-software/tpm2-abrmd/blob/3.0.0/README.md?plain=1#L39
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fedora has recently migrated to wget2, which has dropped ftp support and the
--passive-ftp command line option:
https://fedoraproject.org/wiki/Changes/Wget2asWget
It turns out that the command line option also doesn't do anything for wget1
as it was made the default in wget 1.10:
https://git.savannah.gnu.org/cgit/wget.git/tree/NEWS?h=v1.13#n292
wget 1.10 is from 2005, so it is safe to assume that all supported
distributions use >= 1.10.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
With the corresponding binary library and gstreamer 0.10 plugin removed, the
package for the kernel module does not make a lot of sense, so remove the
package.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The linux4sam_1.9 upstream is no longer available for this binary-only
library that was used with a gstreamer 0.10 plugin, which was itself removed
in 2020.02 with commit fb49c7a261 (package/gstreamer/*: remove
packages), so remove the package.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarball is also available over https from github, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarball (with .tar.gz extension but same content) is also available over
https from sourceforge, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.netfilter.org no longer provides ftp, so use the https:// url from
_SITE.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
http redirects to https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarballs are also available over https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.netfilter.org no longer provides ftp, so use the https:// url from
_SITE.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
http redirects to https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarballs are also available over https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The ftp server does not respond, so change to https:// instead. Here the
3.2.6 version is under older_versions.
wget ftp://ftp.ncftp.com/ncftp/ncftp-3.2.6-src.tar.gz
--2024-06-03 08:10:44-- ftp://ftp.ncftp.com/ncftp/ncftp-3.2.6-src.tar.gz
=> ‘ncftp-3.2.6-src.tar.gz’
Resolving ftp.ncftp.com (ftp.ncftp.com)... 209.197.102.38
Connecting to ftp.ncftp.com (ftp.ncftp.com)|209.197.102.38|:21... ^C
http redirects to https, so update the help text to match.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The ftp server does not allow anonymous login, causing the download to fail:
wget --passive-ftp -nd -t 3 -O '/home/peko/source/buildroot/output-qt/build/.lynx2.8.9rel.1.tar.bz2.XlcdCK/output' 'ftp://ftp.invisible-island.net/lynx/tarballs/lynx2.8.9rel.1.tar.bz2'
--2024-06-02 22:21:49-- ftp://ftp.invisible-island.net/lynx/tarballs/lynx2.8.9rel.1.tar.bz2
=> ‘/home/peko/source/buildroot/output-qt/build/.lynx2.8.9rel.1.tar.bz2.XlcdCK/output’
Resolving ftp.invisible-island.net (ftp.invisible-island.net)... 216.194.253.29
Connecting to ftp.invisible-island.net (ftp.invisible-island.net)|216.194.253.29|:21... connected.
Logging in as anonymous ...
Login incorrect.
Luckily the tarball is also available over https://, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr:
- use https, not http
- drop trailing '/' in _SITE
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.netfilter.org no longer provides ftp, so use the https:// url from
_SITE.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
http redirects to https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.netfilter.org no longer provides ftp, so use the https:// url from
_SITE.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
http redirects to https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.netfilter.org no longer provides ftp, so use the https:// url from
_SITE.
This provides a .sha256sum but NOT md5/sha1, so update the .hash file to
match.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
http redirects to https, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarballs are also available at
https://freeradius.org/ftp/pub/freeradius/, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The tarballs are also available at
https://freeradius.org/ftp/pub/freeradius/, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
ftp.astrom.com also serves the files over https://, so use that instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: use https, not http]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
For consistency, adapt the reference in the hash file too.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr: switch to https as suggested by Baruch]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
The server was decommisioned in 2017 and is unlikely to ever come back, so
drop the reference:
https://www.doomworld.com/forum/topic/96999-rip-ftpidsoftwarecom/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Since qt5base was last bumped in 8ab4a0a348 (package/qt5: bump packages
to latest kde submodule versions), the hash for the downloaded tarball
has changed:
$ make qt5base-source
[...]
ERROR: expected: 935d01f5c34903ad9e979431cec7a8a59332ed3fc539e639f5ba87e8d6989b9d
ERROR: got : 3067c4d84ba9927bfe65bf606c17af082199e0a3b22781fbf9bc6c6bc3de26dd
We know the hash was good back when 8ab4a0a348 was applied, because
the tarball has been cached on sources.buildroot.org with the expected
hash:
$ curl 'https://sources.buildroot.net/qt5base/qtbase-da6e958319e95fe564d3b30c931492dd666bfaff.tar.bz2' 2>/dev/null |sha256sum -
935d01f5c34903ad9e979431cec7a8a59332ed3fc539e639f5ba87e8d6989b9d -
But now, the archive generated by the KDE gorge (Gitlab underneath) has
another hash (as seen above). This means that the KDE forge (Gitlab) has
changed the way it generates archives. So, what's the delta? It turns
out that the only changes are about CRLF that were present in the
original archive, and are no longer in the new one. It is to be noted
that the affected files do not have CRLFS in the repository. It further
turns out that the archive was previously generated with .gitattibutes
of the main branch ('dev' in Qt repositories), while now they are
generated with the .gitattibutes of the commit for which they are
generated.
Switch to using the git download method for really reproducible
archives...
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Sebastian Weyer <sebastian.weyer@smile.fr>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Currently, when we generate archives, e.g. for git, svn, cargo or go, we
use the package _BASENAME_RAW as the root directory of the generated
archive. For example, for package foo at version 1.2.3, that would generate
an archive rooted at foo-1.2.3/.
This is usually what we want, except in one specific condition: when the
package shares its download with another package *and* it is a generated
archive. In that case, the root directory will be different for each of
the two packages, which is incorrect, but was so far benign: we never
had any hash for such generated archives, and they were only generated
in two cases:
- linux and linux-headers
- barebox and barebox-aux
As we skip one directory depth when extracting the archives, we did not
care what the root directory was; whether it was that of one package or
the other was of no consequence.
But now that we can have hashes for archives generated from custom
versions, this breaks the usual case where the headers used for the
toolchains are those of the kernel to build for the target. In this
case, we may end up downloading the linux-headers package before we
download the linux package, so we'd get the hash for an archive rooted
at linux-headers-XXX/, but the one for the linux package the archive
would be rooted at linux-XXX/, or we may end up (e.g. with parallel
builds) downloading the linux package first and linux-headers next.
That would cause conflicts in hashes, as demonstrated by the only defconfig
we have in that situation, olimex_stmp157_olinuxino_lime_defconfig.
_BASENAME_RAW is a construct that is expanded to include the RAWNAME
followed by a dash and the version, if there is a version, or with just
the RAWNAME when there is no version.
We tweak the download macro to use _DL_SUBDIR followed by the version.
This is only used by VCS backends (cvs, git, svn...) and so there will
always be a version string, so no need to duplicate the case without a
version like is done for _BASENAME_RAW
_DL_SUBDIR defaults to _RAWNAME, so this is a noop by default, unless
the package declares it shares its download with another one, in which
case the generated archive will now be rooted as for the shared package.
This was triggered by:
https://patchwork.ozlabs.org/project/buildroot/patch/20240602070634.597337-1-francois.perrad@gadz.org/
Reported-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Restarting dnsmasq can cause constant issues: stop works, but start
fails because the new instance can't bind the socket. Another restart
immediately after works just fine:
# /etc/init.d/S80dnsmasq restart
Stopping dnsmasq: OK
Starting dnsmasq:
dnsmasq: failed to create listening socket for 192.168.128.1: Address in use
FAIL
# /etc/init.d/S80dnsmasq restart
Stopping dnsmasq: FAIL
Starting dnsmasq: OK
Solve this by waiting for process to actually stop before returning
from the stop command. Clean up the PID file after to avoid potential
issues with the PID being reused after stop. The wait could also be
placed inside the restart block, but putting it into the stop block
has the advantage that it also avoids similar issues for any other
callers.
Signed-off-by: Fiona Klute <fiona.klute+wiwa@gmx.de>
[yann.morin.1998@free.fr:
- fix shellcheck
- reflow commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
