libinput: bump to version 1.5.4

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sudo: bump to version 1.8.19p2

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

zlib: bump to version 1.2.11

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sysstat: bump version to 11.4.3

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cmake: bump version to 3.7.2

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

imagemagick: bump version to 7.0.4-4

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lighttpd: bump version to 1.4.45

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-pillow: bump to version 4.0.0

This commit bumps python pillow to 4.0.0 version

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mpd: drop dependency on libglib2

Version 0.20.x does not depend on libglib2 anymore. Note, that the
dependency on MMU and Thread remain, as MPD uses fork() and thread
functionality.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mpd: bump version to 0.20.2

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

core/br2-external: fix use of relative paths

Fixes #9576

When the path to a br2-external tree is relative, make enters an endless
recursive loop (paths elided for brevity):

    $ make BR2_EXTERNAL=.. foo_defconfig
    make[1]: stat: ../configs/../configs/../configs[...]/toto_defconfig: Filename too long
    make[1]: *** No rule to make target '../configs/../configs/../configs[...]/toto_defconfig',
    needed by '../configs/../configs/../configs[...]/toto_defconfig'.  Stop.
    Makefile:79: recipe for target '_all' failed
    make: *** [_all] Error 2

It is a bit complex to understand the actual technical reason for this
never-ending expansion; it seems it happens in the code generated by the
percent_defconfig macro. Not sure why, though...

But the root cause is the relative path.

Just use absolute, canonical paths to br2-external trees. Always.

[Peter: add bugzilla reference]
Reported-by: outtierbert@gmail.com
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

agentpp: bump to 4.0.7

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

snmppp: bump to 3.3.8

Remove patch not needed anymore: the bug has been fixed in this release.

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.9.4

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 4.{4, 9}.x series

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/espeak: fix build issue with gcc6

On some architecture, "char" is signed (x86_64, nios2...) so the
compiler try to convert int 0xc2 and 0xba to a signed char.
This is an error since gcc6 (Wnarrowing).

cast string_ordinal init values.

Fixes:
http://autobuild.buildroot.net/results/bae/baef9888b1979d18171668a675985e3f3b45fda6

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-bottle: bump version to 0.12.13

0.12.12 and 0.12.13 are both bugfix releases, fixing issues introduced in
0.12.11:

https://github.com/bottlepy/bottle/issues/918
https://github.com/bottlepy/bottle/issues/923

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/weston: fix build on ancient Khronos headers

Backport two patches from upstream, to build against ancient headers
and when EGL is not available.

Fixes:
    http://autobuild.buildroot.net/results/2de/2dea0a1b82c535fded6fd67a69496d70e6bcca56
    http://autobuild.buildroot.org/results/112/1125199749455e349d8eb87ca86c778763aae489

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nodejs: disable icu support for host build

Fixes:
http://autobuild.buildroot.net/results/1d6/1d6bbef2cb0c8c2e00b6d7511814ff9ddb2e3073/
http://autobuild.buildroot.net/results/4c7/4c7fc92a42405e25f41394fa44f5bdc27a4538c4/

Apperently if both icu and nodejs are enabled during the nodejs host build
the nodejs buildsystem gets confused by the icu version installed by
Buildroot (icu 58.2) and the one bundled with the nodejs source tree(icu
57), which ends up in linking-time errors as:

"""
undefined reference to
`icu_58::NumberFormat::format(icu_58::StringPiece,
icu_58::UnicodeString&, icu_58::FieldPositionIterator*, UErrorCode&)
const'
"""
(note the icu_58 in the symbol name while the bundled icu version is 57)

 This patch disables the (not used) i18n support in the nodejs host build
config in order to fix the issue. The issue doesn't affect the target build of
nodejs.

[Peter: add autobuilder references]
Signed-off-by: Zoltan Gyarmati <mr.zoltan.gyarmati@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tslib: use upstream .tar.xz archive

Save some network bandwidth.

[Peter: use TSLIB_VERSION instead of hardcoding 1.3]
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tslib: disable raw input plugin under kernel < v3.12

The SYN_CNT input code was added in kernel v3.12.

Fixes:
http://autobuild.buildroot.net/results/5cd/5cdb9d22092e9222cc7e8fe8dd3936305a5d371d/
http://autobuild.buildroot.net/results/211/2115038caff1e036cbc9dcb5cb6905abe643552a/
http://autobuild.buildroot.net/results/c79/c79de6fdd5cfe406979941790276296b6d1ec0b8/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tslib: fix missing headers

Add a patch adding missing headers.

Fixes:
http://autobuild.buildroot.net/results/cb8/cb81abe996b0fb0070ddcd01c0d695bcc0570548/
http://autobuild.buildroot.net/results/88a/88add491e10f2f7edeb15e0def8843f1321ac7af/
http://autobuild.buildroot.net/results/9db/9db1d64fd08c8763a1648e78d7b9155777de6cae/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

jasper: disable C++ compiler check

Add a patch to disable the default cmake C++ compiler check.

Fixes:
http://autobuild.buildroot.net/results/970/97001530e59062c36f27721877cb8b5c3ba8906a/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

jasper: disable PDF documentation generation

We don't need the PDF document on target. This also avoids incompatible host
Latex packages.

Fixes:
http://autobuild.buildroot.net/results/e60/e60c4a71a08aebadd0bc3fb95a57a4a223e4b6fa/
http://autobuild.buildroot.net/results/4ec/4ec8a1735590a3cad4b74630b4b6bdd2e3a7eec8/

[Peter: reformat as suggested by Yann]
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

toolchain: bump Codescape MTI MIPS version to 2016.05-06

Also...

  - Fix a typo in Config.in
  - Take into account the host's architecture to download the x86 or
    x86_64 version. This makes the IA32 libs dependency in unnecessary.

[Peter: fix kernel headers comment as pointed out by Romain]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

toolchain: bump Codescape IMG MIPS version to 2016.05-06

Also...

- Fix a typo in Config.in
- Take into account the host's architecture to download the x86 or
  x86_64 version. This makes the IA32 libs dependency in unnecessary.

[Peter: fix kernel headers comment as pointed out by Romain]
Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rabbitmq-server: security bump to version 3.6.6

Fixes a critical authentication vulnerability in the MQTT plugin
(CVE-2016-9877):

MQTT (MQ Telemetry Transport) connection authentication with a
username/password pair succeeds if an existing username is provided but the
password is omitted from the connection request.  Connections that use TLS
with a client-provided certificate are not affected.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libxmlrpc: bump to version 1.39.12

Also:
* remove patch "Fix non C++ build" - merged upstream
* remove patch "Fix ar, ranlib handling" - merged upstream
* renumber remaining patches

Signed-off-by: Alvaro Gamez Machado <alvaro.gamez@hazent.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

audit: bump version to 2.7

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ruby: bump version to 2.4.0

The problem addressed by 0001 patch has been fixed upstream and is that
fix is included in this release:
  https://github.com/ruby/ruby/commit/aa107497cd379b713eba8cecdb9a882bb1e0dd89

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/liteboard: Bump Linux to 4.9.2

Patches from 4.8 version don't apply. Update them by backporting
liteBoard support from Linux master branch.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/liteboard: Bump U-Boot to 2017.01

There is already support in newest U-Boot version, so drop existing
U-Boot patches.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lttng-tools: bump version to 2.9.3

0001-Fix-Add-missing-pthread.h-include.patch already included in this
release:

  https://github.com/lttng/lttng-tools/commit/5f702b607116a8303cb09fb091d8b9740c06baca

--with-xml-prefix configure option doesn't exist, so drop it:

  configure:22815: WARNING: unrecognized options: [snip], --with-xml-prefix

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mpd: add patch to fix linking with ogg

Building mpds internal static xiph library needs to link with libogg.
Otherwise building mpd fails with:

```
/mips-linux-gnu/bin/ld: libxiph.a(libxiph_a-OggVisitor.o): undefined
reference to symbol 'ogg_stream_packetout'
```

Add a patch which adds OGG_LIBS to XIPH_LIBS so that the linker finds
the necessary ogg library.

Fixes:
http://autobuild.buildroot.net/results/9f0/9f062dc51daed5c5047faa8d79ecbd4e228f2572/
http://autobuild.buildroot.net/results/1cc/1cc097c5022bd3161dc03b0866cb04075c944a64/
http://autobuild.buildroot.net/results/2e3/2e3dbcdea34053675a0139c1911b6da1a6670e2c/
.. and more.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

bind: security bump to version 9.11.0-P2

Bugfixes:

 - CVE-2016-9131: A malformed response to an ANY query can cause an
   assertion failure during recursion

 - CVE-2016-9147: An error handling a query response containing inconsistent
   DNSSEC information could cause an assertion failure

 - CVE-2016-9444: An unusually-formed DS record response could cause an
   assertion failure

 - CVE-2016-9778: An error handling certain queries using the
   nxdomain-redirect feature could cause a REQUIRE assertion failure in db.c

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/freeswitch: bump version to 1.6.14

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

jasper: bump to version 2.0.10

Use upstream provided tarball.

Upstream switched to cmake.

libjpeg dependency is now optional.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xserver_xorg-server: bump to version 1.19.1

Include this bugfix [1] (freeze with DRI2).
Tested using Enlightenment and Lugaru game on x86_64 target using DRI2.

[1] https://bugs.freedesktop.org/show_bug.cgi?id=99333

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mkpasswd: remove dash from "host mkpasswd" to match other host tools

Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-lxml: bump to version 3.7.2

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-urwid: bump to version 1.3.1

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nodejs: add support for building on aarch64 architectures

Signed-off-by: Daniel Mack <daniel@zonque.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

tslib: bump version to 1.3

Signed-off-by: Martin Kepplinger <martin.kepplinger@ginzinger.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pcre: bump to version 8.40

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.9.3

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 4.{4, 9}.x series

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mpd: fix static linking with tremor

Although tremor (the library is named vorbisidec) provides a pkg-config
file, mpd does not use it to find tremor. Since version 0.20 does throw
an error instead of a warning, that's why the issue was left unnoticed
by the autobuilders.

Help mpd to find tremor by providing the path to the library and passing
LIBS through the environment. We use the host pkg-config tool to get the
correct values from the vorbisidec.pc file.

Fixes:
http://autobuild.buildroot.net/results/6b9/6b97403e70caa12c32494b1c82ce61d3e4e456f6/

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/mx6sx_udoo_neo: Bump to U-Boot 2017.01

Bump to U-Boot 2017.01, which supports mx6sx_udoo_neo by default.

Remove the U-Boot patch that we used for the previous version.

Also adjust the 'fdtfile' name as it has been changed in U-Boot
mainline.

[Peter: part 2, boot.scr / defconfig changed accidently got dropped]
Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/ustr: fix ldconfig for host build

The host build of the ustr package also needs to not run the ldconfig to
prevent a build failure caused by the symlink creating a race condition.
Related commit for target build change was 22069232.

Signed-off-by: Clayton Shotwell <clayton.shotwell@rockwellcollins.com>
Signed-off-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

collectd: fix libgcrypt support

For the newer versions the collectd configure script expects
libgcrypt-config as parameter rather than the location for the
libgcrypt-config script. Adjust the package to account for this.
Fixes:
http://autobuild.buildroot.net/results/a49/a494bc905e4509528c4932f76a094b9ea8e70bd3/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/mx6sx_udoo_neo: Bump to U-Boot 2017.01

Bump to U-Boot 2017.01, which supports mx6sx_udoo_neo by default.

Remove the U-Boot patch that we used for the previous version.

Also adjust the 'fdtfile' name as it has been changed in U-Boot
mainline.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

php: bump version to 7.1.0 (security)

Fixed CVEs:
 - CVE-2016-9933 (imagefilltoborder stackoverflow on truecolor images)
   http://bugs.php.net/72696
 - CVE-2016-9934 (NULL Pointer Dereference in WDDX Packet
   Deserialization with PDORow)
   http://bugs.php.net/73331

Full ChangeLog:
  http://php.net/ChangeLog-7.php#7.1.0

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

php-imagick: bump version to 3.4.3RC1

This version is marked as "stable" on php-imagick's website, plus is
necessary for the upcoming php-7.1 version bump.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nano: bump version to 2.7.4

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

btrfs-progs: bump version to 4.9

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

kexec-lite: add KEXEC_LITE_LICENSE_FILES

Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

flac: fix benchmark linking issue with older glibc versions

Fixes:
http://autobuild.buildroot.net/results/b64/b643824d797050d7c001a3b72598158d8f1c6128/
http://autobuild.buildroot.net/results/a2f/a2f2d7b4e9e7b57bc8691e3ec29ecf818be3f79b/

The benchmark tool uses clock_gettime which is available in librt instead of
libc in older glibc versions.  The build system correctly links with -lrt on
Linux systems, but misdetects non-x86 linux systems as !linux, causing build
failures.

Add a patch to relax the linux OS detection to also work on non-x86 systems.

Patch submitted upstream:
http://lists.xiph.org/pipermail/flac-dev/2017-January/006103.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

olimex_a20_olinuxino_lime: bump versions

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

olimex_imx233_olinuxino: bump versions

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/warp7: Bump U-Boot to 2017.01 version

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uboot-tools: bump to version 2017.01

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

boot/uboot: bump to version 2017.01

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ser2net: bump version to 3.3

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nano: bump version to 2.7.3

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lua-messagepack: bump version to 0.4.0

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libnss: bump to version 3.27.2

Fixes a memory leak in SSL_SetTrustAnchors():
https://bugzilla.mozilla.org/show_bug.cgi?id=1318561

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libnspr: bump to version 4.13.1

Reverts a non-backwards compatible change to the pipe handling:
https://bugzilla.redhat.com/show_bug.cgi?id=1383918

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lttng-babeltrace: bump version to 1.5.1

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gnutls: security bump to version 3.5.8

The 3.5.x has been promoted to stable, hence 3.4.x is deprecated and
3.3.x kept as old-stable.

libdane now specifies LGPLv2.1+ so drop the README kludge (which is also
gone regarding licensing).

libunistring is a new dependency, even though gnutls ships a builtin version
we prefer to use unbundled to avoid duplication with other users and target
size growth.

Fixes:

GNUTLS-SA-2017-01 - It was found using the OSS-FUZZ fuzzer
infrastructure that decoding a specially crafted X.509 certificate with
Proxy Certificate Information extension present could lead to a double
free.
GNUTLS-SA-2017-02 - It was found using the OSS-FUZZ fuzzer
infrastructure that decoding a specially crafted OpenPGP certificate
could lead to heap and stack overflows.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

imagemagick: bump version to 7.0.4-3 (security)

Fixes CVE-2016-8707 (Fix possible buffer overflow when writing
compressed TIFFS). This CVE fix is included since 7.0.3-9:
  http://git.imagemagick.org/repos/ImageMagick/commit/fde5f55af94f189f16958535a9c22b439d71ac93

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cjson: bump version to v1.2.0

Also remove the patch since it's already contained in this release.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sqlite: bump to version 3.16.2

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libvpx: disable on blackfin

Fixes
http://autobuild.buildroot.net/results/533/533810941afbdd71cdd3eaeeb654ec3728daade0/

Triggers toolchain issue:
/tmp/ccpKbTiO.s: Assembler messages:
/tmp/ccpKbTiO.s:3800: Error: pcrel too far BFD_RELOC_BFIN_5

[Peter: extend commit message]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nmon: not available on uclibc/musl

Fixes:
http://autobuild.buildroot.net/results/70c/70ce1aa234e321884469d04282f80750bcf9abc8/

nmon uses fstab.h which is only provided by glibc.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mysql: propagate common dependencies to toplevel config

Commit 3d707d2b (mysql: rename package to oracle-mysql, make a virtual
package) introduced a user selectable virtual BR2_PACKAGE_MYSQL package, but
didn't propagate the (common) dependencies of the two variants to it, so the
virtual package can now be selected even though neither of the variants are
available.

As several packages enable mysql support when BR2_PACKAGE_MYSQL is selected,
this causes a number of autobuilder issues:

http://autobuild.buildroot.net/results/7fe/7fe0d0a3e7ed0430852dc42b718dd037557207e8/
http://autobuild.buildroot.net/results/cc4/cc4c2d936f3e1ba6c0a9782b2218de54a4ff75d2/

Fix it by propagating the common dependencies of the two variants to the
virtual package to ensure it cannot be enabled unless at least one of them
are available.

Also move the toolchain comment outside the conditional so it is visible
when mysql isn't available.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gst1-plugins-bad: Add kmssink support

Add support for the KMS video sink element. From the Gstreamer 1.10
release notes:

"New element kmssink to render video using Direct Rendering Manager (DRM)
and Kernel Mode Setting (KMS) subsystems in the Linux kernel. It is oriented
to be used mostly in embedded systems."

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

memcached: bump to version 1.4.34

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.9.2

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 4.{4, 8, 9}.x series

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nodejs: bump to version 6.9.4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qextserialport: really disable target (and not staging) install for static builds

Commit f09b33a0a (qextserialport: fix static build) adjusted the logic for
static builds, but the change contained a typo - It disabled
_INSTALL_STAGING for static builds, not _INSTALL_TARGET.

The autobuilders didn't detect this as nothing links against qextserialport
(so the missing staging install didn't cause issues) and the target install
command was only defined for !static.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pkg-perl: set PERL_USE_UNSAFE_INC

Recent perls are built with the `default_inc_excludes_dot` option.
As many CPAN modules rely on '.' in @INC, the toolchain
must set `PERL_USE_UNSAFE_INC`.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: Add entry for upower

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nodejs: re-add 6.x patches

Commit 3fd9c062e (nodejs: bump to version 6.9.2) bumped the 6.x version but
forgot to rename the patch directory, so the patches were no longer used.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uclibc: add locale/iconv related bugfixes

- do not remove iconv.h when UCLIBC_HAS_LOCALE enabled
- select UCLIBC_HAS_LIBICONV when UCLIBC_HAS_LOCALE enabled

Fixes:
   http://autobuild.buildroot.net/?reason=libglib2-2.50.2&step=250

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

efl: optional 'upower' ecore system module.

Ecore will reach 'upower' using D-Bus system bus in order to detect if
the system state changes and let applications know about the power
state such as low battery or AC power in order to optimize their power
consumption.

For host this is not needed and would not work, since output/host DBus
declares its own output/host/var/run/dbus/system_bus_socket, which has
no dbus-daemon and thus no services in it.

For target it's optional and only installed if BR2_PACKAGE_UPOWER=y,
otherwise it prints error messages about missing upower service.

Signed-off-by: Gustavo Sverzut Barbieri <barbieri@profusion.mobi>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Acked-by: Romain Naour <romain.naour@gmail.com>
Tested-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/upower: new package

Backport an upstream patch.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Gustavo Sverzut Barbieri <barbieri@profusion.mobi>
Reviewed-by: Gustavo Sverzut Barbieri <barbieri@profusion.mobi>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xserver_xorg-server: AIGLX Extension removed in 1.19.0

https://cgit.freedesktop.org/xorg/xserver/commit/?id=501d8e2beb337e072c93c9310fcd927a099b9c3b

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-arrow: new package

Signed-off-by: David Bachelart <david.bachelart@bbright.com>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-chardet: new package

Signed-off-by: David Bachelart <david.bachelart@bbright.com>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-whoosh: new package

Signed-off-by: David Bachelart <david.bachelart@bbright.com>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nmon: new package

[Peter: add _LICENSE_FILES, pass TARGET_CFLAGS/LDFLAGS, indent]
Signed-off-by: David Bachelart <david.bachelart@bbright.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

bash: add upstream fixes to patch level 5

We unfortunately cannot easily download these because of the file names (not
ending in patch) and patch format (p0), so convert to p1 format and include
in package/bash.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ifenslave: new package

[Peter: handle busybox applet interaction, add comment explaining no build
needed]
Signed-off-by: David Bachelart <david.bachelart@bbright.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libmad: disable ASO support for thumb-only ARM cores

Fixes:
http://autobuild.buildroot.net/results/8d4/8d4ea8613487297f2c33f3b9cbd8903cfb96e4c6/

The ARM specific optimizations enabled by LIBMAD_ASO needs classic ARM
instructions support, so disable for thumb-only cores.

[Peter: don't drop default y as pointed out by Baruch Siach]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uclibc: add kernel module syscall wrappers

Revert the decision to remove the wrappers, but remove the extra
Config symbol and add it by default. Required for kmod package.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libpng: bump to version 1.6.28

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

harfbuzz: bump to version 1.4.1

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libvncserver: security bump to version 0.9.11

Security related fixes:
- Heap-based buffer overflow in rfbproto.c in LibVNCClient in LibVNCServer
  before 0.9.11 (CVE-2016-9941)

- Heap-based buffer overflow in ultra.c in LibVNCClient in LibVNCServer
  before 0.9.11 (CVE-2016-9942)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

irssi: security bump to 0.8.21

Bugfixes:

- CVE-2017-5193: Correct a NULL pointer dereference in the nickcmp function
  found by Joseph Bisch (GL#1)

- CVE-2017-5194: Correct an error when receiving invalid nick message (GL#4,
  #466)

- CVE-2017-5195: Correct an out of bounds read in certain incomplete control
  codes found by Joseph Bisch (GL#2)

- CVE-2017-5196: Correct an out of bounds read in certain incomplete
  character sequences found by Hanno Böck and independently by J.  Bisch
  (GL#3)

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>