musl: add upstream security fix for CVE-2017-15650

>From the upstream announcement:
http://www.openwall.com/lists/oss-security/2017/10/19/5

Felix Wilhelm has discovered a flaw in the dns response parsing for
musl libc 1.1.16 that leads to overflow of a stack-based buffer.
Earlier versions are also affected.

When an application makes a request via getaddrinfo for both IPv4 and
IPv6 results (AF_UNSPEC), an attacker who controls or can spoof the
nameservers configured in resolv.conf can reply to both the A and AAAA
queries with A results. Since A records are smaller than AAAA records,
it's possible to fit more addresses than the precomputed bound, and a
buffer overflow occurs.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

board: Add Bananapi M1 support

Add initial support for bananapi M1 board with below features:
- U-Boot 2017.09
- Linux 4.13.7
- Default packages from buildroot

Cc: Jason <manager@sinovoip.com.cn>
Cc: hailymei@banana-pi.com <hailymei@banana-pi.com>
Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gst1-plugins-bad: fix patch 0001-openjpeg-Support-building-with-openjpeg-2.3-simpler.patch

The previous version was by mistake mixed up with the patch 'gst-plugins-bad:
openjpeg: Remove compatibility with openjpeg 2.0'

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

support/config-fragments/autobuild: add ARC glibc fragment

glibc is now supported for ARC so let's kick-start autobuilders
with glibc toolchain for ARC HS.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/go: fix cross-compilation settings

This patch fixes a bug with the BR2_TOOLCHAIN_HAS_THREADS variable
handling which causes CGO_ENABLED to be always 0.

Furthermore, it fixes the cross compilation options for the go
compiler: setting CGO_ENABLED should be done only for the target
compiler not the host one.

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Christian Stewart <christian@paral.in>

qt5base: make harfbuzz support selectable

If selected use:

 - system/buildroot harfbuzz in case __sync for 4 bytes is supported
 - qt harfbuzz otherwise (using QAtomic instead)

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

raspberrypi: post-image.sh fix gpu_mem option

The gpu_mem option is not using the proper option argument which causes sed to
fail.

+ case "${arg}" in
+ gpu_mem=ome/gportay/output-rpi3-qtwe/images
+ sed -e '/^ome/gportay/output-rpi3-qtwe/images=/s,=.*,=ome/gportay/output-rpi3-qtwe/images,' -i /home/gportay/output-rpi3-qtwe/images/rpi-firmware/config.txt
sed: -e expression #1, char 8: extra characters after command
+ case "${arg}" in
+ gpu_mem=ome/gportay/output-rpi3-qtwe/images
+ sed -e '/^ome/gportay/output-rpi3-qtwe/images=/s,=.*,=ome/gportay/output-rpi3-qtwe/images,' -i /home/gportay/output-rpi3-qtwe/images/rpi-firmware/config.txt
sed: -e expression #1, char 8: extra characters after command

The issue comes from the use of $1 instead of $arg to extract the gpu_mem
value. $1 is the $(BINARIES_DIR) which leads to a sed expression error.

Also, it adds the error flag to the shell script to prevent from such situation
and terminate the build in error.

Signed-off-by: Gaël PORTAY <gael.portay@savoirfairelinux.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

wine: Bump to version 2.0.3

Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-numpy: Add support of ARC architecture

This enables support for ARC cores in numpy.
Cherry-picked from
https://github.com/numpy/numpy/commit/8edd610ffa3499eea3580f98f296ec80578fba73

Hopefully becomes a part of the next major release (like 1.14).

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-numpy: Bump version to 1.13.3

This is just a bug-fix release.

Removing 0003-BUG-Ensure-_npy_scaled_cexp-f-l-is-defined-when-need.patch
as it is a part of the release.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openssl: add libressl as a provider

At this point, libressl can be added to the openssl virtual package.

- Remove the entry package/libressl/Config.in from package/Config.in
- Remove the file: package/libressl/Config.in
- Add libressl entry to package/openssl/Config.in

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

wpa_supplicant: supports only the real OpenSSL, not LibreSSL

wpa_supplicant will not build with LibreSSL without patches, so let's
support only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libevent: supports only the real OpenSSL, not LibreSSL

libevent will not build with LibreSSL without patches, so let's
support only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openldap: supports only the real OpenSSL, not LibreSSL

openldap will not build with LibreSSL without patches, so let's
support only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

opusfile: supports only the real OpenSSL, not LibreSSL

opusfile will not build with LibreSSL without patches, so let's
support only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mosquitto: supports only the real OpenSSL, not LibreSSL

mosquitto will not build with LibreSSL without patches, so let's
support only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

ffmpeg: supports only the real OpenSSL, not LibreSSL

ffmpeg will not build with LibreSSL without patches, so let's support
only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

hostapd: supports only the real OpenSSL, not LibreSSL

hostapd will not build with LibreSSL without patches, so let's support
only OpenSSL.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

softether: require libopenssl

softether tries to use SSLv3 functionality as a fallback. LibreSSL
doesn't support SSLv3 anymore. Two main issues prevent a patch:

- Trying to wrap the sslv3 functionality from the source with a guard
  clause results in linking errors after compiling is done.
- There are multiple security vulnerabilities with using sslv3.
- There are multiple security issues in github pertaining to using
  sslv3.
- This project seems to not be updated very often, and the security
  issues are being ignored it seems.

For people who still want to use softether, they will have to use
libopenssl.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

heirloom-mailx: add libressl support patch

heirloom-mailx has two small issues when compiling against LibreSSL:
  - RAND_egd is used (LibreSSL does not support RAND_egd)
    Solution: "Guard" the code calling RAND_egd

  - SSLv3_client_method function is used (LibreSSL does not support SSLv3)
    Solution: "Guard" the code with #ifndef OPENSSL_NO_SSL3

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openssl: introduce BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL

Some packages that use openssl are not compatible with libressl, only
with the real openssl (known as libopenssl in Buildroot). So before we
add libressl as a provider for the openssl virtual package, we
introduce a BR2_PACKAGE_OPENSSL_FORCE_LIBOPENSSL hidden option that
packages incompatible with LibreSSL will be able to select.

This will allow packages that need OpenSSL to continue using "select",
without having to change to using "depends on" dependencies.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openssl: new virtual package

To ease the transition to having both OpenSSL and LibreSSL, there has to be
a new virtual package introduced to handle both.

Instead of making a libssl, and adding OpenSSL and libressl to that package,
it will be far easier to move openssl to libopenssl and to make OpenSSL
a virtual package.  This offers a few advantages:

- BR2_PACKAGE_OPENSSL is still a visible symbol with no dependencies.
- It does not require a huge patch to convert every instance of
  OpenSSL -> libssl)
- Users will be able to update without ever having to select anything new.
- LibreSSL can be added at a later date to the virtual package.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
[Thomas: define BR2_PACKAGE_PROVIDES_HOST_OPENSSL to the value
"host-libopenssl" as we always want to use the original OpenSSL for
the host variant.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gst1-plugins-bad: fix openjpeg-2.3 compile failure

Add upstream patch [1], fixes [2]:

  In file included from gstopenjpegdec.h:29:0,
                   from gstopenjpegdec.c:27:
  gstopenjpeg.h:42:37: fatal error: openjpeg-2.2/openjpeg.h: No such file or directory
  #  include <openjpeg-2.2/openjpeg.h>

[1] https://cgit.freedesktop.org/gstreamer/gst-plugins-bad/commit/?id=bff2d834a4a38f64e555cee3d0144fde6c515acd
[2] http://autobuild.buildroot.net/results/884/884956af56f63b2634a1984f5ea416075ed87bc8

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/tvheadend: bump version

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xlib_libXfont: bump version to 1.5.3

Added all hashes provided by upstream.

Removed patches applied upstream:
https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?h=libXfont-1.5-branch&id=a2a5fa591762b430037e33f1df55b460550ab406
https://cgit.freedesktop.org/xorg/lib/libXfont/commit/?h=libXfont-1.5-branch&id=3b08934dca75e4c559db7d83797bc3d365c2a50a

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

support/testing: update ISO9660 test case Linux kernel

The Linux 4.0 kernel doesn't build with gcc 6.x, which is used since
the toolchain update in commit
193dfffa834a4cd76bc7b41089bd93d4c37dfc65 ("support/testing: use more
recent toolchains"). So let's update to Linux 4.11 instead (like the
existing Qemu x86 defconfig does), and update the kernel configuration
file accordingly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux: Deselect all unconfigured compression options

The LINUX_KCONFIG_FIXUP_CMDS are meant to deselect any compression
option that are not selected in the buildroot configuration. But it only
deselects the last one in the list instead of all of them because it
overwrites the LINUX_COMPRESSION_OPT_ variable instead of appending to
it. Only the last option set to that variable gets deselected.

This produces the warning:

.config:2216:warning: override: KERNEL_GZIP changes choice state

is emitted when buildroot runs olddefconfig when buildroot configures a
kernel with a custom config that has a different kernel compression
option set to what is configured in buildroot.

Accumulate all the deselected compression options instead of overwriting
them to ensure all non-selected options get deselected..

Signed-off-by: Cam Hutchison <camh@xdna.net>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/testing: use more recent toolchains

With the hard disk crash of autobuild.b.o, we lost old toolchains, so
use the latest toolchains, which have been restored.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

boost: add workaround patch for musl issue

musl has a bug in that <sched.h> defines CPU_ZERO(), which uses
memset(), but it doesn't have the prototype for it. This has been
fixed by upstream musl but until we rebuild our toolchains, let's have
a patch for Boost that works around this problem. We will of course
remove this patch once musl is updated to 1.1.17 and our toolchains
have been rebuilt.

Fixes:

  http://autobuild.buildroot.net/results/6884cff634367cb640940051a60e5e13f30f70a2/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Revert "zstd: install to staging directory"

This reverts commit 95c15aaf15f4bd5b1ebcf87d204ddf5a345197d5. It was
mistakenly pushed, and causes problems because it installs the shared
library to staging, but not to target.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest-game: new package

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add libspatialindex optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add leveldb optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add hiredis optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add postgresql optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: enable sound support

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add freetype optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add NLS optional dependency

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: add libcurl optional dependency

Curl support is strongly recommended for multiplayer game.

The build system warn when curl is disabled:
  cURL is required to load the server list
  cURL is required to announce to the server list

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/minetest: new package

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

zstd: install to staging directory

Install libzstd to the staging directory.

Signed-off-by: Chris Packham <judge.packham@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pppd: Add an option to not to overwrite /etc/resolv.conf

By default pppd built by buildroot writes the list of nameservers to
/etc/resolv.conf instead of /etc/ppp/resolv.conf
This is not the default behavior of pppd and breaks name resolution
if several network interfaces are used. The change makes this optional
and enabled by default, to be backward compatible and to add a possibility
to turn this behavior off, if required.

Signed-off-by: Maksim Salau <msalau@iotecha.com>
[Arnout: extend the help text to explain that it won't work on readonly
 rootfs]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

freerdp: bump to 2.0.0-rc0

Remove patches that has been merged/updated upstream

0001-fix-building-shared-libs.patch:
CmakeLists packages are rewritten.

0002-add-support-for-tz-package:
https://github.com/FreeRDP/FreeRDP/commit/dd93fd2b3de7bef3f4faebfe04448344a0a5ab88

0003-add-missing-define.patch:
https://github.com/FreeRDP/FreeRDP/commit/656b3be02d22a52957903e3c89660ffb0247307b

0004-ffmpeg30.patch:
https://github.com/FreeRDP/FreeRDP/commit/b7b66968f93f6ce75dd06d12638e14029bf3717b

Also add sha256sum for license file.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

boost: bump to 1.65.1, coroutine2 is now a header only library

The coroutine2 functionality is now provided only through headers, the
compiled library has disappeared. Due to that passing "coroutine2" as
argument to --without-libraries. Hence, the
BR2_PACKAGE_BOOST_COROUTINE2 option is removed by this commit.

We don't need Config.in.legacy handling, because coroutine2 support is
now unconditionally available in boost.

While at it, add LICENSE_1_0.txt sha256sum to boost.hash.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
[Thomas: drop Config.in.legacy handling, reword commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

softether: bump to v4.22-9634-beta

Also add a sha256sum for the license file.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

glibmm: bump required gcc version to 4.9

Fixes:

  http://autobuild.buildroot.net/results/052905b339c6aecc33e9b91d9cc658baeb51ed8f/

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
[Thomas: propagate to pulseview.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

webkitgtk: security bump to version 2.18.1

This is a maintenance release of the current stable WebKitGTK+ version,
which contains bugfixes (many of them related to rendering, plus one
important fix for touch input) and many security fixes.

Release notes:

    https://webkitgtk.org/2017/10/18/webkitgtk2.18.1-released.html

Fixes CVE-2017-7081, CVE-2017-7087, CVE-2017-7089, CVE-2017-7090,
CVE-2017-7091, CVE-2017-7092, CVE-2017-7093, CVE-2017-7094,
CVE-2017-7095, CVE-2017-7096, CVE-2017-7098, CVE-2017-7099,
CVE-2017-7100, CVE-2017-7102, CVE-2017-7104, CVE-2017-7107,
CVE-2017-7109, CVE-2017-7111, CVE-2017-7117, CVE-2017-7120,
CVE-2017-7142:

    https://webkitgtk.org/security/WSA-2017-0008.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

prosody: refactor with PROSODY_CONF_OPTS variable

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Thomas: keep TARGET_CONFIGURE_OPTS in the environment.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qemu: bump to 2.10.1

Also add sha256sums for license files.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: remove package/sepolgen/

The directory package/sepolgen/ was removed in commit 9d6da7a26
(policycoreutils: split packages and bump to 2.7), but two
entries were left in the DEVELOPERS file.

This causes the following warnings when running util/get-developers:
WARNING: 'package/sepolgen/' doesn't match any file
WARNING: 'package/sepolgen/' doesn't match any file

Remove the erroneous entries.

Signed-off-by: Cam Hutchison <camh@xdna.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qpdf: add missing dependency on jpeg

Fixes:

  configure: WARNING: unable to find required header jpeglib.h
  configure: WARNING: unable to find required library jpeg
  configure: error: some required prerequisites were not found

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Config.in: fix help comment for gcc optimization

The default for is set to BR2_OPTIMIZE_S, the help comment designated
BR2_OPTIMIZE_0 as default.
Changed the help comment to show that BR2_OPTIMIZE_S is the default.

Signed-off-by: Lothar Felten <lothar.felten@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libuv: bump to version 1.15.0

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

luvi: fetch uploaded release tarball

Upstream has finally released an uploaded tarball, which is prefered
over cloning the repository from github.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

setools: change sepol library directory

setools currently points the libsepol library directory to
$(STAGING_DIR)/lib/ when it should be $(STAGING_DIR)/usr/lib

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Tested-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5: bump LTS version to 5.6.3

qt5base:
  - move hash file to 5.6.3
  - move 0001-eglfs-rasp-pi-header-inclusion.patch to 5.6.3
  - remove 0002-eglfs-fix-eglfs_mali-compile-for-odroid-mali.patch (upstream committed [1])

qt5declarative:
  - move patches to 5.6.3

qt5quickcontrols2:
  - move hash file to 5.6.3

qt5webkit:
  - move patches to 5.6.3

[1] http://code.qt.io/cgit/qt/qtbase.git/commit/?h=5.6&id=f1b4bd4790860e1ff5afcec111a359bc3a91cfda

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/{mesa3d, mesa3d-headers}: bump version to 17.2.3

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.13.8

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 4.{1, 4, 9, 13}.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

policycoreutils: split packages and bump to 2.7

Policycoreutils was broken up into several packages, as such several
changes needed to happen for this patch to work:

- Remove patches 3, 4, and 5 as they no longer apply.
- Refresh patches 1 and 2 to work with version 2.7
- Remove semodule_${deps,expand,link,package} and sestatus from the makedirs
  in the mk file.
- Remove restorecond from the make and config file. (Seperate package)
- Remove Audit2allow from the make and config file. (In a different package)
- Remove the package sepolgen
- Add the package selinux-python
- Add the package restorecond
- Add the package semodule-utils
- Add the relevant Config.in.legacy options into the menu.

Because these are utilities that work on top of python, the older versions of
these utilites still work, and as such this should be a single patch.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

checkpolicy: bump to 2.7

Also remove patch, as it's in this release.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libsepol: bump to 2.7, setools: bump to 4.1.1

The reason for combining these patches is because the
old version of setools is not compatible iwth libsepol 2.7.  If a user where
to do a git pull on a patch that only updates libsepol or setools, the build
would fail to compile.

setools has been completely rewritten in python instead of C.

The current version of setools includes a few programs that require
python-qt5 or python-networkx to run, however the package does not
check to see if these exist when compiling, and will install the scripts
to the target directory even if they don't exist.

In the case of python-networkx, this package is not available on Buildroot.
The scripts that require them are: sedta and seinfoflow.
In the case of python-qt5, qpol is the script that requires it.

Some setools.mk notes to get the package to compile:

- Convert the package .mk to use python-package instead of autotools-package.

- setup.py hard codes base_lib_dirs to point to several host directories.
  To fix this, sed is used before compiling to point the base_lib_dirs to
  the staging directory.

- setup.py also includes the "Werror" flag, however compilers before gcc6
  cause a few autogenerated variables to not be initialized before use,
  causing the build to fail.
  To fix this, a patch is provided that removes the Werror flag.

- Remove sedta and seinfoflow from the target system after install.  These
  packages rely on the package python-networkx which is not available in
  buildroot.

- Remove the installed apol package and the setoolsgui directory from the
  target directory if python-qt5 is not selected.

Other changes:
- Removed all patches, as they are not compatible with the new version of
  setools.

- Add COPYING, COPYING.GPL, and COPYING.LGPL to setools.hash

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

wpa_supplicant: fix upstream URL

wpa_supplicant project URL has been changed to w1.fi/wpa_supplicant.
The old domain epitest.fi has expired.

Signed-off-by: Alexander Mukhin <alexander.i.mukhin@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

glibmm: bump to 2.54.1

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libglib2: bump to 2.54.1

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

powertop: needs autoreconf

Commit 01048deab60 (package/powertop: bump to version 2.9) removed
autoreconf even though the remaining patch touches Makefile.am. Fix
this.

Fixes:
http://autobuild.buildroot.net/results/3bf/3bf8daee559e2978f8602c56397afda771299032/
http://autobuild.buildroot.net/results/f9b/f9b4f113a333107a972fa51bd0347eeb0d52496f/
http://autobuild.buildroot.net/results/067/0675826888b6f89e76291c7835839344300ca9f5/

Cc: Romain Naour <romain.naour@gmail.com>
Cc: Steven Noonan <steven@uplinklabs.net>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

shared-mime-info: need autoreconf

0001-Remove-incorrect-dependency-from-install-data-hook.patch is
patching Makefile.am, so we need to autoreconf. If we don't do this,
we get build failures such as:

configure.ac:3: error: version mismatch.  This is Automake 1.15.1,
configure.ac:3: but the definition used by this AM_INIT_AUTOMAKE
configure.ac:3: comes from Automake 1.15.  You should recreate
configure.ac:3: aclocal.m4 with aclocal and run automake again.
WARNING: 'automake-1.15' is probably too old.
         You should only need it if you modified 'Makefile.am' or
         'configure.ac' or m4 files included by 'configure.ac'.

Fixes:

  http://autobuild.buildroot.net/results/440c9edd34d56d9207b9f1ee326a14a1c757b27d/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/openjpeg: bump version to 2.3.0

Removed patch 0003, applied upstream:
https://github.com/uclouvain/openjpeg/commit/51a1dcaa6ed5713520dca36fc58cd9240c08b7ca

Renamed patch 0004.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Acked-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

sngrep: bump to v1.4.4

Also add LICENSE sha256 hash.

Signed-off-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

manual: clarify license file hash check during legal-info target

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libsemanage: bump to 2.7

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libselinux: bump to 2.7

remove patch as it's in this release.

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5: bump latest version to 5.9.2

qt5base:
  - removed 0001-Fix-error-attribute-target-crc-is-unknown.patch
    (upstream committed, see [1])
  - removed 0002-examples-fix-compile-without-opengl-support.patch
    (upstream committed, see [2])

qt5declarative:
  - removed 0001-Fix-alignment-issue-on-ARMv7.patch
    (upstream committed, see [3])
  - moved 0001-examples-photoviewer-needs-widgets-support.patch to 5.6.2
    only (upstream 5.9.2 committed, see [4])
  - moved 0002-examples-qquickviewcomparison-and-quickwidget-needs-.patch
    to 5.6.2 only (similare patch upstream committed, see [5])

qt5location:
  - removed 0001-Fix-plugins-build-dependency.patch
    (upstream committed, see [6])

qt5webchannel:
 - fix webchannel.js installation to target (the locatinon of the
   file webchannel.js changed from src/webchannel/qwebchannel.js
   to examples/webchannel/shared/qwebchannel.js, see commit [7])

qt5webengine:
  - removed 0001-Always-compile-QWebEnginePage-print.patch
    (upstream committed, see [8])
  - keep 0002-Load-libEGL-and-libGLES2-symbols-implicitly.patch
    (upstream committed, see [9], but reverted afterwards, see [10])

qt5webkit:
 - fall back to 5.9.1 (no 5.9.2 package provided, see [11] and [12]).

[1] http://code.qt.io/cgit/qt/qtbase.git/commit/?id=b7722c251c3a0938c7c71fc3da47fdbe920060b7
[2] http://code.qt.io/cgit/qt/qtbase.git/commit/?id=6ce4b680cdde7827a6ed4d00dbeb7e7e91569433
[3] http://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=03c2661b1243cc529fc3d8cfa65073f1da420307
[4] http://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=452a78d0ac4a1579733a8ab641be24c9b7c0dd96
[5] http://code.qt.io/cgit/qt/qtdeclarative.git/commit/?id=fa52bb665d6beb77a951c14c8edcba3541850afc
[6] http://code.qt.io/cgit/qt/qtlocation.git/commit/?id=3ac051c4549575634cecc706175b019f4ed4c3bf
[7] https://code.qt.io/cgit/qt/qtwebchannel.git/commit/?id=e7f150abaa8e81d3e404e9631a49341a7f7623d1
[8] http://code.qt.io/cgit/qt/qtwebengine.git/commit/?id=085c2c529473bbe9dd7c8c5698a45053520cc423
[9] http://code.qt.io/cgit/qt/qtwebengine.git/commit/?id=d4c621f6a6b87f2a86069fa393b9f7c4f9e7b9ad
[10] http://code.qt.io/cgit/qt/qtwebengine.git/commit/?id=c11c2c8981e647c1eb2c6753ce77d436b92fff87
[11] https://blog.qt.io/blog/2017/10/06/qt-5-9-2-released/#comment-1200724
[12] https://blog.qt.io/blog/2017/10/06/qt-5-9-2-released/#comment-1200746

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Tested-by: Joshua Henderson <joshua.henderson@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5: add license file hashes for all submodules

Signed-off-by: Joshua Henderson <joshua.henderson@microchip.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
----
Changes v2 --> v3:
  - use 'Hashes for license files:' instead of repeated
    'Hash for license file' (suggested by Thomas Petazzoni)

Changes v2:
  - add reviewed-by and minor commit title change (removed package prefix)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

hplip: bump version to 3.17.10

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

cups: bump version to 2.2.5

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qpdf: bump version to 7.0.0

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/gcc: bump to 5.5.0

Remove xtensa patches included in this release:
872-xtensa-use-unwind-dw2-fde-dip-instead-of-unwind-dw2-.patch
873-xtensa-fix-_Unwind_GetCFA.patch
876-xtensa-Fix-PR-target-78603.patch
877-xtensa-fix-PR-target-82181.patch

Remove upstream patch:
942-asan-fix-missing-include-signal-h.patch

Remove backported patches for glibc >= 2.26
943-Use-ucontext_t-not-struct-ucontext-in-linux-unwind.h.patch
944-sanitizer-linux.patch

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ghostscript: bump version to 9.22

Remove patches that has been merged/updated upstream

0002-Host-tool-mkromfs_1-needs-libz.patch
-> http://git.ghostscript.com/?p=ghostpdl.git;a=commit;h=284f5fe121d8eb0a0f50a6f2465ee2f99a061018
0003-Bug-697799-have-.eqproc-check-its-parameters.patch
-> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=4f83478c88c2e05d6e8d79ca4557eb039354d2f3
   http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=57f20719e1cfaea77b67cb26e26de7fe4d7f9b2e
   http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad
0004-Bug-697799-have-.rsdparams-check-its-parameters
-> http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=04b37bbce174eed24edec7ad5b920eb93db4d47d
   http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=ccfd2c75ac9be4cbd369e4cbdd40ba11a0c7bdad

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

logrotate: bump version to 3.13.0

Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

msgpack: fix static build

Disabled shared libraries when building static only.

Fixes:
http://autobuild.buildroot.net/results/057/057d72bc84c467973ec3c076f5d8108e02d6e283/
http://autobuild.buildroot.net/results/499/499069f6821ddd2dcb83201b017a58eae00ebe16/
http://autobuild.buildroot.net/results/499/499069f6821ddd2dcb83201b017a58eae00ebe16/

Cc: Simon Dawson <spdawson@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

msgpack: fix build without threads support

Some example code depends on pthreads, and we generally don't build
examples in Buildroot, so disable their build.

Fixes:
http://autobuild.buildroot.net/results/f5d/f5d493dbe65cbe58d0924176efbd12e4a078f3ee/
http://autobuild.buildroot.net/results/813/81387649d9dbdfe4ccba9c7d0885aa8bd5239938/
http://autobuild.buildroot.net/results/9d4/9d486fca93136bb9dbf22c9101186d9d1fc0eb66/

Cc: Simon Dawson <spdawson@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
[Thomas: completely disable examples.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: remove myself

I'm no longer actively participating.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libglib2: needs autoreconf

Patch 0002-disable-tests.patch modifies Makefile.am, so we have to
autoreconf. It hasn't been seen until now, but becomes very clear
since the bump of automake to 1.15.1, as we're seeing build failures
such as:

configure.ac:66: error: version mismatch.  This is Automake 1.15.1,
configure.ac:66: but the definition used by this AM_INIT_AUTOMAKE
configure.ac:66: comes from Automake 1.15.  You should recreate
configure.ac:66: aclocal.m4 with aclocal and run automake again.

Fixes:

  http://autobuild.buildroot.net/results/3402357d8e90f1866dfeaee7bb61119d80dc8bcb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

hostapd: add upstream security fixes

Fixes CVE-2017-13082

http://lists.infradead.org/pipermail/hostap/2017-October/037989.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wpa_supplicant: add upstream security fixes

Fixes CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081,
CVE-2017-13087, CVE-2017-13088:

http://lists.infradead.org/pipermail/hostap/2017-October/037989.html

[Peter: also add patch 0001 as suggested by Jörg Krause]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ipset: fix musl build

Add upstream patch removing use of non-standard u_int8_t type.

Fixes:
http://autobuild.buildroot.net/results/126/126c97db87cd3bdc6d222982a53d871387cc9b50/
http://autobuild.buildroot.net/results/22d/22dcb72e75d1844828ba344f5ed126de06d2ab82/
http://autobuild.buildroot.net/results/b56/b56a6e3b5036c10f2f2b74e36c130d751b2c1312/

Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/automake: bump version to 1.15.1

Removed patch applied upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux-headers: bump 4.13.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.13.7

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

bzip2: fix passing of TARGET_MAKE_ENV to make

TARGET_MAKE_ENV is not passed to make because it is on a different
line without a backslash.

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux-headers: bump 3.2.x and 4.{4, 9, 13}.x series

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux: bump default to version 4.13.6

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libnss: security bump to version 3.33

Fixes CVE-2017-7805 - Martin Thomson discovered that nss, the Mozilla
Network Security Service library, is prone to a use-after-free vulnerability
in the TLS 1.2 implementation when handshake hashes are generated.  A remote
attacker can take advantage of this flaw to cause an application using the
nss library to crash, resulting in a denial of service, or potentially to
execute arbitrary code.

Also add a hash for the license file while we're at it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libnspr: bump version to 4.17

libnss 3.33 needs libnspr >= 4.17.

Also add a hash for the license file while we're at it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libpjsip: bump to 2.7

Signed-off-by: Adam Duskett <Adamduskett@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xserver_xorg-server: security bump version to 1.19.5

Fixes

xfixes: unvalidated lengths (CVE-2017-12183)

Xi: fix wrong extra length check in ProcXIChangeHierarchy
 (CVE-2017-12178)

dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
 (CVE-2017-12177)

Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libdrm: bump version to 2.4.84

Changed _SITE to https.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xlib_libXres: bump version to 1.2.0

Added all hashes provided by upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xlib_libXfont2: bump version to 2.0.2

Removed patches applied upstream, added all upstream hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>