configs/warp7: Bump to mainline kernel 4.9

Use mainline 4.9 instead of a custom kernel based on NXP 4.1.

As mx7 boots in non-secure mode in mainline kernel, change the
U-Boot target to "warp7".

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: Add entry for udoo_neo and wandboard

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libsigrokdecode: bump to version 0.4.1

For details, see:
https://www.sigrok.org/blog/libsigrokdecode-041-released

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cryptopp: add upstream security fix for CVE-2016-9939

Fixes security issue (DoS) in Crypto++ ASN1 decoder:

https://github.com/weidai11/cryptopp/issues/346

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

fs/tar: make --no-recursion effective

The tar --no-recursion option is position sensitive. It only affects following
file listing options. Move --no-recursion before the -T option to make it
effective. This fixes duplication of entries in the generated rootfs.tar
archive.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: remove perl-db-file

Package perl-db-file was removed today:
https://git.buildroot.net/buildroot/commit/?id=8546ff31c58b2501a69e49bc0f27a4ffa1d2ae08

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

toolchain-external: bump CodeSourcery NIOSII to 2016.11

Keep BR2_TOOLCHAIN_HAS_BINUTILS_BUG_19405 since it's not fixed in
Binutils 2.26.

Runtime tested with an experimental version of Qemu 2.7 for Nios2.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/znc: bump version to 1.6.4

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 3.18.x and 4.1.x series

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/dependencies: ensure we have 'file' on the host

Recently, the autoconf macros for libtool started using '/usr/bin/file'
to determine the type of library that is generated by the toolchain.
Packages that use this recent version of the libtool autoconf macros
will fail in a rather dramatic way when /usr/bin/file is not present
on the host: the package will still build but no shared library is
generated, which in turn may cause build failures in other packages
that link with it.

For example, libpng's configure determines that it is not possible to
build a shared library on MIPS64 because the expected output from 'file'
is not present. Therefore, only a static libpng.a is built. Later,
bandwithd links with -lpng but it doesn't use the pkg-config's
Private-Libs (because it's not linking statically) and it doesn't have
access to the NEEDED reference from the shared library. Therefore, it
doesn't link with zlib and fails with

    pngrutil.c:(.text+0x55c): undefined reference to `inflate'

We cant use host-file because it is itself an autotools package and is
itself using libtool, so this would be a chicken-n-egg problem. Besides,
the libtool script really wants to call /usr/bin/file, so it would not
even find our host-file anyway.

So, just require that '/usr/bin/file' is present on the host.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/vdr: bump version to 2.3.2

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

perl-db-file: remove this package

The module DB_File (Berkeley DB wrapper) is a Perl core module.
Long time ago, its build as a core module was broken.
Since perl-cross-1.0.2, this issue is fixed.
So, this package which build DB_File as CPAN module, becomes useless.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/sdl2: fix build with gcc6

Fixes
http://autobuild.buildroot.net/results/b99/b997c2b6307deb48a42e9b317715a00b65f90149/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Tested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/sdl2: fix build error on powerpc/powerpc64

Fixes
http://autobuild.buildroot.net/results/ffd/ffd689f1ba34ad43f52c38fe37da393a9d8b9d5e/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Tested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

stunnel: fix static link

zlib is a dependency of OpenSSL. Take that into account when linking
statically.

Fixes:
http://autobuild.buildroot.net/results/dfe/dfe7c82c7976912378e33e03ea4c677bee6a778d/
http://autobuild.buildroot.net/results/48c/48cb55428613e91abfe8e71456182082d9eabb75/
http://autobuild.buildroot.net/results/810/81029efad8b9e2f48c26a7b20f62c90844fc86df/

and many more.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uclibc: update to 1.0.21

Remove all patches as they are upstream.
Remove MALLOC_GLIBC_COMPAT and UCLIBC_HAS_OBSTACK as they got removed.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

busybox: fix modutils compile

Do not use syscall wrappers from uClibc.

Patch submitted upstream:
http://lists.busybox.net/pipermail/busybox/2016-December/085031.html

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lighttpd: bump to version 1.4.44

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

exim: security bump to 4.87.1

No features are added or removed. This release contains
just a fix for CVE-2016-9963

    - Fix CVE-2016-9963 - Info leak from DKIM.  When signing DKIM, if
      either LMTP or PRDR was used for delivery, the key could appear in
      logs.  Additionally, if the experimental feature "DSN_INFO" was used,
      it could appear in DSN messages (and be sent offsite).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: fix option passed to the snmp dependency

--with-libnetsnmp doesn't take a path to the netsnmp config script,
but to the sysroot where netsnmp can be found.

Fixes:

  http://autobuild.buildroot.org/results/358e2f02f42e08fe362ecd46e636c0048e77c21f/

Signed-off-by: Jack Kao <jackzzjack@gmail.com>
[Thomas: path is $(STAGING_DIR)/usr, not $(STAGING_DIR)/usr/include.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

putty: don't treat warnings as errors

Fixes:
http://autobuild.buildroot.net/results/652/65246fe6357cd3cd8490bc54baa2394730dcef79/
http://autobuild.buildroot.net/results/853/85320f3b8e770bbfbec306685ad75b66e91bd6ee/
http://autobuild.buildroot.net/results/492/492a7055408ed6b388982cece41e98d956ef85f8/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bullet: bump to version 2.85.1

http://bulletphysics.org/wordpress/?p=456

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docker-engine: fix docker version output

At compile-time the docker build scripts generate a version file used
to build the output of the docker version command. This file is
generated somewhat properly by the Buildroot build system, however the
version number and commit ID are incorrectly formatted. This patch fixes
the output to the correct format.

This is important as some tools like WeaveWorks won't even start unless
they can parse the Docker Version output correctly.

[Peter: strip v from version using patsusbt]
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add write_prometheus plugin support

Add explicit support for the write_prometheus plugin, it requires the
libmicrohttpd and protobuf-c libraries.

[Peter: add note about where dependencies come from]
Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add gps plugin support

Add explicit support for the gps plugin that uses libgps from the gpsd
package.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: explicitly disable intel_rdt plugin

It requires the libpqos library which buildroot doesn't provide yet.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: explicitly disable dpdkstat plugin

It requires the libdpdk library which buildroot doesn't provide yet.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add hugepages plugin support

Add explicit support for the new hugepages dependency-less plugin.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: explicitly disable grpc plugin

It requires the libgrpc++ library which buildroot doesn't provide yet.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add mqtt plugin support

Add explicit support for the mqtt (mosquitto) plugin.
Place it under the write category even though it can read as well, since
it will normally be used to write (publish) rather than read
(subscribe).

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add cpusleep plugin support

Add explicit support for the new cpusleep dependency-less plugin.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add chrony plugin support

Add explicit support for the new chrony dependency-less plugin.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: explicitly disable xencpu plugin

It requires the libxenctrl library which buildroot doesn't provide yet.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: explicitly disable zone plugin

It's intended for solaris so no usage case for buildroot.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: drop notify_email global disable

It's a no-op since it's disabled/enabled by the config knob.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: add notify_nagios plugin support

Add explicit support for the new notify_nagios dependency-less plugin.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: bump to version 5.7.0

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libcurl: security bump to 7.52.1

Fixes CVE-2016-9594 - Unitilized random

Libcurl's (new) internal function that returns a good 32bit random value was
implemented poorly and overwrote the pointer instead of writing the value
into the buffer the pointer pointed to.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

armadeus_apf9328_defconfig: bump kernel to 3.18.29

Which includes the gcc5+ fix for ftrace:

commit aeea3592a13bf12861943e44fc48f1f270941f8d
Author: Behan Webster <behanw@converseincode.com>
Date:   Wed Sep 24 01:06:46 2014 +0100

    ARM: 8158/1: LLVMLinux: use static inline in ARM ftrace.h

    With compilers which follow the C99 standard (like modern versions of gcc and
    clang), "extern inline" does the wrong thing (emits code for an externally
    linkable version of the inline function). In this case using static inline
    and removing the NULL version of return_address in return_address.c does
    the right thing.

Signed-off-by: Behan Webster <behanw@converseincode.com>
Reviewed-by: Mark Charlebois <charlebm@gmail.com>
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Otherwise, the build dies with:

arch/arm/kernel/return_address.c:66:7: error: redefinition of ‘return_address’
 void *return_address(unsigned int level)
       ^
In file included from include/linux/ftrace.h:20:0,
                 from arch/arm/kernel/return_address.c:12:
./arch/arm/include/asm/ftrace.h:48:21: note: previous definition of ‘return_address’ was here
 extern inline void *return_address(unsigned int level)
                     ^

For more details, see:
https://travis-ci.org/buildroot/buildroot-defconfig-testing/jobs/185616889

notice: Only build tested as I don't have the hw, which is also why the
kernel is only bumped to 3.18 to make it as safe as possible.

CC: Julien Boibessot <julien.boibessot@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

util-linux: fix ncurses/wchar handling

Since commit 006a328ad6bed214ec3c4d92120510ea37329dd1 ("util-linux: fix
build with ncurses"), we have a build failure that occurs with musl
toolchains when wide-char support is not enabled in ncurses.

The problem comes from the fact that musl provides wchar support (so it
defines wchar_t). But when ncursesw is not available, we currently pass
--disable-widechar which tells util-linux that wchar support is not
available at all (not only in ncurses). When this gets passed to
util-linux configure script, then it defines its own wchar_t, which
conflicts with the musl definition.

So, we should not pass --disable-widechar when BR2_USE_WCHAR=y, which is
what this commit does: it moves the BR2_USE_WCHAR logic outside of the
ncurses logic, and passes --enable-widechar/--disable-widechar as
appropriate.

However, there's a gotcha: util-linux really wants the ncursesw variant
of ncurses when the system has wchar support enabled. We take this into
account by:

 - Enabling ncursesw when BR2_PACKAGE_NCURSES_WCHAR=y. In this case, we
   have ncurses and we have BR2_USE_WCHAR=y, so everything is fine.

 - Otherwise, enabling ncurses when BR2_PACKAGE_NCURSES=y but
   BR2_USE_WCHAR is disabled.

To make sure that the existing util-linux programs that need ncurses
support still build fine, we adjust the Config.in to select
BR2_PACKAGE_NCURSES_WCHAR on BR2_USE_WCHAR=y configurations.

Fixes:

  http://autobuild.buildroot.net/results/19de2a0b12380ddc86dbba0dae3a3877b25f83ff/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

kexec: bump to 2.0.14

Patch 0002-arm-add-phys_to_virt.h-and-iomem.patch is now obsolete as
it's been properly fixed upstream now.

Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-lxml: bump to version 3.7.0

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

xfsprogs: disable on musl

Despite a recent bump, xfsprogs still doesn't build on musl. It's been
failing for a long long time, so let's disable it in this configuration.

Fixes:

  http://autobuild.buildroot.net/results/c6cd42da1abe2936872da1f9db093ffc72be3c15/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

util-linux: attempt to fix host-util-linux build

Should fix:

  http://autobuild.buildroot.net/results/65595aa787498087a9a85c9cd19135396b246afb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: add Eric Le Bihan for package/skalibs/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

skalibs: new package

This new package provides skalibs, a collection of free software / open
source C development files used for building all softwares from
skarnet.org.

Note that, though skalibs (and all skarnet softwares) follows the
"./configure; make; make install" convention, it does not behave like a
traditional autotools project:

 - static libraries are installed in $prefix/usr/lib/skalibs.
 - pkg-config and libtool are not used: instead a custom system called
   "sysdeps" is used and locations to libraries and headers are to be
   passed explicitly via options of the './configure' script.

The host variant is provided to allow building the host variants of the
other skarnet softwares.

Signed-off-by: Eric Le Bihan <eric.le.bihan.dev@free.fr>
[Thomas: remove post install target hook, do it directly in the target
installation commands.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

util-linux: fix build with ncurses

util-linux version 2.29 changed ncurses handling a lot. pkg-config
support to detect ncurses is removed from configure.ac and
ncurses-config is used to detect it. But it even didn't allow to
change config file for cross compilation. However, it is fixed in
upstream later and pkg-config support is added back.

This commit adds two patches from upstream that adds pkg-config support
and allows specifying ncurses-config file as well. However preference is
first given to pkg-config and later ncurses-config file. It also first checks
for version 6 and later 5.

Config option that changed are, ncursesw is enabled by default and ncurses
is disabled by default. So we need to explicilty specify with/without wide
char support now. This new version also allows disabling widechar support.
But it can't be enabled if ncurses without widechar support is enabled.

While building ncurses package, we explicitly enable pkg-config support,
so we don't need to specify ncurses-config file, but it is specified for
completeness.

Fixes:
  http://autobuild.buildroot.net/results/4a2/4a25fb0d4546391d5dbbaa6cde17c45aeddb3549

Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com>
Cc: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docker-engine: bump version to v1.12.5

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docker-containerd: bump version to v0.2.5

Version bump as a dependency of Docker-Engine v1.12.5.

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

olimex_a20_olinuxino_lime2_defconfig: correct u-boot configuration

This defconfig currently doesn't build:
https://travis-ci.org/buildroot/buildroot-defconfig-testing/jobs/185616951

As u-boot needs dtc, so add that and change to kconfig mode like on our
other allwinner defconfigs as that is in fact what is used.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

iproute2: bump to version 4.9.0

Add the libc-compat.h musl workaround patch to the copy of the kernel header.

Add a patch adding missing limits.h for musl.

Drop 0001-Avoid-in6_addr-redefinition.patch; not needed after the
libc-compat.h patch.

Drop upstream 0003-iproute2-tc_bpf.c-fix-building-with-musl-libc..patch.

Drop 0004-iproute-no-iptables.patch; should be fixed by upstream commit
4710e46ec3 (tc, ipt: don't enforce iproute2 dependency on iptables-devel).

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

iperf3: bump to version 3.1.4

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nodejs: bump to version 6.9.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

alsa-utils: bump to version 1.1.3

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

alsa-lib: bump to version 1.1.3

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/google-breakpad: really fix the C++11 dependency

The C++11 build issue is still here since the C++11 is not complete in
gcc 4.7 [1]. So disable Google-breakpad for toolchains based on
gcc <= 4.7.

[1] https://gcc.gnu.org/gcc-4.7/cxx0x_status.html

Fixes:
http://autobuild.buildroot.net/results/c5e/c5e629f26bf6da369dff1e4588c16d2773173e9f

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnp: bump to version 1.6.21

Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/sdl2: bump version to 2.0.5

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python: security bump version to 2.7.13

Rebased patches 004 & 010.

Changelog:
https://hg.python.org/cpython/raw-file/v2.7.13/Misc/NEWS

Fixes CVE-2016-2183 & CVE-2016-1000110.

This bump also fixes the host build with openssl 1.1.0,
http://patchwork.ozlabs.org/patch/696139/ is not needed anymore.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/util-linux: bump version to 2.29

Removed patch applied upstream:
http://git.kernel.org/cgit/utils/util-linux/util-linux.git/commit/?id=7f0d4d56a2f1ed34c3da4501e65fb79497b3dda1

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libcdio: bump version to 0.94

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/apache: security bump version to 2.4.25

Changelog:
http://www.apache.org/dist/httpd/CHANGES_2.4.25

Fixes CVE-2016-8740, CVE-2016-5387, CVE-2016-2161, CVE-2016-0736,
CVE-2016-8743.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wine: Bump to version 1.8.6

Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lzlib: depends on lua

It's missing the dependency on lua, hence when using the upcoming PPS
support its staging directory isn't populated with the required
dependencies resulting in build failure.

Signed-off-by: Gustavo Zacarias <gustavo.zacarias@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

runc: pass -extldflags '-static' in correct variable

commit 9101ce5800 (runc: pass -extldflags '-static' on when
BR2_STATIC_LIBS=y) contained a small copy/paste error, FLANNEL_GLDFLAGS was
used instead of RUNC_GLDFLAGS.

[Peter: refer to exact commit]
Signed-off-by: Fabrice Fontaine <fabrice.fontaine@orange.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libcurl: security bump to 7.52.0

Fixes CVE-2016-9586 - printf floating point buffer overflow

For details, see:
https://curl.haxx.se/docs/adv_20161221A.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gcc: bump 6.x series to version 6.3.0

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/monit: security bump to version 5.20.0

Fixes CVE-2016-7067.

Note that since version 5.20.0 monit optionally depends on zlib.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nftables: bump to version 0.7

And fix small CONF_OPTS assignment snafu.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libnftnl: bump to version 1.0.7

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nmap: bump to version 7.40

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sudo: bump to version 1.8.19p1

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uclibc: add patch to fix <stdlib.h>

This commit adds a patch to <stdlib.h>, to fix a bug introduced in
uClibc-ng 1.0.20, and which was causing build failures for at least one
package in Buildroot: freeswitch.

Fixes:

  http://autobuild.buildroot.net/results/12c246b058224f68494b84355a29dc4efb85df6d/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-bottle: security bump to 0.12.11

"\r\n" sequences were not properly filtered when handling redirections.
This allowed an attacker to perform CRLF attacks such as HTTP header
injection:

https://github.com/bottlepy/bottle/issues/913

Python-bottle now uses setuptools instead of distutils.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mimic: indentation cleanup

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mimic: needs wchar support

Fixes:
http://autobuild.buildroot.net/results/9f7/9f7c1af4b9fd8331672c9096821db91d5f7f3aa1/
http://autobuild.buildroot.net/results/47f/47f5ec3fabefd85e62b675142bd6728904acd5d8/

At the same time fixup space/tabs for 'help' option.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tor: security bump to 0.2.8.12

Fixes CVE-2016-1254 - One byte past an allocated buffer read while parsing
hidden service descriptors:

https://blog.torproject.org/blog/tor-02812-released

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

busybox: adjust nommu swaponoff handling for busybox 1.26.0+

Fixes:
http://autobuild.buildroot.net/results/dfe/dfec2c0626ab087325fd869bcbe0b9dc354d788c/

Busybox 1.26.0 gained separate config options for swapon / swapoff:

commit f417ffd88f194bbfd18605882ee242190c1bab34
Author: Denys Vlasenko <vda.linux@googlemail.com>
Date:   Mon Nov 14 17:30:50 2016 +0100

    Make swapon and swapoff individually selectable.

    For example, without swapoff, code shrinks by 277 bytes.

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
So adjust busybox.config and the logic to disable these applets for nommu
builds for the new names.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pure-ftpd: Added pure-ftpwho config option

Added the pure-ftpwho config option. When selected, the --with-ftpwho
compiler option is passed which enabled the pure-ftpwho command.

Signed-off-by: Bryce Ferguson <bryce.ferguson@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gdk-pixbuf: security bump to version 2.36.2

Fixes:
* Fix a NULL pointer dereference (#776026)
* Fix a memory leak (#776020)
* Avoid a buffer overrun in the qtif loader ($#775648)
* Fix a crash in the bmp loader (#775242)
* Fix crash opening pnm images with large dimensions (#775232)
* Prevent buffer overflow in the pixdata loader (#775693)

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: kill 3.14.x and 4.{5, 6, 7}.x series

These aren't supported upstream any more so remove the options and add
them to legacy.
Also switch the older deprecations that used 3.14.x to 3.12.x

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

can-utils: bump version

This version bump also fixes:
http://autobuild.buildroot.net/results/0e5/0e5242376ff6aa82e89ed1172350e05009d48156

Signed-off-by: Rahul Bedarkar <rahul.bedarkar@imgtec.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-paramiko: bump to version 2.1.1

Replace wrong runtime dependencies with python-pyasn and
python-cryptography.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-cryptography: bump to version 1.7.1

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sudo: bump to version 1.8.19

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

busybox: bump to version 1.26.0

Drop upstream patch.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: cleanup dead custom-local option

The option `BR2_LINUX_KERNEL_CUSTOM_LOCAL` no longer exists (see commit
e782cd5b1bc231dda527d5d0a04e6a338669b92c [1]); removing the option. Note
that this legacy option has already been handled (Config.in.legacy) in
the mentioned commit.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: cleanup dead custom-local option

The option `BR2_LINUX_KERNEL_CUSTOM_LOCAL` no longer exists (see commit
e782cd5b1bc231dda527d5d0a04e6a338669b92c [1]); removing the option. Note
that this legacy option has already been handled (Config.in.legacy) in
the mentioned commit.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rsyslog: enable journal plugins when using systemd

The rsyslog package provides input and output plugins for journald which
are disabled by default. The following adds the option to include
`imjournal` and `omjournal` modules when building for a systemd target.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rsyslog: remove non-existent enable/disable systemd options

The configuration flags `--enable-systemd` and `--disable-systemd` do
not exist in rsyslog (and may have never existed; most likely copy-paste
from other packages which have said options); removing the options.

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: add entry for rpm

Signed-off-by: James Knight <james.knight@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uboot: fix custom patch dir legacy handling

Commit 3e3fef39e71ed0426130b36aa00e4630ebb537ae added new and improved
patch handling, with BR2_TARGET_UBOOT_PATCH.  This was in addition to
the existing BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR option, that only
handled directories.

Later, commit 21b25d28fc7af3bb1b2c55e4a46e0d067ebc0081 moved the old
BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR to legacy options.  But on the way,
bad things happened:

* The original option was a string, while the one added to Config.in.legacy
is a bool.  This results in a warning from defconfigs that actually define
the old BR2_TARGET_UBOOT_CUSTOM_PATCH_DIR (because a string is not a valid
value for a bool), but it does not result in the legacy option being
selected.  Consequently, BR2_LEGACY is not selected either.

* The advice at the top of Config.in.legacy to add a hidden WRAP option
to select BR2_LEGACY was not heeded.

* The advice at the top of Config.in.legacy to use the old string
option as the default for the new string option was not heeded.  In
this case, the variable was not just renamed, as the old option
supported directories only, while the new one supports files too.
But since the old option is a subset of the new option, it can still
be used to set a useful default.

So, this mod turns the legacy option back to a string, adds a hidden
bool WRAP option to set BR2_LEGACY when the string is non emoty, and
uses the legacy option to set the default for the new option.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

legacy/sqlite: add "sqlite" to legacy option name

The "command-line editing support was updated" does not indicate
the package name, unlike the other legacy options.  This commit
adds "sqlite", to be nicer.

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mkusers: fix spelling in intro comment

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website/news.html: add 2016.11 announcement link

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libupnp: add upstream security fix for CVE-2016-8863

Fix out-of-bound access in create_url_list()

If there is an invalid URL in URLS->buf after a valid one, uri_parse is
called with out pointing after the allocated memory. As uri_parse writes
to *out before returning an error the loop in create_url_list must be
stopped early to prevent an out-of-bound access.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libupnp: add upstream security fix for CVE-2016-6255

If there's no registered handler for a POST request, the default behaviour
is to write it to the filesystem. Several million deployed devices appear
to have this behaviour, making it possible to (at least) store arbitrary
data on them. Add a configure option that enables this behaviour, and change
the default to just drop POSTs that aren't directly handled.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-twisted: bump to version 16.6.0

Add two new dependencies:

python-contstantly: runtime only
python-incremental: both runtime and build-time dependency

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-zope-interface: bump to version 4.3.3

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-constantly: new package

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>