lighttpd: security bump to version 1.14.51

Fixes the following security issues:

1.4.50:
[mod_alias] security: potential path traversal with specific configs
[core] security: use-after-free invalid Range req
[mod_alias] security: path traversal in mod_alias (in some use cases) (fixes #2898)
[core] security: use-after-free after invalid Range request (fixes #2899)

1.4.51:
[core,security] process headers after combining folded headers
[mod_userdir] security: skip username “.” and “..”

1.4.51 brings optional pam and wolfssl support.  Explicitly disable these
options for now.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qemu: switch to sdl2

Since version 2.12.0 and
https://github.com/qemu/qemu/commit/e52c6ba34149b4f39c3fd60e59ee32b809db2bfa,
SDL 1.2 is deprecated so switch to SDL 2.0 as SDL 1.2 will be removed in
the last release of 2018

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qemu: sdl frontend needs x11

Since qemu 2.12.0 and
https://github.com/qemu/qemu/commit/2ec78706d188df7d3dab43d07b19b05ef7800a44,
x_keymap.h has been converted from "SDL display driver" to "X11 keymaps"

So add a select on BR2_PACKAGE_SDL_X11

Fixes:
 - http://autobuild.buildroot.org/results/1908d2d7de8d3aff11ed6fbb8fe4cf3eff54b5a5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

synergy: needs gcc >= 4.9

Since version 1.9.0 and
https://github.com/symless/synergy-core/commit/c0376e9e2f659aec23a748f9a8d8ee6cd82f1281,
synergy needs C++14 so add a dependency on
BR2_TOOLCHAIN_GCC_AT_LEAST_4_9

Fixes:
 - http://autobuild.buildroot.org/results/c4646ee9342ea8bd906bfe2b29996c48cb403ccc

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: Pieterjan Camerlynck <pieterjan.camerlynck@gmail.com>
Reviewed-by: Pieterjan Camerlynck <pieterjan.camerlynck@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

motion: bump to version 4.2

- Remove patch (already in version)
- Add new mandatory libmicrohttpd dependency, see:
  https://github.com/Motion-Project/motion/commit/3cd68cab497527bb51af63fc4279b024f828b536
- Add new optional gettext dependency, see:
  https://github.com/Motion-Project/motion/commit/4ff191be82920451f5940d6685a2ab7388e0f7b6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

kconfig: Refresh patches

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

kconfig: Restore missing custom changes + add patches

Commit 6eacea5ae0 accidentally removed these changes in merge_config.sh:
0f56304521 ("merge_config.sh: create temporary files in /tmp")
28fac3973b ("merge_config.sh: add br2-external support")

Changes were lost because commits just changed files, but didn't add patches.
Therefore not only restore our changes, but also add (updated) patches.

Missing 0f56304521 caused breaking merge_config.sh when used in out of
tree build:
$ make -C buildroot O=$PWD/output defconfig
...
$ cd output
$ echo 'BR2_TARGET_GENERIC_HOSTNAME="test"' > test.frag
$ ../buildroot/support/kconfig/merge_config.sh .config test.frag
Using .config as base
Merging test.frag
umask 0022 && make -C /home/test/buildroot O=/home/test/output/. alldefconfig
  GEN     /home/test/output/Makefile
*** Can't read seed configuration "./.tmp.config.qIcpASpUyh"!
make[1]: *** [Makefile:925: alldefconfig] Error 1
make: *** [Makefile:16: _all] Error 2

Fixes: 6eacea5ae0 support/kconfig: bump to kconfig from Linux 4.17-rc2
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Reported-by: Erico Nunes <nunes.erico@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

kconfig: Add missing patch

which was specified, but not added during last update.

Fixes: 6eacea5ae0 ("support/kconfig: bump to kconfig from Linux 4.17-rc2")
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

neardal: fix static build with libedit and libbsd

Add an upstreamable patch to use pkg-config for finding libedit and
readline dependencies and drop ncurses "hack"

Fixes:
 - http://autobuild.buildroot.org/results/b0b17f4a5b0a32631a12bdb350ba7c21f7c595d0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-pycryptodomex: bump to version 3.7.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

openswan: security bump to version 2.6.50.1

- Fixes CVE-2018-15836 (a Bleichenbacher-style signature forgery which
  involves RSA padding attack)
- Add hash for license files

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

openswan: disable documentation

Disable pod2man and xmlto which are used to build man pages

Fixes:
 - http://autobuild.buildroot.org/results/2268814b8f5a071ecec1aab962b50a1edcb818d7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libkcapi: disable documentation

Disable db2pdf, db2ps and xmlto which are used for building PDF, PS, man
or html documentation

Fixes:
 - http://autobuild.buildroot.org/results/28df3b50d90bc53b965280b77224f89fe09ec2b9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

valgrind: fix uclibc c99 support detection

Fixes [1]:

  checking for /home/peko/autobuild/instance-0/output/host/bin/powerpc-linux-gcc option to accept ISO C99... unsupported
  configure: error: Valgrind relies on a C compiler supporting C99

with the following in the valgrind-3.14.0/config.log:

  configure:5517: checking for .../host/bin/powerpc-linux-gcc option to accept ISO C99
  configure:5666: .../host/bin/powerpc-linux-gcc -c -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -fno-stack-protector -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 conftest.c >&5
  conftest.c:55:9: error: unknown type name 'wchar_t'
     const wchar_t *name;
           ^~~~~~~

[1] http://autobuild.buildroot.net/results/b25013f785a11f07e8da3735741b96036712f42a

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

scancpan: also use README.md as default license file

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

lcdproc: use ac_cv_mtab_file

Set ac_cv_mtab_file to /etc/mtab otherwise build will fail if no mtab,
mnttab or fstab is found in /etc (on host)

Fixes:
 - http://autobuild.buildroot.org/results/efaf2833d674c7e366c59f367f0b83c7f88546bb

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

liburiparser: security bump to version 0.9.0

Fixes an out-of-bounds write, detect an integer overflow and protect
against acting on NULL input. For additional datails, see

   https://github.com/uriparser/uriparser/blob/uriparser-0.9.0/ChangeLog

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python3: bump to version 3.7.1

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-setuptools: bump to version 40.5.0

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mjpg-streamer: add optional dependency to zeromq

The ZeroMQ output module also depends on protobuf, see upstream PR 145.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mjpg-streamer: bump version

This bump includes
https://github.com/jacksonliam/mjpg-streamer/commit/2b751f1f2ab1dfaf1d12bedf98d4fe37a42d3edd

which fixes
http://autobuild.buildroot.net/results/247/247a55398aed37a08c67cc21db6836ad342d24ca/

and includes
https://github.com/jacksonliam/mjpg-streamer/commit/ddb69b7b4f114f3c2ca01adf55712792ca8aed43

which fixes
http://autobuild.buildroot.net/results/dad/dad054954de76cab56333747274520f269be2066/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gpsd: disable documentation

Fixes:
 - http://autobuild.buildroot.org/results/cbdb4cc34080714082f044fde7e069e6ab5a0e8e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-dateutil: bump to version 2.7.5

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

iproute2: fix build on glibc < 2.21 / uClibc

Fixes:
http://autobuild.buildroot.net/results/fc9/fc99b1ad49080f552ce611d5a7a2f9fe171b5a2c/
http://autobuild.buildroot.net/results/5f7/5f74c258a3adafa5aecd4abc378eef0573143764/

q_{etf,taprio}.c uses CLOCK_TAI, which isn't exposed by glibc < 2.21 or
uClibc, breaking the build. Provide a fallback definition like it is done
for IPPROTO_MPLS and others.

Patch submitted upstream:
https://lwn.net/ml/netdev/20181027153102.32302-1-peter%40korsgaard.com/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-fastentrypoints: bump to version 0.12

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

iproute2: bump version to 4.19.0

For support for the new 4.19+ kernel features. Release notes:
https://lwn.net/ml/netdev/20181023104935.282ff4ec@xeon-e3/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mysql: properly order "depends on" vs. bool

This fixes a check-package warning introduced by commit
19df27ed03b33cd86c971afb355091161972851f ("package/mariadb: add option
to disable build of embedded server")

Fixes:

package/mysql/Config.in:59: attributes order: type, default, depends on, select, help (http://nightly.buildroot.org/#_config_files)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arm-trusted-firmware: replace hard-coded arm64 with MKIMAGE_ARCH

We already use $(MKIMAGE_ARCH) in lots of places; use it here too.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arm-trusted-firmware: replace mkimage invocation with MKIMAGE

We already use $(MKIMAGE) instead of $(HOST_DIR)/bin/mkimage in xvisor, linux,
and cpio; use it here too.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

uboot: replace mkimage invocation with MKIMAGE

We already use $(MKIMAGE) instead of $(HOST_DIR)/bin/mkimage in xvisor, linux,
and cpio; use it here too.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-path-tiny: bump to version 0.104

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-net-ping: bump to version 2.71

The license file hash is changed due to:

 - Changes in the README file unrelated to the licensing terms.
 - Update of the copyright year (2017 changed to 2017-2018)

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-net-dns: bump to version 1.18

The license file hash is updated, but due to changes to the README
file that do not affect the licensing terms.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-mojolicious: bump to version 8.04

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-mail-dkim: bump to version 0.54

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-libwww-perl: bump to version 6.36

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-io-socket-ssl: bump to version 2.060

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-gd: bump to version 2.69

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-file-slurp: bump to version 9999.23

The license file is changed to README.md, because README no longer
exists. The licensing terms are unchanged:

"""
This program is free software; you can redistribute it and/or modify it
under the same terms as Perl itself.
"""

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-date-manip: bump to version 6.73

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

perl-crypt-openssl-rsa: bump to version 0.31

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

valgrind: bump version to 3.14.0

- new option: link-time optimisation

For details see [1].

[1] http://valgrind.org/docs/manual/dist.news.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

giflib: disable xmlto

Fixes:
 - http://autobuild.buildroot.org/results/87c7fa4a8e393acaccc84bd2774f9eee32ef7d90

xmlto is optionally used to generate documentation, which we don't need.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libevdev: bump version to 1.6.0

For details see [1].

Rebased patch 0001-configure-add-disable-runtime-tests-option.patch.

[1] https://lists.freedesktop.org/archives/input-tools/2018-October/001488.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

board/zynqmp/post-image.sh: support dots in DTS file names

Some ZynqMP device trees in the kernel have a dot in their name,
for example "zynqmp-zcu102-rev1.0". The post image script
left out the part after the dot and created an invalid symlink.

Signed-off-by: Francois Beerten <fbeerten.git@colabti.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

tar: adjust Config.in comment dependency

Since commit 916b21a7fbf266f452b8dc4116133cc57fdad269 ("package/tar:
Depends on MMU"), BR2_PACKAGE_TAR depends on BR2_USE_MMU. However, the
Config.in comment does not take into account this dependency, an
inconsistency which is fixed by this commit.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnp18: bump to version 1.8.4

Replace LICENSE by COPYING, see:
https://github.com/mrjimenez/pupnp/commit/d3a04002e5e5220f88b43d979505bb3156532e83

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

boost: context needs thread if gcc < 6

Commit f3a483a81be43b0ff674400e11900605969f8f1c added -std=c++11 to
boost build if context is selected and gcc is at least 4.7 however it
has the side effect that cc-tool fails to find boost_system with the
following error if context and system is enabled with a gcc greater
than 6:

configure:16312: /home/dawncrow/buildroot-test/scripts/instance-0/output/host/bin/x86_64-linux-g++ -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -Os   -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -I/home/dawncrow/buildroot-test/scripts/instance-0/output/host/x86_64-buildroot-linux-musl/sysroot/usr/include  -L/home/dawncrow/buildroot-test/scripts/instance-0/output/host/x86_64-buildroot-linux-musl/sysroot/usr/lib conftest.o -lboost_system -latomic >&5
conftest.o: In function `boost::system::error_category::std_category::equivalent(int, std::error_condition const&) const':
conftest.cpp:(.text._ZNK5boost6system14error_category12std_category10equivalentEiRKSt15error_condition[_ZNK5boost6system14error_category12std_category10equivalentEiRKSt15error_condition]+0x37): undefined reference to `boost::system::detail::generic_category_instance'

This error is related to the fact that since boost 1.68 and commit
https://github.com/boostorg/system/commit/7b6dcf6ac668e24f11ec5dbc68d1fa0248d964df,
boost system headers are now C++14 "by default" with gcc above 6:
- https://github.com/boostorg/system/issues/24
- https://github.com/boostorg/system/issues/26
- https://lists.boost.org/Archives/boost/2018/08/242770.php

So when building with gcc > 6, cc-tool thinks that boost has
generic_category_instance but because boost was compiled with
std=c++11, this function will not be in the library causing a link error

Instead of "hacking" even more boost, just remove -std=c++11 from
boost.mk and select BOOST_THREAD with gcc lower than 6

Fixes:
 - http://autobuild.buildroot.org/results/fc8f8a64751c751b2b66301967cc008509bbaa70

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: Matt Weber <matthew.weber@rockwellcollins.com>
Reviewed-by: Ferdinand van Aartsen <ferdinand@ombud.nl>
Tested-by: Ferdinand van Aartsen <ferdinand@ombud.nl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

boot/xloader: remove package

U-boot has provided SPL support as a viable replacement for the
2nd stage bootloader on TI platforms.  The X-loader project
hasn't had a commit in the log since 12-05-2011.
(https://gitorious.org/x-loader/x-loader)

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/tidsp-binaries: remove package

The suit of TI OMAP3 dsp tools/libraries are being removed as the
upstream projects are no longer active.

Suggest using Buildroot 2018.02.x LTS if the feature is still
required.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dsp-tools: remove package

The suit of TI OMAP3 dsp tools/libraries are being removed as the
upstream projects are no longer active.

The dsp-tools package used the tidsp-binaries package.

Suggest using Buildroot 2018.02.x LTS if the feature is still
required.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gst-dsp: remove package

The suit of TI OMAP3 dsp tools/libraries are being removed as the
upstream projects are no longer active.

The gst-dsp package used the tidsp-binaries package.

Suggest using Buildroot 2018.02.x LTS if the feature is still
required.

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-pytz: bump to version 2018.6

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-dateutil: bump to version 2.7.4

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

brotli: update to version 1.0.7

The new version, among other changes, includes important fixes
for unaligned memory access on ARM (both for 32 and 64-bit), as well
as performance improvements and build fixes.

Patch "0001-Tell-CMake-to-not-check-for-a-C-compiler.patch" is not
needed due to the issue being fixed upstream, and therefore is removed.

Patch "0001-CMake-Allow-using-BUILD_SHARED_LIBS-to-choose-static.patch"
is rebased against the latest upstream changes.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

p11-kit: fix detection of certificates path

The p11-kit configure script looked for certificates location on the
host. This doesn't work well with cross compilation. Make the
certificates patch depend on BR2_PACKAGE_CA_CERTIFICATES, and set the
right target location of the path.

Fixes:
http://autobuild.buildroot.net/results/295/295614d4aa3db9bb35bebbe56e38110f5a2de178/
http://autobuild.buildroot.net/results/0fb/0fb454ca0df74a8585cffe8f5d1f5d23cdfdbec6/
http://autobuild.buildroot.net/results/ef7/ef71f3d67afba547b5167253fb02476e59152803/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dc3dd: fix build with glibc 2.28

gnulib code in dc3dd relied on internal glibc definitions that are no
longer visible with glibc 2.28. Add a patch based on upstream gnulib to
fix the build.

Fixes:
http://autobuild.buildroot.net/results/552/552b8e44fe6585f978e2fb7a920057a868cf6689/
http://autobuild.buildroot.net/results/00d/00d2bf5a4c97bea2ace0427c0bed57e11f9a5f9a/
http://autobuild.buildroot.net/results/17a/17a9246bfb034c531ec5e27e29d38857e58db271/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libostree: bump to version 2018.9

Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xserver_xorg-server: security bump to version 1.20.3

Fixes CVE-2018-14665:
https://lists.x.org/archives/xorg-announce/2018-October/002927.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website: update for 2018.02.7

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2018.02.7

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8c9284703c496b913d936689df72d49e095442e4)
[Peter: drop Makefile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website: update for 2018.08.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2018.08.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 507020139190aaf44793c3c901321d23ba476c13)
[Peter: drop Makefile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-perl: add per package upgrade target

If PKG_DISTNAME is defined, an addition pkg-upgrade target is created
that will run scancpan with the right parameters for re-generating the
package.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Arnout:
  - make it really private to pkg-perl;
  - factor away the host/target condition, instead use $(4) directly.
]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

perl-*: regenerate with _DISTNAME

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

scancpan: add PERL_FOO_DISTNAME in perl-foo.mk

This variable is needed for upgrading packages with scancpan.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

redis: needs dynamic library

dlfcn.h is included in src/debug.c and src/module.c
module.c uses dlopen function

Fixes:
 - http://autobuild.buildroot.org/results/fdda0ee7461dfc9ea479d4d80ab42c50006a3b13

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xdriver_xf86-video-r128: bump version to 6.12.0

Removed patches:
- 0001 not needed anymore after upstream commits
https://cgit.freedesktop.org/xorg/driver/xf86-video-r128/commit/?id=11b230ba61c00c69b23c5be592cf88492113355e
https://cgit.freedesktop.org/xorg/driver/xf86-video-r128/commit/?id=9d62b878ce40d9b5f7887c63a4e2498a52253c36

- 0002 was applied upstream
https://cgit.freedesktop.org/xorg/driver/xf86-video-r128/commit/?id=c4c878d2ccb75fa75afe46e0e50ee9975c5c57fc

Added license hash and all tarball hashes provided by upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pysmi: bump to version 0.3.2

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/apache: bump version to 2.4.37

Changelog: http://www.apache.org/dist/httpd/CHANGES_2.4.37
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libpqxx: bump version to 6.2.5

Removed patch applied upstream:
https://github.com/jtv/libpqxx/commit/44970d7331e4f369e160af0135a2d1fc16f27a21

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libva: bump version to 2.3.0

Removed patch 0001, applied upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-serial-asyncio: new package

asyncio extension package for pyserial

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-serial: update

we no longer need to remove aio.py since asyncio has been moved to python-serial-asyncio

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/live555: security bump to version 2018.10.17

Changelog: http://www.live555.com/liveMedia/public/changelog.txt

Fixes CVE-2018-4013:
https://security-tracker.debian.org/tracker/CVE-2018-4013

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

redis: bump to version 4.0.11

>From the release notes
(https://raw.githubusercontent.com/antirez/redis/4.0/00-RELEASENOTES):

Upgrade urgency HIGH: not critical but very important bugs fixed.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

core: support host gcc of the future

When we do a release, we know only of a set of gcc versions that the
host may have. But in the future, distributions with newer gcc versions
may show up.

Currently, we do not recognise those versions, and thus we do as if they
were older than the oldest we know of. This means that a set of packages
become unselectable, when they should be.

We fix that by capping the detected version to the highest we know of.

Reported-by: gargar_ on IRC
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/redis: Bump to version 4.0.10

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5base: Qt KMS support does not depend on opengl

Qt KMS support should not explicitly depend on the availability of opengl.
Don't explicitly disable KMS if opengl is not available and fallback to
detecting if libdrm is available before disabling kms.

The scenario where this is necessary involves using the Qt linuxfb backend
"dumb buffer" support via the DRM API.  This is new in Qt 5.9 [1] and only
requires KMS, but not opengl. Although on Qt 5.6, only eglfs actually
uses libdrm/kms, it doesn't hurt to add the dependency and the -kms
option there as well, and doing so keeps the logic in the .mk file
simple.

[1] http://doc.qt.io/qt-5/embedded-linux.html#linuxfb

Cc: Peter Seiderer <ps.report@gmx.net>
Cc: Julien Corjon <corjon.j@ecagroup.com>
Signed-off-by: Joshua Henderson <joshua.henderson@microchip.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/mariadb: add option to disable build of embedded server

Size of output/target/usr:

with embedded: 1,7G
without embedded: 648M

This config option saves space on the target if the embedded server
is not used by any other package:

https://mariadb.com/kb/en/library/embedded-mariadb-interface/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Tested-by: Ryan Coe <bluemrp9@gmail.com>
[Peter: make Config.in option depend on _MARIADB_SERVER]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5multimedia: add license info for examples fftreal library

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

qt5x11extras: fix license information

This commit fixes several problems with the license information of
qt5x11extras:

 - With the latest version update the legacy version files
   LICENSE.GPLv2 LICENSE.GPLv3 and LICENSE.LGPLv3 were removed, use
   the new ones LICENSE.GPL2 LICENSE.GPL3 and LICENSE.LGPL3 instead.

   Fixes:

   http://autobuild.buildroot.net/results/238bb74f23d7a11516eac088da3188d463abac5a

 - Hashes for some licenses files for the 5.6.3 version were missing.

As part of this, we switch to using per-version hash files entirely.

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package: linuxptp: enhance systemd service

linuxptp now pulls in the time-sync.target, which other services can
use to make sure they have a valid time before starting.

phc2sys (linuxptp-system-clock.service) starts after ptp4l
(linuxptp.service) so we have a valid time before writing it to the
hardware clock.

Signed-off-by: Petr Kulhavy <brain@jikos.cz>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

.gitlab-ci.yml: do runtime tests only on explicit trigger

When the runtime tests were first introduced, they still ran pretty
quickly. Nowadays, however, there are a lot of runtime tests, and some
of them take a really long time. So running them on every push is
really too much.

Just like we do for the defconfigs, run them on explicit trigger only.

The explicit trigger is now done every week, but it can be increased
to e.g. twice or three times per week.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Makefile: .gitlab-ci.yml: fail when listing tests fail

To update the .gitlab-ci.yml file, we run run-tests -l to list all the
tests and post-process the output in a format suitable for
.gitlab-ci.yml. However, in a pipeline, it is the last command that
gives the return value. In addition, we have to redirect stderr of
run-tests -l because nose2 prints the tests on stderr, not stdout. Thus,
when run-tests -l fails, the update of .gitlab-ci.yml silently succeeds
but no tests are included in the .gitlab-ci.yml.

To fix this, set the pipefail option. This is bash-specific, but our
Makefile ascertains that we are running with bash as the shell (if bash
is available, but if it is not, dependencies.sh will error out). The
error message is still invisible, but at least make will fail.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

openssh: bump to version 7.9p1

Drop patch #1. uClibc no longer includes pthreads.h indirectly.

Drop patch #2. The sys/param.h header is included indirectly through the
local includes.h header since version 6.8p1.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/binutils: remove binutils 2.27 patches

binutils 2.27 support was removed in commit
453d29f1f45736d0156071930a09015def68994a.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

utils/diffconfig: remove BR2_* prefix restriction

The utils/diffconfig script works only on variables with the BR2_
prefix. This is OK for Buildroot [def]configs since this is the prefix
for all user-facing variables, but it prevents using the same script
to compare configs from kconfig-based packages.

Remove the BR2_ restriction, allowing usage such as:

  ./utils/diffconfig \
board/qemu/xtensa-lx60/linux.config \
board/qemu/xtensa-lx60/linux-nommu.config

Signed-off-by: Marcel Patzlaff <m.patzlaff@pilz.de>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python3: use pure python UUID backend

Python3 at runtime identifies the uuid backend to use to implement safe
time-based UUID generation functions. When the python _uuid extension
module, /usr/lib/python3.7/lib-dynload/_uuid.cpython-37m-<arch>.so
is not found, the fall back is to use a pure python implementation.

 - If uuid.h from util-linux is available at build time, the _uuid
   module is built and used. A Buildroot patch allows us to disable this
   build-time check and never build the _uuid module.

With the bump to python 3.7, an optional dependency on util-linux was
added to build the _uuid module. However, this may lead to circular
dependencies. To break this circular dependency, we can disable the
build of the _uuid module and always use the pure python implementation.

Ref:
http://lists.busybox.net/pipermail/buildroot/2018-October/233113.html
http://lists.busybox.net/pipermail/buildroot/2018-September/231060.html
http://lists.busybox.net/pipermail/buildroot/2018-October/233079.html

CC: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Tested-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

core/legal-info: Add package dependencies with licenses to the manifest

This adds one column to the legal-info manifest table. It contains the
dependencies of the given package and their licenses. This information
is useful when assessing license compatibility of the packages and
their libraries.

An example of the content of the new column for the MPD package is
shown below:

    "alsa-lib [LGPL-2.1+ (library), GPL-2.0+ (aserver)] boost
    [BSL-1.0] libid3tag [GPL-2.0+] libmad [GPL-2.0+] libogg
    [BSD-3-Clause] libvorbis [BSD-3-Clause] libzlib [Zlib]
    skeleton-init-common [unknown] skeleton-init-sysv [unknown] sqlite
    [Public domain] toolchain-external-linaro-arm [unknown]"

[Credits to Yann E. MORIN <yann.morin.1998@free.fr> for suggesting a
few simplifications.]

Signed-off-by: Michal Sojka <sojka@merica.cz>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

core/legal-info: Change order of legal-manifest parameters

The last parameter {HOST|TARGET} is now first. With this change,
adding new columns to the legal manifest file (as in the next commit)
will be slightly easier to review.

Signed-off-by: Michal Sojka <sojka@merica.cz>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gvfs: enable keyring

Enable keyring if libsecret is available

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bluez5_utils: ensure build order with the headers-only variant

Since bluez5_utils and bluez5_utils-headers would install the same set
of files (headers), we want to ensure the former is run after the
latter.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Grzegorz Blach <grzegorz@blach.pl>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

linux: add custom linux boot logo option

This patch adds a simple way to change the linux bootup logo.
The patch was kept purposely simple to support only the use cause
where a user needs a color linux boot up logo.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Peter: clarify/reword option/help text, automatically enable framebuffer
support, fix convert path]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/imagemagick: add host package

This patch adds the host package for imagemagick.
It comes with a minimal selection of configure options to
compile fast cause it is used only to convert
the image files for the custom linux logo.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Peter: explicitly disable other configure options like it is done for the
target variant, add host-pkgconf]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mongoose: bump to version 6.13

For some reason, the hash of the Github-provided tarball for mongoose
6.7 has changed. The actual contents are the same between the old and
new tarballs, only the order of the files is changed.

However, changing the hash would break older Buildroot releases
(because sources.buildroot.net would pick up the tarball with the new
hash, and old Buildroot releases would no longer be able to pick up
the tarball with the old hash, neither from Github nor from the
Buildroot mirror).

So, we simply bump to a newer version of mongoose. This way, old
Buildroot releases will continue to fetch Mongoose 6.7 from the
Buildroot mirror, with the old hash matching. New Buildroot releases
will be using the new Mongoose version, with a correct hash that
allows to download from Github successfully.

The hash of the license file has changed, due to a change in the
copyright years.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mongoose: add hash for license file

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mongoose: add security patch fixing CVE-2018-10945

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

python3: add optional dependency on bluez5_utils-headers

When python3 depends on bluez5_utils-headers,
python3 is build with bluetooth support.

Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
[Arnout: select bluez5_utils-headers is bluez5_utils is enabled]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

bluez5_utils-headers: new package

Header files from bluez utils version 5.x.

Separated headers are required to break circular dependencies
when python3 is built with bluetooth support.

This is a blind option, it will be automatically selected by python3
when bluez5_utils is enabled.

Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
[Arnout: add comment to keep versions in sync; make it a blind option]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>