package/elfutils: security bump to version 0.176

Fixes CVE-2018-18310: An invalid memory address dereference was
discovered in dwfl_segment_report_module.c in libdwfl in elfutils
through v0.174. The vulnerability allows attackers to cause a denial of
service (application crash) with a crafted ELF file, as demonstrated by
consider_notes.

Fixes CVE-2018-18520: An Invalid Memory Address Dereference exists in
the function elf_end in libelf in elfutils through v0.174. Although
eu-size is intended to support ar files inside ar files,
handle_ar in size.c closes the outer ar file before handling all inner
entries. The vulnerability allows attackers to cause a denial of service
(application crash) with a crafted ELF file.

Fixes CVE-2018-18521: Divide-by-zero vulnerabilities in the function
arlib_add_symbols() in arlib.c in elfutils 0.174 allow remote attackers
to cause a denial of service (application crash) with a crafted ELF
file, as demonstrated by eu-ranlib, because a zero sh_entsize is
mishandled.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mosquitto: update help text in Config.in

(and add myself to DEVELOPERS)

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mosquitto: extend systemd integration

Since version 1.5, mosquitto can be built with explicit support for
systemd. If enabled, libmosquitto will link against libsystemd: when
started, the mosquitto broker notifies systemd that it is ready (ie.
initialized and ready to accept connections), so that services that
depend on the mqtt broker can be started only at that point.

To enable this feature, the systemd service config file needs to change
to Type=notify. Upstream now provides such a file, so we can remove
ours.

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mosquitto: allow to build as static lib

Since version 1.5, it is possible to build mosquitto as a static lib.

However, the broker still needs a toolchain with support for shared libraries,
because it contains code to dynamically load modules at runtime. This
code makes use of dlfcn.h, which is only available for dylib enabled
systems.

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
[Peter: adjust broker comment]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/config-fragments/autobuild: update CSV after musl toolchain rename

In commit a5893254055610e416316803de0095b0ce6f03f6
("support/config-fragments/autobuild: rename br-riscv64-musl config"),
the RISC-V 64-bit musl toolchain config snippet was renamed, but the
toolchain.csv file was not updated accordingly.

Due to this, utils/genrandconfig was no longer able to generate any
configuration.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/prboom: work around gcc bug 85180

With Microblaze Gcc version < 8.x the build hangs due to gcc bug
85180: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85180. The bug
shows up when building prboom with optimization but not when building
with -O0. To work around this, if BR2_TOOLCHAIN_HAS_GCC_BUG_85180=y we
force using -O0.

Fixes:
http://autobuild.buildroot.net/results/e72/e72a2070ab7e9a093c3c70002ee94ee57a6154f6/

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/prboom: avoid using hardcoded optimization flags

Package prboom builds using -O2 flag ignoring Buildroot settings, this
is due to the fact that -O2 is appended at the end of compiler flags.

Remove -O2 from 'configure.ac' file and set PRBOOM_AUTORECONF to YES,
this way CFLAGS_OPTS will contain Buildroot TARGET_CFLAGS.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/boost: remove gcc bug 85180 dependency for boost-fiber option

BR2_TOOLCHAIN_HAS_GCC_BUG_85180 dependency is already satisfied because
BR2_PACKAGE_BOOST_FIBER depends on
BR2_PACKAGE_BOOST_CONTEXT_ARCH_SUPPORTS that doesn't contain
BR2_microblaze and BR2_TOOLCHAIN_HAS_GCC_BUG_85180 depends right on
BR2_microblaze. So let's remove 'depends on
BR2_TOOLCHAIN_HAS_GCC_BUG_85180'.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ecryptfs-utils: remove libnss gcc bug dependency

Package libnss had a BR2_TOOLCHAIN_HAS_GCC_BUG_85862 dependency and
since ecryptfs-utils depends on libnss it does have this dependnecy as
well.

However, gcc bug 85862 has been worked around now in libnss by
disabling optimization, so libnss no longer has this
BR2_TOOLCHAIN_HAS_GCC_BUG_85862 dependency. We can therefore drop it
from ecryptfs-utils as well.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libnss: re-enable package on microblaze

With Microblaze Gcc version < 8.x the build hangs due to bug 85862:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=85862
To avoid this, the libnss package has a !BR2_TOOLCHAIN_HAS_GCC_BUG_85862
dependency. However, gcc bug 85862 only triggers when optimization is
enabled, so we can work around the issue by passing -O0, which is what
we do in other Buildroot packages to work around this bug.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-numpy: disable numpy if fenv.h is not provided by libc

With a C library which does not provide fenv.h, it won't work at runtime:
Crash after an "import numpy" on python.

Since numpy v1.16.0:
"Alpine Linux (and other musl c library distros) support
We now default to use fenv.h for floating point status error reporting.
Previously we had a broken default that sometimes would not report
underflow, overflow, and invalid floating point operations. Now we can
support non-glibc distrubutions like Alpine Linux as long as they ship
fenv.h."

Disable python-numpy for uClibc to avoid the runtime errors.

ARC's glibc used to have an incomplete fenv.h, but this has been fixed
since commit be0aaaaecda5 ("toolchain: bump ARC tools to arc-2019.03
release"), so we don't need an exception for ARC.

Two patches attempted to fix the build for uclibc and glibc for ARC, but
didn't fix the runtime issue. Remove those patches.

Signed-off-by: Damien DUVAL <damien.duval@smile.fr>
Signed-off-by: Alexandre PAYEN <alexandre.payen@smile.fr>
Cc: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/qt5/qt5base: build with correct optimization

Qt5 has predefined optimization flags depending if you're building for
size, for debug etc. These flags are defined in
mkspecs/common/gcc-base.conf:

QMAKE_CFLAGS_OPTIMIZE      = -O2
QMAKE_CFLAGS_OPTIMIZE_FULL = -O3
QMAKE_CFLAGS_OPTIMIZE_DEBUG = -Og
QMAKE_CFLAGS_OPTIMIZE_SIZE = -Os

Then, in common/features/default_post.prf, they add those flags to
QMAKE_CFLAGS_RELEASE/QMAKE_CXXFLAGS_RELEASE depending on various build
options (optimize_size, optimize_full, optimize_debug):

optimize_size {
    !isEmpty(QMAKE_CFLAGS_OPTIMIZE):!isEmpty(QMAKE_CFLAGS_OPTIMIZE_SIZE)  {
        QMAKE_CFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
        QMAKE_CXXFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
        QMAKE_CFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_SIZE
        QMAKE_CXXFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_SIZE
    }
} else: optimize_full {
    !isEmpty(QMAKE_CFLAGS_OPTIMIZE):!isEmpty(QMAKE_CFLAGS_OPTIMIZE_FULL)  {
        QMAKE_CFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
        QMAKE_CXXFLAGS_RELEASE -= $$QMAKE_CFLAGS_OPTIMIZE
        QMAKE_CFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_FULL
        QMAKE_CXXFLAGS_RELEASE += $$QMAKE_CFLAGS_OPTIMIZE_FULL
    }
}

Since this default_post.prf is included *after* our qmake.conf file,
these flags override our optimizations flags, which is not good.

However, our qmake.conf file is included *after* gcc-base.conf, so we
can simply reset those variables to have the empty value, and our
optimization flags will be used.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
[Thomas: completely change the approach, by simply resetting the
QMAKE_CFLAGS_OPTIMIZE_* variables in qmake.conf]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/qt5/qt5base: drop wrong optimization flag

In qmake.conf.in has been left 'QMAKE_CXXFLAGS_RELEASE += -O3' but this
leads to not use Buildroot CXXFLAGS when building in release
mode(without debugging symbols). So let's remove it to let Qt5 to follow
Buildroot optimization flags like other packages do.

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/sshguard: new package

sshguard protects hosts from brute-force attacks against SSH and other
services.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
[Peter: cleanup, start init script at S49, correct license, select iptables]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rpi-wifi-firmware: bump to the latest version

Includes the newest firmware as shipped by Raspbian Buster,
the Raspbian release designed for the Pi4

Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rpi-bt-firmware: bump to latest version

Includes the newest firmware as shipped by Raspbian Buster,
the Raspbian release designed for the Pi4

Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

board/raspberrypi: add support for the new pi4

This is based on the pi3 defconfig. There is currently no 64-bit support
since the upstream kernel does not build in this configuration.

Signed-off-by: Michael Cullen <michael@michaelcullen.name>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rpi-firmware: bump version for pi4 support

This commit pulls in the latest version of rpi-firmware to enable support
for the new Pi4.  The Pi4 uses a different set of start files, so it adds
variant selection and copies the Pi4 variant of the files if selected.

Signed-off-by: Michael Cullen <michael@michaelcullen.name>
[Peter: reword / rework slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-numpy: fix run-time failure with clapack

The numpy build system attempts to find lapack/blas at build time. It
tries a lot of different implementations, e.g. lapack, openblas, atlas,
... It is possible to help this automatic discovery by specifying
libraries to load in site.cfg and/or by setting environment variables
BLAS and LAPACK.

Unfortunately, the build system's logic is really hard to understand and
it's fragile. For example, regardless of what is specified as libraries
to load, it *will* try to find libblas.so and liblapack.so. However,
when something is specified explicitly in site.cfg, it will use a
different code path.

It turns out that when we specified the blas and lapack libraries
explicitly, as is done now, the build system logic will assume (without
checking) that cblas is used. This causes calls to cblas_* to be linked
in - again without checking, because numpy contains a copy of the header
and it uses dlopen to load it. clapack, however, does *not* provide
cblas (although it does provide a library libblas.so, but no
libcblas.so). Therefore, when importing numpy at runtime, we get an
error like:

ImportError: /usr/lib/python3.7/site-packages/numpy/core/_multiarray_umath.cpython-37m-arm-linux-gnueabihf.so: undefined symbol: cblas_sgemm

The initial attempt to fix this added cblas to the libraries. This
happens to work because apparently the entire libraries line is ignored
when a non-existing library is added to it (remember, clapack does not
provide libcblas).

Another attempt was to set BLAS=None in the environment. This didn't
have any effect. Setting both BLAS=None and LAPACK=None does disable
lapack and blas, but then we don't use clapack at all.

In fact, it is not necessary to provide a libraries line at all: the
build system will attempt to find liblapack, libblas and libcblas
without any help.

Therefore, remove the libraries line from site.cfg and remove
PYTHON_NUMPY_SITE_CFG_LIBS.

Note that the paths to staging's /usr/include and /usr/lib need to be
specified explicitly. Indeed, the numpy build system doesn't use the
compiler to check the presence/absence of includes and libraries; it
searches the paths itself. It also hardcodes paths to /usr/lib etc, but
this is something that will be tackled in a separate commit.

Note that there is another problem: both lapack and clapack provide
libblas.so and liblapack.so. This will be handled in a later commit.

Also, openblas provides a cblas implementation in libopenblas.so, so
there should be a dependency on openblas to make sure numpy can find it.
This part is not entirely clear yet, so it will also be handled in a
separate commit.

Runtime testing is essential to be able to track this kind of issue, so
that is something that will be added in a separate commit as well.

Fixes:
http://lists.busybox.net/pipermail/buildroot/2019-June/252380.html

Initial patch from Giulio Benetti :
[v1] http://patchwork.ozlabs.org/patch/1100100/
[v2] http://patchwork.ozlabs.org/patch/1100208/

Signed-off-by: Alexandre PAYEN <alexandre.payen@smile.fr>
Cc: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/gsettings-desktop-schemas: bump to version 3.33.1

- Switch to meson-package
- Disable introspection (enabled by default)
- Drop host-intltool (not needed anymore with meson)
- Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/checksec: bump to version 2.1.0

Remove patch, it does not seem to be needed anymore as issue was not
reproduced (see https://github.com/slimm609/checksec.sh/issues/54)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

.gitlab-ci.yml: fix alphabetic ordering

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/hifive_unleashed: new defconfig

This patch adds support for the HiFive Unleashed board. This includes
building the firmware, kernel and rootFS for the HiFive Unleashed.

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
[Thomas:
 - fix the directory name hifive_unleased -> hifive-unleashed
 - drop from readme.txt the instructions about manually flashing each
   partition, since we have a full SD card image
 - drop the custom post-image.sh script]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/opensbi: add support for including Linux payload

Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
[Thomas:
 - Config.in: move the BR2_TARGET_OPENSBI_PLAT dependency to a
   "depends on", there's no need to have an if...endif block just for
   that.
 - Config.in: drop the BR2_TARGET_OPENSBI_LIBRARY_ONLY dependency,
   since this option doesn't exist
 - opensbi.mk: don't use qstrip on BR2_TARGET_OPENSBI_LINUX_PAYLOAD,
   since it's a boolean option
 - opensbi.mk: use += when adding linux to DEPENDENCIES
 - opensbki.mk: refactor the firmware file installation with a loop]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

DEVELOPERS: fix alphabetic ordering of Shyam Saini entries

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nanopi_m4: new defconfig

This initial support includes:
Custom u-boot
Linux v5.1
ATF v2.0
Buildroot default packages

Tested-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
 - Use BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1
 - Use final 5.1 kernel
 - Use default ext2 filesystem]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/olimex_a33_olinuxino: new defconfig

This initial support includes:
u-boot v2019.04
Linux v5.0
Buildroot default packages

Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas: use BR2_TARGET_UBOOT_BOOT_SCRIPT to generate the U-Boot
script, instead of doing it in the post-build]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nanopc_t4: new defconfig

This initial support includes:
Linux 5.1
Custom U-Boot
Arm Trusted Firmware v2.0
Buildroot default packages

Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
 - Use the headers from the kernel, by using
   BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
 - Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/pine64_rockpro64: new defconfig

This initial support includes:
            Linux 5.1
            Custom U-Boot
            Arm Trusted Firmware v2.0
            Buildroot default packages

Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
 - Use the headers from the kernel, by using
   BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
 - Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/radxa_rock_pi4: new defconfig

This initial support includes:
        Linux 5.1
        Custom U-Boot
        Arm Trusted Firmware v2.0
        Buildroot default packages

Tested-by: Akash Gajjar <akash@openedev.com>
Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
 - Use the headers from the kernel, by using
   BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_1=y
 - Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nenopi_neo4: new defconfig

This initial support includes:
        Linux v5.2
        Custom U-Boot
        Arm Trusted Firmware v2.0
        Buildroot default packages

Signed-off-by: Shyam Saini <shyam.saini@amarulasolutions.com>
[Thomas:
 - Use the kernel headers from the kernel, by using
   BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_5_2=y
 - Use the final 5.2 kernel instead of rc1.
 - Use the default ext2 rootfs size]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/quazip: bump to v0.8.1

And also add the hash of the COPYING file

Signed-off-by: Zoltan Gyarmati <zgyarmati@zgyarmati.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/vte: needs host-intltool

Fixes:
 - http://autobuild.buildroot.org/results/30a8032ebba5a30bacd321c407a1d0734fadf757

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu-*: add host-qemu-system

Such config allows to setup gitlab tests for various
qemu architectures (x86, mips, nios2, microblaze, ..., etc)
using the same Qemu version.

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/qemu: remove comment about sh64

sh64 has been removed since commit [1]:

[1] 4338a319b72570e433fd7484f8a95e1e0e978941

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/qemu: enable sparc64 support in host-qemu

This change enables host qemu support for sparc64 which among other
things allows to test this architecture in gitlab.

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/qemu: enable nios2 support in host-qemu

This change enables host qemu support for nios2 which among other
things allows to test this architecture in gitlab.

Signed-off-by: Jugurtha BELKALEM <jugurtha.belkalem@smile.fr>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/csky_gx6605s: bump kernel to 5.0 and use buildroot toolchain

The most important change is to use the toolchain compiled by
buildroot itself. We also bump kernel to 5.0 with kernel.org.

Gx6605s' PHYS_OFFSET if 0x10000000 and we make qemu and gx6605s the
same to ease maintaince. This PHYS_OFFSET is also OK for 610 qemu.

In this patch we add gx6605s.dts in board/csky, because linux-5.0
doesn't contain gx6605s.dts in its tree.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu_cskyXXX_virt: new defconfig

Add C-SKY defconfig for QEMU virt machine.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-matplotlib: needs a toolchain with C++ support

Matplotlib contains .cpp source code:

ls src/*.cpp
src/_backend_agg.cpp
src/_backend_agg_wrapper.cpp
src/_contour.cpp
src/_contour_wrapper.cpp
src/ft2font.cpp
src/ft2font_wrapper.cpp
src/_image.cpp
src/_image_wrapper.cpp
src/mplutils.cpp
src/_path_wrapper.cpp
src/_png.cpp
src/py_converters.cpp
src/_tkagg.cpp
src/_ttconv.cpp
src/_windowing.cpp

So add a dependency on C++ support in the toolchain to fix build errors like
(no autobuilder reference yet):

../output/host/bin/powerpc-buildroot-linux-uclibc-gcc -Wno-unused-result \
  -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -D_LARGEFILE_SOURCE \
  -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Os -fPIC \
  -DFREETYPE_BUILD_TYPE=system \
  -DPY_ARRAY_UNIQUE_SYMBOL=MPL_matplotlib_ft2font_ARRAY_API \
  -DNPY_NO_DEPRECATED_API=NPY_1_7_API_VERSION -D__STDC_FORMAT_MACROS=1 \
  -I../output/host/lib/python3.7/site-packages/numpy/core/include \
  -Iextern/agg24-svn/include \
  -I../output/host/bin/../powerpc-buildroot-linux-uclibc/sysroot/usr/include \
  -I../output/host/bin/../powerpc-buildroot-linux-uclibc/sysroot/usr/include/freetype2 \
  -I. \
  -I../output/host/powerpc-buildroot-linux-uclibc/sysroot/usr/include/python3.7m \
  -c src/ft2font.cpp -o build/temp.linux-x86_64-3.7/src/ft2font.o
powerpc-buildroot-linux-uclibc-gcc.br_real: error: src/ft2font.cpp: C++
  compiler not installed on this system

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/config-fragments/autobuild: make br-arm-internal-glibc bleeding edge

We do not have any configuration that tests the very bleeding edge gcc
and binutils versions, so let's change br-arm-internal-glibc to use
the latest version of gcc (9.x right now) and binutils (2.32 right
now). The idea is that this defconfig should be updated to the latest
version of gcc and binutils when their version is bumped.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/config-fragments/autobuild: update toolchains to 2019.05.1

All toolchains have been rebuilt with Buildroot 2019.05.1. A number of
toolchains are now using Linux headers 5.1 instead of 4.19, because
5.1 is now the default version.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/config-fragments/autobuild: rename br-riscv64-musl config

For internal toolchains, we have a policy of naming the files with
"internal", to clearly distinguish them from external toolchain
configurations.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: add Pierre-Jean Texier for libevent

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libevent: bump to version 2.1.11

See https://github.com/libevent/libevent/releases

Also remove upstreamed patch (already in version)

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gupnp-tools: bump to version 0.8.15

- Switch to meson-package
- Add patch to fix build without gupnp-av

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gupnp: bump to version 1.0.4

- Switch to meson-package
- Disable introspection (enabled by default)
- Disable examples (enabled by default)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gssdp: bump to version 1.0.3

- Switch to meson-package
- Disable examples (enabled by default)
- Disable introspection (enabled by default)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gssdp: add optional libgtk3 dependency

gssdp's sniffer depends on libgtk3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

confis/qemu_mips64r6*_malta: use the default compiler version (gcc 8.x)

Theses defconfig was added at the when gcc 6 was not the default version
used by Buildroot, so the gcc version was explicitely set.

Since then, gcc 8.x is used as the default. So drop BR2_GCC_VERSION_6_X.

Tested with Qemu 2.8.1 (Debian 1:2.8+dfsg-6+deb9u7)
qemu_mips32r6_malta_defconfig
qemu_mips32r6el_malta_defconfig
qemu_mips64r6_malta_defconfig
qemu_mips64r6el_malta_defconfig

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gcc: remove libmudflap option

libmudflap was removed from gcc 4.9 [1] so it depends on gcc <= 4.9.
This option can't be selected since we removed gcc 4.8 from Buildroot
[2].

[1] 4a692aefee10088c385d30e829abf80af1616d1b
[2] f66952197b41452b77dfa065adc7172137e4c243

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gdb: remove gdb 7.12.1

gdb 7.12.1 was released on 21 Jan 2017 [1] and is the last version that
doesn't requires a C++11 compiler.  Since Buildroot now support three other
gdb versions (8.1, 8.2 and 8.3), reduce the number of choice by dropping
7.12.1.

Remove BR2_PACKAGE_GDB_NEEDS_CXX11 symbol since it's not useful
anymore.

[1] https://lists.gnu.org/archive/html/info-gnu/2017-01/msg00009.html

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/quagga: bump to version 1.2.4

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dnsmasq: fix build with kernel >= 5.2

Fixes:
 - http://autobuild.buildroot.org/results/edfe5d208f1626903ce16cd481a29e54f9e8c611

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/pdbg: fix musl build

Fixes:
 - http://autobuild.buildroot.org/results/81b1107bdb06250e1a7837506aec0c9762e771c5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mpv: bump version to 0.29.1

Added license hash, removed patches:

0003: upstream PR was closed as 'merged'
0004: patch was backported and is now included

Renamed license file according to upstream change.

Support for sdl1 was removed upstream:
https://github.com/mpv-player/mpv/commit/1dcf511376545de7624863b76d7f30dc3bb44ac9

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

{linux, linux-headers}: bump 4.{14, 19}.x / 5.2.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mosquitto: bump to version 1.6.4

Bugfix release, fixing a number of issues.  For details, see the
announcement:

https://mosquitto.org/blog/2019/08/version-1-6-4-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/imagemagick: fix host build for old distributions

Fixes:
http://autobuild.buildroot.net/results/5f0/5f0b85033e800c9eebc46812592966ec6826bb5d/

imagemagick uses clock_gettime, which was provided by librt rather than libc
in glibc < 2.17 - Causing link errors.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/Config.in: remove double /

Detected by check-package, which gets confused by it.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

utils/checkpackagelib: CommentsMenusPackagesOrder: properly initialize levels

Fix an issue introduced by Arnout while committing. Jerzy originally
initialized the menu_of_packages, package and print_package_warning
members like they should be, but Arnout thought it wasn't needed and
removed that.

It is actually needed, to make sure the top level (level 0) works.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/264383157
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: improve test_luasyslog

Lua has a builtin lsyslog module, so let's test this one as well.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/mosquitto: fix typo in Config.in

Introduced in ea989ad2b2c2361c47e269dd89cb559edf561db4

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/iputils: fix build with thread support disabled

Fixes:
http://autobuild.buildroot.net/results/10652b7bf6a606f0dd802916006c44abf3e5e059
http://autobuild.buildroot.net/results/9656af1aafbd2624fb75bf5fc1dfa13b6175c10b
http://autobuild.buildroot.net/results/2e170e149b293d40978e158d55dc0102315b9d86

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/pkg-kconfig.mk: new <pkg>-diff-config target

This patch introduces the new target to compare the current
configuration with the one derived from the defconfig + fragments (if
any). It helps identifying settings not yet inserted to the defconfig
or any fragment.

Signed-off-by: Marcel Patzlaff <m.patzlaff@pilz.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/pkg-kconfig.mk: reusability improvements

This patch refactors savedefconfig and the configuration re-generation
to separate macros so that the functionality can be re-used in further
rules.

Signed-off-by: Marcel Patzlaff <m.patzlaff@pilz.de>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Tested-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mtd: needs zstd

For the target variant, zstd is an optional dependency when ubifs-tools
are enabled. For the host variant, we make it an unconditional
dependency.

Fixes:
http://autobuild.buildroot.org/results/99baf1de106f9c80a32e665263c1e4278097643d (target)
http://autobuild.buildroot.org/results/e3b96704f0b23e82999aa3d6e93233edecbecfe7 (host)

Signed-off-by: Julien BOIBESSOT <julien.boibessot@armadeus.com>
Tested-by: Markus Mayer <mmayer@broadcom.com>
[yann.morin.1998@free.fr: fix the target variant too]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/quagga: fix static linking with getopt

quagga has its own copy of getopt_long() instead of using the system's,
and this copy also defines the opterr and optind variables. Obviously,
this is only apparent when linking statically.

This problem can easily be avoided by making sure that getopt() itself
is defined too. This way, there is no reason any more to pull in libc's
getopt() and the corresponding definitions of opterr and optind. Note
that getopt() itself is pulled in by netsnmp, not by quagga itself.

Fortunately, there's a REALLY_NEED_PLAIN_GETOPT flag that we can define
to make sure getopt() does get built by quagga. We can safely do this
unconditionally (instead of only when BR2_PACKAGE_QUAGGA_SNMP and
BR2_STATIC_LIBS are enabled): without netsnmp, getopt() will simply not
be used, and with dynamic libs there's no risk of conflicts anyway.

Fixes:
http://autobuild.buildroot.net/results/0ac598c2259a8d7e8b72d4e8ed95079675b31b84

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/bison: fix parallel build issue

Following the bump of Bison to 3.4.1 in commit
d3c2f33543b91670f8ead627ec7975142b9e6b5a, the build started failing on
autobuilders using a fairly old version of make (3.81). The failure is
caused by a parallel build problem in examples/c/reccalc/.

Fixing it is not trivial, and would require autoreconf, which then
fails due to help2man being missing. So for the time being, simply
disable parallel build on bison.

The issue has been reported to the bug-bison@ mailing list, but the
e-mail doesn't appear yet in the mailing list archives.

Fixes:

  http://autobuild.buildroot.net/results/856/8568bcef944096f2c21470d36f02b520989af5eb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/config-fragments: add RISC-V 64-bit musl autobuild config

Add a RISC-V 64-bit autobuild configuration for the internal
toolchain with musl.

Signed-off-by: Mark Corbin <mark.corbin@embecosm.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dropwatch: remove binutils dependency

Add a patch to make binutils optional and disable it in the context of
buildroot as suggested by Thomas in
https://patchwork.ozlabs.org/patch/1134299

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mono: bump to version 6.0.0.313

This patch bumps mono to version 6.0.0.313 and it's related dependency
monolite to version d0aa6798-834d-11e9-b38a-3b0d70487d01.

The hash of the mono license file has changed, with the following
modification:

-* mcs/nunit24: MS-PL
-

However, this modification is in the "Build Time Code" section, which
describes the license of the parts of the code used only at build
time, which we don't document in the <pkg>_LICENSE
variable. Therefore, no relevant licensing change has occured from the
point of view of <pkg>_LICENSE.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
[Thomas: update the hash of the license file, and add a corresponding
explanation in the commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: security bump version to 7.3.8

Release notes: https://www.php.net/ChangeLog-7.php#7.3.8

Fixes CVE-2019-11042 & CVE-2019-11041

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

system: directly use system shell as root shell

Rather than through the /bin/sh symlink, because because invocating bash as
sh causes bash to mimic sh (see INVOCATION in bash(1)).

Signed-off-by: Philip Molloy <philip.a.molloy@gmail.com>
[yann.morin.1998@free.fr: use the system shell, not a new option,
 as suggested by Arnout]
[Peter: describe why this is done using the description from Philip's help
 text]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

utils/checkpackagelib: CommentsMenusPackagesOrder: use regex for source

The 'source' strings identify which package is incorrectly ordered. We
need to extract the actual package name from that string, which is
currently done with constants that assume the file is package/Config.in.

In addition, only 'source' lines that are indented with a tab are
checked. This kind of indentation is done in package/Config.in, but not
e.g. boot/Config.in.

Therefore, use a regular expression to match the 'source' lines, and to
extract the directory part from it.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

utils/checkpackagelib: CommentsMenusPackagesOrder: append elements to arrays if needed

In the future, the nesting level of menus, comments and conditions may
increase. The fixed array length used now is not appropriate. Therefore,
append elements to the arrays if needed.

Also change order of variables.

Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

utils/checkpackagelib: CommentsMenusPackagesOrder: fix 'menuconfig' handling

The CommentsMenusPackagesOrder check builds the 'state' to track the
depth of menus and conditions. However, a menuconfig doesn't create a
menu by itself - it is always followed by a condition that implies the
menu. As a result, when unwinding the 'state', the level will be wrong.

Fix this by checking for menu followed by a space, so it no longer
matches menuconfig. For consistency, do the same for comment and if
as well.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gst1-plugins-good: add shout2 plugin option

Signed-off-by: Arnold Bloemert <abloemert@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/piglit: new package

Piglit is an open-source test suite for OpenGL implementations.
It's an python3 script based around several tools like glxinfo,
wflinfo, dmesg.

Even though waffle support can be replaced by freeglut,
using pliglit with waffle is recommended since freeglut
will be replaced by waffle.

Add host-python-{mako,numpy,six} dependency since the build system
is checking with the host-python interpreter.

There is no comment about waffle dependency due to too complex
dependencies of waffle.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[Reworked during the Buildroot summer camp 2019]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Arnout: small corrections to license info. It's messy.]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: use virtio-rng-pci to test syslog-ng

Recent versions of syslog-ng need some entropy on startup.
So use VirtIORNG to provide it. In order to accomplish this:
 - build the kernel containing the driver;
 - pass '-device virtio-rng-pci' to qemu.

Use the same kernel version and kernel config as qemu_arm_versatile.
It already has PCI enabled but it does not have HW_RANDOM_VIRTIO, so add
a defconfig fragment to enable the drivers.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/259856394

At the same time, fix a typo (missing '#') that resulted in the
generation of root.tar. This file is not used in the test.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/atmel: kernel needs host openssl to build

Since commit df7005975e5a8419918600b1fcac57799a0ff5da, the linux
configuration requires host-openssl to be built.

Reported-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/atmel: bump to linux4sam_6.1

Only the atmel_sama5d27_som1 board was bumped to linux4sam_6.1 so update
the other boards.

Moreover, display variant device trees are no longer in the linux4sam
kernel tree as we have adopted the DT overlays. In case of interest for those
DTs, please use the Microchip external available here:
https://github.com/linux4sam/buildroot-external-microchip

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

board/atmel: genimage: remove display variant dtbs

Display variant dtbs are no longer part of the linux-at91 tree.

Signed-off-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iputils: use capabilities if possible

If support for extended attributes is enabled, then we can use them to
store capabilities. If not, we keep using the setuid bit.

arping does not get a capability, as it can be used for arp poisoning.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[yann.morin.1998@free.fr:
  - resort to using q full-fledged conditional block
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iputils: drop setuid on arping

arping can be used for arp poisoning, so it should really not be setuid.

Reported-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Acked-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gmrender-resurrect: bump to version a7b0b1b9ca482d2d34ac62c2f2dc0cf0dfbb702b

Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cloop: bump to version 3.14.1.2

- Remove patch, it is not needed anymore as CFLAGS/LDFLAGS are now
  correctly passed to extract_compressed_fs. CFLAGS/LDFLAGS are not
  passed to cloop_suspend but it isn't built. Moreover original CFLAGS
  are lost but this is acceptable)
- Switch site to http://snapshot.debian.org/archive/debian as
  http://debian-knoppix.alioth.debian.org/packages/sources/cloop is not
  available anymore
- Add hash for license files

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cloop: needs _GNU_SOURCE

host-cloop needs _GNU_SOURCE for loff_t otherwise build fails with gcc
8.3.0 on:
extract_compressed_fs.c: In function 'main':
extract_compressed_fs.c:55:2: error: unknown type name 'loff_t'; did you mean 'off_t'?
  loff_t *offsets;

Fixes:
 - No autobuilder failures

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qemu: fix host virtfs option

Fix the build of host-qemu with virtfs enabled: fix a typo in makefile
conditional and add a dependency on host-libcap as that is a dependency of
virtfs support:

    if test "$virtfs" != no && test "$cap" = yes && test "$attr" = yes ; then
      virtfs=yes

The virtfs configuration option was added by commit e0f49e648401
("package/qemu: add option to enable virtual filesystem in host qemu").

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Etienne Carriere <etienne.carriere@linaro.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/glib-networking: needs dynamic library

glib-networking uses the meson's shared_module function

This is a partly revert of commit
ed3eef6bb49270de619e5a86a249fdd8724c40cd 'package/glib-networking: bump
to version 2.61.1' re-adding the dynamic library dependency due to the
meson's build system and not from gnutls

Fixes:
 - http://autobuild.buildroot.org/results/60037e37e020404485df9814f3f3ad4e3b2abdb3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

.gitlab-ci.yml: regenerate for new defconfig

Commit a8fac3fcfc2c71 introduced qemu_ppc_mac99_defconfig but forgot to
add it to .gitlab-ci.yml.

Do that now.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/263733672
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/assimp: bump to version 4.1.0

- Remove second patch (already in version)
- Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/llvm: disable libxml2

libxml2 is needed during Windows builds to populate the COFF
file manifest info.  This isn't required for Linux builds.

Cc: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package llvm/clang: note about version bumping dep

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Acked-by: Romain Naour <romain.naour@smile.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/python-django: security bump to version 2.2.4

Fixes the following security issues:

CVE-2019-14232: Denial-of-service possibility in django.utils.text.Truncator

If django.utils.text.Truncator's chars() and words() methods were passed the
html=True argument, they were extremely slow to evaluate certain inputs due
to a catastrophic backtracking vulnerability in a regular expression.  The
chars() and words() methods are used to implement the truncatechars_html and
truncatewords_html template filters, which were thus vulnerable.

The regular expressions used by Truncator have been simplified in order to
avoid potential backtracking issues.  As a consequence, trailing punctuation
may now at times be included in the truncated output.

CVE-2019-14233: Denial-of-service possibility in strip_tags()

Due to the behavior of the underlying HTMLParser,
django.utils.html.strip_tags() would be extremely slow to evaluate certain
inputs containing large sequences of nested incomplete HTML entities.  The
strip_tags() method is used to implement the corresponding striptags
template filter, which was thus also vulnerable.

strip_tags() now avoids recursive calls to HTMLParser when progress removing
tags, but necessarily incomplete HTML entities, stops being made.

Remember that absolutely NO guarantee is provided about the results of
strip_tags() being HTML safe.  So NEVER mark safe the result of a
strip_tags() call without escaping it first, for example with
django.utils.html.escape().

CVE-2019-14234: SQL injection possibility in key and index lookups for
JSONField/HStoreField

Key and index lookups for django.contrib.postgres.fields.JSONField and key
lookups for django.contrib.postgres.fields.HStoreField were subject to SQL
injection, using a suitably crafted dictionary, with dictionary expansion,
as the **kwargs passed to QuerySet.filter().

CVE-2019-14235: Potential memory exhaustion in
django.utils.encoding.uri_to_iri()

If passed certain inputs, django.utils.encoding.uri_to_iri could lead to
significant memory usage due to excessive recursion when re-percent-encoding
invalid UTF-8 octet sequences.

uri_to_iri() now avoids recursion when re-percent-encoding invalid UTF-8
octet sequences.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nano: bump version to 4.3

Release notes:
https://lists.gnu.org/archive/html/info-gnu/2019-06/msg00004.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dhcp: fix target installation

We don't use "make install" for the target installation so we must pick
the executables from the ".libs" directories on which libtool generates
them otherwise we install the automatically generated wrapper scripts.

This was not necessary before the upgrade to version 4.4.1.

Fixes: https://bugs.busybox.net/show_bug.cgi?id=12051
Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/rtorrent: bump to version 0.9.8

Remove patch (already in version) and drop AUTORECONF as it is not
needed anymore

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libtorrent: bump to version 0.13.8

Remove both patches (already in version) and drop AUTORECONF as it is
not needed anymore

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/tinyxml2: bump to version 7.0.1

Even though the hash of the license file changes, there are no changes
in the licensing terms themselves. There are changes in other parts of
readme.md, and whitespace changes in the licensing terms, but no
licensing term changes per-se.

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
[Thomas: add explanation about the license file hash change]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>