Commit Graph

50638 Commits

Author SHA1 Message Date
Fabrice Fontaine
e59503a9d8 package/suricata: fix build with lua
Fixes:
 - http://autobuild.buildroot.net/results/11bc7f4e1c54f074dd10a995233bee45c293e488

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e0fbbdb6fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:07:38 +02:00
Fabrice Fontaine
4a71c673f1 package/util-linux: accept sector-size
Fixes:
 - https://bugs.buildroot.org/show_bug.cgi?id=12841

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit af787a4cf5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:04:16 +02:00
Fabrice Fontaine
c77166012b package/util-linux: renumber patches
Commit 3052da3eac did not renumber
remaining patches, fix that

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit df2f438616)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 22:01:37 +02:00
Yann E. MORIN
8b31a049b1 support/gnuconfig: reference the correct sha1 we're using
In commit ff9f778c66 (support/gnuconfig: update to 2019-05-28), we
forgot to update the README to reference the sha1 we're using, keeping
the old one from 2016...

Update it now.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3bf545da78)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:55:47 +02:00
Fabrice Fontaine
a2220778b1 package/freerdp: security bump to version 2.1.0
- Drop patch (already in version)
- Fix multiple CVEs: CVE-2020-11039, CVE-2020-11038, CVE-2020-11043,
  CVE-2020-11040, CVE-2020-11041, CVE-2020-11019, CVE-2020-11017,
  CVE-2020-11018
- Fix multiple leak and crash issues (#6129, #6128, #6127, #6110, #6081,
  #6077)

Extracted from:
65d3ff4461

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8c26ce8539)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:54:00 +02:00
Fabrice Fontaine
f8f7b417ef package/matchbox: add hash for license file
Add hash for license file, add sha256 for tarball and update indentation
for hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7f59e2c01a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:51:39 +02:00
Fabrice Fontaine
d914cd2c6a package/matchbox: add missing expat dependency
matchbox selects expat but does not add it to its dependency resulting
in the following build failure:

configure: error: cannot find expat library
make: *** [/home/buildroot/autobuild/run/instance-2/output-1/build/matchbox-1.2/.stamp_configured] Error 1

Fixes:
 - http://autobuild.buildroot.org/results/37021f1d7fcfd890011068a28ce6181dc509e746

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3a784f49eb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:51:14 +02:00
Yann E. MORIN
61f5bceb52 release: don't include temp files
When we prepare the release, we generate the manual in various formats,
so that it can be consulted locally without needing the miriads of tools
needed to generate it.

However, this creates the temporary .br2-external.* files in the output
directory, and those end up in the release tarball.

This is not a problem in practice, but is not clean.

Run 'distclean' in the output directory, to get rid of everything but
the generated documentation.

Reported-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bee47598aa)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:34:50 +02:00
Fabrice Fontaine
8616ca9f17 package/domoticz: set WITH_LIBUSB
Use WITH_LIBUSB which is available since version 4.9700 and
f53817577a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a896be19de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:31:50 +02:00
Fabrice Fontaine
eec5fb6419 package/squid: security bump to version 4.11
Fix CVE-2020-11945: An issue was discovered in Squid before 5.0.2. A
remote attacker can replay a sniffed Digest Authentication nonce to gain
access to resources that are otherwise forbidden. This occurs because
the attacker can overflow the nonce reference counter (a short integer).
Remote code execution may occur if the pooled token credentials are
freed (instead of replayed as valid credentials).

http://www.squid-cache.org/Advisories/SQUID-2020_4.txt

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b365c64236)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:30:41 +02:00
Matt Weber
8fc8ca203a package/libsepol: fix -fno-common build failures
GCC10 as a host complier has started to trigger these failures

 Add upstream patch for
    libsepol: remove leftovers of cil_mem_error_handler
    libsepol: fix CIL_KEY_* build errors with -fno-common

Fixes:
http://autobuild.buildroot.net/results/1ebeed4bb1b0f5bca493ff687f879367eaeaf868

Cc: Romain Naour <romain.naour@gmail.com>
Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:29:03 +02:00
Luca Ceresoli
4314359b28 package/exim: fix parallel build
exim does build in parallel correctly, but has a concurrency bug in
generating version info files which happens either in the build step or in
the install step.

Add a patch to fix the bug.

Fixes:
  http://autobuild.buildroot.net/results/ebf/ebfccad007e216564889645a07f5487747116331//
  http://autobuild.buildroot.net/results/56a/56a8457efcb32579ad6da99a769b6438dd0db267//
  http://autobuild.buildroot.net/results/6a1/6a1f8a352649baf767b094cb6bbe2a7397fa7fac//
  http://autobuild.buildroot.net/results/5ed/5ed1c42b3d33198f32d1267e5cc2b1fa1211495a//
  http://autobuild.buildroot.net/results/b30/b304569948fd481ce33ecd052a1036153c5d459e//
  http://autobuild.buildroot.net/results/d2c/d2c7abfe08672e53ff890127f787f8d2e84860f4//

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8c75f95e0a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:24:53 +02:00
Romain Naour
78296a0502 package/qemu: disable curl for the host variant
Under certain circumstances (host distribution, openssl version),
the qemu-system binary fail to start:

qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

There is no problem when only host-qemu is built, but it's linked with /lib64/libcurl.so.4
$ make host-qemu
$ ldd output/host/bin/qemu-system-aarch64
        [...]
	libcurl.so.4 => /lib64/libcurl.so.4 (0x00007fb21cb57000)
	libssh.so.4 => /lib64/libssh.so.4 (0x00007fb21c35d000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007fb21c34a000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007fb21c2b4000)

Note: /lib64/libcurl.so.4 is linked with libssh and libssl:
$ ldd /lib64/libcurl.so.4
	[...]
	libssh.so.4 => /lib64/libssh.so.4 (0x00007f90d8efd000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007f90d8eea000)
	libssl.so.1.1 => /lib64/libssl.so.1.1 (0x00007f90d8e54000)

Continue the build.
$ make

We can notice that qemu_aarch64_virt_defconfig set
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y

So host-openssl package is built and this is the problem:

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libcurl.so.4 => /lib64/libcurl.so.4 (0x00007f3adb444000)
	libssh.so.4 => /lib64/libssh.so.4 (0x00007f3adac4a000)
	libpsl.so.5 => /lib64/libpsl.so.5 (0x00007f3adac37000)
	libssl.so.1.1 => /home/naourr/buildroot/test/qemu_aarch64_virt_defconfig-master/host/lib/libssl.so.1.1 (0x00007f3adaba8000)

qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

This is due to the build system trying to find libcurl using
pkg-config or curl-config.

libcurl is used by the QEMU Block driver for CURL images and
elf2dmp tool which is not needed.
Instead of adding host-libcurl dependency, we can disable it
entierely.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e30eaeb10e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:22:58 +02:00
Romain Naour
15b41bb802 package/qemu: enable or1k support in host-qemu
This change enables host qemu support for or1k which among other
things allows to test this architecture in gitlab.

The or1k support was named or32 until Qemu 2.9.0 and then renamed or1k
in upstream commit [1]. Since we're already using Qemu 4.2.0, we use
the or1k name.

Tested using qemu_or1k_defconfig.

[1] https://git.qemu.org/?p=qemu.git;a=commit;h=4a09d0bb34ab030e09e87173b2e3ec0fd7616cff

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a41fae16d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:22:21 +02:00
Romain Naour
9ca889a2c1 package/qemu: disable SDL2 for the host variant
There is no host variant for SDL2 library in Buildroot.
So the qemu build system will try to detect automatically the
external SDL2 libraries installed on the host.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libSDL2-2.0.so.0 => /lib64/libSDL2-2.0.so.0

Disable explicitely sdl2 options (named sdl) to improve the
build reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 44e5da60b7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:21:51 +02:00
Romain Naour
f2e2ac81e2 package/qemu: disable bzip2 for the host variant
bzip2 support is needed for reading bzip2-compressed dmg images.

But the host-bzip2 is missing from host qemu package dependency,
so the qemu build system will try to detect automatically the
external libbzip2 libraries installed on the host.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libbz2.so.1 => /lib64/libbz2.so.1
or
	libbz2.so.1.0 => output/host/lib/libbz2.so.1.0
if host-bzip2 is built before host-qemu.

Disable explicitely bzip2 options to improve the build
reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 743fceb2ed)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:21:10 +02:00
Romain Naour
1df0dd3cb0 package/qemu: disable vnc optional support for the host variant
The vnc support is enabled by default and the build system
will try to detect automatically some external libraries
installed on the host for vnc-png, vnc-jpeg and vnc-sasl.

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libpng16.so.16 => /lib64/libpng16.so.16
or
	libpng16.so.16 => output/host/lib/libpng16.so.16
if host-libpng is built before host-qemu.

Disable explicitely thoses options to improve the build
reproducibility.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ece36b9a46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:20:57 +02:00
Romain Naour
84e768acf2 package/qemu: disable libssh for the host variant
There is no host-libssh in Buildroot, avoid qemu build system
to find libssh from the host.

Under certain circumstances (host distribution, openssl version), the
qemu-system binary fail to start:

host/bin/qemu-system-aarch64: symbol lookup error: /lib64/libssh.so.4: undefined symbol: EVP_KDF_ctrl, version OPENSSL_1_1_1b

$ ldd output/host/bin/qemu-system-aarch64
	[...]
	libssh.so.4 => /lib64/libssh.so.4

Explicitely disable libssh for the host variant.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0c4a80c7c4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:20:39 +02:00
Bernd Kuhls
ad120f7335 package/libfm-extra: fix dependency comment
According to the depends used the package does not need C++.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 08935f2a86)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:16:36 +02:00
Davide Viti
a975326ca4 DEVELOPERS: adjust e-mail address for Davide Viti
Previous address is still valid but not used as primary address any
longer

Signed-off-by: Davide Viti <zinosat@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3d1583729c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:15:47 +02:00
Alexey Lukyanchuk
578f0936f2 package/qpdf: fix 'no such file' exeption
Without a source for randomness, qpdf will crash with 'no such file'
error. It's can me tested by command like 'qpd some_pdf.pdf -'.
This problem breaks cups printing.

This patch change configure options to '--with-random=/dev/urandom'

Signed-off-by: Alexey Lukyanchuk <skif@skif-web.ru>
[yann.morin.1998@free.fr: reword commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 69dfbbd33b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:12:29 +02:00
Michele Comignano
d883e860b1 package/vlc: enable gnutls if selected
Signed-off-by: Michele Comignano <comick@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d3a5da884)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 21:12:04 +02:00
Fabrice Fontaine
006165909d package/paho-mqtt-c: fix build without C++
Fixes:
 - http://autobuild.buildroot.org/results/831ecc34b51ee2be82a3c25f5ec94f0dd2103655

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit dd63d5822d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:54:57 +02:00
Fabrice Fontaine
1c6df588db package/suricata: security bump to version 4.1.8
- This is the first release after Suricata joined the Oss-Fuzz program,
  leading to discovery of a number of (potential) security issues:
  https://suricata-ids.org/2020/04/28/suricata-4-1-8-released
- Drop first, second and fourth patches (already in version)
- Update indentation of hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6138dee5e7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:27:02 +02:00
Fabrice Fontaine
1c7c8303e6 package/libhtp: security bump to version 0.5.33
- ChangeLog:
  - compression bomb protection
  - memory handling issue found by Oss-Fuzz
  - improve handling of anomalies in traffic
- Drop first patch (already in version)
- Update indentation of hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b3d5194696)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:26:32 +02:00
Dagg Stompler
c99a2b0a48 board/hardkernel/odroidc2: remove unused files
Commit b80712a16a ("configs/odroidc2:
remove the defconfig") has removed the odroidc2 defconfig, but left
behind a number of files in board/hardkernel/odroidc2, which are now
unused. Let's remove them.

Signed-off-by: Dagg Stompler <daggs@gmx.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 197da62866)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:25:35 +02:00
Fabrice Fontaine
c53538af04 package/paho-mqtt-c: fix build on uclibc or musl
Fixes:
 - http://autobuild.buildroot.org/results/4beb96d43180813906578b42875a1c3d4a905ed7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 91beea442a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:24:06 +02:00
Bernd Kuhls
2a9f241a83 package/samba4: security bump version to 4.11.8
Reformatted hash.

Fixes CVE 2020-10700 & CVE 2020-10704.

Release notes: https://www.samba.org/samba/history/samba-4.11.8.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 11bc27fd0d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:23:07 +02:00
Asaf Kahlon
50f20f639e docs: adding-packages-python: don't mention distutilscross
The package was removed a long time ago.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 427697f297)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:01:19 +02:00
Carlos Santos
04df6eba78 DEVELOPERS: trim Carlos Santos' watch list
- I fixed build problems on cups and cups-filters but don't use them.

- gtest, libpam-radius-auth, libpam-tacplus and perl-file-util were
  used in my previous job. I don't have access to the packages that
  use them neither to the corresponding test infrastructure anymore.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1c3ffaed57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 20:00:24 +02:00
Yann E. MORIN
0cba056b9c package/tzdata: do extract to get the license file
Back in 2014, about 6 years ago now, in my infinite wisdom, I
decided that extracting the tzdata source was not necessary for
the target variant, because we would be installing the files
generated by the host variant, in commit 7aad5daa5d (package/tzdata:
only compile the zoneinfo once).

However, that did not account for the fact that we would eventually
like to have the licensing information for tzdata, later added in
2019, in commit 60889ccdf0 (package/tzdata: bump to version 2019b).

However, that last comit only added the license file to the host
variant, without explanations why that was so. It turns out that the
reason it was not added to the target variant is, probably, that he
source code for the target variant is not extracted, and thus saving
the license file fails.

But we really want the license file for what goes on into the target.

So, do extract the source code for the target variant, even if only to
get the license file.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Richard Braun <rbraun@sceen.net>
Cc: Martin Bark <martin@barkynet.com>
Cc: Christopher McCrory <chrismcc@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5c0c4861be)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-10 19:56:50 +02:00
Alexander Dahl
12581af61c package/zic: bump to version 2020a
Signed-off-by: Alexander Dahl <post@lespocky.de>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2f976c31b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:20:45 +02:00
Alexander Dahl
69f2f95d52 package/tzdata: bump to version 2020a
Signed-off-by: Alexander Dahl <post@lespocky.de>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7656cae01e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:20:36 +02:00
Adrian Perez de Castro
50a48fd6b3 package/webkitgtk: security bump to version 2.28.2
This is a minor release which provides fixes for CVE-2020-11793,
CVE-2020-3887, CVE-2020-3894, and CVE-2020-3899.

Updating from 2.28.0 also brings a few rendering fixes, a build fix
on MIPS64, a build fix for GStreamer 1.12, and solves a couple of
crashes. The full release notes covering 2.28.1 and 2.28.2 can be
found at:

  https://webkitgtk.org/2020/04/13/webkitgtk2.28.1-released.html
  https://webkitgtk.org/2020/04/24/webkitgtk2.28.2-released.html

A detailed security advisory can be found at:

  https://webkitgtk.org/security/WSA-2020-0004.html

Note that the above does not cover all the CVEs, and a new advisory
including them is expected to be published in the next days.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 080f4251ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:05:40 +02:00
Adrian Perez de Castro
5c3b82b027 package/wpewebkit: security bump to version 2.28.2
This is a minor release which provides fixes for CVE-2020-11793,
CVE-2020-3887, CVE-2020-3894, and CVE-2020-3899.

Updating from 2.28.0 also brings a few rendering fixes, a build fix
on MIPS64, a build fix for GStreamer 1.12, and solves a couple of
crashes. The full release notes covering 2.28.1 and 2.28.2 can be
found at:

  https://wpewebkit.org/release/wpewebkit-2.28.1.html
  https://wpewebkit.org/release/wpewebkit-2.28.2.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0004.html

Note that the above does not cover all the CVEs, and a new advisory
including them is expected to be published in the next days.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e028d52b7e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:05:34 +02:00
Adrian Perez de Castro
af237ed997 package/webkitgtk: bump to version 2.28.0
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6ebd152853)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:51 +02:00
James Hilliard
3cffbc6769 package/wpebackend-fdo: bump to version 1.6.0
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 60992a8ce1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:29 +02:00
James Hilliard
a4ac41f92d package/libwpe: bump to version 1.6.0
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 90e735f6d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:04:22 +02:00
James Hilliard
bbe227dac6 package/wpewebkit: bump to version 2.28.0
Adjust fix build with musl patch for 2.28.0.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cd75229976)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-09 09:02:29 +02:00
Ryan Barnett
c7d37980f1 package/e2fsprogs: bump to version 1.45.6
Fixes a number of out of bounds memory accesses.  For details, see the
release notes:
https://github.com/tytso/e2fsprogs/blob/v1.45.6/doc/RelNotes/v1.45.6.txt

Signed-off-by: Ryan Barnett <ryanbarnett3@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3938f87e41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 16:44:48 +02:00
Bernd Kuhls
81e3284ac4 package/mesa3d-headers: fix install of dri.pc
mesa3d-headers is a little bit special: it uses the same sources as
the mesa3d package, named just 'mesa' upstream. mesa uses the meson
buildsystem, an that is what we use in the mesa3d package.

However, mesa3d-headers does not install the whole of mesa; it only
installs a select set of headers for those binary blobs that do not
provide them.

mesa does not provide such a feature (only installing headers) with
its meson buildsystem. As a consequence, we've made mesa3d-headers a
generic package, that basically only copies headers over.

Additionally, mesa3d-headers also provides the dri.pc file for when
Xorg is enabled; see 7468b60e7c (package/mesa3d-headers: also install
dri header and .pc file).

We used to manually generate that file from a .in template that was
present in mesa source code at the time it was still using autotools.
But when they switched over to using meson, the template was dropped
[0], and the dri.pc is now entirely generated using meson internals
[1].

So we now have no template present in the source code, so we must
come up with our own. This simplifies the replacement pattern to
just inject the version string.

[0] https://cgit.freedesktop.org/mesa/mesa/commit/?id=158758618264eac113025a86a360dc305ed4498b
[1] https://cgit.freedesktop.org/mesa/mesa/tree/src/mesa/drivers/dri/meson.build?h=19.2#n93

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Tested-by: Vincent Fazio <vfazio@xes-inc.com>
[yann.morin.1998@free.fr:
  - entirely rework the commit log
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9014c21cac)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 16:42:09 +02:00
Danomi Manchego
ea288b517d package/paho-mqtt-c: disable tests and cpack docs
paho-mqtt-c by default enables the building of test materials and
install of CPack documentation:

PAHO_ENABLE_TESTING - "Build tests and run"
PAHO_ENABLE_CPACK - "Enable CPack"

Let's disable these to save a couple megabytes and time.  This is
in keeping with the generic settings in pkg-cmake.mk.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5686d69eef)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:38:50 +02:00
Peter Korsgaard
9097b9ef06 package/wireguard-linux-compat: bump version to 1.0.20200413
For details, see the announcement:
https://lists.zx2c4.com/pipermail/wireguard/2020-April/005295.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 66962e9bb8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:37:01 +02:00
Fabrice Fontaine
73a52cbc9f package/gflags: force Release mode
Force Release otherwise libraries will be suffixed by _debug which will raise
unexpected build failures with packages that use gflags (e.g. rocksdb)

Fixes:
 - http://autobuild.buildroot.org/results/3545774258babc3584f69e7d523efdf7fff1acb5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 198e42d6eb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:08:05 +02:00
Thomas Petazzoni
54d0ae1bfe package/libarchive: remove double handling of zstd
When 4bcc344464 was applied, it was not
noticed that 96dc6701af (from another
contributor) had already been
applied. 4bcc344464 essentially did the
same thing as 96dc6701af, except it also
disable zstd support explicitly in the host-libarchive package.

Let's drop the part of 4bcc344464 that
duplicates 96dc6701af.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 37e853d63c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:06:08 +02:00
Fabrice Fontaine
beb89fd77f package/libarchive: add zstd optional dependency
zstd is available since version 3.3.3 and
26838cf5c1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4bcc344464)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:05:56 +02:00
Fabrice Fontaine
cebf537751 package/libarchive: add lz4 optional dependency
lz4 is available since version 3.2.0 and
724f3f918e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9a514c72cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:05:26 +02:00
Christian Stewart
97a6aeea81 package/docker-engine: bump version to 19.03.7
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e505bc4777)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:02:02 +02:00
Christian Stewart
763f05b818 package/docker-containerd: bump version to 1.2.13
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 93fecb7ed5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 12:01:11 +02:00
Timo Ketola
ad164f5297 fs/cpio: make initramfs init script survive 'console=' kernel argument
When booting with 'console=<empty>' in the kernel command line (as e.g.
U-Boot does with silent flags in effect), opening /dev/console fails.

As per POSIX [0], when iany redirection fails, the shell running exec
shal exit in error. So, when 'console=<empty>' is specified.
/dev/console can't be opened, and the redirection fails, and /init is
killed.

That behaviour was fixed on the kernel side with commit 2bd3a997befc2
(Open /dev/console from rootfs), present since 2.6.34, released in May
2010, so any [dr]ecent kernel will have that fix.

Furthermore, busybox will fix things up anyway (in bb_sanitize_stdio()),
falling back to opening /dev/null if no console is availble. systemd
does a similar thing (in make_console_stdio()), and sysvinit again has
a similar approach (in console_init()).

The archealogy search turned up those relevant commits:

    2011-08-04 10a130f91e initramfs/init: make sure that 0, 1, 2 fds are available
        introduces the three exec redirections in initramfs

    2011-09-06 3fac21ef8d cpio: fix boot with dynamic /dev
        introduces the three exec redirections in cpio

    2011-09-06 13a3afc536 fs/initramfs: refactor with fs/cpio
        dropped the initramfs tweaks to reuse the cpio ones

    2012-11-04 e1ebae700a fs/common: Create initial console device
        introduces the /dev/console char,5,1 pseudo device creation in
        cpio

    2018-03-31 dec061adce fs/cpio: don't extend packages' permissions table
        switched from the permission-table to a manual mknod to create
        /dev/console

The redirections were added before we could guarantee there was a
/dev/console in the rootfs.

We're now guaranteed to have /dev/console in an initramfs, and any recent
kernel will automatically open /dev/console before spawning /init.

The three redirections are useless now, and cause harm under certain
conditions. Drop them.

[0] https://pubs.opengroup.org/onlinepubs/9699919799/utilities/V3_chap02.html#tag_18_20_01

Signed-off-by: Timo Ketola <timo.ketola@exertus.fi>
Cc: Peter Korsgaard <peter@korsgaard.com>
[yann.morin.1998@free.fr:
  - extend commit log with the analysis done with Peter
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 98a6f1fc02)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-05-08 11:52:45 +02:00