DEVELOPERS: add Gwenhael Goavec-Merou for librtlsdr

Even though librtlsdr was initially introduced by Jason Pruitt in
2014, and Jason is still listed in the DEVELOPERS file for this
package, in recent times it's mainly Gwenhael who has been taking of
this package. Let's reflect that in the DEVELOPERS file so that
Gwenhael gets notified when there are librtlsdr issues.

Cc: Jason Pruitt <jrspruitt@gmail.com>
Cc: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/librtlsdr: fix version fetching when code is extracted from tarball

librtlsdr currently fails to build on the autobuilders, as it fails
for out of tree builds. Indeed, there is some CMake logic in librtlsdr
that determines the version using Git. This works fine when librtlsdr
is fetched from Git of course. But in the context of Buildroot,
librtlsdr is extracted from a tarball.

For an in-tree build, the "git describe" invocation goes all the way
up to the Buildroot .git/ metadata, and uses that as the librtlsdr
version (it's of course wrong, but the build works). In an out-of-tree
build, there is no parent directory with .git/ metadata, so Git fails,
the VERSION variable is empty and later CMake aborts the build because
of that.

We fix that by adjusting the version retrieving logic to only use Git
if a .git/ metadata folder is found at the root of the librtlsdr
source tree. The patch has been submitted upstream.

Fixes:

  http://autobuild.buildroot.net/results/ea52be1da8ed03272db06679d5a0a441ffe6ea0c/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/htop: add patch for fixing build with gcc 10

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/x11r7/xserver_xorg-server: add security fix for CVE-2020-14347

Release notes:
https://lists.x.org/archives/xorg-announce/2020-July/003051.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Thomas: add IGNORE_CVES entry.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python3-decorator: use PYTHON3_DECORATOR_VERSION

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libfuse3: bump to version 3.9.4

Drop patch (already in version). The commit list between 3.9.2 and
3.9.4 is just made of fixes:

db9b4fa148e6c22c0d4b4c567fa65d1cd5368152 Released 3.9.4
50cbca799c1f9b010fabaa0dd4a387f29d140873 fuse_send_data_iov(): correctly calculate total buffer size.
7b3e3899157566875280a8b860eb5ad5c73eadc1 Define fuse_session_loop_mt as a macro on uclibc and MacOS (#532)
c5e8684b5a2f3400af6d7a3edcaeb3ce8ffc51b5 Fixed typo in command to compile program (#536)
e8a9e84672dcaa892d4708c163f768dc177b6d4c Doc fixes (#537)
d1deae6968c49d83334e874c33abfe15824c4548 Fix FreeBSD CI (#539)
48450411647ca0818821af7b05b819ceff92ae7c Fix: crash on failure to set locale (#529)
9e1c2a4959c16c0b50090dd822389ad9acb08111 fuse_lowlevel: Move assert for se before dereferencing it with se->debug (#530)
7471156354002c6547aa6c3a4f39a3262f435ba4 Fixed minor print alignment issue in iconv_help(), replacing tab with space (#519)
9fa4dc1661f085d4e89a54d75acc3347d52f33fa Fix the typo "filed" -> "field" in fuse manpage (#524)
717c8b8b3ed815f14e5607a995d0113446e3fb0b README: Correct the directory name from 'examples' to 'example' (#526)
032db1ab298d62c4d0c5be1f9fb2df299aec2346 docs: Replace `mesonconf` with `meson configure` (#528)
06342ca60ed822b856990915f127d8beddc0d1f6 libfuse: Assign NULL to "old" to avoid free it twice (#522)
5021d6a0a100d4987be126e87b7ee5fbfc17bbdc Typo fixed. (#520)

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mtd: crypto support needs headers >= 4.12

crypto support includes <linux/hash_info.h> since version 2.1.2 and
https://github.com/sigma-star/mtd-utils/commit/a739b59efe7996e3bdcbe8b17743dc05ac7c110a

However, linux/hash_info.h is only exported since kernel 4.12:
https://github.com/torvalds/linux/commit/fcc8487d477a3452a1d0ccbdd4c5e0e1e3cb8bed

Fixes:
 - http://autobuild.buildroot.org/results/dbaeed9e9e2af191166808d2d6d6d3c2e5051c2c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/scripts/pkg-stats: show progress of upstream URL and latest version

This commit slightly improves the output of pkg-stats by showing the
progress of the upstream URL checks and latest version retrieval, on a
package basis:

Checking URL status
[0001/0062] curlpp
[0002/0062] cmocka
[0003/0062] snappy
[0004/0062] nload
[...]
[0060/0062] librtas
[0061/0062] libsilk
[0062/0062] jhead
Getting latest versions ...
[0001/0064] libglob
[0002/0064] perl-http-daemon
[0003/0064] shadowsocks-libev
[...]
[0061/0064] lua-flu
[0062/0064] python-aiohttp-security
[0063/0064] ljlinenoise
[0064/0064] matchbox-lib

Note that the above sample was run on 64 packages. Only 62 packages
appear for the URL status check, because packages that do not have any
URL in their Config.in file, or don't have any Config.in file at all,
are not checked and therefore not accounted.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/scripts/pkg-stats: use aiohttp for upstream URL checking

This commit reworks the code that checks if the upstream URL of each
package (specified by its Config.in file) using the aiohttp
module. This makes the implementation much more elegant, and avoids
the problematic multiprocessing Pool which is causing issues in some
situations.

Suggested-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/scripts/pkg-stats: use aiohttp for latest version retrieval

This commit reworks the code that retrieves the latest upstream
version of each package from release-monitoring.org using the aiohttp
module. This makes the implementation much more elegant, and avoids
the problematic multiprocessing Pool which is causing issues in some
situations.

Since we're now using some async functionality, the script is Python
3.x only, so the shebang is changed to make this clear.

Suggested-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libabseil-cpp: make check-package happy

The "depends on" must be after the "default" properties.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/677751258

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/testing/tests/boot/test_atf: DTC needed for ATF Vexpress test

Since the bump of ATF to 2.2 for the ATF Vexpress test case in commit
fc3d6a3ed0f5f1ceda7ab64b8b2bee88abd29373
("support/testing/tests/boot/test_atf: update U-Boot/ATF use in
TestATFVexpress"), DTC is now needed otherwise the build fails with:

make[2]: dtc: Command not found
Makefile:873: recipe for target 'build/juno/release/fdts/juno_tb_fw_config.dtb' failed

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934470

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libabseil-cpp: add BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS

The libabseil-cpp package fails to build on a number of CPU
architectures in our autobuilders.

On most CPU architectures, the first issue looked like this:

libabseil-cpp-20200225/absl/base/internal/direct_mmap.h: In function 'void* absl::lts_2020_02_25::base_internal::DirectMmap(void*, size_t, int, int, int, off64_t)':
libabseil-cpp-20200225/absl/base/internal/direct_mmap.h:121:39: error: static assertion failed: Platform is not 64-bit
  121 |   static_assert(sizeof(unsigned long) == 8, "Platform is not 64-bit");
      |                 ~~~~~~~~~~~~~~~~~~~~~~^~~~
libabseil-cpp-20200225/absl/base/internal/direct_mmap.h:123:15: error: 'SYS_mmap' was not declared in this scope; did you mean 'SYS_mmap2'?
  123 |       syscall(SYS_mmap, start, length, prot, flags, fd, offset));
      |               ^~~~~~~~
      |               SYS_mmap2

Indeed, on 32-bit architectures, libabseil-cpp has some special code
to use the mmap2() system call, and it white-lists the supported
architectures. It is therefore trivial to add support for more
architectures.

However, once this is fixed, another issue arises:
absl/debugging/internal/examine_stack.cc uses the ucontext data
structures, which are not provided by uClibc-ng on all CPU
architectures, and even the code of libabseil-cpp does not exist for
all CPU architectures.

So, this commit solves that by simply making libabseil-cpp available
on architectures/C libraries where it is supported: it needs ucontext
support in the toolchain + a CPU architecture where
absl/debugging/internal/examine_stack.cc has the appropriate logic.

This new dependency is propagated to the reverse dependencies of
libabseil-cpp.

With this commit, libabseil-cpp passes a test-pkg -a test (so all
external toolchains used by the autobuilders):

                             andes-nds32 [ 1/45]: SKIPPED
                             arm-aarch64 [ 2/45]: OK
                        br-aarch64-glibc [ 3/45]: OK
                           br-arcle-hs38 [ 4/45]: SKIPPED
                            br-arm-basic [ 5/45]: SKIPPED
                  br-arm-cortex-a9-glibc [ 6/45]: OK
                   br-arm-cortex-a9-musl [ 7/45]: OK
                   br-arm-cortex-m4-full [ 8/45]: SKIPPED
                             br-arm-full [ 9/45]: OK
                    br-arm-full-nothread [10/45]: SKIPPED
                      br-arm-full-static [11/45]: SKIPPED
                   br-i386-pentium4-full [12/45]: OK
                br-i386-pentium-mmx-musl [13/45]: OK
                       br-m68k-5208-full [14/45]: SKIPPED
                      br-m68k-68040-full [15/45]: SKIPPED
                    br-microblazeel-full [16/45]: SKIPPED
                 br-mips32r6-el-hf-glibc [17/45]: OK
                      br-mips64-n64-full [18/45]: OK
                 br-mips64r6-el-hf-glibc [19/45]: OK
                      br-mipsel-o32-full [20/45]: OK
                          br-nios2-glibc [21/45]: SKIPPED
                      br-openrisc-uclibc [22/45]: SKIPPED
               br-powerpc-603e-basic-cpp [23/45]: SKIPPED
             br-powerpc64le-power8-glibc [24/45]: OK
               br-powerpc64-power7-glibc [25/45]: OK
                  br-powerpc-e500mc-full [26/45]: SKIPPED
                              br-riscv32 [27/45]: OK
                              br-riscv64 [28/45]: OK
                         br-riscv64-musl [29/45]: OK
                             br-sh4-full [30/45]: SKIPPED
                        br-sparc64-glibc [31/45]: SKIPPED
                         br-sparc-uclibc [32/45]: SKIPPED
                    br-x86-64-core2-full [33/45]: OK
                          br-x86-64-musl [34/45]: OK
                          br-xtensa-full [35/45]: SKIPPED
                       linaro-aarch64-be [36/45]: OK
                          linaro-aarch64 [37/45]: OK
                              linaro-arm [38/45]: OK
                     sourcery-arm-armv4t [39/45]: OK
                            sourcery-arm [40/45]: OK
                     sourcery-arm-thumb2 [41/45]: OK
                         sourcery-mips64 [42/45]: OK
                           sourcery-mips [43/45]: OK
                          sourcery-nios2 [44/45]: SKIPPED
                         sourcery-x86-64 [45/45]: OK
45 builds, 18 skipped, 0 build failed, 0 legal-info failed

Fixes:

  http://autobuild.buildroot.net/results/ead663b4b67b0b57ed003a46db3182d95cc01bc0/
  (and many similar build failures)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/libabseil-cpp: fix build on RISC-V 32-bits

This commit backports an upstream patch that fixes the build on RISC-V
32-bits.

Fixes:

  http://autobuild.buildroot.net/results/c6c2c99bdba8c840d52fe0464d26aca169ea1d90/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/libfuse3: define fuse_session_loop_mt as a macro on uclibc

This will fix a build failure with fuse-overlayfs

Fixes:
 - http://autobuild.buildroot.org/results/7186515526ee60488dac3bf9c4580ffd13a0ceac

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: actually backport upstream commit]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

configs/qemu_arm_vexpress_tz_defconfig: bump ATF version, cleanup config

Bump to a later version of ATF and cleanup the Python
configuration. Previously this configuration had to work around Python
3 issues with OP-TEE. Now this relies on OP-TEE properly building
itself with host-python3.

Signed-off-by: Dick Olsson <hi@senzilla.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/optee-os: depend on host-python3

Recent versions of OP-TEE depend on Python 3. Currently, OP-TEE is
building with the Python interpreter provided by the user. This patch
includes an upstream patch that makes the interpreter configurable,
and makes use of this configuration with host-python3.

Signed-off-by: Dick Olsson <hi@senzilla.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python3-pycryptodomex: new package

This package will ensure that pycryptodomex is built for Python 3.
Comments in both python-pycryptodome and python3-pycryptodomex are
added to ensure they stay in sync.

Signed-off-by: Dick Olsson <hi@senzilla.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/minizip: fix build with gcc 4.8

Fixes:
 - http://autobuild.buildroot.org/results/b8baff4b86923d29163ce5cc9e391904d81fc90c

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/prosody: luabitop is only needed with Lua 5.1

The luabitop package is only available with Lua 5.1. LuaJIT, Lua 5.3
or more recent versions of Lua have this functionality built-in.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/luabitop: depends on lua 5.1

In preparation for the introduction of Lua 5.4, clarify the dependency
of luabitop: it only makes sense when used with Lua 5.1.

Also update the comment to no longer mention Lua 5.2, since we don't
support Lua 5.2 in Buildroot anymore.

Note that as explained in https://luajit.org/extensions.html, LuaJit
already implements luabitop functions, so luabitop is really for Lua
5.1 only, not for all Lua interpreters that implemented the 5.1 ABI.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/setools: install for host-python3

setools needs python3 since version 4.2.0 and
https://github.com/SELinuxProject/setools/commit/e292a77c52ed882707c8d165e77914837367313f

However today in Buildroot, when no target python is selected, or when
BR2_PACKAGE_PYTHON=y, all host python modules are installed for
host-python, i.e Python 2. But this module won't install in Python 2,
so let's force its host variant to be installed with Python 3 on the
host. Of course, for that to work, its dependency must also be built
for host-python3, so we change it to the newly introduced
host-python3-cython package.

Fixes:
 - http://autobuild.buildroot.org/results/c2febcea5fbd8a21709721524ae9e9b5fc0896f9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python3-cython: new package

The host-setools package needs to be built for the host-python3, even
when the target Python is not necessarily Python 3.x. Since it depends
on host-python-cython, we need a Python 3 variant of it, which this
patch introduces.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Tested-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: bump version to 7.4.9

Changelog of this bugfix release:
https://www.php.net/ChangeLog-7.php#7.4.9

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen8mn: Linux needs host-openssl

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934109

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen8mm: Linux needs host-openssl

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934107

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen8m: Linux needs host-openssl

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934102

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen7: Linux needs host-openssl

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934100

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen6x: Linux needs host-openssl

The kernel configuration used for the nitrogen6x defconfig needs
host-openssl.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934098

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/nitrogen6sx: Linux needs host-openssl

The kernel configuration used for the nitrogen6x defconfig needs
host-openssl.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934095

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/globalscale_espressobin: Linux needs host-openssl

The kernel configuration used for the globalscale_espressobin
defconfig needs host-openssl.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674933954

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/microchip_sama5d27_wlsom1_ek_mmc_dev: use bluez5-utils instead of bluez-utils

bluez-utils has been removed, so use bluez5-utils instead for the
microchip_sama5d27-wlsom1_ek_mmc_dev configuration, to avoid a build
failure due to legacy options being selected.

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/674934030

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libcamera: needs faligned-new

Fixes:

  - http://autobuild.buildroot.net/results/2db7292e251ce81d31187c3a9eb36dbc9236bd07

  ../src/libcamera/v4l2_videodevice.cpp: In member function 'int libcamera::V4L2VideoDevice::allocateBuffers(unsigned int, std::vector<std::unique_ptr<libcamera::FrameBuffer> >*)':
  ../src/libcamera/v4l2_videodevice.cpp:1139:39: error: 'new' of type 'libcamera::V4L2BufferCache' with extended alignment 8 [-Werror=aligned-new=]
   1139 |  cache_ = new V4L2BufferCache(*buffers);
        |                                       ^
  ../src/libcamera/v4l2_videodevice.cpp:1139:39: note: uses 'void* operator new(std::size_t)', which does not have an alignment parameter
  ../src/libcamera/v4l2_videodevice.cpp:1139:39: note: use '-faligned-new' to enable C++17 over-aligned new support
  ../src/libcamera/v4l2_videodevice.cpp: In member function 'int libcamera::V4L2VideoDevice::importBuffers(unsigned int)':
  ../src/libcamera/v4l2_videodevice.cpp:1315:36: error: 'new' of type 'libcamera::V4L2BufferCache' with extended alignment 8 [-Werror=aligned-new=]
   1315 |  cache_ = new V4L2BufferCache(count);
        |                                    ^
  ../src/libcamera/v4l2_videodevice.cpp:1315:36: note: uses 'void* operator new(std::size_t)', which does not have an alignment parameter
  ../src/libcamera/v4l2_videodevice.cpp:1315:36: note: use '-faligned-new' to enable C++17 over-aligned new support

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/x11r7/xlib_libX11: bump version to 1.6.11

Reformatted license hash.

Quoting release notes:
https://lists.x.org/archives/xorg-announce/2020-August/003053.html
"This release fixes a regression introduced by the security patches in
 1.6.10.
 See https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/116 for
 details."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: avoid optimization flags added by meson

Efl's meson build system add some optimization flags related to cpu
architecture [1]. In the context of Buildroot, such optimization flags
are already provided by the toolchain wrapper.

For ppc, efl's meson expect the altivec support is available but this is
not the case for ppc e500 cpus.

Disable native-arch-optimization option to avoid such issue.

[1] https://git.enlightenment.org/core/efl.git/tree/meson.build?h=v1.24.3#n165

Fixes:
http://autobuild.buildroot.net/results/dd2586be32c25d93eebfaa743c1f7d36915bb0d7

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/f2fs-tools: fsck should use correct returncodes

fsck.f2fs does not implement the returncodes from the fsck interface.
This is particularly bad if systemd is used with a root f2fs partition,
as it will interpret the rc as order to reboot.

for thread & pending upstream fix see:
https://sourceforge.net/p/linux-f2fs/mailman/message/37079401/

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-rpi-gpio: fix build with gcc 10.x

0001-fix-build-with-gcc-10.x.patch: Add patch to fix build with gcc 10.x

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/smstools3: fix build with gcc 10.x

0001-fix-build-with-gcc-10.x.patch: Add patch to fix build with gcc 10.x
Fetch from: https://salsa.debian.org/debian-mobcom-team/smstools/-/blob/57a358a9eebbe2ca5639cc526f7027944ed95ea1/debian/patches/gcc10.patch

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/apache: security bump version to 2.4.46

Changelog: http://archive.apache.org/dist/httpd/CHANGES_2.4.46

Release notes: https://downloads.apache.org/httpd/Announcement2.4.html

Fixes CVE-2020-9490, CVE-2020-11984 & CVE-2020-11993:
https://httpd.apache.org/security/vulnerabilities_24.html

Added sha512 hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[yann.morin.1998@free.fr:
  - don't add md5 and sha1 hashes
  - single comment above hashes
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/boost: fixup Optimization flag in boost build

When building with Boost Build the CXXFLAGS are extended depending
on the optimization level set. When not defined explicitly the
optimization level depends on the <variant>. For release it's 'speed'
and for debug it's set to 'off'

These flags overwrite the -O flag passed in with TARGET_CXXFLAGS as
it is appended when calling g++.

This commit sets the Optimization flags generated by Boost Build
to the value of TARGET_OPTIMIZATION no matter what level is used.

As Boost Build offers no nice way to alter those values the gcc
toolchain file is altered directly.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/libabseil-cpp: needs dynamic library support

The libabseil-cpp build needs <dlfcn.h>, so let's add a
!BR2_STATIC_LIBS dependency. The only package which is selecting
libabseil-cpp, grpc, already had this dependency anyway.

Fixes:

  http://autobuild.buildroot.net/results/2d796dd4cc43388da235b83f53778d902f477799/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/tftpd: fix build with gcc 10.x

Take a patch from Fedora to fix the build of tftpd with gcc 10.x.

Fixes:

  http://autobuild.buildroot.net/results/750ddefd2c31872fd44e9ae70d87048d8512849d/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/feh: update hash of license file

In commit 8d8caaf0c295e60fadc0dc14039376bfecb379fa ("package/feh: bump
version to 3.4.1"), feh was bumped from 3.4 to 3.4.1.

However, the hash of the license file was not updated, even though the
COPYING file had seen a copyright year update:

-Copyright (C) 2010-2018 Daniel Friesel.
+Copyright (C) 2010-2020 Daniel Friesel.

Let's update the license file hash to fix legal-info.

Fixes:

  http://autobuild.buildroot.net/results/991fb57bc99c2f44a00c846688f1b3e017b87724/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

Update for 2020.08-rc1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/uboot: Fix kconfig to use $(BR2_MAKE)

U-Boot must use $(BR2_MAKE) as it uses a Make feature from v4.0. We
already use $(BR2_MAKE) in the BUILD_CMDS, but the kconfig commands
still uses $(MAKE). Without this fix, building U-Boot with kconfig will
fail with the following cryptic error.

> Makefile:37: *** missing separator.  Stop.

Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/pkg-kconfig: Support custom $(MAKE)

The U-Boot package requires GNU Make v4.0 or later, and so all U-Boot
"make" commands must use "$(BR2_MAKE)" so they use the host-make
package. Currently pkg-kconfig is hardcoded to uses $(MAKE), so add a
way to support $(BR2_MAKE). The package infra for pkg-automake and
pkg-cmake have a similar problem, and they solved it by defining a
$(PKG)_MAKE variable, and allowing each package to override it.

Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

CHANGES: update for 2020.08-rc1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/config-fragments/autobuild: update bleeding-edge br-arm-internal-glibc

Update our bleeding edge br-arm-internal-glibc defconfig to use the
latest version of gcc and binutils, so that we test these in the
autobuilders.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/librtlsdr: bump to last commit

Last official release is 2 years ago.

Current master branch provides fixes and improvements:
- fix crash with usbfs mmap with usb controler has no DMA support and kernel < 5.6 [1].
- better SDR dongle configuration

This patch:
- bump librtlsdr to d794155ba65796a76cd0a436f9709f4601509320 (2020/03/18)
- adapt 0001-disable_shared_library_target_in_build.patch
  (http://lists.osmocom.org/pipermail/osmocom-sdr/2020-May/002075.html)
- add option to enable/disable zerocopy buffer on non arm platform

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/usb/core?h=v5.8-rc3&id=a0e710a7def471b8eb779ff551fc27701da49599

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/busybox: enable flags for use as systemd pager

If the less package is not enable and systemd is enabled,
then configure the less applet to fully work with systemd.

systemd sets the flags for less in an environment variable
and requires a few options for correct display.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/testing/tests/boot/test_atf: update U-Boot/ATF use in TestATFVexpress

This simply updates to more modern versions of ATF and U-Boot.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ima-evm-utils: bump version to 1.3

added tpm2-tss as dependency (needed for ima_boot_aggregate cmd for
reading PCR; better to use libtss2-esys and libtss2-rc than require
tsspcrread binary in runtime)

added also sha1 hash from sourceforge

added 2 patches fixing build (both are 1.3 specific)

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lxc: fix build when __NR_signalfd is not available

Fixes:
 - http://autobuild.buildroot.org/results/75096a48d2dbda57459523db3ed0952e63f93535

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/glibc: fix build on RISC-V with gcc 10.x

Backport upstream commit to use __has_include:
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=28dd3939221ab26c6774097e9596e30d9753f758

Otherwise glibc fails to build with gcc 10:

warning: "__has_include__" is not defined, evaluates to 0 [-Wundef]
../sysdeps/unix/sysv/linux/riscv/flush-icache.c:24:21: error: missing binary operator before token "("
   24 | #if __has_include__ (<asm/syscalls.h>)
      |                     ^

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618374

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Alistair Francis <Alistair.Francis@wdc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu_mips64r6: fix Linux kernel build with gcc 10.x

From [1]

"GCC 10 (PR 91233) won't silently allow registers that are not architecturally
available to be present in the clobber list anymore, resulting in build failure
for mips*r6 targets in form of:
...
.../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
  146 |  __asm__ volatile (  \
      |  ^~~~~~~

This is because base R6 ISA doesn't define hi and lo registers w/o DSP extension.
This patch provides the alternative clobber list for r6 targets that won't include
those registers."

Since kernel 5.4 and mips support for generic vDSO [2], the kernel fails to build
for mips r6 cpus with gcc 10 for the same reason as glibc.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=24640f233b466051ad3a5d2786d2951e43026c9d

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618363
https://gitlab.com/kubu93/buildroot/-/jobs/655618364

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu_mips32r6: fix Linux kernel build with gcc 10.x

From [1]:

"GCC 10 (PR 91233) won't silently allow registers that are not architecturally
available to be present in the clobber list anymore, resulting in build failure
for mips*r6 targets in form of:
...
.../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
  146 |  __asm__ volatile (  \
      |  ^~~~~~~

This is because base R6 ISA doesn't define hi and lo registers w/o DSP extension.
This patch provides the alternative clobber list for r6 targets that won't include
those registers."

Since kernel 5.4 and mips support for generic vDSO [2], the kernel fail to build
for mips r6 cpus with gcc 10 for the same reason as glibc.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=24640f233b466051ad3a5d2786d2951e43026c9d

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618359
https://gitlab.com/kubu93/buildroot/-/jobs/655618360

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/valgrind: bump version to 3.16.1

* 3.16.1 fixes two critical bugs discovered after 3.16.0 was frozen.
  for details see [1].
* changed SITE from ftp to https.

[1] https://www.valgrind.org/docs/manual/dist.news.html

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: add FFI extension support

Signed-off-by: Tom Marcuzzi <tom.marcuzzi@orolia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/nginx: drop gdlib-config

Drop gdlib-config and use pkg-config to find gd.
Indeed, gdlib.pc is available since version 2.1.0 and
https://github.com/libgd/libgd/commit/071a2a94ee9f9e5ce00ff689dfe67a0fcb885ad6
and gdlib-config has been dropped from version 2.3.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/meson: update rpath patch to upstream version

The version of this patch merged by upstream has some changes to rpath
syntax matching and handling for additional syntax edge cases.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: disable portabled

portabled is a container-like service, but so far its still a preview
and basically unknown as the portablectl is hidden in
/usr/lib/systemd.

Disable it for now.

See https://systemd.io/PORTABLE_SERVICES/

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove util-linux nologin dependency

if the tool is not enabled, then configure /bin/false
as fallback.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove util-linux binaries dependency

None of the tools in this set are necessary.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove libblkid dependency

this dependency is optional, it is used to
allow udev to add information to blockdevices.
Aslong as MOUNT or FSCK are enabled, it will end up enabled
anyway, but this seems more clear and correct.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: import does not need bzip2 and lz4

Those are optional dependencies.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: support new v246 options

This adds switches for new options:

initrd: Installs services if systemd is used on an initramfs,
useless otherwise

kernel-install: helper scripts to update kernel with an
systemd-boot partition

analyze: tool to analyze bootup and dependencies

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: bump version to 246

Add zstd as optional dependency, and
disable new options for host-systemd.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: keep X11 input 2.2+ enabled

Since efl 1.23, X11 input 2.2+ has been enabled by default [1].

>From [2]:
"It would be a pretty unusual system to have x and no xinput2.2 support."

While at it, enable explicitely X11 input 2 (enabled by default).

[1] https://git.enlightenment.org/core/efl.git/commit/?id=cf005ac54abdea843e5731765e41e5088275249f
[2] https://sourceforge.net/p/enlightenment/mailman/message/37065780/

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/enlightenment: bump to version 0.24.2

- Disable new dependency on polkit for now.
- Add OFL license for fonts.
- Update COPYING file hash.
- Update indentation in hash file (two spaces)

See:
https://www.enlightenment.org/news/e24.2

enlightenment 0.24 require efl >= 1.24.

https://git.enlightenment.org/core/enlightenment.git/commit/?id=4b6467685e7ac9ae68f08bd524f332a908f5fa74

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/terminology: bump to version 1.8.0

See:
https://www.enlightenment.org/news/2020-07-26-terminology-1.8.0

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: bump to version 1.24.3

- Remove upstream patch [1].
- evas-modules option removed since all evas-modules are now built shared. [2]
- Make sure that mono is disabled [3].
- gstreamer support removed from emotion & evas [4].
- emotion-loaders-disabler & emotion-generic-loaders-disabler removed [5].
- Add openjpeg dependency for jp2k evas loader [6] otherwise the build
  system fail when only libjpeg.so is provided (jpeg-turbo or libjpeg).
- Update COMPLIANCE file hash due to esacpe library removal [7].
- Update COPYING file hash due to new csharp,cxx libraries and esacpe,emotion
  removal [8].
- Remove bullet dependency from recommended option for efl [9].
- Add new patches to fix build with "Unknown variable" issue with meson.
- Fix Evas_Engine_GL_Drm.h include path.

[1] https://git.enlightenment.org/core/efl.git/commit/?id=a2afcfc872c29bd2c4a60fdafbc655c90f938d1e
    https://git.enlightenment.org/core/efl.git/commit/?id=c245b576aad09ac5faeb800de7f7c4fef87c6363
[2] https://git.enlightenment.org/core/efl.git/commit/?id=6d8e39a6425e721eb40e0cb1e67f1cbf5b223cc0
[3] https://git.enlightenment.org/core/efl.git/commit/?id=17a81bee4a53891e44a165a14ca20027f9aa0824
[4] https://git.enlightenment.org/core/efl.git/commit/?id=b8dc80c144fec54a521987535c57b995748ccece
[5] https://git.enlightenment.org/core/efl.git/commit/?id=075bab83c4288b5de20f6acfc6b0459656ea85e0
[6] https://git.enlightenment.org/core/efl.git/commit/?id=8ec6e28b7cc568a8bb636de90b2dd10f19db2be3
[7] https://git.enlightenment.org/core/efl.git/commit/?id=f3d9b8ee703621cfbb52a03d346335148318af7a
[8] https://git.enlightenment.org/core/efl.git/commit/?id=40a980174b7e29e6946f7425bd7a238ae45900f8
    https://git.enlightenment.org/core/efl.git/commit/?id=a3ade15d5a45e7d564b7c1304f561af9c4203991
    https://git.enlightenment.org/core/efl.git/commit/?id=31da42a0503556a59c190efcb0a79331e828bf6c
[9] https://git.enlightenment.org/core/efl.git/commit/?id=523a64d2265c13a82ba73022d10919f0e392bab2

See:
https://www.enlightenment.org/news/efl-1.24.0
https://www.enlightenment.org/news/efl-1.24.1
https://www.enlightenment.org/news/efl-1.24.2
https://www.enlightenment.org/news/efl-1.24.3

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: bump to version 1.23.2

- Remove upstream patch [1].
- Switch to meson build system.
- The cryptography backend is now mandatory, use openssl for the host
  and use openssl by default for the target if gnutls is not selected.
- Add host-giflib since the dependency can't be disabled anymore.
  (even by adding gif in HOST_EFL_EVAS_LOADERS_DISABLER).
- Disable explicitely meson build options that was not previously handled
  (avahi, emotion, ecore-imf-loarders...)
- Elput support is now enabled through drm meson option [2], remove
  BR2_PACKAGE_EFL_ELPUT.
- Update license file hash (csharp licensing information, cxx bindings
  licensing)
- Add COPYING.images and licenses/COPYING.ASL license file.
- The evas png loader is now mandatory [3] (even by adding png in
  EFL_EVAS_LOADERS_DISABLER).
- Same for the evas gif loader [4].
- Backport an upstream patch to fix the evas build with -Dwl=false.
- Update indentation of hash file (two spaces)

See:
https://www.enlightenment.org/news/efl-1.23.0
https://www.enlightenment.org/news/efl-1.23.1
https://www.enlightenment.org/news/efl-1.23.2

[1] https://git.enlightenment.org/core/efl.git/commit/?id=c46a8143916f0d3f66bbdffc7107c97c88df212d
[2] https://git.enlightenment.org/core/efl.git/tree/meson.build?h=v1.23.3#n297
[3] https://git.enlightenment.org/core/efl.git/tree/src/modules/evas/meson.build?h=v1.23.3#n2
[4] https://git.enlightenment.org/core/efl.git/tree/src/modules/evas/meson.build?h=v1.23.3#n4

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/sam-ba: bump to version 3.3.1

sam-ba tool moved to github, changed license to GPLv2 and dropped x86
support.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/fmt: bump to version 7.0.2

See full changelog: https://github.com/fmtlib/fmt/releases/tag/7.0.2

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/at91bootstrap3: enable for cortexa7

Enable this bootloader for cortex a7 based SoCs: support for the
sama7g5 SoC is now in upstream at91bootstrap3, and it is a Cortex-A7
based SoC.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ruby: security bump to version 2.4.10

Fixes the following security issues:

- CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional
  fix)
  https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/cups: bump to version 2.3.3

This patch bumps cups to version 2.3.3.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Tested-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/cups: add proper init script

Cups service for systemv was erroneously installed in /etc/rcX.d and
therefore not working. Also, its init script installed in /etc/init.d
was definitely not a Buildroot-style init script.

This patch adds a Buildroot style init script instead of using the
example provided by the package.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gd: fix CVE-2018-14553 and CVE-2019-6977

- Fix CVE-2018-14553 : gdImageClone in gd.c in libgd 2.1.0-rc2 through
  2.2.5 has a NULL pointer dereference allowing attackers to crash an
  application via a specific function call sequence.

- Fix CVE-2019-6977: gdImageColorMatch in gd_color_match.c in the GD
  Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch
  function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14,
  and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be
  exploited by an attacker who is able to trigger imagecolormatch calls
  with crafted image data.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wayland: fix build with toolchains without c++

Fixes
http://autobuild.buildroot.net/results/fb2/fb205601cac2bbf8e70ec2bf4eaf22264d8edc96/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: security bump to version 2.0.19

Fixes the following security issues:
* Fix CVE-2018-9154
  https://github.com/jasper-software/jasper/issues/215
  https://github.com/jasper-software/jasper/issues/166
  https://github.com/jasper-software/jasper/issues/175
  https://github.com/jasper-maint/jasper/issues/8

* Fix CVE-2018-19541
  https://github.com/jasper-software/jasper/pull/199
  https://github.com/jasper-maint/jasper/issues/6

* Fix CVE-2016-9399, CVE-2017-13751
  https://github.com/jasper-maint/jasper/issues/1

* Fix CVE-2018-19540
  https://github.com/jasper-software/jasper/issues/182
  https://github.com/jasper-maint/jasper/issues/22

* Fix CVE-2018-9055
  https://github.com/jasper-maint/jasper/issues/9

* Fix CVE-2017-13748
  https://github.com/jasper-software/jasper/issues/168

* Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505
  https://github.com/jasper-maint/jasper/issues/3
  https://github.com/jasper-maint/jasper/issues/4
  https://github.com/jasper-maint/jasper/issues/5
  https://github.com/jasper-software/jasper/issues/88
  https://github.com/jasper-software/jasper/issues/89
  https://github.com/jasper-software/jasper/issues/90

* Fix CVE-2018-9252
  https://github.com/jasper-maint/jasper/issues/16

* Fix CVE-2018-19139
  https://github.com/jasper-maint/jasper/issues/14

* Fix CVE-2018-19543, CVE-2017-9782
  https://github.com/jasper-maint/jasper/issues/13
  https://github.com/jasper-maint/jasper/issues/18
  https://github.com/jasper-software/jasper/issues/140
  https://github.com/jasper-software/jasper/issues/182

* Fix CVE-2018-20570
  https://github.com/jasper-maint/jasper/issues/11
  https://github.com/jasper-software/jasper/issues/191

* Fix CVE-2018-20622
  https://github.com/jasper-maint/jasper/issues/12
  https://github.com/jasper-software/jasper/issues/193

* Fix CVE-2016-9398
  https://github.com/jasper-maint/jasper/issues/10

* Fix CVE-2017-14132
  https://github.com/jasper-maint/jasper/issues/17

* Fix CVE-2017-5499
  https://github.com/jasper-maint/jasper/issues/2
  https://github.com/jasper-software/jasper/issues/63

* Fix CVE-2018-18873
  https://github.com/jasper-maint/jasper/issues/15
  https://github.com/jasper-software/jasper/issues/184

* Fix CVE-2017-13750
  https://github.com/jasper-software/jasper/issues/165
  https://github.com/jasper-software/jasper/issues/174

Furthermore, drop now upstreamed patches and change to the new
jasper-software upstream location.

Signed-off-by: Michael Vetter <jubalh@iodoru.org>
[Peter: reword for security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cc-tool: bump to version 0.27

- Switch site to get latest version
- Drop patches (already in version)
- Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/vdr: fix build with glibc 2.31

Fixes:
 - http://autobuild.buildroot.org/results/b8475cfddee94d2938be98356e53328b5cd064b5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/unbound: bump version to 1.11.0

Signed-off-by: Stefan Ott <stefan@ott.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libmbim: bump version to 1.24.2

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/waffle: bump version to 1.6.1

Release notes for v1.6.1:
https://lists.freedesktop.org/archives/mesa-announce/2020-March/000575.html

Removed patch 0001 which was applied upstream.

Switched _SITE to gitlab according to release notes for v1.6.0:
https://lists.freedesktop.org/archives/mesa-announce/2019-June/000520.html

Added -Dwaffle_has_nacl=OFF to CONF_OPTS to disable nacl support, this
avoids adding a dependency to C++:
https://gitlab.freedesktop.org/mesa/waffle/-/commit/6ca943584e593aec2bd4f9c66d91859e63e02d61#9a2aa4db38d3115ed60da621e012c0efc0172aae_27_26

Added support for mesa3d surfaceless egl:
https://gitlab.freedesktop.org/mesa/waffle/commit/7318f22c4761035c03e99420edf3e92f07e06c9c

Added support for bash-completion:
https://gitlab.freedesktop.org/mesa/waffle/-/blob/maint-1.6/CMakeLists.txt#L189

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cryptography: bump to version 3.0

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cbor2: bump to version 5.1.2

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-pycryptodomex: bump to version 3.9.8

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-yarl: bump to version 1.5.1

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/sysdig: Fix check-package

This patch fixes a couple of 'check-package' errors:

package/sysdig/sysdig.mk:23: remove trailing backslash
package/sysdig/sysdig.mk:25: consecutive empty lines

Signed-off-by: Stephane Viau <stephane.viau@oss.nxp.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

boot/grub2: Backport Boothole securify fixes

Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html

Fixes the following security issues:

 * CVE-2020-10713
   A flaw was found in grub2, prior to version 2.06. An attacker may
   use the GRUB 2 flaw to hijack and tamper the GRUB verification
   process. This flaw also allows the bypass of Secure Boot
   protections. In order to load an untrusted or modified kernel, an
   attacker would first need to establish access to the system such as
   gaining physical access, obtain the ability to alter a pxe-boot
   network, or have remote access to a networked system with root
   access. With this access, an attacker could then craft a string to
   cause a buffer overflow by injecting a malicious payload that leads
   to arbitrary code execution within GRUB. The highest threat from
   this vulnerability is to data confidentiality and integrity as well
   as system availability.

 * CVE-2020-14308
   In grub2 versions before 2.06 the grub memory allocator doesn't
   check for possible arithmetic overflows on the requested allocation
   size. This leads the function to return invalid memory allocations
   which can be further used to cause possible integrity,
   confidentiality and availability impacts during the boot process.

 * CVE-2020-14309
   There's an issue with grub2 in all versions before 2.06 when
   handling squashfs filesystems containing a symbolic link with name
   length of UINT32 bytes in size. The name size leads to an
   arithmetic overflow leading to a zero-size allocation further
   causing a heap-based buffer overflow with attacker controlled data.

 * CVE-2020-14310
   An integer overflow in read_section_from_string may lead to a heap
   based buffer overflow.

 * CVE-2020-14311
   An integer overflow in grub_ext2_read_link may lead to a heap-based
   buffer overflow.

 * CVE-2020-15706
   GRUB2 contains a race condition in grub_script_function_create()
   leading to a use-after-free vulnerability which can be triggered by
   redefining a function whilst the same function is already
   executing, leading to arbitrary code execution and secure boot
   restriction bypass

 * CVE-2020-15707
   Integer overflows were discovered in the functions grub_cmd_initrd
   and grub_initrd_init in the efilinux component of GRUB2, as shipped
   in Debian, Red Hat, and Ubuntu (the functionality is not included
   in GRUB2 upstream), leading to a heap-based buffer overflow. These
   could be triggered by an extremely large number of arguments to the
   initrd command on 32-bit architectures, or a crafted filesystem
   with very large files on any architecture. An attacker could use
   this to execute arbitrary code and bypass UEFI Secure Boot
   restrictions. This issue affects GRUB2 version 2.04 and prior
   versions.

Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rauc: bump version to 1.4

Signed-off-by: Yair Ben Avraham <yairba@protonmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xlib_libX11: security bump version to 1.6.10

Fixes CVE-2020-14344:
https://lists.x.org/archives/xorg-announce/2020-July/003050.html

Removed md5 & sha1 hashes, upstream does not provide them anymore.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cython: bump to version 0.29.21

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-pynacl: bump to version 1.4.0

We need to backport a commit to fix a build failure cased by a spurious
wheel dependency.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-six: bump to version 1.15.0

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-txaio: bump to verison 20.4.1

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/{protobuf, python-protobuf}: bump to version 3.12.4

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/mesa3d: xvmc needs x11

This is a follow-up patch to

https://git.buildroot.net/buildroot/commit/package/mesa3d?id=e79ee3b0f91aa3eb1b20d86701a195e3bd9a26d3

to make sure that MESA3D_PLATFORMS contains x11 needed by xvmc:
https://cgit.freedesktop.org/mesa/mesa/tree/meson.build?h=20.1#n510

Fixes
http://autobuild.buildroot.net/results/dae/dae41e30d2ac69b768ec0a5b795a2e559c35bcd3/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>