Commit Graph

69704 Commits

Author SHA1 Message Date
Peter Korsgaard
ecce7bf95a package/dfu-programmer: bump version to 1.1.0
The update-bash-completion.sh issue is now fixed, so remove the workaround:

https://github.com/dfu-programmer/dfu-programmer/pull/91

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-28 21:30:36 +02:00
Peter Korsgaard
99d525028f package/aufs-util: use HTTPS for git.code.sf.net
git.code.sf.net is available over HTTPS, so use that for security and
consistency with the other packages.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-28 21:30:30 +02:00
Peter Korsgaard
f2a590750f package/aufs: use HTTPS for git.code.sf.net
git.code.sf.net is available over HTTPS, so use that for security and
consistency with the other packages.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-28 21:30:24 +02:00
Peter Korsgaard
05296ced36 Config.in: default to HTTPS for s.b.n backup site
Now that we have HTTPS support for sources.buildroot.net (through Lets
encrypt / Cloudflare), it makes sense to default to it for our backup site.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-28 21:30:18 +02:00
Peter Korsgaard
cf2dcaa1ec package/riscv64-elf-toolchain: add .hash file
The host-riscv64-elf-toolchain package was missing a hash file, add it now.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-28 21:30:12 +02:00
Adrian Perez de Castro
d4fc46f751 package/xdg-dbus-proxy: fix tarball name in hash file
Fixes: 487761a5b2 ("package/xdg-dbus-proxy: bump to version 0.1.5")
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-26 18:58:11 +02:00
Alistair Francis
91381143e8 package/libspdm: bump version to 3.1.0
Drop now upstreamed patches.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:22:07 +02:00
Giulio Benetti
ed573043b5 package/libblockdev: bump to version 3.0.4
Update local patch to add missing strerror_l() to other files.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:17:15 +02:00
Giulio Benetti
359abca84c package/harfbuzz: bump to version 8.2.2
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:17:06 +02:00
Francois Perrad
33065ef61e package/moarvm: bump to version 2023.10
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:07:24 +02:00
Francois Perrad
c87abf01a9 package/janet: bump to version 1.32.1
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:07:03 +02:00
Fabrice Fontaine
97d6a77d1e package/paho-mqtt-c: bump to version 1.3.13
https://github.com/eclipse/paho.mqtt.c/releases/tag/v1.3.13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:06:09 +02:00
Fabrice Fontaine
f6890c1c4e package/dhcpcd: bump to version 10.0.4
https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.0.2
https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.0.3
https://github.com/NetworkConfiguration/dhcpcd/releases/tag/v10.0.4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:05:57 +02:00
Bernd Kuhls
871f611e5a package/intel-mediadriver: bump version to 23.3.5
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:04:44 +02:00
Christian Stewart
0629895dbf package/docker-compose: bump version to v2.23.0
Significant update with new features & fixes.

Full release notes:

https://github.com/docker/compose/releases/tag/v2.23.0

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 22:04:31 +02:00
Julien Olivain
68689a6cbc package/rdma-core: bump to version v48.0
For change log, see:
https://github.com/linux-rdma/rdma-core/releases/tag/v48.0

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-25 21:54:26 +02:00
Peter Korsgaard
fefcfddc5e package/mxsldr: add .hash file
The host-mxsldr package was missing a hash file, add it now.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-25 21:52:00 +02:00
Fabrice Fontaine
de7bc4ada2 package/minizip-zlib: fix CVE-2023-45853
MiniZip in zlib through 1.3 has an integer overflow and resultant
heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long
filename, comment, or extra field. NOTE: MiniZip is not a supported part
of the zlib product.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:16:46 +02:00
Fabrice Fontaine
17ffb91551 package/libtommath: add LIBTOMMATH_CPE_ID_VENDOR
cpe:2.3🅰️libtom:libtommath is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/F0D99614-AA27-4713-ADD2-103647C8838B

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:16:22 +02:00
Fabrice Fontaine
07c44afc8d package/nghttp2: security bump to version 1.57.0
Fix CVE-2023-44487: The HTTP/2 protocol allows a denial of service
(server resource consumption) because request cancellation can reset
many streams quickly, as exploited in the wild in August through October
2023.

Fix CVE-2023-35945: nghttp2 fails to release memory when PUSH_PROMISE or
HEADERS frame cannot be sent, and nghttp2_on_stream_close_callback fails
with a fatal error. For example, if GOAWAY frame has been received, a
HEADERS frame that opens new stream cannot be sent.

https://github.com/nghttp2/nghttp2/security/advisories/GHSA-vx74-f528-fxqg
https://github.com/nghttp2/nghttp2/security/advisories/GHSA-6pcr-v3hg-752p
https://github.com/nghttp2/nghttp2/compare/v1.41.0...v1.57.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:15:52 +02:00
Fabrice Fontaine
7385c7f8b3 package/wireshark: security bump to version 4.0.10
https://www.wireshark.org/news/20231004.html
https://www.wireshark.org/news/20231004a.html

Fix CVE-2023-5371:
https://www.wireshark.org/security/wnpa-sec-2023-27.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:14:46 +02:00
Bernd Kuhls
d00881cad1 package/apache: security bump version to 2.4.58
Fixes CVE-2023-31122, CVE-2023-43622 & CVE-2023-45802:
https://httpd.apache.org/security/vulnerabilities_24.html

Release notes:
https://lists.apache.org/thread/1qnr3jpk1mdnqc2c6foyjvg0ch636h1n

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:14:13 +02:00
Christian Stewart
a78bf295bc package/runc: bump version to v1.1.9
Bugfixes and riscv64 support.

Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-25 21:13:38 +02:00
Alexey Romanov
75fa573ef9 package/pkg-kernel-module: add BR2_MAKE_HOST_DEPENDENCY
Commit 0b9efc991f ("linux: use BR2_MAKE") switched LINUX_MAKE to
$(BR2_MAKE) to avoid build issue with kernel version >= 6.2 and GNU
Make version < 3.82. However, the same issue is actual for kernel
modules as well.

Using $(BR2_MAKE) should guarantee a consistent behavior between
kernel and kernel-modules builds.

Signed-off-by: Alexey Romanov <avromanov@sberdevices.ru>
Signed-off-by: Sergey Bobrenok <SIBobrenok@sberdevices.ru>
[yann.morin.1998@free.fr: minor coding style]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-24 21:21:01 +02:00
Adam Duskett
e0cecc326a package/opkg: enable sha256sum support
Support for sha256 has no additional dependency, the size increase is
minimal, and sha256 is the smallest hash still not broken (md5 and sha1
are), so it makes sense to enable it unconditionally.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: make it unconditional and commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:42 +02:00
Adam Duskett
ef2aa9e6b5 package/opkg: add curl support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:39 +02:00
Adam Duskett
00583e1c16 package/opkg: add bzip2 support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:36 +02:00
Adam Duskett
3d9ba8c3f7 package/opkg: Add lz4 support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:33 +02:00
Adam Duskett
23a669456f package/opkg: add xz suspport
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:12 +02:00
Adam Duskett
6d55ba0f8a package/opkg: add zstd support
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: drop option, use package as condition]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:18:06 +02:00
Yann E. MORIN
b3dd463442 package/opkg: move related code together
In commit d31db334c3 (opkg: Add gnupg signature checking support.),
the macro definition for the hook, and the hook assignment, got
separated by the then-newly introduced GPG handling.

Move the macro definition closer to the hook assignment. Since this is
a post-install hook, it is but logical that it comes further down in
the .mk file.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 19:17:14 +02:00
Adam Duskett
10e6449964 package/opkg-utils: bump version to 0.6.2
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:52:25 +02:00
Adam Duskett
4c761f459a package/opkg: bump version to 0.6.2
Tested in Fedora 39 and Debian 11 with:
./support/testing/run-tests tests.package.test_opkg.TestOpkg.test_run

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:52:19 +02:00
Titouan Christophe
b7267eab9a package/redis: security bump to v7.2.2
This fixes CVE-2023-45145, see the release notes:
https://raw.githubusercontent.com/redis/redis/7.2.2/00-RELEASENOTES

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:50:10 +02:00
Thomas Petazzoni
7f1088f9ca package/tar: allowing building even on non-Y2038 compliant systems
Since the bump of tar to version 1.35 in Buildroot commit
d4d483451f ("package/tar: security bump
to version 1.35"), the build will fail on systems that are not Y2038,
such as uClibc configurations.

In order to preserve the previous behavior, pass --disable-year2038.
See the gnulib documentation for details [0]. Contrary to what the
option name might suggest, it doesn't really disable Y2038 support,
but only the check that the system is Y2038 compliant. So even with
--disable-year2038, if the system is Y2038 compliant (uses a 64-bit
arch, uses the musl C library, or uses the glibc C library with
BR2_TIME_BITS_64=y), tar will be Y2038 compliant.

[0] https://www.gnu.org/software/gnulib/manual/html_node/Avoiding-the-year-2038-problem.html

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-23 18:21:32 +02:00
Adam Duskett
bc8d214e98 package/python-django: bump version to 4.2.6
Tested with tests.package.test_python_django.TestPythonPy3Django.test_run in
Fedora 38 and Debian 11

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:37:13 +02:00
Fabrice Fontaine
5ef8369d98 package/suricata: security bump to version 6.0.15
This is a security release, fixing a number of important issues.

https://forum.suricata.io/t/suricata-6-0-15-released/4068/2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:36:16 +02:00
Fabrice Fontaine
9ccfb25dde package/vim: security bump to version 9.0.2053
Fix CVE-2023-5344, CVE-2023-5441 and CVE-2023-5535

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 20:32:40 +02:00
Bernd Kuhls
bf9583a502 package/elfutils: enable on musl
Buildroot commit eb60820c0a disabled
elfutils for musl toolchains in 2015. Current code builds fine with musl
so remove the exceptions.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[yann.morin.1998@free.fr:
  - move all libc-related conditional blocks together
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 18:02:32 +02:00
Bernd Kuhls
d8bcff69fc {linux, linux-headers}: bump 5.15.x / 6.{1, 5}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:26:53 +02:00
Bernd Kuhls
07aa4dcbfa package/libdrm: bump version to 2.4.117
Release notes:
https://lists.x.org/archives/xorg-announce/2023-October/003429.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:26:47 +02:00
Giulio Benetti
274ca1732f package/rtl8188eu: bump to 2023-07-29 version on v5.2.2.4 branch
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:16:36 +02:00
Francois Perrad
01c42d05bd package/perl-mojolicious: bump to version 9.34
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 16:08:55 +02:00
Gaël PORTAY
2c2d01ac0f package/libxmlrpc: bump version to 1.60.01 (code/advanced@r3176)
Signed-off-by: Gaël PORTAY <gael.portay@rtone.fr>
[yann.morin.1998@free.fr: bump to 01.60.01 bug fix with openssl]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-22 14:05:09 +02:00
Yann E. MORIN
f685549b19 docs/manual: fix typo
Reported-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2023-10-21 23:30:27 +02:00
Yann E. MORIN
23edf9837c package/pkg-utils: teach per-package-rsync to copy or hardlink dest
commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) was recently reverted, so we
are back to a situation where it is possible for packages and post-build
scripts to modify files in-place, and thus impact files in any arbitrary
per-package directory, which may break things on rebuild for example.

21d52e52d8 was too big a hammer, but we can still apply the reasoning
from it, to the aggregation of the final target and host directories.

This solves the case for post-build scripts at least. We leave the case
of inter-package modification aside, as it is a bigger issue that will
need more than just copying files around.

We use --hard-links, so that hard-links in the source (the PPD), are
kept as new hard-links (i.e. "copy" of hard-links) in the destination.
This contributes to limiting the size of target/.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
2023-10-21 21:18:13 +02:00
Yann E. MORIN
8f1487d6fa Revert "package/pkg-utils.mk: break hardlinks in global {TARGET, HOST}_DIR on per-package build"
Commit 21d52e52d8 (package/pkg-utils.mk: break hardlinks in global
{TARGET, HOST}_DIR on per-package build) stopped hardlink the source and
destination when rsyncing per-package directory, on the rationale that
modifying files in-place after the rsync would also modify the original
file, and that break foo-rebuild and can cause issues with post-build
scripts.

However, what 21d52e52d8 did not envision, is that copying instead of
hard-linking has two nasty side effects:

  - the size increase for the build directory increase with the number
    of packages and with the depth of th dependency chains for those
    packages: a (relatively small) build that was previously totalling
    ~13GiB in output/, now totals north of 122GiB, an almost 10-time
    increase;

  - the build time increases, as it takes more time to read+write files
    than it takes to create a new link to a file; the same build saw an
    increase of build time from 5min 10s to 7min 30s, a 45% increase.

These regressions are both serious, so revert the change; we'll come up
with a stopgap measure in follow-up commits.

This reverts commit 21d52e52d8.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Herve Codina <herve.codina@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
2023-10-21 21:08:24 +02:00
Neal Frager
3f23277c41 configs/zynq_microzed_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_microzed_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:42:00 +02:00
Neal Frager
b0c46e2f91 configs/zynq_zed_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_zed_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:41:55 +02:00
Neal Frager
490b71f9f0 configs/zynq_zc706_defconfig: bump to xilinx-v2023.2
This patch bumps the zynq_zc706_defconfig to xilinx-v2023.2 which includes
the following updates:

- Linux v6.1.30
- U-Boot v2023.01 with additional bug fixes

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2023-10-18 11:41:48 +02:00