Commit Graph

68249 Commits

Author SHA1 Message Date
Daniel Lang
c42be1a552 package/libiec61850: ignore CVE-2023-27772
Segmentation fault in example code can be exploited.
BUILD_EXAMPLES is disabled for all cmake projects.

See https://github.com/mz-automation/libiec61850/issues/442

Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b25f1cb47c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 21:05:25 +02:00
Adam Duskett
6a753f9db2 package/php: bump version to 8.2.10
Signed-off-by: Adam Duskett <aduskett@gmail.comm>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9bf196ce28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:58:12 +02:00
Stefan Agner
84503913ef package/go: bump to v1.19.13
go1.19.13 (released 2023-09-06) includes a couple of bug fixes.  In
particular it fixes a bug introduced with the update to v1.19.11 which
broke http using a unix socket addressing.

Signed-off-by: Stefan Agner <stefan@agner.ch>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 20:55:59 +02:00
Julien Olivain
81c75c6340 package/dt: fix Kconfig package URL
The old package URL is no longer working. This commit updates it to
the one advertised at [1].

[1] b30eb7a123/html/dt.html (L33)

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 79c7a67a4c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:51:47 +02:00
Francois Perrad
a047247ad6 package/libtommath: security bump to version 1.2.1
This is a bugfix release only containing the fix to a potential integer underflow
which got assigned CVE-2023-36328.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b7488b4d68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:50:28 +02:00
Thomas Petazzoni
eba4944528 package/pixman: ignore CVE-2023-37769
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 19921699b3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:49:40 +02:00
Thomas Petazzoni
ccc3376195 package/python-ipython: ignore CVE-2023-24816
It affects only Windows, so we don't care in the context of Buildroot.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a9c74c5b7f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:48:45 +02:00
Thomas Petazzoni
b877cf88b8 package/python-tornado: backport fix for CVE-2023-28370
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 317c4b8f60)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:48:37 +02:00
Thomas Petazzoni
45440a7e62 package/python-pip: ignore CVE-2018-20225
See https://security-tracker.debian.org/tracker/CVE-2018-20225 for the
rationale of ignoring this CVE. Things basically work as intended.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 57229c22f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:48:07 +02:00
Thomas Petazzoni
fc9377fc4c package/python-django: security bump to 4.1.10
4.1.9 is affected by CVE-2023-36053, and 4.1.10 was released to fix
it. The changes between 4.1.9 and 4.1.10 are just:

f9a14b8f0668029fb7e0aebcae57b60dcec4a529 (tag: 4.1.10) [4.1.x] Bumped version for 4.1.10 release.
beb3f3d55940d9aa7198bf9d424ab74e873aec3d [4.1.x] Fixed CVE-2023-36053 -- Prevented potential ReDoS in EmailValidator and URLValidator.
3b48fe413f91612fb8c43fe9d489860d10c84bf7 [4.1.x] Added stub release notes for 4.1.10 and 3.2.20.
0e5948b8df5d25deb48a505cbf16f010d9dc603c [4.1.x] Fixed MultipleFileFieldTest.test_file_multiple_validation() test if Pillow isn't installed.
66e1e9b006618ba00e804d18bd90d3a9e94801b3 [4.1.x] Added CVE-2023-31047 to security archive.
d1385cc51b142b05b21b721d9d68fc461bc7241f [4.1.x] Post-release version bump.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2397349fa9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:47:30 +02:00
Thomas Petazzoni
2e346847cf package/poppler: bump version to latest in 22.x series
This commit updates poppler to the latest version in the 22.x series,
with only has bug fixes. Here is the list of commits between 22.10.0
and 22.12.0:

df568263c51950ceed6f1fb42f80e99a2614c275 (tag: poppler-22.12.0) poppler 22.12.0
198dc1d0674c0a462668e6868c35b1ee0e731005 Form::addFontToDefaultResources: Be stubborn in finding a font we can use
a5952ab70716a2d4f792a943c2dcf3068f1d6885 Revert "CI: Fix Debian brokenness"
8fcaa7c622d24761a9ecb3922f95d072077d6f34 CI: Fix Debian brokenness
cc665f757af6b87dd245d36e079dd44d8d2d2182 (tag: poppler-22.11.0) poppler 22.11.0
a296982e1d5b4968b2bd044d80647ae6f9267526 Do not include a poppler/ file from a splash/ header
bc4a0d9a2abfcd75d9b0ee4be3f7600905fe6001 Form: Provide Unicode marker when ensuring fonts
111f38a722eedddd94faa52dda8c5e0da561fb41 Cairo: Update font after restore
907d05a6a141284aee22fbd16ab0a2fb4e0f2724 Fix crash in file that wants to do huge transparency group
e53f5aae3bce7d09788f2ad62be998895fb9807b PSOutputDev::setupResources: Fix stack overflow in malformed doc
a4ca3a96a6b1f65b335a1ea362e6c202e46ae055 topIdx can't be negative
e471f8e09bf2e38df0cf5df1acecbcca70685573 Init all the fields of JPXStreamPrivate
5190c0d4369bd9f501922585140be4ec736e24f2 No need to store smaskInData in priv
6263bb90b09326103b10e4c4edfbc5b84c884921 Page label ranges can't start in < 0

Note: this version bump does not include the fix for CVE-2023-34872,
so we still need the backported patch.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f3ab33c62f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:46:44 +02:00
Thomas Petazzoni
816f4ba688 package/poppler: backport patch to fix CVE-2023-34872
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fea8852c68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:46:40 +02:00
Bernd Kuhls
5c2c08529a {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 99674f64ba)
[Peter: drop 6.4.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:37:04 +02:00
Julien Olivain
7817b9c2a6 support/testing: python-magic-wormhole: fix random failures
The magic-wormhole "receive" command can output "waiting" messages
when key receival or verification are longer than a predefined
timeout:
https://github.com/magic-wormhole/magic-wormhole/blob/0.13.0/src/wormhole/cli/cmd_receive.py#L135

The intent is to have an interactive user experience.

This behavior makes the runtime test unreliable as the test always
expect the sent message as the exact output. When the test execution
is slower, it sometimes get the "waiting" message instead of the
expected message.

Some test jobs are succeeding:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4968059737
while some other are failing.

magic-wormhole can override those timers with environment variables.
See:
https://github.com/magic-wormhole/magic-wormhole/blob/0.13.0/src/wormhole/cli/cmd_receive.py#L26

This commit sets those environment variable to larger values
(100 seconds instread of 1 by default), to make sure the test will
always pass.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4962923235

Reported-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Tested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d44a888c32)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 11:07:01 +02:00
Bernd Kuhls
78c498be21 {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 16c3b4b92b)
[Peter: drop 6.4.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:31:41 +02:00
Fabrice Fontaine
82ddf2070c toolchain/helpers.mk: strengthen uClibc locale check
Currently, when verifying the configuration of a uClibc toolchain for
the presence of locale support, we check __UCLIBC_HAS_LOCALE__. It
turns out that we in fact also expect __UCLIBC_HAS_XLOCALE__ to be
defined, as without it locale_t is not defined, causing build failure
in some packages, such as libcpprestsdk:

In file included from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/include/cpprest/json.h:18,
                 from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/src/pch/stdafx.h:88,
                 from /home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/src/http/client/http_client_msg.cpp:13:
/home/thomas/autobuild/instance-0/output-1/build/libcpprestsdk-2.10.18/Release/include/cpprest/asyncrt_utils.h:317:13: error: 'locale_t' does not name a type
  317 |     typedef locale_t xplat_locale;
      |             ^~~~~~~~

As essentially our requirement for uClibc in external toolchains is
"it should match the uClibc configuration used by Buildroot for
internal toolchains", it makes sense to verify
__UCLIBC_HAS_XLOCALE__. Note that of course checking
__UCLIBC_HAS_XLOCALE__ is sufficient, as it cannot be enabled if
__UCLIBC_HAS_LOCALE isn't.

This addresses an issue with the Synopsys ARC external toolchain,
which is built with __UCLIBC_HAS_LOCALE__, but without
__UCLIBC_HAS_XLOCALE__ causing a build failure with some
packages (such as libcpprestsdk).

Therefore, this patch also changes how the Synospys ARC external
toolchain is exposed in Buildroot: it no longer advertise locale
support.

Fixes:

  http://autobuild.buildroot.org/results/e6778e60cc1ea455f5b4511d5824f04d8040f67b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3c8d890c19)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:28:16 +02:00
Daniel Lang
0b02b9c17c support/scripts/pkg-stats: fix typos
Signed-off-by: Daniel Lang <dalang@gmx.at>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 8997c746fa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:24:07 +02:00
Thomas Petazzoni
a0e84303d5 package/log4cxx: ignore CVE-2023-31038
CVE-2023-31038 affects log4cxx only if ODBC is supported. While
CVE-2023-31038 has been fixed in newer versions of log4cxx, there is
quite a huge gap to do a version bump, and the commit that fixes
CVE-2023-31038 could not be identified.

Therefore, we want to rely on the fact that our log4cxx package does
not support ODBC: there is indeed no explicit dependency on our
unixodbc package in log4cxx.mk. However, log4cxx automatically detects
if ODBC is available and if it is, it uses it.

So what we do in this commit is backport an upstream commit, which
adds explicitly options to enable/disable ODBC and ESMTP support, and
we use them to (1) always disable ODBC and (2) explicitly
enable/disable ESMTP support.

Thanks to ODBC being disabled, we're not affected by CVE-2023-31038.

Of course, there is a potential regression for users who were relying
on the implicit unixodbc dependency, but as we could not identify the
commit fixing the CVE-2023-31038, this is the best we can do at the
moment.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit cf686670b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:19:53 +02:00
Thomas Petazzoni
43e316ca8a package/heirloom-mailx: ignore CVE-2004-2771
The CVE-2004-2771 is already fixed by the Debian patch
0014-globname-Invoke-wordexp-with-WRDE_NOCMD.patch. The Debian patch
description is:

Subject: [PATCH 4/4] globname: Invoke wordexp with WRDE_NOCMD (CVE-2004-2771)

See also https://marc.info/?l=oss-security&m=141875285203183&w=2 for
more details.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 829610c701)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:17:55 +02:00
Thomas Petazzoni
3baed49fb6 package/heirloom-mailx: fix comment about ignore CVE-2014-7844
In commit
15972770cf ("package/heirloom-mailx:
security bump to version 12.5-5 from Debian"), we added CVE-2014-7844
in HEIRLOOM_MAILX_IGNORE_CVES, but with the wrong comment about it: it
is a different patch in the Debian stack of patches that fixes
it. Indeed the description of patch
0011-outof-Introduce-expandaddr-flag.patch is:

=====================================================================
Subject: [PATCH 1/4] outof: Introduce expandaddr flag

Document that address expansion is disabled unless the expandaddr
binary option is set.

This has been assigned CVE-2014-7844 for BSD mailx, but it is not
a vulnerability in Heirloom mailx because this feature was documented.
=====================================================================

See also https://marc.info/?l=oss-security&m=141875285203183&w=2 for
details.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 94716fdb48)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-14 10:17:44 +02:00
Thomas Petazzoni
4c6f56ebbc boot/grub2: backport fixes for numerous CVEs
Grub 2.06 is affected by a number of CVEs, which have been fixed in
the master branch of Grub, but are not yet part of any release (there
is a 2.12-rc1 release, but nothing else between 2.06 and 2.12-rc1).

So this patch backports the relevant fixes for CVE-2022-28736,
CVE-2022-28735, CVE-2021-3695, CVE-2021-3696, CVE-2021-3697,
CVE-2022-28733, CVE-2022-28734, CVE-2022-2601 and CVE-2022-3775.

It should be noted that CVE-2021-3695, CVE-2021-3696, CVE-2021-3697
are not reported as affecting Grub by our CVE matching logic because
the NVD database uses an incorrect CPE ID in those CVEs: it uses
"grub" as the product instead of "grub2" like all other CVEs for
grub. This issue has been reported to the NVD maintainers.

This requires backporting a lot of patches, but jumping from 2.06 to
2.12-rc1 implies getting 592 commits, which is quite a lot.

All Grub test cases are working fine:

  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500585
  https://gitlab.com/tpetazzoni/buildroot/-/pipelines/984500679

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Arnout: fix check-package warning in patch 0002]
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 65c99394ff)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 22:22:33 +02:00
Yann E. MORIN
8075b43085 package/pcm-tools: fix github-download
The pcm-tools package contains a version.h with git attributes:

    $ cat version.h
    #define PCM_VERSION " ($Format:%ci ID=%h$)"

    $ man 5 gitattributes
       Creating an archive
         export-subst
           If the attribute export-subst is set for a file then Git
           will expand several placeholders when adding this file to
           an archive. The expansion depends on the availability of
           a commit ID, i.e., if git-archive(1) has been given a tree
           instead of a commit or a tag then no replacement will be
           done. The placeholders are the same as those for the option
           --pretty=format: of git-log(1), except that they need to be
           wrapped like this: $Format:PLACEHOLDERS$ in the file. E.g.
           the string $Format:%H$ will be replaced by the commit hash.

So, the archive generated by github has changed since we updated
pcm-tools in 2021-12-08 with commit d1d93d488c (package/pcm-tools:
bump to version 202110). The downlad was still OK in 2022-01-04 [0]
but has been failing at least since 202-08-25 [1].

Since the archive is generated on the github side, there is not much we
can do to fix this up.

We switch over to using git to do the download, and we generate the
archive localy, which we know is reproducible.

We fix the version.h so that it contains the same string as the backup
tarball we host on s.b.o.

There are three other files in pcm-tools that have git attributes, to
exclude them from the generated archive, all pertaining to CI/CD stuff:
    .cirrus.yml export-ignore
    .gitlab-ci.yml export-ignore
    .travis.yml export-ignore

We don't remove them, because they have no impact on the build, and they
are anyway already present in the archive by the time we could act on it
anyway...

[0] http://autobuild.buildroot.org/results/127/1276a3d49c8848039f034e7f03632df365097e94/
[1] http://autobuild.buildroot.org/results/8bb/8bbf9c36af332bbf5e7c1abcbb594a0b231ef97e/

Reported-by: Woody Douglass <wdouglass@carnegierobotics.com>
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 60f50a5e34)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 22:12:02 +02:00
Arnout Vandecappelle
7bc2b674e0 .checkpackageignore: correct renamed path of openjdk 17.0.8+7 patch
Commit c1038fe47c renamed the patch, but didn't update
.checkpackageignore, leading to two failures:

.checkpackageignore:1055: ignored file package/openjdk/17.0.7+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch is missing
package/openjdk/17.0.8+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch:0: missing Upstream in the header (http://nightly.buildroot.org/#_additional_patch_documentation)

Rename the file in .checkpackageignore as well.

Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 6bee7c3eb2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 22:05:32 +02:00
Adam Duskett
f77fa78b1b package/openjdk{-bin}: security bump versions to 11.0.20+8 and 17.0.8+7
Fixed the following security issues:

* CVEs
  - CVE-2023-22006
  - CVE-2023-22036
  - CVE-2023-22041
  - CVE-2023-22044
  - CVE-2023-22045
  - CVE-2023-22049
  - CVE-2023-25193
* Security fixes
  - JDK-8298676: Enhanced Look and Feel
  - JDK-8300285: Enhance TLS data handling
  - JDK-8300596: Enhance Jar Signature validation
  - JDK-8301998, JDK-8302084: Update HarfBuzz to 7.0.1
  - JDK-8302475: Enhance HTTP client file downloading
  - JDK-8302483: Enhance ZIP performance
  - JDK-8303376: Better launching of JDI
  - JDK-8304468: Better array usages
  - JDK-8305312: Enhanced path handling
  - JDK-8308682: Enhance AES performance

For details, see the announcements:
https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024064.html
https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-July/024063.html

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit c1038fe47c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 22:05:03 +02:00
Bernd Kuhls
74ebf46e43 {linux, linux-headers}: bump 6.1.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9a4c8a056)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 22:02:10 +02:00
Bernd Kuhls
05027604e5 package/clamav: security bump version to 1.0.3
Release notes:
https://blog.clamav.net/2023/08/clamav-120-feature-version-and-111-102.html

Fixes CVE-2023-40477:
"Upgrade the bundled UnRAR library (libclamunrar) to version 6.2.10."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 387d66dc4f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 21:48:06 +02:00
Romain Naour
005bb5430d support/misc/gitlab-ci.yml.in: retry a job only if it failed due to a runner issue
Each time a new pipeline is triggered, some jobs may fail due to
temporary issue with a Gitlab runner (network, power supply, docker or
maintainance).

Most of the problems are "runner system failure" [1] and require to
retart each failed jobs manually by maintainers to complete the
pipeline with only real failures if any.

The "retry" keyword allows to configure how many times a job is retried
if it fails. "retry:when" allows to retry a failed job only on
specific failure types like "runner_system_failure".

While at it, retry a job if it failed due to a timeout failure (this
timeout means that the job was pending for more than 24h) [2].

Such timeout failures occur on pipelines testing each Buildroot's
defconfig since there is not enough gitlab runner available to build
all of them within 24h.

Retry only jobs that are more likely to wait for a runner
(generate-gitlab-ci-yml, runtime_test_base, defconfig_base and test_pkg).

[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/4936949397 (runner system failure)
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/4936949530 (timeout failure or the job got stuck)

https://docs.gitlab.com/ee/ci/yaml/#retrywhen

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e0166ecba0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 21:28:10 +02:00
Waldemar Brodkorb
36f536a027 package/gcc: fix powerpc toolchain issues with 64-bit capable cores
Some of the powerpc CPUs supported by Buildroot are dual mode CPUs,
which means 32 Bit and 64 Bit mode is supported, and for any 64-bit
capable CPU, GCC defaults to using 64-bit, even if the toolchain tuple
starts with powerpc-* (and not powerpc64-*). This causes issues when
building toolchains with uClibc or musl.

In order to resolve this, we force GCC to understand we want to
generate 32-bit code, using the --with-cpu-32 option.

See here the gcc documentation for details about --with-cpu-32:
https://gcc.gnu.org/install/configure.html

See here for a discussion on the musl mailinglist about the error:
https://inbox.vuxu.org/musl/20220722162900.GB1320090@port70.net/

Fixes:
 - http://autobuild.buildroot.net/results/450/4509d8cfb7d99beb4ef023f170490def1d90f92c
 - http://autobuild.buildroot.net/results/654/6545a464d49f9f3c6740a5208cfad7f09ec4cb8b
 - http://autobuild.buildroot.net/results/cf8/cf866d5320b069eb1e8b4f05e8e58de0ad2ec7b5

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5acaac7122)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 21:27:09 +02:00
Bernd Kuhls
547eb202b8 {linux, linux-headers}: bump 5.{10, 15}.x / 6.1.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 19da044715)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 20:57:58 +02:00
Bernd Kuhls
6d4e69b9f5 package/python3: security bump version to 3.11.5
Added md5 hash provided by upstream.

Release notes: https://www.python.org/downloads/release/python-3115/

Fixes CVE-2023-40217.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a26fa40853)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 20:56:25 +02:00
Romain Naour
a70eefcdd8 configs/freescale_imx6qsabresd_defconfig: fix defconfig
While switching ATF to github, the BR2_TARGET_UBOOT_CUSTOM_GIT=y
symbol was not removed. Since then this defconfig fail to build
in gitlab-ci due to invalid defconfig check.

  WARN: defconfig ./configs/freescale_imx6qsabresd_defconfig can't be used:
        Missing: BR2_TARGET_UBOOT_CUSTOM_GIT=y

[1] dd42b159a5

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/4889436612

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0ee8ef970b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 20:54:57 +02:00
Peter Korsgaard
7ce77eac68 package/mosquitto: bump to version 2.0.17
Bugfix release, fixing a number of regressions in 2.0.16

From the changelog
(https://github.com/eclipse/mosquitto/blob/master/ChangeLog.txt)

2.0.17 - 2023-08-22
===================

Broker:
- Fix `max_queued_messages 0` stopping clients from receiving messages.
  Closes #2879.
- Fix `max_inflight_messages` not being set correctly. Closes #2876.

Apps:
- Fix `mosquitto_passwd -U` backup file creation. Closes #2873.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c11950fe4a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 18:08:18 +02:00
Bernd Kuhls
e48b285188 {linux, linux-headers}: bump 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 47ac12bd4e)
[Peter: drop 6.4.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 18:05:30 +02:00
Giulio Benetti
c8e676ca8a package/rtl8189fs: fix build with big endian
Add local patch to allow to override CFLAGS and undefine
CONFIG_LITTLE_ENDIAN by default and use the correct endianness according
to target architecture.

Fixes:
http://autobuild.buildroot.net/results/fe67db3884573ef750eda9d0dccd5f97b3ae698e

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 624814f4ec)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 18:03:37 +02:00
Julien Olivain
64ac64b89b package/screen: security bump to version 4.9.1
See release announce:
https://lists.gnu.org/archive/html/screen-users/2023-08/msg00000.html

Fixes:
CVE-2023-24626: https://www.cve.org/CVERecord?id=CVE-2023-24626

Note: Buildroot installs screen as setuid, so the described scenario
in CVE applies.

This commit also rebases all patches on this release. Patch were
regenerated with 'git format-patch -N', so patch file name changed in
this process. The file .checkpackageignore is also updated accordingly.

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 96a54b0907)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 18:00:12 +02:00
Raphaël Mélotte
86456b4f32 package/network-manager: remove leftover comment about headers
Commit 0a8ef2f3f7 bumped the headers
version requirements, but did not update the associated comment.

Remove the comment entirely, as it does not apply anymore.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bdaade3e34)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 17:57:49 +02:00
Frank Vanbever
03be91896d package/libmodsecurity: security bump to version 3.0.10
- Fixes CVE-2023-38285 [1]
- Adapted 0001-configure.ac-drop-usage-of-git-at-configure-time.patch due to
  upstream moving to autoconf portable shell constructs.

Signed-off-by: Frank Vanbever <frank.vanbever@mind.be>

[1] https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/modsecurity-v3-dos-vulnerability-in-four-transformations-cve-2023-38285/

Signed-off-by: Frank Vanbever <frank.vanbever@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 670329f057)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 17:56:57 +02:00
Giulio Benetti
b0be067143 package/ramspeed: disable package if affected from gcc bug 43744
This package is affected by gcc bug 43744 and I have not found a work
around for it(i.e. the common -O0 we use or other), so let's disable it if
gcc has such bug.

Fixes:
http://autobuild.buildroot.net/results/ab289769c5fea435934ed260d38e0a4fdd2ba72d

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6b3d0c5adb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 17:55:13 +02:00
Waldemar Brodkorb
1cbb24f995 package/gmp: guard riscv definition
In commit 30997eaa65438a2ce726ad8a204ac5a36363f5c8 a mistake
was made. Guard the definition correctly.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3f46db39e6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 17:26:03 +02:00
Waldemar Brodkorb
91c74b5185 package/gmp: fix compile error for riscv
In commit 87b2a30319 gmp got updated
to 6.2.1, since then the compile error exist.

Compile error looks like this:
tmp-mul_1.s: Assembler messages:
tmp-mul_1.s:55: Error: unrecognized opcode `mul a5,a7,a3'
tmp-mul_1.s:57: Error: unrecognized opcode `mulhu a7,a7,a3'

Patch should be backported to stable branches.

Fixes:
 - http://autobuild.buildroot.net/results/2f2/2f2112bea73adbf49eabb62fe6cda6a9cd5d0567
 - http://autobuild.buildroot.net/results/566/566a4945555b781ed127997176f73b3c17ecab5d

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6d8deb4b23)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 17:26:00 +02:00
Bernd Kuhls
8f1bc63d5b package/php: security bump version to 8.2.9
Changelog: https://www.php.net/ChangeLog-8.php#8.2.9
Release notes: https://www.php.net/releases/8_2_9.php

Fixes CVE-2023-3823 & CVE-2023-3824.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c2612d918f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 15:12:58 +02:00
Bernd Kuhls
830afae9bb package/clamav: security bump version to 1.0.2
Release notes: https://blog.clamav.net/2023/07/2023-08-16-releases.html

Fixes CVE-2023-20197 & CVE-2023-20212.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c78799639b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 13:04:44 +02:00
Bernd Kuhls
1479514797 package/samba4: security bump version to 4.18.6
Release notes: https://www.samba.org/samba/history/samba-4.18.6.html

Includes a mitigation for CVE-2007-4559.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2235ab809f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 13:04:25 +02:00
Bernd Kuhls
a390ec2a9a {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 4}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 20c5bae6fa)
[Peter: drop 6.4.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 12:17:52 +02:00
Bernd Kuhls
5694bf6f99 package/postgresql: security bump version to 15.4
Release notes:
https://www.postgresql.org/about/news/postgresql-154-149-1312-1216-1121-and-postgresql-16-beta-3-released-2689/

Fixes CVE-2023-39417 & CVE-2023-39418.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 31ddf22ff6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:42:26 +02:00
Clement Ramirez
116fb0285d package/cups: security bump version to 2.4.6
Fixes CVE-2023-34241 (see [0] for details)

[0] https://github.com/OpenPrinting/cups/releases/tag/v2.4.6

The number of changes between 2.4.4 and 2.4.6 is really small, and
limited to bug fixes:

9d614a4b3184205294c55355a1d2eb54d4532ccd (tag: v2.4.6) Update CHANGES.md
6f6da74ec284e28c156f0b9f62f3bd610e61aa78 Fix use-after-free in cupsdAcceptClient() (fixes CVE-2023-34241)
3f12185ca9cbb5350a6370d6046066907b8abc12 Merge pull request #735 from AtariDreams/Fixer
f5281777c80cdf820a2a71c9e7f08b91f0e11160 Fix compilation on older macOS versions
ee82c5b18409def3ec1424ce2eb343aabb0ff0d1 Merge pull request #730 from zdohnal/cupssinglefile_24x
1504527b2415a4b67b0e3e17593b053f3628746f  cups/ppd-cache.c: Put cupsSingleFile into generated PPD
3be1d5da8fe9ee13aab5ee6ecc11b2f9387821a6 Prepare files for next release
c1f54ec966ccc5d5564eed95dcb540842af7b5ca (tag: v2.4.5) cups/cups.h: Update for 2.4.5
70dba05b7511a96476ea0ef8fe1d92c6500c6e61 Finish hotfix release 2.4.5
87f5cb7d8f0da8fa2835bb0aa3ca48b5e5a66a3f Merge pull request #727 from AtariDreams/hotfix
61aa0b259183fe59124566f08ecf649bb806cd24 Regression: Certificate data is corrupted during base64 conversion
7362f41c45d834564f876ffac536f59eece843ec Prepare files for next release

Signed-off-by: Clement Ramirez <ramirez.clement3@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit db46428e0a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:41:46 +02:00
Bernd Kuhls
e95a26d6c5 package/freeswitch: security bump version to 1.10.10
Release notes:
https://github.com/signalwire/freeswitch/releases/tag/v1.10.10
"This is a major release containing critical security fixes, adding
 Debian 12 Bookworm, OpenSSL 3 and FFmpeg5 support."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b9a864d03d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:40:23 +02:00
Bernd Kuhls
4e02baaf51 package/libks: bump version to 2.0.2
Updated license hash due to copyright year bump:
52a3f2a546

Needed for freeswitch bump to 1.10.10:
7c1faeff48

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 171977f4bf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:40:16 +02:00
Bernd Kuhls
c39c2c7bf2 package/libks: bump version to 1.8.3
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 28fe2d493b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:40:09 +02:00
Bernd Kuhls
29a7da9bbd package/sofia-sip: bump version to 1.13.15
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fe9fc288d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-09-13 09:39:47 +02:00