git.libre-soc.org Git - buildroot.git/log

Makefile: unconfigured "make toolchain" should run report error

As reported by Alessandro Power on StackOverflow [1], the behaviour
of "make toolchain" in an unconfigured tree is misleading.

When .config doesn't exist, we don't read in the package .mk files, so
"make <package>" doesn't work:

    $ make busybox
    make: *** No rule to make target 'busybox'.  Stop.

However, for "linux" and "toolchain", the corresponding file (or
actually directory) already exists. So instead, we get:

    $ make linux
    make: Nothing to be done for 'linux'.

This is confusing, because it looks as if the build succeeded.

The obvious solution is to make linux and toolchain PHONY targets when
.config doesn't exist. However, that actually does the reverse, because
then a rule _does_ exist for them and since they don't have
dependencies, make will consider them to be ready.

Therefore, we also have to provide an explicit rule for them, and
explicitly error out. Thise behaviour is still different from other
packages, but at least it is much less confusing.

[1] https://stackoverflow.com/questions/44521150

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Acked-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libgcrypt: security bump to version 1.7.8

>From the NEWS file:

- Mitigate a flush+reload side-channel attack on RSA secret keys
dubbed "Sliding right into disaster". For details see
<https://eprint.iacr.org/2017/627>. [CVE-2017-7526]

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

nodm: uClibc wordexp support is enabled by default

Build tested with Qemu X86 sample.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

squid: uClibc workaround no longer required

As all librt and libpthread functions are integrated into
libc for a while, workaround no longer required.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Acked-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

boot/syslinux: drop patch 0008, not needed after gnu-efi update

Thanks to the bump of gnu-efi from 3.0.5 to 3.0.6, patch 0008 in the
syslinux package is no longer needed. More specifically, it's commit
bf07e8141777e5a2d67ec8447084215224bdad4b in upstream gnu-efi that
fixed the underlying issue.

Signed-off-by: Benoît Allard <benoit.allard@greenbone.net>
[Thomas: add better commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/gnu-efi: bump version to 3.0.6

Refreshed patch 0001-Allow-CFLAGS-CPPFLAGS-to-be-completed-from-the-envir.patch.
Dropped patch 0002-Fix-parallel-make-failure-for-archives.patch applied upstream.

Signed-off-by: Benoît Allard <benoit.allard@greenbone.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libva-intel-driver: bump version to 1.8.3

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libva: bump version to 1.8.3

Configure option dummy-driver was removed:
https://github.com/01org/libva/commit/8cd60bb59ffac21560d1c424d456cc25e917371f

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

glibc: add upstream security patches fixing CVE-2017-1000366 (stack clash)

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH
values to manipulate the heap/stack, causing them to alias, potentially
resulting in arbitrary code execution. Please note that additional
hardening changes have been made to glibc to prevent manipulation of stack
and heap memory but these issues are not directly exploitable, as such they
have not been given a CVE.

https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt

Patches are identical to upstream, except that the ChangeLog modifications
have been stripped.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dovecot-pigeonhole: bump version to 0.4.19

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dovecot: bump version to 2.2.31

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mpd: bump to version 0.20.9

Building version 0.20.7 fails with a GCC 4.9 toolchain:

```
src/Main.cxx:125:23: error: call to non-constexpr function 'const _Tp& std::max(const _Tp&, const _Tp&) [with _Tp = long unsigned int]'
64 * KILOBYTE);
^
make[3]: *** [src/Main.o] Error 1
```

The issue was reported upstream [1] and already fixed in version 0.20.8.

Fixes:
http://autobuild.buildroot.net/results/fb6/fb67f453683078023e9d801176ef6871bc720c67/
http://autobuild.buildroot.net/results/200/2005f2a7f2857e59ad1a896db0421bb0328b1766/
http://autobuild.buildroot.net/results/804/80410b62d4ca292df8ecbaf7b0e2a020767111b6/

[1] https://github.com/MusicPlayerDaemon/MPD/issues/45

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

util-linux: fix compilation when libc lacks wide-character support

A recent change in util-linux left calls to wcstok and wcspbrk not
guarded by "#ifdef HAVE_WIDECHAR". This causes build failures when
libc does not have the wide-character functions, like some uClibc
builds.

Solve the problem by means of a patch already sent upstream.

Fixes:
  http://autobuild.buildroot.net/results/fd8a1a8e0cef3aeed9588540e8e663664f6b43aa
  http://autobuild.buildroot.net/results/5ad73ea8b471321988c50d80a5e50d4504151dd6
  http://autobuild.buildroot.net/results/04411b7280dc51ecd51236967981a42352bbeb3e

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

mosquitto: add upstream security fix

Fixes CVE-2017-9868: In Mosquitto through 1.4.12, mosquitto.db (aka the
persistence file) is world readable, which allows local users to obtain
sensitive MQTT topic information.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

systemd: add security fix

Add a fix for CVE-2017-9445: In systemd through 233, certain sizes passed to
dns_packet_new in systemd-resolved can cause it to allocate a buffer that's
too small. A malicious DNS server can exploit this via a response with a
specially crafted TCP payload to trick systemd-resolved into allocating a
buffer that's too small, and subsequently write arbitrary data beyond the
end of it.

The other patch fixes an issue with the security fix.

[Peter: use CVE description from MITRE]
Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rtl8821au: fix license file name

Fixes #9976.

Reported-by: Nick Wright <nwright98@gmail.com>
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux-headers: bump 4.4.x series

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uboot-tools: drop unreferenced empty variable

Commit log 0e0ea8cf5e2c57 (uboot-tools: install libubootenv to staging)
mentions that installation is done in <pkg>_INSTALL_STAGING_CMDS directly, but
forgot to remove the now empty UBOOT_TOOLS_INSTALL_LIBUBOOTENV.

Cc: Jörg Krause <joerg.krause@embedded.rocks>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/dhcp: dhcp server: select systemd tmpfile support when systemd is used

tmpfile support is optional in systemd but the dhcp server install it's
config file in $(TARGET_DIR)/usr/lib/tmpfiles.d directory when systemd
is used as init system.

So it seems that dhcp server require tmpfile support for systemd based
system.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xlib_libxshmfence: needs sync_4

Also propagate reverse dependency to mesa3d and xserver_xorg-server.

Fixes xserver_xorg-server build
http://autobuild.buildroot.net/results/7da/7da8b46cda8786422e8293f26b79582b35a433d6/

For patch discussion refer to http://patchwork.ozlabs.org/patch/674595/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Thomas: only select BR2_PACKAGE_XPROTO_PRESENTPROTO if
BR2_TOOLCHAIN_HAS_SYNC_4 is available, add comment explaining why.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux-headers: bump 3.10.x and 4.{9, 11}.x series

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

linux: bump default version to 4.11.7

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core: add "cmake3" to the list of cmake candidates

This is useful on CentOS 7, whose "cmake" utility corresponds to version
2.8.12, which is too old for Buildroot.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core: allow having a list of "cmake" candidates

Add the BR2_CMAKE_CANDIDATES variable, containing a list of candidates
to check and use as BR2_CMAKE, if possible.

This allows using "cmake3" on CentOS 7, whose default cmake corresponds
to version 2.8.12. Example:

$ make BR2_CMAKE_CANDIDATES="cmake cmake3"

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core: allow check-host-cmake.sh to try several candidates

This is useful on CentOS 7 whose "cmake" package provides cmake 2.8.12,
which is too old, but the "cmake3" package (from EPEL) provides version
3.6.3, which is satisfactory. Examples:

    $ sh support/dependencies/check-host-cmake.sh 2.8 cmake cmake3
    /usr/bin/cmake

    $ sh support/dependencies/check-host-cmake.sh 3.1 cmake cmake3
    /usr/bin/cmake3

    $ sh support/dependencies/check-host-cmake.sh 3.8 cmake cmake3
    (nothing)

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core: reverse the argument order in check-host-cmake

Pass the minimal version before the program name. In a later change the
script will become able to test a list of candidates.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

support/scripts: allow /etc/shadow to be symlinked

This commit fixes a problem where it was not possible to replace
/etc/shadow with a symlink to a e.g. a user partition where the
shadow file is placed. This is required, e.g. for systems where the
rootfs is mounted read-only but users should still be able to be
added. Thus, if within an filesystem overlay setup a user tries
to replace /etc/shadow with a symlink to the real file on a user
partition a buildroot build stops with an error message because
sed is called on the symlink instead of following the symlink.
This commit fixes this shortcoming.

Signed-off-by: Jens Maus <mail@jens-maus.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: add Waldemar as a developer for the glibc package

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: fix alphabetic ordering for Waldemar entries

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

glibc: remove version choice

We do not support uClibc-ng/musl C library version choice support,
do the same for GNU C Library.
No legacy handling required as only version choice is removed.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[Thomas: move 3.2 kernel headers dependency to the libc choice in
toolchain/toolchain-buildroot/Config.in file, and added a Config.in
comment about it.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/irrlicht: new package

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[Thomas: adjust LICENSE variable.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/beecrypt: remove c++ support

Optional C++ support depends on icu, the icu version bump to 59.1
brought ABI-breaking changes
http://site.icu-project.org/download/59#TOC-char16_t-in-C-

which are incompatible with beecrypt. Since beecrypt did not get any
updates upstream since 2009 and no package uses beecrypt's C++ support
we disable this broken option.

With C++ support removed patches 0002 & 0004 are not needed anymore.

Fixes
http://autobuild.buildroot.net/results/a1a/a1ad507371192ddecacab0df91f7b2a84c7c288d/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board: Add support for Engicam Is.IoT MX6UL SOM

Add initial support for Engicam Is.IoT MX6UL SOM board
with below features:
- U-Boot 2017.07-rc1
- Linux 4.11.5
- Default packages from buildroot

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
[Thomas: add host-dosfstools/host-mtools.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board: Add support for Engicam GEAM6UL SOM

Add initial support for Engicam GEAM6UL SOM board
with below features:
- U-Boot 2017.07-rc1
- Linux 4.11.5
- Default packages from buildroot

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
[Thomas: add host-dosfstools and host-mtools.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board: engicam: Add icorem6 for i.CoreM6 support

Create board/engicam/icorem6 for i.CoreM6 supported files.
and update the readme.txt so-that it can list i.CoreM6 board
details.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board: Add support for Engicam i.CoreM6 RQS SOM

Add initial support for Engicam i.CoreM6 Quad/Dual/DualLite/Solo RQS
board with below features:
- U-Boot 2017.07-rc1
- Linux 4.11.5
- Default packages from buildroot

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
[Thomas: add missing host-dosfstools and host-mtools.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

configs/engicam_imx6qdl_icore_defconfig: add missing tools

A VFAT filesystem is described in the genimage configuration file, so
we need host-dosfstools and host-mtools enabled in the defconfig.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board: Add support for Engicam i.CoreM6 DualLite/Solo boards

Add initial support for Engicam i.CoreM6 DualLite/Solo board
with below features:
- U-Boot 2017.07-rc1
- Linux 4.11.5
- Default packages from buildroot

U-Boot 2017.07-rc1 has common u-boot defconfig for All i.CoreM6
variant boards, so this patch update the same along with
buildroot defconfig that reflect the common name.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libglib2: bump version to 2.52.2

Patches were changed to git format, because libglib is a git project.
0003-gio-2.0.pc-include-libmount-in-Libs.private.patch was added to upstream
as of commit:
https://git.gnome.org/browse/glib/commit/?id=ecdd3c29fc4bd28f01fe53d0528bfee888c9c62c.

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

psmisc: update homepage link

The gitlab repo is much more informative and updated.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

psmisc: bump to version 23.1

Forward port 0001-link-against-libintl.patch. Since now autoreconf works, move
the patch from Makefile.in to Makefile.am. Also, convert to git format.

Remove 0002-no-__progname.patch. Buildroot default uClibc and musl now provide
__progname.

Add a patch that adds the git-version-gen script to fix autoreconf.

Remove upstream patch.

Upstream switched to .xz tarballs.

Add upstream provided hashes.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x264: needs host-nasm instead of host-yasm

Upstream switched to nasm >= 2.13
http://git.videolan.org/?p=x264.git;a=commitdiff;h=d2b5f4873e2147452a723b61b14f030b2ee760a5#patch2

Fixes
http://autobuild.buildroot.net/results/3f5/3f5759a1fd6aaa0394229cdfce278752d4a01ddc/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/nasm: bump version to 2.13.01

Needed to fix x264 build error.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libgpiod: bump version to v0.3

Add host-pkgconf to dependencies as we now use PKG_CHECK_MODULES in
configure.ac.

Changelog for v0.3:

New features:
- gpiomon can now watch multiple lines at the same time and supports custom
  output formats which can be specified using the --format argument
- testing framework can now test external programs: test cases for gpio-tools
  have been added

Improvements:
- improve error messages
- improve README examples
- configure script improvements

Bug fixes:
- use correct UAPI flags when requesting line events

Also includes bug fixes from v0.2.1:

Bug fixes:
- capitalize 'GPIO' in error messages in gpioset, gpioget & gpiomon
- tweak the error message on invalid arguments in gpiofind
- don't ignore superfluous arguments and fix the displayed name for falling
  edge events in gpiomon

Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/dt-utils: new package

Add two upstreamable patches for this package to fix uClibc
and musl builds.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

glmark2: Bump to the latest version

The two patches are no longer needed with the latest upstream version,
so bump to the latest one.

Tested on imx6.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

util-linux: bump to version 2.30

- Update the "basic set" description to include fincore, which is built
  by default, and remove tailf, which was removed in this version.
- Add configuration options for the new utilities "chmem" and "lsmem".
- Add a patch to revert the assumption that ncursesw headers are under
  /usr/include/ncursesw/ only. That's necessary to have both versions
  for ABI/API compatibility but does not make sense on embedded systems.
- Drop autoreconf, since the patch on term-utils/Makemodule.am is gone.

The patch is a bit drastic but it solves the problem of using ncursews
while we discuss a better solution in the util-linux mailing list.

Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

uclibc: fix knock build issue

This patch sync's with GNU C library and removes __FAVOR_BSD.

Fixes:
http://autobuild.buildroot.net/results/908/90863b5adb769a346acd3dc4bbe8d5fa497a0581/build-end.log

Reported-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openvpn: security bump to version 2.4.3

Fixes:

CVE-2017-7508 - Remotely-triggerable ASSERT() on malformed IPv6 packet

CVE-2017-7520 - Pre-authentication remote crash/information disclosure for
clients

CVE-2017-7521 - Potential double-free in --x509-alt-username

CVE-2017-7521 - Remote-triggerable memory leaks

CVE-2017-7522 - Post-authentication remote DoS when using the --x509-track
option

Details at

https://community.openvpn.net/openvpn/wiki/VulnerabilitiesFixedInOpenVPN243

Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

spice: add post-0.12.8 upstream security fixes

Fixes the following security issues:

CVE-2016-9577

    Frediano Ziglio of Red Hat discovered a buffer overflow
    vulnerability in the main_channel_alloc_msg_rcv_buf function. An
    authenticated attacker can take advantage of this flaw to cause a
    denial of service (spice server crash), or possibly, execute
    arbitrary code.

CVE-2016-9578

    Frediano Ziglio of Red Hat discovered that spice does not properly
    validate incoming messages. An attacker able to connect to the
    spice server could send crafted messages which would cause the
    process to crash.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

spice: security bump to version 0.12.8

Fixes the following security issues:

CVE-2016-0749: The smartcard interaction in SPICE allows remote attackers to
cause a denial of service (QEMU-KVM process crash) or possibly execute
arbitrary code via vectors related to connecting to a guest VM, which
triggers a heap-based buffer overflow.

CVE-2016-2150: SPICE allows local guest OS users to read from or write to
arbitrary host memory locations via crafted primary surface parameters, a
similar issue to CVE-2015-5261.

The pyparsing check has been dropped from configure, and the spice protocol
definition is again included, so the workarounds can be removed.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

spice: security bump to version 0.12.6

Fixes the following security issues:

CVE-2015-3247: Race condition in the worker_update_monitors_config function
in SPICE 0.12.4 allows a remote authenticated guest user to cause a denial
of service (heap-based memory corruption and QEMU-KVM crash) or possibly
execute arbitrary code on the host via unspecified vectors.

CVE-2015-5260: Heap-based buffer overflow in SPICE before 0.12.6 allows
guest OS users to cause a denial of service (heap-based memory corruption
and QEMU-KVM crash) or possibly execute arbitrary code on the host via QXL
commands related to the surface_id parameter.

CVE-2015-5261: Heap-based buffer overflow in SPICE before 0.12.6 allows
guest OS users to read and write to arbitrary memory locations on the host
via guest QXL commands related to surface creation.

Client/gui support is gone upstream (moved to spice-gtk / virt-viewer), so
add Config.in.legacy handling for them.

Lz4 is a new optional dependency, so handle it.

The spice protocol definition is no longer included and instead used from
spice-protocol. The build system uses pkg-config --variable=codegendir to
find the build time path of this, which doesn't take our STAGING_DIR prefix
into consideration, so it needs some help. The installed protocol
definition will likewise be newer than the generated files, so we need to
workaround that to ensure they are not regenerated (which needs host python
/ pyparsing).

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

spice: bump to version 0.12.5

Tunneling support is gone upstream, so drop the patch and add
Config.in.legacy handling for the option.

Celt051 is no longer a hard dependency, and opus is a new optional
dependency, so adjust the dependencies to match.

Python / pyparsing are not needed as the tarball contains the generated
files (this should presumably have been host-python in the first place as
these are used at build time), but we need a small workaround to convince
configure that they really aren't needed.

Alsa-lib is only needed for client support, and the configure script checks
for X11/Xext/Xrender, so adjust the dependencies to match.

A user manual is now generated by default if asciidoc is available, so
explicitly disable that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/linuxconsoletools: always select a sub-option

This patch forces BR2_PACKAGE_LINUXCONSOLETOOLS_INPUTATTACH
to be selected if none of the other sub-options are
selected. This fixes build failures when using
'make randpackageconfig', where selecting
BR2_PACKAGE_LINUXCONSOLETOOLS without selecting any sub-option
would break in the 'install to target' phase.

Fixes:
http://autobuild.buildroot.net/results/94b/94bc050f291cc42a4fdcf02157320576feb03654/
http://autobuild.buildroot.net/results/f62/f62c5e8bd63d21211eb0e658c4e84135bd59b8cb/

And many more.

[Peter: add autobuilder references and wrap Config.in line]
Signed-off-by: Koen Martens <koen.martens@transport.alstom.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/cubieboard2_defconfig: use U-Boot boot script generation logic

Instead of a custom post-build script, use the boot script generation
logic of the U-Boot package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

uboot: add support for generating U-Boot boot scripts

More and more of our defconfigs need to generate a U-Boot boot
script. It's a simple call to mkimage, but we already have 12
instances of this logic in board/, and there are patch series waiting
in patchwork adding 3 more boards that need this.

So let's add an option in the U-Boot package to generate such a boot
script image easily.

Note that we assume a single script needs to be generated, and the
output file name is boot.scr. The only platform for which it seems to
not be the case are the Boundary Devices platforms: they generate two
boot scripts, 6x_bootscript and 6x_upgrade, but they are anyway
installed inside TARGET_DIR, not BINARIES_DIR.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

upmpdcli: needs gcc >= 4.9

Commit 5d043799cd changed the dependency for libupnpp on GCC to 4.9, but
did not propagate the dependency to upmpdcli.

Fixes:
http://autobuild.buildroot.net/results/df2/df23cd5e77f61caf3f30cf43c91bc161a88def3a/

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/{mesa3d, mesa3d-headers}: bump version to 17.1.3

Patch 0006 is no longer needed as the fix is already upstream.
Confirmed that the colors are displayed correctly when running the
Qt5CinematicDemo application on i.mx6.

Patch 0007 is already applied upstream.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/olimex_a13_olinuxino: new defconfig

Add initial support for a13_olinuxino board
with below features
- U-Boot 2017.05
- Linux 4.11.5
- Default packages from buildroot

Signed-off-by: Chakra Divi <chakra@openedev.com>
Reviewed-by: Jagan Teki <jagan@amarulasolutions.com>
[Thomas:
- use full name in DEVELOPERS file
- remove parametrization of the post-build.sh script, just hardcode
   the boot.cmd file used as input
- add missing dosfstools and mtools host packages in defconfig,
   needed because a vfat partition is defined in the genimage.cfg
   file
- minor tweaks to readme.txt file.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

apr: bump version to 1.6.2

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

jansson: bump to version 2.10

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

syslog-ng: bump to version 3.10.1

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mmc-utils: bump version to 37c86e60c0442fef570b75cd81aeb1db4d0cbafd

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libcurl: bump version to 7.54.1

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

sqlite: bump to version 3190300

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

strace: bump version to 4.17

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

orangepi_zero_defconfig: add xradio wireless driver

Add xradio driver to enable on-board SDIO WiFi chip XR819.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

xr819-xradio: new package

This patch adds xradio wireless driver for SDIO WiFi chip XR819.
The out-of-tree driver is sourced from fifteenhex's work
on github https://github.com/fifteenhex/xradio

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
[Thomas: add entry in DEVELOPERS file.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lua-flu: new package

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
[Thomas: "depends on" before "select" in Config.in]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openssh: fix sshd for MIPS64 n32

This patch backports two patches that have been sent upstream as a pull
request in order to fix sshd for MIPS64 n32.

The first patch adds support for detecting the MIPS ABI during the
configure phase.

The second patch sets the right value to seccomp_audit_arch taking into
account the MIPS64 ABI.

Currently seccomp_audit_arch is set to AUDIT_ARCH_MIPS64 or
AUDIT_ARCH_MIPSEL64 (depending on the endinness) when openssh is built
for MIPS64. However, that's only valid for n64 ABI. The right macros for
n32 ABI defined in seccomp.h are AUDIT_ARCH_MIPS64N32 and
AUDIT_ARCH_MIPSEL64N32, for big and little endian respectively.

Because of that an sshd built for MIPS64 n32 rejects connection attempts
and the output of strace reveals that the problem is related to seccomp
audit:

[pid   194] prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=57,
filter=0x555d5da0}) = 0
[pid   194] write(7, "\0\0\0]\0\0\0\5\0\0\0Ulist_hostkey_types: "..., 97) = ?
[pid   193] <... poll resumed> )        = 2 ([{fd=5, revents=POLLIN|POLLHUP},
{fd=6, revents=POLLHUP}])
[pid   194] +++ killed by SIGSYS +++

Pull request: https://github.com/openssh/openssh-portable/pull/71

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

barebox: support multiple image files

Add support for specifying multiple image files in
BR2_TARGET_BAREBOX_IMAGE_FILE config option.

This is useful for boards with several RAM size variants.

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
[Thomas: rename internal variable from $(1)_IMAGE_FILE to
$(1)_IMAGE_FILES.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

configs/atmel: bump to linux4sam_5.6

Bump at91sam9x5ek, atmel_sama5d2_xplained, atmel_sama5d3_xplained and
atmel_sama5d4_xplained to linux4sam_5.6.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board/atmel: provide u-boot env for at91sam9x5ek_mmc

Default bootargs have changed in U-Boot for this board. Build U-Boot
environment and add it to the SD card image to update bootargs.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

board/atmel: at91sam9x5ek_mmc: add 1M offset for FAT partition

at91sam9x5ek_mmc board was missing in the previous patch adding 1M
offset for FAT partition to solve some boot issues with the ROM code.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

kmsxx: update version

Updating version to latest as on 26 June 2017 to include kmstest utility

Signed-off-by: Venkateswara Rao Mandela <venkat.mandela@ti.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

iperf: fix tarball hashes changed upstream

Upstream uploaded a new tarball with the same version number 2016-09-08,
some time after the update to v2.0.9 in buildroot. Someone noticed, but
upstream set the ticket to wontfix, and promised to do better in the
future: https://sourceforge.net/p/iperf2/tickets/20/

Signed-off-by: Alexander Dahl <post@lespocky.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

c-ares: security bump to version 1.13.0

Fixes the following security issues:

CVE-2017-1000381: The c-ares function `ares_parse_naptr_reply()`, which is
used for parsing NAPTR responses, could be triggered to read memory outside
of the given input buffer if the passed in DNS response packet was crafted
in a particular way.

https://c-ares.haxx.se/adv_20170620.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/input-tools: remove package

remove input-tools, it has been obsoleted by linuxconsoletools

linuxconsoletools uses the same name as upstream and carries
the latest version of the tools installed by input-tools.

Signed-off-by: Koen Martens <gmc@sonologic.nl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

apache: security bump to version 2.4.26

Fixes the following security issues:

CVE-2017-3167: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26,
use of the ap_get_basic_auth_pw() by third-party modules outside of the
authentication phase may lead to authentication requirements being bypassed.

CVE-2017-3169: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26,
mod_ssl may dereference a NULL pointer when third-party modules call
ap_hook_process_connection() during an HTTP request to an HTTPS port.

CVE-2017-7659: A maliciously constructed HTTP/2 request could cause
mod_http2 to dereference a NULL pointer and crash the server process.

CVE-2017-7668: The HTTP strict parsing changes added in Apache httpd 2.2.32
and 2.4.24 introduced a bug in token list parsing, which allows
ap_find_token() to search past the end of its input string. By maliciously
crafting a sequence of request headers, an attacker may be able to cause a
segmentation fault, or to force ap_find_token() to return an incorrect
value.

CVE-2017-7679: In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26,
mod_mime can read one byte past the end of a buffer when sending a malicious
Content-Type response header.

While we're at it, use the upstream sha256 checksum instead of sha1.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

bind: security bump to version 9.11-P1

Fixes the following security issues:

CVE-2017-3140 is a denial-of-service vulnerability affecting 9.9.10,
9.10.5, 9.11.0->9.11.1, 9.9.10-S1, and 9.10.5-S1 when configured with
Response Policy Zones (RPZ) utilizing NSIP or NSDNAME rules.

https://kb.isc.org/article/AA-01495/74/CVE-2017-3140

CVE-2017-3141 is a Windows privilege escalation vector affecting
9.2.6-P2+, 9.3.2-P1+, 9.4.x, 9.5.x, 9.6.x, 9.7.x, 9.8.x, 9.9.0->9.9.10,
9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, and 9.10.5-S1. The
BIND Windows installer failed to properly quote the service paths,
possibly allowing a local user to achieve privilege escalation, if
allowed by file system permissions.

https://kb.isc.org/article/AA-01496/74/CVE-2017-3141

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/kvazaar: needs threads

Fixes:

http://autobuild.buildroot.net/results/6e1eabd691b8674f61898bc0fe734208d226f965/

Signed-off-by: Alexandre Esse <alexandre.esse.dev@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

DEVELOPERS: Add janus-gateway to Adam Duskett

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

janus-gateway: add unix-sockets to transport section

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: alphabetic ordering.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

janus-gateway: add mqtt to transport section

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: propagate paho-mqtt dependencies, use alphabetic ordering.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

janus-gateway: add rabbitmq to transports section

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: propagate rabbitmq-c dependency, use alphabetic ordering.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

janus-gateway: add websockets to transport section

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: propagate BR2_USE_MMU dependency.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

janus-gateway: add HTTP/REST to a new transport config section

janus-gateway supports many different transports, and currently there
is no implicit way to turn them off or on. Instead, if the dependency
happens to be built, then the transport is enabled.

Create a transports section in the config file and add
BR2_PACKAGE_JANUS_REST as the first transport.

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: propagate thread dependency.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mtd: switch to a foreach loop for installation

Such a construct allows to bail out if the installation of one of the
program fails, which the current shell-based for loop doesn't do.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mtd: bump to version 2.0.0

This revision includes:
  - Moving from a handwritten makefile to autotools.
  - Restructuring and cleaning up the source tree.
  - Fixing the problems that the patches in the package/mtd directory fixed.

Changes:
  - Move from generic-package to autotools-package in mtd.mk.
  - Remove no longer necessary patches.
  - Update binary locations in mtd.mk
  - Update library/header locations in mtd.mk
  - Remove MTD_ADD_MISSING_LINTL definition from mtd.mk, as it's no longer
    needed.

Tested with toolchains compiled with musl, uclibc, and glibc.

Signed-off-by: Adam Duskett <aduskett@codeblue.com>
[Thomas: additional improvements
- introduce hidden options BR2_PACKAGE_MTD_JFFS_UTILS,
   BR2_PACKAGE_MTD_UBIFS_UTILS and BR2_PACKAGE_MTD_TESTS that match the
   ./configure options of mtd. Those hidden options select the
   appropriate dependencies checked by the configure script, and are
   selected by the existing per-tool Config.in options.
- .mk file is changed to handle properly the new hidden options
   BR2_PACKAGE_MTD_JFFS_UTILS, BR2_PACKAGE_MTD_UBIFS_UTILS and
   BR2_PACKAGE_MTD_TESTS.
- .mk file is changed to properly handle BR2_PACKAGE_ACL, by passing
   --with-xattr/--without-xattr.
- remove HOST_MTD_BUILD_CMDS and HOST_MTD_INSTALL_CMDS, those are no
   longer needed since we have an autotools-package now.
- MTD_STAGING_y and MTD_INSTALL_STAGING_CMDS are removed, we use the
   default staging installation commands, that install everything that
   is needed.
- the MTD_TARGETS_UBI_y variable is merged into MTD_TARGETS_y, as we no
   longer need to distinguish both.
- integck installation logic is moved into MTD_TARGETS_y.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x264: bump version

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Thomas: update hash file.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x264: disable optional ffmpeg support

In buildroot ffmpeg uses x264 as optional dependency if
BR2_PACKAGE_FFMPEG_GPL is enabled at the same time.

If BR2_PACKAGE_FFMPEG_GPL is disabled and ffmpeg is built without x264
support before x264 itself is build, x264 picks up certain ffmpeg libs
as optional dependency leading to build errors because x264 does not
correctly link statically against ffmpeg.

To avoid a circular dependency and to avoid teaching x264 how to
correctly link statically with ffmpeg we just disable all ffmpeg-
related options.

Fixes
http://autobuild.buildroot.net/results/36a/36abb5b8f3aab57fb7b63056b216b4a58143ee3e/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lirc-tools: no need to check for clock_gettime

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to check whether librt is required for clock_* system calls.

Cc: Rhys Williams <github@wilberforce.co.nz>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

openipmi: no need to check for clock_gettime

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to check whether librt is required for clock_* system calls.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

liboping: no need to check for clock_gettime

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to check whether librt is required for clock_* system calls.

Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

e2fsprogs: don't link with librt

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to link with librt for clock_* system calls.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libv4l: don't link with librt

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to link with librt for clock_* system calls.

The following patches are not renumbered. The noise is too high.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

aiccu: don't link with librt

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to link with librt for clock_* system calls.

Cc: Michael Rommel <rommel@layer-7.net>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

swupdate: don't link with librt

Buildroot no longer supports toolchains with glibc older than 2.17, so there
is no need to link with librt for clock_* system calls.

Cc: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

docs/manual: drop mention of removed external toolchains

The CodeSourcery x86 and sh, the ADI Blackfin, and the Xilinx Mircoblaze
external toolchain profiles have all been removed. Update the manual.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>