package/exim: add upstream security fix for CVE-2019-10149

A flaw was found in Exim versions 4.87 to 4.91 (inclusive).  Improper
validation of recipient address in deliver_message() function in
src/deliver.c may lead to remote command execution.

For more details, see the advisory:

https://www.exim.org/static/doc/security/CVE-2019-10149.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libcurl: bump version to 7.65.1

Fixes a number of bugs discovered after the 7.65.0 release.

https://daniel.haxx.se/blog/2019/06/05/7-65-1-patched-up-and-ready-to-go/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/autossh: bump version to 1.4g

Version 1.4g most notably addresses a bug that could see an alarm signal
occur without a handler, causing autossh to exit inappropriately.

Signed-off-by: Einar Jon Gunnarsson <tolvupostur@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/luv: update hash

Upstream removed (using git force-push) and recreated version 1.29.1-1
and re-uploaded the source tarball. Therefore, the hash has changed and
needs to be updated.

See:
https://github.com/luvit/luv/issues/330

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nanomsg: bump version to 1.1.5

Signed-off-by: Brett Gyarfas <brett.gyarfas@ontera.bio>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 4.{9, 14, 19}.x / 5.{0, 1}.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/busybox: add dependency on dosfstools

dosfstools and busybox may each install mkfs.vfat, so dosfstools must
be installed before busybox.

Signed-off-by: Markus Mayer <mmayer@broadcom.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: Drop support for some packages from Francois Perrad

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Merge branch 'next'

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Kickoff 2019.08 cycle

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website/news.html: add 2019.05 announcement link

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2019.05

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mender-artifact: needs host-xz

host-xz (for lzma) is needed since version 3.0.0 and
https://github.com/mendersoftware/mender-artifact/commit/8f1b79b03fded3a923d948878905ac5fefe59893

Fixes:
 - http://autobuild.buildroot.org/results/c7cecf8946e9d4b4ae118b5f7597638c70decd3f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openjdk: needs host-gawk

Fixes:
 - http://autobuild.buildroot.org/results/bb1bb1cf8b58bf28039186866ed01521114acb72

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/poppler: bump version to 0.77.0

For the version bump, the makefile had to be rewritten for CMake, as
the project moved from autotools to CMake.

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
[Thomas:
 - update again to the lastest poppler version, 0.77.0
 - drop license related changes, since the licensing terms haven't
   changed, and they are not completely clear
 - keep the openjpeg, jpeg and lcms2 dependencies optionals
 - explicitly enable/disable more dependencies
 - bump gcc version dependency to gcc 5.x, and update the Config.in
   comment accordingly
 - don't introduce many sub-options, simply rely on the availability
   of dependencies, or on BR2_SOFT_FLOAT
 - drop libx11/libxext dependencies, no longer used]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/cups-filters: bump to version 1.23.0

This bump is necessary to be compatible with poppler 0.77.0.

Patch 0002-Poppler-removed-memCheck-and-gMemReport-functions.patch is
removed, because it was merged upstream in commit
6b0747c1630dd973acd138f927dbded4ea45e360.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/oprofile: bump to version 1.3.0

Remove second patch (already in version)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/speexdsp: bump to version 1.2.0

Drop patch 0001 which is included in the new release.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/network-manager: drop unrecognized --without-docs

--without-docs was not recognized since at least version 1.8.4, see:
http://autobuild.buildroot.org/results/e1464adf0069952ef0561a0a9b501d26bd409c4a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/network-manager: drop --disable-ifnet

ifnet has been drop since version 1.12.0 and
https://github.com/NetworkManager/NetworkManager/commit/0474441e2258eeecb356e2aa3cde5c7328828646

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/luv: bump to version 1.29.1-1

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libuv: bump to version 1.29.1

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/alsa-lib: bump to version 1.1.9

Drop patch 0002 which is included in the new version.

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-matplotlib: drop redundant !PYTHON dependency

Having both:

       depends on !BR2_PACKAGE_PYTHON
       depends on BR2_PACKAGE_PYTHON3

is kind of useless, and we don't do that for any other Python package
that needs Python 3. So, this commit just drops the depends on
!BR2_PACKAGE_PYTHON.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

Config.in.legacy: fix check-package warnings

Fixes the following warnings:

Config.in.legacy:153: help text: <tab><2 spaces><62 chars> (http://nightly.buildroot.org/#writing-rules-config-in)
Config.in.legacy:154: help text: <tab><2 spaces><62 chars> (http://nightly.buildroot.org/#writing-rules-config-in)
Config.in.legacy:155: help text: <tab><2 spaces><62 chars> (http://nightly.buildroot.org/#writing-rules-config-in)
Config.in.legacy:156: help text: <tab><2 spaces><62 chars> (http://nightly.buildroot.org/#writing-rules-config-in)

which were introduced in commit
55c642287819a062d52e7f290c76ada778772fba ("arch/csky: remove
BR2_CSKY_DSP option")

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-matplotlib: rewrap Config.in help text

The wrapping looked somewhat arbitrary, and not optimized to fill in
the 72 characters we allow.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-matplotlib: depends on BR2_PACKAGE_PYTHON_NUMPY_ARCH_SUPPORTS

BR2_PACKAGE_PYTHON_MATPLOTLIB selects BR2_PACKAGE_PYTHON_NUMPY, so it
should inherit its dependencies, which includes
BR2_PACKAGE_PYTHON_NUMPY_ARCH_SUPPORTS.

Fixes:
 - http://autobuild.buildroot.org/results/038d50784ec80b35e3daff1966df07a1b52780b3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gcc: don't build a toolchain for powerpc with spe ABI with gcc >= 8.x

The powerpc*-*-*spe* support has been deprecated in GCC 8 [1] and has
been removed in GCC 9 [2].

While building with GCC 8, the build stop since we don't provide --enable-obsolete
option.

For now, keep powerpcspe support in Buildroot but only for older compiler
up to GCC 7.

Note: Although we can't select Glibc for powerpcspe since commit [4], this
support has been removed for the next version of Glibc (the upcoming 2.30).

[1] https://gcc.gnu.org/ml/gcc/2018-04/msg00102.html
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=b31d0348ddada49453e3edaaf93a423fdc61dc79
[3] https://sourceware.org/git/?p=glibc.git;a=commit;h=a053e878494080f7070cf92890e546057236c9c9
[4] https://git.buildroot.net/buildroot/commit/?id=5777e3ffd99132a57e3d29659850eec14b1625f8

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/Config.in.powerpc: remove unused gcc target abi options for powerpc

gcc target abi options for powerpc were added by [1] and renamed by [2]
to BR2_PPC_ABI_* but never used. Since always BR2_GCC_TARGET_ABI is empty
when using a powerpc toolchain.

Buildroot currently support SPE and Classic target ABI, nothing seems
to require a specific gcc target abi option.

This patch is a cleanup like commit [3].

[1] 7d8a59b40e46fa6ed84a5b78644327e97d04adef
[2] 98175bd43dbfc70f473cca6759bc8a2f4e655734
[3] fd08153b9d677d654add6c580b9ccc5c27d672e2

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Cyril Bur <cyrilbur@gmail.com>
Cc: Sam Bobroff <sam.bobroff@au1.ibm.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

{linux, linux-headers}: bump 4.{9, 14, 19}.x / 5.{0, 1}.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/v4l2loopback: bump to version 0.12.2 to fix Linux 5.1 compat

This fixes a kernel 5.1.x compatibility issue. The only changes
between 0.12.1 and 0.12.2 are:

d3b198ef6f57ca512fb25147c9d85b922fd4651a Released v0.12.2
376c2c28bd7d4470cd92ff646d6087ca70cd9d2e fixed typo
6edc4b164b1f05bee74cb507a4f50776a65ceb73 mentioned support for 5.0.0
0b8feb80fdef9a415d8250bca1790b3ff23e8391 Replace v4l2_get_timestamp with ktime_get_ts(64)
541e3bc7aaf46dc9a21f92c7f527397fce03dfd8 Update README.md

So the only functional change is the actual ktime_get_ts() fix, which
is needed for Linux 5.1 compatibility. Therefore, bumping is pretty
much the same as backporting just this commit.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Thomas: extend the commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lapack: bump version to 3.8.0

Release notes: http://www.netlib.org/lapack/lapack-3.8.0.html

Added license hash, adjusted source tarball URL.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mender-artifact: bump version to 3.0.0

Two license files are changed, with just a copyright year update.

A new license file is added, as it is listed in
LIC_FILES_CHKSUM.sha256.

Signed-off-by: Raul Hidalgo Caballero <deinok@deinok.com>
[Thomas: fix license file hashes, add a missing license file]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/wpewebkit: fix build with musl

Fixes:
 - http://autobuild.buildroot.org/results/c703d45ab691641beabc3440f081a8bc195b4a23

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/dropbear: add option to provide file with localoptions.h

As discussed in https://patchwork.ozlabs.org/patch/1104071/, this
commit adds a new option that allows the user to provide a file that
contains custom definitions to tweak the Dropbear configuration. It
will be appended to Dropbear's localoptions.h file before the build.

The patch was tested successfully with the DO_MOTD option.

Suggested-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
[Thomas: tweak commit log, rename config option.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/netsurf: disallow on archs requiring ABI specific CFLAGS

Fixes:
http://autobuild.buildroot.net/results/67ef520d82ea529a9fe593d83a3aeae5f8b0ee5d/
http://autobuild.buildroot.net/results/eafc3e4be571d5ecee549a11530ac4e508f31782/
http://autobuild.buildroot.net/results/ba7f30833fef54162a82f4b336a72d6599594526/

The netsurf build system mixes up host and target CFLAGS, so it isn't
compatible with architectures where we pass ABI specific compiler flags (in
TARGET_ABI).

Add a _ARCH_SUPPORTS kconfig variable matching the TARGET_ABI logic we have
in package/Makefile.in, and use it to disallow netsurf for those
architectures.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/swig: enable PCRE regex matching in host-swig

The upcoming ogre package needs a host swig binary with PCRE
regex support.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/zziplib: new package

Force the build system to use python2 interpreter.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
[Thomas: add docs/COPYING.MPL docs/copying.htm to the license files.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/wireshark: security bump to version 3.0.2

The following vulnerabilities have been fixed:
 - wnpa-sec-2019-19 Wireshark dissection engine crash. Bug 15778.

Update patches to use the ones merged upstream

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libopenssl: fix static build

no-dso option has been removed with
https://github.com/openssl/openssl/commit/31b6ed76dfd53529b74e79830c81372d0b756929

To fix this error, use "gcc" target in static builds. This target is
very minimalistic, we need to manually pass -lpthread and
-DOPENSSL_THREADS however we can also remove libdl workarounds

Fixes:
 - http://autobuild.buildroot.org/results/96d6b89d20980e8f7fa450b832474a81d492b315

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

arch/csky: enable internal toolchain support

Now that we have support for C-SKY in gcc, binutils and glibc, we can
use Buildroot to build a C-SKY toolchain.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/linux-headers: restrict versions available on C-SKY

The C-SKY architecture was merged in the upstream Linux kernel
4.20. Therefore, kernel headers from a Linux version earlier than that
cannot be used to build a C-SKY toolchain.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/glibc: add C-SKY specific version

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gdb: add C-SKY specific version

Add gdb build for C-SKY Architecture:

 - Support host-gdb
 - Support gdbserver for target

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gcc: add C-SKY specific gcc version

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/binutils: add C-SKY specific version

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/Makefile: add C-SKY ABI variable value

In preparation for adding support for the C-SKY architecture in the
internal toolchain backend, we need to make sure that GNU_TARGET_NAME
will contain the appropriate ABI, i.e abiv1 or abiv2 depending on the
selected C-SKY core.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/csky: add support for the ck860 core

ck860 is newest CPU core of C-SKY with high performance & SMP
supported.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/csky: specify BR2_GCC_TARGET_FLOAT_ABI

The C-SKY architecture uses two different ABIs, depending on the core
being used:

 - "abiv1" is a mcore based ISA with ELF_NUM:39 and does not support
   FPU & VDSP. It is used only for the ck610 core.

 - "abiv2" is C-SKY's own ISA with ELF_NUM:252 and supports FPU &
   VDSP. It is used for the ck807, ck810, ck860 cores.

Since "abiv1" does not support FPU, BR2_GCC_TARGET_FLOAT_ABI will
always have the value "soft" for the ck610 core.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Thomas: rework commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/csky: add support for VDSP extensions

VDSP is C-SKY enhanced extension instruction set for SIMD, AI and DSP
operation. It is supported by abiv2, used by the ck807, ck810, ck860
cores.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Thomas: update help text in Config.in.legacy about the BR2_CSKY_DSP
option.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/csky: remove BR2_CSKY_DSP option

The DSP extention is in fact no longer used for C-SKY, nor supported
by C-SKY gcc, so we remove it.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Thomas: split from the VDSP patch, add Config.in.legacy]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

arch/csky: move GCC_TARGET_CPU calculation to arch.mk.csky

Calculating GCC_TARGET_CPU requires combining multiple flags, which
isn't very nicely expressed in Config.in, so let's move this into
arch.mk.csky, similarly to what is done in arch.mk.riscv.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Thomas: rework commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/gnuconfig: update to 2019-05-28

This update includes support for the C-SKY architecture.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-by: Yann E. MORIN <yann.morin.1998@free.fr>

support/gnuconfig/config.sub: add C-SKY support

Modify config.sub so that it knows about the C-SKY
architecture. Without this, all autotools projects fail to build on
C-SKY.

Signed-off-by: Guo Ren <ren_guo@c-sky.com>
[Thomas: improved commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mender: bump to version 2.0.0

In addition:
  - Update hashes for license files due to copyright year change.
  - Add hash for vendor/golang.org/x/text/LICENSE
  - Add hash for vendor/github.com/mendersoftware/go-liblzma/LICENSE
  - Add new dependency xz, as mender now depends on LZMA.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/openmpi: fix build failure due to Gcc Bug 68485

Package openmpi manifests Microblaze Gcc Bug 68485 resulting in a build
failure due to an Internal Compiler Error.

As done for other packages in Buildroot work around this Gcc Bug by
setting optimization to -O0 if BR2_TOOLCHAIN_HAS_GCC_BUG_68485=y.

Fixes:
http://autobuild.buildroot.net/results/8f3/8f334427e7475154d69469f8ee4efab6df80e403/

Signed-off-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gstreamer1/gst1-plugins-bad: require dynamic library for decklink plugin

The decklink plugin uses <dlfcn.h> functions: dlopen(), dlsym(), etc.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/opencv3: bump to version 3.4.6

- Remove patch (already in version)
- Update hash of license file (update in year:
  https://github.com/opencv/opencv/commit/14d943f588474cee3cdb8f91e8f7fb7e8af7ad8b)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/opencv3: fix build due to gcc bug 68485

With Microblaze Gcc version <= 9.x the build fails due to gcc bug 68485:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68485. The bug show up when
building opencv3 with optimization but not when building with -O0. To
work around this, if BR2_TOOLCHAIN_HAS_GCC_BUG_68458=y, we force using
-O0.

Fixes:
 - http://autobuild.buildroot.org/results/c78eac84d1c5a6702e7759cd5364da1c3e399b4b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Giulio Benetti <giulio.benetti@micronovasrl.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/dosfstools: introduce custom install routine

We can't use dosfstools' install target, because it'll install *all*
binaries, even the disabled ones. Also, we can't just delete dosfstools
binaries from the target directory after installing them, because other
packages (specifically Busybox) may provide tools of the same name, and
we may end up deleting those instead.

To avoid any issues, we create our own install routines, which only
copy the enabled binaries into the target location.

Signed-off-by: Markus Mayer <mmayer@broadcom.com>
[Thomas: use full destination path for INSTALL commands.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

DEVELOPERS: add Mirza Krak to mender-artifact package

Signed-off-by: Mirza Krak <mirza.krak@northern.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mender: update readme.txt

Provide additional details on how Mender works within Buildroot.

Signed-off-by: Mirza Krak <mirza.krak@northern.tech>
[Thomas: remove duplicate "Default configuration files" title, rewrap
text]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ell: fix build with uclibc

Fixes:
 - http://autobuild.buildroot.org/results/444c9deb728fb041e560d940145f96cc4f455080

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libnss: security bump to version 3.42.1

Fixes the following security issues:

(3.41) CVE-2018-12404: Cache side-channel variant of the Bleichenbacher
attack

(3.42.1) CVE-2018-18508: Add additional null checks to several CMS functions
to fix a rare CMS crash.  Thanks to Hanno Böck and Damian Poddebniak for the
discovery and fixes

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libopenssl: security bump to version 1.1.1c

Fixes the following security issues:

Prevent over long nonces in ChaCha20-Poly1305 (CVE-2019-1543)

ChaCha20-Poly1305 is an AEAD cipher, and requires a unique nonce input for
every encryption operation.  RFC 7539 specifies that the nonce value (IV)
should be 96 bits (12 bytes).  OpenSSL allows a variable nonce length and
front pads the nonce with 0 bytes if it is less than 12 bytes.  However it
also incorrectly allows a nonce to be set of up to 16 bytes.  In this case
only the last 12 bytes are significant and any additional leading bytes are
ignored.

It is a requirement of using this cipher that nonce values are unique.
Messages encrypted using a reused nonce value are susceptible to serious
confidentiality and integrity attacks.  If an application changes the
default nonce length to be longer than 12 bytes and then makes a change to
the leading bytes of the nonce expecting the new value to be a new unique
nonce then such an application could inadvertently encrypt messages with a
reused nonce.

Additionally the ignored bytes in a long nonce are not covered by the
integrity guarantee of this cipher.  Any application that relies on the
integrity of these ignored leading bytes of a long nonce may be further
affected.  Any OpenSSL internal use of this cipher, including in SSL/TLS, is
safe because no such use sets such a long nonce value.  However user
applications that use this cipher directly and set a non-default nonce
length to be longer than 12 bytes may be vulnerable.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/{mesa3d, mesa3d-headers}: bump version to 19.0.5

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libva: bump version to 2.4.1

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

infra/pkg-kconfig: do not rely on package's .config as a timestamp

Since linux-4.19, the kernel's build system internally touches its
.config file.

However, we currently used that file as a timestamp to detect whether
our kconfig fixups were to be (re)applied or not, which in turn is used
to decide whether we should (re)build the package or not.

But with latest kernel versions, this timestamp heuristic is now broken,
and we always rebuild the kernel on subsequent builds.

We fix that by introducing a separate timestamp file of our own, which
we know the kernel (or the kconfig-based packages, for that matters)
does not use.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas De Schampheleire <patrickdepinguin@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iwd: bump to version 0.18

Fix build with ell 0.20

Fixes:
 - http://autobuild.buildroot.org/results/2bd1fb482ee5d963fa335d1fddd90ee6cf96a0d6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/terminology: bump to version 1.4.1

See https://www.enlightenment.org/news/2019-05-24-terminology-1.4.1

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/efl: bump to version 1.22.2

See https://www.enlightenment.org/news/efl-1.22.2

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wireless_tools: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/ustr: add hashes for license files

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/udisks: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/swig: add hashes for license files

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/polkit: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/parted: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libxml-parser-perl: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/kmod: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/intltool: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gperf: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gmp: add hashes for license files

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/fontconfig: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dbus-python: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dbus-glib: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cmake: add hash for license file

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bzip2: add hash for license file

Also add a standard sha256 hash for the package itself.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/attr: add hashes for license files

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/acl: add hashes for license files

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-panel: fix build with NLS

Fixes:
 - http://autobuild.buildroot.org/results/3e72c2c2baae3a70fb5145b1b09a1f3716e4bce2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dropbear: rework license information

According to the LICENSE file curve25519-donna is licensed under
BSD-3-Clause license.

There is only BSD-2-Clause license mentioned so remove
BSD-2-Clause-like.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/netcat-openbsd: bump to version 1.195-2

Cc: Maxime Hadjinlian <maxime.hadjinlian@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

usbutils: bump to version 012

Drop the patch adding license files since they are now in the tarball.

On the other hand, a configure script is no longer distributed with the
tarball. Upstream considers that to be "safer":

  https://www.spinics.net/lists/linux-usb/msg179970.html

Don't remove the usb-devices script; it doesn't needs bash anymore.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

toolchain/toolchain-external/toolchain-external-andes-nds32: add missing dependencies/select

This external toolchain is pre-built for x86, so it can only work on
x86 and x86-64, and for the latter, the ia32 libraries are necessary.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cython: bump to version 0.29.9

Fixes a number of crashes / bugs. For details, see:
https://github.com/cython/cython/blob/master/CHANGES.rst

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iproute2: fix build with musl libc

Add a patch fixing collision of definitions between libc and kernel
headers.

Fixes:
http://autobuild.buildroot.net/results/d38d3a84c61f37747c652382646839a69de16463/
http://autobuild.buildroot.net/results/41bd8e53b51a96f1b29d7ba0d8661a6dfc958415/

Cc: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/php: security bump version to 7.3.6

Release notes: https://www.php.net/archive/2019.php#id2019-05-30-1

Fixes
CVE 2019-11038: https://bugs.php.net/bug.php?id=77973
CVE 2019-11039: https://bugs.php.net/bug.php?id=78069
CVE 2019-11040: https://bugs.php.net/bug.php?id=77988

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nano: bump to version 4.2

Use the usual enable/disable options for the libmagic optional
dependency.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/gnuconfig: update README.buildroot with reality

4 out of 5 packages who are not using autotools but needed their
gnuconfig files updated were not complying with the recommandation in
support/gnuconfig/README.buildroot. The fifth package was converted to
be like the others: use UPDATE_CONFIG_HOOK as a <pkg>_POST_PATCH_HOOKS
rather than calling the CONFIG_UPDATE macro directly.

Now that all packages are consistent, update the README.buildroot file
to match the reality.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/lmbench: use UPDATE_CONFIG_HOOK instead of CONFIG_UPDATE

jimtcl, perl, usb_modeswitch and x264 are registering
UPDATE_CONFIG_HOOK as a post patch hook to get their gnuconfig files
updated. lmbench is the only package calling CONFIG_UPDATE directly,
so for consistency, let's make it use the same logic as jimtcl, perl,
usb_modeswitch and x264.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>