Commit Graph

68937 Commits

Author SHA1 Message Date
Fabrice Fontaine
a04464807a package/conmon: fix libseccomp shared build
Drop patch and disable libseccomp when building statically to avoid the
following build failure raised since commit
29834d8a12:

src/seccomp_notify.c: In function 'seccomp_notify_plugins_load':
src/seccomp_notify.c:136:42: warning: implicit declaration of function 'dlopen'; did you mean 'popen'? [-Wimplicit-function-declaration]
  136 |                 ctx->plugins[s].handle = dlopen(it, RTLD_NOW);
      |                                          ^~~~~~
      |                                          popen
src/seccomp_notify.c:136:53: error: 'RTLD_NOW' undeclared (first use in this function)
  136 |                 ctx->plugins[s].handle = dlopen(it, RTLD_NOW);
      |                                                     ^~~~~~~~

Fixes:
 - http://autobuild.buildroot.org/results/13d3b46990720bba8621c922b5dce54ab650e96d

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8144dd1b4c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 23:14:49 +02:00
Yanghao Cheng
1147afc117 package/xserver_xorg-server: add condition in xserver_xorg-server.mk
Does not install systemd unit if nodm or xdm is enabled.

Signed-off-by: Yanghao Cheng <yanghao.cheng@aioi-atg.com>
[yann.morin.1998@free.fr:
  - don't use $(or ...)
  - slightly reword comment
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6898ca03a2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 23:07:12 +02:00
Yanghao Cheng
a55fe7c69a package/xserver_xorg-server: fix init script conflicts
xdm package also installs a init script that utimately starts X server

Signed-off-by: Yanghao Cheng <yanghao.cheng@aioi-atg.com>
[yann.morin.1998@free.fr:
  - don't use $(or ...)
  - slightly reword comment
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f9cd154467)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 23:05:59 +02:00
Marcin Niestroj
2e9bc6e8fb package/python-pytest: fix dependency on zlib
tests.package.test_python_pytest.TestPythonPy3Pytest runtime tests fails
now with following error:

  ======================================================================
  FAIL: test_run (tests.package.test_python_pytest.TestPythonPy3Pytest.test_run)
  ----------------------------------------------------------------------
  Traceback (most recent call last):
    File "/buildroot/support/testing/tests/package/test_python.py", line 137, in test_run
      self.run_sample_scripts()
    File "/buildroot/support/testing/tests/package/test_python_pytest.py", line 18, in run_sample_scripts
      self.assertRunOk(cmd, timeout=self.timeout)
    File "/buildroot/support/testing/infra/basetest.py", line 89, in assertRunOk
      self.assertEqual(
  AssertionError: 1 != 0 :
  Failed to run: python -m pytest sample_python_pytest.py
  output was:
    Traceback (most recent call last):
      File "<frozen runpy>", line 189, in _run_module_as_main
      File "<frozen runpy>", line 148, in _get_module_details
      File "<frozen runpy>", line 112, in _get_module_details
      File "/usr/lib/python3.11/site-packages/pytest/__init__.py", line 5, in <module>
      File "/usr/lib/python3.11/site-packages/_pytest/_code/__init__.py", line 2, in <module>
      File "/usr/lib/python3.11/site-packages/_pytest/_code/code.py", line 36, in <module>
      File "/usr/lib/python3.11/site-packages/pluggy/__init__.py", line 16, in <module>
      File "/usr/lib/python3.11/site-packages/pluggy/_manager.py", line 10, in <module>
      File "/usr/lib/python3.11/importlib/metadata/__init__.py", line 8, in <module>
      File "/usr/lib/python3.11/zipfile.py", line 6, in <module>
    ImportError: libz.so.1: cannot open shared object file: No such file or directory

Fix that by adding BR2_PACKAGE_PYTHON3_ZLIB dependency.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0dc1213565)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 22:19:37 +02:00
Fabrice Fontaine
934e95457d package/stress-ng: link with -latomic when needed
Fix the following build failure raised since at least bump to version
0.15.04 in commit 00553ea186:

Fixes:
 - http://autobuild.buildroot.org/results/127ed4c110d99c6453a01ce221f628d40e566dc1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 42f2518023)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:35:54 +02:00
Marcin Niestroj
90df3c558b board/orangepi-zero-plus: update link in readme
Old link is no longer working, so use new link instead.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0612504c43)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:27:05 +02:00
Fabrice Fontaine
3e87fa6c67 package/mdadm: add MDADM_CPE_ID_VENDOR
cpe:2.3🅰️mdadm_project:mdadm is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/A4FAEC6A-3572-48E9-ABB8-C96D8C8B91AF

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bdab457768)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:20:32 +02:00
Fabrice Fontaine
1ff517bd9a package/freerdp: security bump to version 2.11.0
- Fix CVE-2023-39350 to CVE-2023-39354, CVE-2023-39356, CVE-2023-40181,
  CVE-2023-40186, CVE-2023-40188, CVE-2023-40567, CVE-2023-40569 and
  CVE-2023-40589
- Drop fourth patch (already in version)

https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.0
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q9x9-cqjc-rgwq
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg53-9j9h-3c8f
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c3r2-pxxp-f8r6
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5v5-qhj5-mh6m
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hm8c-rcjg-c8qp
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4ccfb2561f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:19:52 +02:00
Fabrice Fontaine
5b0caa8efb package/webp: security bump to version 1.3.2
- security fixes for lossless encoder (#603, chromium: #1420107,
  #1455619, CVE-2023-1999)
- security fix for lossless decoder (chromium: #1479274,
  CVE-2023-4863)

https://github.com/webmproject/libwebp/blob/v1.3.2/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c88c1d3319)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:17:34 +02:00
Fabrice Fontaine
2d138272ef package/libqb: security bump to version 2.0.8
- Fix CVE-2023-39976: log_blackbox.c in libqb before 2.0.8 allows a
  buffer overflow via long log messages because the header size is not
  considered.
- Drop patch (already in version) and so autoreconf

https://github.com/ClusterLabs/libqb/compare/v2.0.6...v2.0.8
https://github.com/ClusterLabs/libqb/releases/tag/v2.0.7
https://github.com/ClusterLabs/libqb/releases/tag/v2.0.8

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c89d7a2daf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:14:08 +02:00
Fabrice Fontaine
79f0c91b79 package/libjxl: security bump to version 0.8.2
Fix CVE-2023-35790: An issue was discovered in dec_patch_dictionary.cc
in libjxl before 0.8.2. An integer underflow in patch decoding can lead
to a denial of service, such as an infinite loop.

https://github.com/libjxl/libjxl/releases/tag/v0.8.2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Julien Olivain <ju.o@free.fr>
Tested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e4572cc705)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 21:04:29 +02:00
Fabrice Fontaine
589ef7294a package/hwloc: security bump to version 2.9.3
Fix CVE-2022-47022: An issue was discovered in open-mpi hwloc 2.1.0
allows attackers to cause a denial of service or other unspecified
impacts via glibc-cpuset in topology-linux.c.

https://github.com/open-mpi/hwloc/blob/hwloc-2.9.3/NEWS
https://github.com/open-mpi/hwloc/compare/hwloc-2.9.2...hwloc-2.9.3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7a85e0797f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:45:26 +02:00
Fabrice Fontaine
9d5c4d4cb5 package/sngrep: security bump to version 1.7.0
Fix CVE-2023-31981 and CVE-2023-31982

https://github.com/irontec/sngrep/blob/v1.7.0/ChangeLog
https://github.com/irontec/sngrep/compare/v1.6.0...v1.7.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 922e0d8451)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:41:40 +02:00
Fabrice Fontaine
122e3258b9 package/irssi: bump to version 1.4.4
Fix CVE-2023-29132: Irssi 1.3.x and 1.4.x before 1.4.4 has a
use-after-free because of use of a stale special collector reference.
This occurs when printing of a non-formatted line is concurrent with
printing of a formatted line.

https://irssi.org/NEWS/#news-v1-4-4
https://irssi.org/NEWS/#news-v1-4-3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7637e25d63)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:38:50 +02:00
Julien Olivain
d67bab2873 package/libjxl: fix riscv build
libjxl was failing to build for riscv targets, since commit ff7c37e57
"package/libjxl: security bump to version 0.8.1". Build was failing with
output:

    /build/libjxl-0.8.1/lib/jxl/enc_xyb.cc: In function 'jxl::Image3F jxl::N_SCALAR::TransformToLinearRGB(const jxl::Image3F&, const jxl::ColorEncoding&, float, const JxlCmsInterface&, jxl::ThreadPool*)':
    /build/libjxl-0.8.1/lib/jxl/enc_xyb.cc:223:21: error: variable 'std::atomic<bool> ok' has initializer but incomplete type
      223 |   std::atomic<bool> ok{true};
          |                     ^~

This build failure was due to a missing <atomic> header inclusion. For
some reason, the build failure was observed only with RISC-V toolchains.

This commit fixes the issue by adding an upstream commit, not yet in a
package release. See [1].

Fixes:
http://autobuild.buildroot.org/results/121/12107bc7aea7afae1d2fb935d31b44eee6ea1501

[1] 22d12d74e7

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit de45aea47b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:37:24 +02:00
Julien Olivain
500723f9fc package/openblas: fix some x86 32bit builds
OpenBLAS Makefile normally needs to explicitly define the CPU
architecture size (32 or 64bit) in the BINARY macro. See [1].

When an architecture supports both 64 and 32bit, the 32bit support
is sometimes implemented in OpenBLAS by overriding a fallback to an
anterior architecture. For example, if the build target architecture
is x86 Haswell 32bit, OpenBLAS build will override the arch to
Nehalem. See [2].

If the BINARY macro is undefined, the 32bit fallback will not happen,
sometimes leading to a link failure, with output:

    i686-buildroot-linux-gnu/bin/ar: strmm_kernel_LN.o: No such file or directory

This commit fixes those issues by explicitly defining the BINARY
macro. This issue has also been discussed upstream in [3] and [4].

Note: this issue was not introduced recently ([3] dates back from 2015),
and was also see in previous package version, for example in [5].

Fixes:
http://autobuild.buildroot.net/results/e1e/e1e2034a78799abe1bd28b036fa6f7d13322e42f

[1] https://github.com/xianyi/OpenBLAS/blob/v0.3.24/Makefile.rule#L50
[2] https://github.com/xianyi/OpenBLAS/blob/v0.3.24/Makefile.system#L113
[3] https://github.com/xianyi/OpenBLAS/issues/657
[4] https://github.com/xianyi/OpenBLAS/issues/1106
[5] http://autobuild.buildroot.net/results/5cd/5cdccd106b1de275ac75c39783e536107a31651f

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit eb4f5a2cbc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:32:09 +02:00
Fabrice Fontaine
8dd87af9c8 package/lldpd: fix CVE-2023-41910
An issue was discovered in lldpd before 1.0.17. By crafting a CDP PDU
packet with specific CDP_TLV_ADDRESSES TLVs, a malicious actor can
remotely force the lldpd daemon to perform an out-of-bounds read on heap
memory. This occurs in cdp_decode in daemon/protocols/cdp.c.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3557a7b599)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:00:59 +02:00
Fabrice Fontaine
e9df0c5363 package/zbar: add ZBAR_CPE_ID_VENDOR
cpe:2.3🅰️zbar_project:zbar is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/438B9E70-F8E2-4318-83B5-46A0DF320CE3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 23e774d2de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 20:00:08 +02:00
Giulio Benetti
3e24fcfb15 package/rtl8812au-aircrack-ng: bump to version 2023-07-23
This version fix build failure on Linux version < 5.15.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ce78e1909)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 19:56:36 +02:00
Yann E. MORIN
5f09ce4e66 support/download/git: fix shellcheck errors
The quoting around the expansion of ${relative_dir} was indeed incorrect
since it was introduced back in 8fe9894f65 (suport/download: fix git
wrapper with submodules on older git versions): it is in fact already
quoted as part of the whole sed expression.

${GIT} can contain more than one item, but we don't care about splitting
on spaces when we just print it for debug, so we can just quote it
rather than add an exception.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bcee3ca6d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 17:57:54 +02:00
Yann E. MORIN
424a575cde support/download/git: properly catch failures
Since commit b7efb43e86 (download/git: try to recover from
utterly-broken repositories), we catch errors through an ERR
trap, so we can try and recover from a broken repository. In
that commit, we switched from using "set -e" to "set -E", so
that trap is inherited in functions, command substitutions,
and subshells.

However, the trap is not defined until we have parsed the
options, created the cache directory, and eventually chdir()ed
into it. Athough improbable, it is possible for the git helper
to fail in any of those steps, and that would not get caught.

Fix that

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit daa341cb9b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 17:56:15 +02:00
Yann E. MORIN
53b78df10f support/download: generate even more reproducible tarballs
When we generate the taballs off a local working copy of a VCS tree,
the umask is the one that we enforce in out top-level Makefile.

However, it is possible that a user manually tinkers in said working
copy (e.g. to check an upstream bug fix, or regression). If the user
umask is different from the one Buildroot enfirces, such tinkering
can impact the mode bits of the files, even if their content is not
modified.

When we eventually need to create a tarball from said working copy,
the VCS (e.g. git) will only be interested in checking whether the
content of the files have changed before chcking them out, and will
not look at, and restore/fix the mode bits.

As a consequence, we may create non-reproducible archives.

We fix that by enforcing the mode bits on the files before we create
the tarball: we disable the write and execute bits, and only set the
execute bit if the user execute bit is set.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 768f9f80f6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-24 17:55:37 +02:00
Yann E. MORIN
6bd6b4c2cf package/qt5: fix upstream git trees
Since commits 4e8b5f9bee [0], 6cfbd51d98 [1], and d838a416c4 [2],
the repository we clone from is the cgit browser, and it does not serve
the git tree, only the browser:

    $ git clone https://code.qt.io/cgit/qt/qtcoap.git
    Cloning into 'qtcoap'...
    fatal: repository 'https://code.qt.io/cgit/qt/qtcoap.git/' not found

Browsing there displays the cgit UI, which gives a proper URI to clone
from; switch to using that. Things happened to "work" so far thanks to
sources.buildroot.net.

[0] 4e8b5f9bee package/qt5/qt5mqtt: bump version to 5.15.2 (and fix download)
[1] 6cfbd51d98 package/qt5/qt5coap: bump version to 5.15.2 (and fix download)
[2] d838a416c4 package/qt5/qt5knx: bump version to 5.15.2 (and fix download)

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Peter Seiderer <ps.report@gmx.net>
Cc: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Cc: Giulio Benetti <giulio.benetti@benettiengineering.com>
CC: Julien Corjon <corjon.j@ecagroup.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0055c9c634)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-17 08:40:59 +02:00
Fabrice Fontaine
afdd2760e6 package/libde265: add LIBDE265_CPE_ID_VENDOR
cpe:2.3🅰️struktur:libde265 is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Astruktur%3Alibde265

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fd94f49566)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-17 08:38:16 +02:00
Fabrice Fontaine
44919c0a6e package/libheif: add LIBHEIF_CPE_ID_VENDOR
cpe:2.3🅰️struktur:libheif is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Astruktur%3Alibheif

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 270b7c017d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-17 08:36:53 +02:00
Waldemar Brodkorb
a256ff6080 package/gcc: fix missing .note.GNU-stack section
Shellinabox configure fails to detect ptsname_r, because of the following warning
binutils 2.39+ emits:
ld: warning: crtend.o: missing .note.GNU-stack section implies executable stack
ld: NOTE: This behaviour is deprecated and will be removed in a future version of the linker

Then the build errors out with:
shellinabox/launcher.c:772:12: error: static declaration of 'ptsname_r' follows non-static declaration

The same issue exist for cairo 1.16.0 and the detection of pthreads.

Fixes:
 - http://autobuild.buildroot.net/results/3e4/3e478d22e820703ddfd11d1491e631ef8ed6b29b
 - http://autobuild.buildroot.net/results/f60/f602ea17d5938a5beb81d07e13de75ba41d5f6a1

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab4f3fafaa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-17 08:29:52 +02:00
Daniel Lang
15639f4299 utils/getdeveloperlib.py: handle file removal
If a patch only removes files, it is ignored. Meaning, that the
registered developer isn't automatically picked up when calling
get-developer.
Fix this by also checking if the line starts with ---, as a patch
removing a file has a line starting with --- with the name of the
removed file and one started with +++ /dev/null.
A set is used to store the changed files, which doesn't allow
duplicates. Therefore normal patches aren't affected by this change.

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7bc5ea80c7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-15 19:50:24 +02:00
Julien Olivain
1c6e9cd37f package/zynaddsubfx: fix build with gcc 13
When compiling with gcc 13, build fails with errors, such as:

    In file included from /build/zynaddsubfx-3.0.6/src/Nio/NulEngine.h:21,
                     from /build/zynaddsubfx-3.0.6/src/Nio/NulEngine.cpp:14:
    /build/zynaddsubfx-3.0.6/src/Nio/MidiIn.h:37:9: error: 'uint8_t' does not name a type
       37 |         uint8_t midiSysEx(unsigned char data);
          |         ^~~~~~~

Those gcc 13 changes were announced at:
https://gcc.gnu.org/gcc-13/porting_to.html#header-dep-changes

This commit fixes the issue by adding upstream patches, not yet
included in a release.

Fixes:
http://autobuild.buildroot.net/results/97b5a30c7be820ac91e745cf60f9b759e962aa5c

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 56e7ca5dbc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-15 19:38:58 +02:00
Maxim Kochetkov
995a61e958 package/timescaledb: bump version to 2.11.2
Release notes: https://github.com/timescale/timescaledb/blob/2.11.2/CHANGELOG.md

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b0f2709e6f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:08:47 +02:00
Daniel Lang
6fb61f11b7 package/libiec61850: ignore CVE-2023-27772
Segmentation fault in example code can be exploited.
BUILD_EXAMPLES is disabled for all cmake projects.

See https://github.com/mz-automation/libiec61850/issues/442

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b25f1cb47c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:05:17 +02:00
Frank Hunleth
73554da86f package/erlang: support building on aarch64
Erlang has good support for aarch64 hosts, and this allows it to be
built without a warning.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 54b6eced24)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:02:55 +02:00
Christian Stewart
999cf19465 package/conmon: bump version to 2.1.8
Bug fixes.

https://github.com/containers/conmon/releases/tag/v2.1.8

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f862a1abf1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:01:02 +02:00
Adam Duskett
37b44df9af package/php: bump version to 8.2.10
Signed-off-by: Adam Duskett <aduskett@gmail.comm>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9bf196ce28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:57:57 +02:00
Christian Stewart
2b72f1d167 package/go: security bump to version 1.20.8
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template
package, as well as bug fixes to the compiler, the go command, the runtime, and
the crypto/tls, go/types, net/http, and path/filepath packages.

CVE-2023-39318: html/template: improper handling of HTML-like comments within script contexts
CVE-2023-39319: html/template: improper handling of special tags within script contexts
CVE-2023-39321: crypto/tls: panic when processing post-handshake message on QUIC connections

https://go.dev/doc/devel/release#go1.20.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:21:23 +02:00
Stefan Agner
4fd72a713a package/docker-cli: bump version to v24.0.6
Bug fixes in containerd storage backend and Docker itself and a single
new warning about old Docker image format deprecation.

https://github.com/moby/moby/releases/tag/v24.0.6

Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9204d644a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:20:19 +02:00
Stefan Agner
c4a7dee1c2 package/docker-engine: bump version to v24.0.6
Bug fixes in containerd storage backend and Docker itself and a single
new warning about old Docker image format deprecation.

https://github.com/moby/moby/releases/tag/v24.0.6

Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4e80116562)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:20:12 +02:00
Peter Korsgaard
d8ce1deff9 Update for 2023.08
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:54:35 +02:00
Julien Olivain
79c7a67a4c package/dt: fix Kconfig package URL
The old package URL is no longer working. This commit updates it to
the one advertised at [1].

[1] b30eb7a123/html/dt.html (L33)

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:20:13 +02:00
Adam Duskett
0ef48995a1 package/zeromq: Fix building against gcc-13
`gcc-13` added an assert to standard headers to make sure custom
allocators have intended implementation of rebind type instead
of inherited rebind. gcc change:
https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=64c986b49558a7

Taken from upstream commit bdd471fa17100fe84f64da348951dab3ee4780bb

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-06 21:18:10 +02:00
Francois Perrad
b7488b4d68 package/libtommath: security bump to version 1.2.1
This is a bugfix release only containing the fix to a potential integer underflow
which got assigned CVE-2023-36328.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-05 15:24:38 +02:00
Thomas Petazzoni
19921699b3 package/pixman: ignore CVE-2023-37769
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:42:15 +02:00
Thomas Petazzoni
a9c74c5b7f package/python-ipython: ignore CVE-2023-24816
It affects only Windows, so we don't care in the context of Buildroot.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:34:07 +02:00
Thomas Petazzoni
317c4b8f60 package/python-tornado: backport fix for CVE-2023-28370
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:33:37 +02:00
Thomas Petazzoni
57229c22f1 package/python-pip: ignore CVE-2018-20225
See https://security-tracker.debian.org/tracker/CVE-2018-20225 for the
rationale of ignoring this CVE. Things basically work as intended.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:32:56 +02:00
Thomas Petazzoni
2397349fa9 package/python-django: security bump to 4.1.10
4.1.9 is affected by CVE-2023-36053, and 4.1.10 was released to fix
it. The changes between 4.1.9 and 4.1.10 are just:

f9a14b8f0668029fb7e0aebcae57b60dcec4a529 (tag: 4.1.10) [4.1.x] Bumped version for 4.1.10 release.
beb3f3d55940d9aa7198bf9d424ab74e873aec3d [4.1.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and URLValidator.
3b48fe413f91612fb8c43fe9d489860d10c84bf7 [4.1.x] Added stub release notes for 4.1.10 and 3.2.20.
0e5948b8df5d25deb48a505cbf16f010d9dc603c [4.1.x] Fixed MultipleFileFieldTest.test_file_multiple_validation() test if Pillow isn't installed.
66e1e9b006618ba00e804d18bd90d3a9e94801b3 [4.1.x] Added CVE-2023-31047 to security archive.
d1385cc51b142b05b21b721d9d68fc461bc7241f [4.1.x] Post-release version bump.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:32:03 +02:00
Thomas Petazzoni
f3ab33c62f package/poppler: bump version to latest in 22.x series
This commit updates poppler to the latest version in the 22.x series,
with only has bug fixes. Here is the list of commits between 22.10.0
and 22.12.0:

df568263c51950ceed6f1fb42f80e99a2614c275 (tag: poppler-22.12.0) poppler 22.12.0
198dc1d0674c0a462668e6868c35b1ee0e731005 Form::addFontToDefaultResources: Be stubborn in finding a font we can use
a5952ab70716a2d4f792a943c2dcf3068f1d6885 Revert "CI: Fix Debian brokenness"
8fcaa7c622d24761a9ecb3922f95d072077d6f34 CI: Fix Debian brokenness
cc665f757af6b87dd245d36e079dd44d8d2d2182 (tag: poppler-22.11.0) poppler 22.11.0
a296982e1d5b4968b2bd044d80647ae6f9267526 Do not include a poppler/ file from a splash/ header
bc4a0d9a2abfcd75d9b0ee4be3f7600905fe6001 Form: Provide Unicode marker when ensuring fonts
111f38a722eedddd94faa52dda8c5e0da561fb41 Cairo: Update font after restore
907d05a6a141284aee22fbd16ab0a2fb4e0f2724 Fix crash in file that wants to do huge transparency group
e53f5aae3bce7d09788f2ad62be998895fb9807b PSOutputDev::setupResources: Fix stack overflow in malformed doc
a4ca3a96a6b1f65b335a1ea362e6c202e46ae055 topIdx can't be negative
e471f8e09bf2e38df0cf5df1acecbcca70685573 Init all the fields of JPXStreamPrivate
5190c0d4369bd9f501922585140be4ec736e24f2 No need to store smaskInData in priv
6263bb90b09326103b10e4c4edfbc5b84c884921 Page label ranges can't start in < 0

Note: this version bump does not include the fix for CVE-2023-34872,
so we still need the backported patch.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:31:02 +02:00
Thomas Petazzoni
fea8852c68 package/poppler: backport patch to fix CVE-2023-34872
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-03 21:29:48 +02:00
Bernd Kuhls
7ec2df1e9a package/mesa3d-demos: add dependency on libdecor for wayland support
libdecor cannot be selected due to a circular dependency:

package/wayland/Config.in:1:error: recursive dependency detected!
package/wayland/Config.in:1: symbol BR2_PACKAGE_WAYLAND is selected by BR2_PACKAGE_LIBDECOR
package/libdecor/Config.in:1: symbol BR2_PACKAGE_LIBDECOR is selected by BR2_PACKAGE_MESA3D_DEMOS
package/mesa3d-demos/Config.in:1: symbol BR2_PACKAGE_MESA3D_DEMOS is selected by BR2_PACKAGE_PIGLIT
package/piglit/Config.in:1: symbol BR2_PACKAGE_PIGLIT depends on BR2_PACKAGE_WAFFLE_SUPPORTS_WAYLAND
package/waffle/Config.in:7: symbol BR2_PACKAGE_WAFFLE_SUPPORTS_WAYLAND depends on BR2_PACKAGE_WAYLAND

Without libdecor, the build fails since the bump of mesa3d-demos to
version 9.0.0 in 80304d9911:

"""
Run-time dependency libdecor-0 found: NO (tried pkgconfig and cmake)
Looking for a fallback subproject for the dependency libdecor-0
../output-1/build/mesa3d-demos-9.0.0/meson.build:88:17: ERROR: Automatic wrap-based subproject downloading is disabled
"""

Fixes:

  http://autobuild.buildroot.net/results/8de50be8233f0133aadc26bda71b48d7ec329e04/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:12:16 +02:00
Bernd Kuhls
cb4e9360b4 package/libdecor: new package
Needed for wayland support in mesa3d-demos.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Sebastian Weyer <sebastian.weyer@smile.fr>
Tested-by: Sebastian Weyer <sebastian.weyer@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:09:25 +02:00
Bernd Kuhls
84b0d834a4 package/mesa3d-demos: add dependency on libxkbcommon for wayland support
Since the bump of mesa3d-demos to version 9.0.0 in Buildroot commit
80304d9911, libxkbcommon is needed for
the wayland support. Without libxkbcommon, the build fails with:

Run-time dependency wayland-client, wayland-egl, xkbcommon found: NO (tried pkgconfig and cmake)

../output-1/build/mesa3d-demos-9.0.0/meson.build:62:14: ERROR: Dependency "wayland-client, wayland-egl, xkbcommon" not found, tried pkgconfig and cmake

Fixes:

  http://autobuild.buildroot.net/results/1c01da4966b054de9c15f0eb3d738806c7d5d315/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: patch extracted from
https://patchwork.ozlabs.org/project/buildroot/patch/20230716145003.339645-2-bernd@kuhls.net/]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2023-09-02 19:09:25 +02:00