Petr Vorel [Thu, 21 Jan 2021 19:12:08 +0000 (20:12 +0100)]
package/ltp-testsuite: bump version to
20210121
Add --disable-metadata configure option. Buildroot by default disable
packages' doc generation. Also generating LTP metadata documentation
would require have host package, which could be complicated since the
LTP build system is autoconf but not automake based.
Drop cacheflush01 patch (from this release) and rebase musl workaround
patch.
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Petr Vorel [Thu, 21 Jan 2021 19:12:07 +0000 (20:12 +0100)]
package/ltp-testsuite: update patch status
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Baruch Siach [Thu, 21 Jan 2021 17:16:04 +0000 (19:16 +0200)]
package/tcpdump: bump to version 4.99.0
Drop upstream security patch.
Rename --with-system-libpcap to --disable-local-libpcap following
upstream change.
The configure scripts uses pkg-config to find libpcap, add host-pkgconf
dependency.
pkg-config handles static build for us. Remove explicit static build
handling.
Use https for SITE to save redirect.
Update license file hash due to whitespace changes.
Format hashes with two space delimiters.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Baruch Siach [Thu, 21 Jan 2021 17:16:03 +0000 (19:16 +0200)]
package/libpcap: bump to version 1.10.0
configure script now uses pkg-config. Add host-pkgconf dependency.
pkg-config should provide necessary info for libnl build/link. Don't
pass paths to configure.
Add --without-dpdk to make sure we don't link with host installed
libraries.
Format hashes with two space delimiters.
Use https for SITE to save redirect.
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Jianhui Zhao [Thu, 21 Jan 2021 14:17:23 +0000 (22:17 +0800)]
package/rtty: bump version to 7.2.1
Signed-off-by: Jianhui Zhao <zhaojh329@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Thu, 21 Jan 2021 20:43:57 +0000 (21:43 +0100)]
package/libgcrypt: bump to version 1.9.0
Drop first patch (already in version)
https://dev.gnupg.org/T4294
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Thu, 21 Jan 2021 20:43:56 +0000 (21:43 +0100)]
package/libgcrypt: drop LIBGCRYPT_DISABLE_TESTS
Drop LIBGCRYPT_DISABLE_TESTS which is not needed since commit
ef79770dcd4337e52725c43922b2fb2dbeda43b8
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Maxim Kochetkov [Tue, 12 Jan 2021 06:10:25 +0000 (09:10 +0300)]
package/timescaledb: bump to version 2.0.0
Add patches needed for compatibility with Postgresql 13, which are
still under review upstream.
Debug builds (BR2_ENABLE_DEBUG=y) fails because of warnings, so
disable WARNINGS_AS_ERRORS.
Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 17:41:51 +0000 (18:41 +0100)]
Replace LIBFOO_CPE_ID_NAME by LIBFOO_CPE_ID_PRODUCT
Replace LIBFOO_CPE_ID_NAME by LIBFOO_CPE_ID_PRODUCT to better "comply"
with the official "Well-Formed CPE Name Data Model" parameters:
- https://csrc.nist.gov/publications/detail/nistir/7695/final
- https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 17:41:50 +0000 (18:41 +0100)]
Revert "docs/manual: replace LIBFOO_CPE_ID_PRODUCT"
This reverts commit
ff13cb94144cf2db3d019a32b82cbfa2168e4712.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Tue, 19 Jan 2021 18:05:42 +0000 (19:05 +0100)]
package/poppler: add boost optional dependency
boost is an optional dependency which is enabled by default since
version 0.80.0 and
https://github.com/freedesktop/poppler/commit/
355fd8d58ca0209284fe568b3add28f207e995c1
There is no cmake option to enable or disable this dependency
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Bernd Kuhls [Wed, 20 Jan 2021 07:39:00 +0000 (08:39 +0100)]
package/vlc: security bump version to 3.0.12
Removed patch which was applied upstream, removed md5 hash.
Security Bulletin: https://www.videolan.org/security/sb-vlc3012.html
Fixes CVE-2020-26664: https://nvd.nist.gov/vuln/detail/CVE-2020-26664
Added CPE_ID, cpe:2.3:a:videolan:vlc_media_player is a valid CPE
identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&orderBy=2.3&keyword=cpe%3A2.3%3Aa%3Avideolan%3Avlc_media_player&status=FINAL
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Tue, 19 Jan 2021 21:53:14 +0000 (22:53 +0100)]
package/jack2: add JACK2_CPE_ID_VENDOR
cpe:2.3:a:jackaudio:jack2 is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ajackaudio%3Ajack2
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Tue, 19 Jan 2021 21:53:13 +0000 (22:53 +0100)]
package/jack2: bump to version 1.9.17
- Add COPYING as a license files, available since version 1.9.15 and
https://github.com/jackaudio/jack2/commit/
d75ddb82304bf500b031f52c11b0a106e2dc9a55
- Update indentation in hash file (two spaces)
https://github.com/jackaudio/jack2/releases/tag/v1.9.15
https://github.com/jackaudio/jack2/releases/tag/v1.9.16
https://github.com/jackaudio/jack2/releases/tag/v1.9.17
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Wed, 20 Jan 2021 17:40:08 +0000 (18:40 +0100)]
package/atop: bump to version 2.6.0
wchar is needed since
https://github.com/Atoptool/atop/commit/
fa101b4dc5d3729d84466f708c29959570bd0919
https://www.atoptool.nl/downloadatop.php
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Johan Oudinet [Wed, 20 Jan 2021 14:49:01 +0000 (15:49 +0100)]
package/vuejs: bump version to 3.0.5
The vuejs developers have changed the way this package is distributed.
The tarball containing the dist files does not contain anymore the
LICENSE file. The license remains MIT but until it is reintroduced in
the tarball, we have to skip the license file hash verification.
Signed-off-by: Johan Oudinet <johan.oudinet@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Geoffrey Le Gourriérec [Wed, 20 Jan 2021 19:59:54 +0000 (20:59 +0100)]
configs/qemu_ppc_virtex_ml507: remove defconfig
Support for this board was removed in Linux upstream [1] since Xilinx
new design tools dropped these platforms in 2013, along with all
PPC405/PPC440 new designs. They are not maintained nor tested anymore.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=
7ade8495dcfd788a76e6877c9ea86f5207369ea4
Signed-off-by: Geoffrey Le Gourriérec <geoffrey.legourrierec@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Geoffrey Le Gourriérec [Wed, 20 Jan 2021 19:59:53 +0000 (20:59 +0100)]
configs/qemu_*: bump kernel version to 5.10.7
Bump most QEMU defconfigs (every one that was previously on 5.4.y)
to latest longterm kernel 5.10.7.
Please note the following exceptions/modifications:
- board/qemu/qemu_s390x_defconfig: ignored (already up to date)
- board/qemu/sh4*-r2d:
- Remove the remaining kernel patch [1] provided by Alan Modra
fixing rodata alignment, carried here by Romain Naour [2] to
fix an issue preventing kernel from booting with binutils 2.23.
Patch is present in upstream Linux now.
- Fix compile-time error regarding 64-bit time data structures
from kernel headers when building with uclibc. Previous fix [3]
existed upstream; but see details below.
- board/qemu/ppc-mpc8544ds: Updated kernel patch
- board/qemu/arm-versatile: Updated kernel patch
- board/qemu/mips*r6*: Updated kernel patch
Tested on all configs/qemu* configurations. [4]
[1] https://www.sourceware.org/ml/binutils/2019-12/msg00112.html
[2] https://git.busybox.net/buildroot/commit/?id=
a2331c8a61bdd71c47492efc818fb0458a349219
[3] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=
fc94cf2092c7c1267fa2deb8388d624f50eba808
[4] https://gitlab.com/clumsyape/buildroot/-/pipelines/
244024195
Signed-off-by: Geoffrey Le Gourriérec <geoffrey.legourrierec@gmail.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Wed, 20 Jan 2021 17:38:03 +0000 (18:38 +0100)]
package/sysklogd: needs threads
threads is mandatory since version 2.0 and
https://github.com/troglobit/sysklogd/commit/
f6e17bd6b30397912dcae33842b7aba8d32710a2
Fixes:
- http://autobuild.buildroot.org/results/
33846ba0c6746c2befcd3c3ce0bbe0c5b32669ed
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Joachim Wiberg <troglobit@gmail.com>
[yann.morin.1998@free.fr: reorder dependencies]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 22:31:09 +0000 (23:31 +0100)]
package/sysklogd: set SYSKLOGD_CPE_ID_VALID
cpe:2.3:a:sysklogd_project:sysklogd is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asysklogd_project%3Asysklogd
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 22:31:08 +0000 (23:31 +0100)]
package/sysklogd: drop unneeded hash
Commit
6a91580c1175b098fe2508ca11bfcf621ecbbe9f added the hash of
0001-Define-_GNU_SOURCE_required_for_O_CLOEXEC_on_uClibc.patch but this
is not needed as this file is included in buildroot and not downloaded
While at it, update indentation in hash file (two spaces)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Yann E. MORIN [Sun, 10 Jan 2021 11:19:21 +0000 (12:19 +0100)]
package/pkg-meson.mk avoid host ccache detection
meson will by default try to detect the presence of ccache, and if
found, will use it unconditionally.
However, using a system-wide ccache, which would be using our own cache
directory, may very well conflict with our own ccache.
But there is no option to disable that meson behaviour. The only
workaround that is even the official documented way to do so, is to
actually pass environment variables that point to the compiler:
https://mesonbuild.com/Feature-autodetection.html#ccache
For the host variants, we pass $(HOST_CONFIGURE_OPTS) in the environment,
and this contains correct settings for CC and CXX, so meson does not try
and detect ccache; it uses exactly what we tell it to use.
For the target variant, the settings for the cross-compiler are defined
in the cross-compilation file, and so meson just abides by our will. But
for the compiler-for-build, there is no way to specify the CC_FOR_BUILD
or CXX_FOR_BUILD via a cross-compilation file:
https://mesonbuild.com/Machine-files.html
https://mesonbuild.com/Cross-compilation.html
We could pass the full TARGET_CONFIGURE_OPTS in the environment, like we
do for the host variant, but this contains a lot more variables that are
supposed to be covered by the cross-compilation file.
So, we stay safe and just provide the exact two variables that meson
will use to avoid detecting ccache.
If the current configuration defines the use of ccache, then these two
variables will be properly setup to use our own ccache.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Gleb Mazovetskiy <glex.spb@gmail.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Norbert Lange <nolange79@gmail.com>
Fabrice Fontaine [Wed, 20 Jan 2021 21:14:37 +0000 (22:14 +0100)]
package/yaml-cpp: set YAML_CPP_CPE_ID_VALID
cpe:2.3:a:yaml-cpp_project:yaml-cpp is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ayaml-cpp_project%3Ayaml-cpp
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Wed, 20 Jan 2021 21:13:36 +0000 (22:13 +0100)]
package/xscreensaver: set XSCREENSAVER_CPE_ID_VALID
cpe:2.3:a:xscreensaver_project:xscreensaver is a valid CPE identifier
for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Axscreensaver_project%3Axscreensaver
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Wed, 20 Jan 2021 20:52:40 +0000 (21:52 +0100)]
package/znc: add ZNC_CPE_ID_VENDOR
cpe:2.3:a:znc:znc is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aznc%3Aznc
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Wed, 20 Jan 2021 20:48:52 +0000 (21:48 +0100)]
package/zsh: add ZSH_CPE_ID_VENDOR
cpe:2.3:a:zsh:zsh is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Azsh%3Azsh
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:52 +0000 (14:36 +0100)]
package/libjpeg: add LIBJPEG_CPE_ID_VENDOR
cpe:2.3:a:ijg:libjpeg is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aijg%3Alibjpeg
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:50 +0000 (14:36 +0100)]
package/apparmor: add APPARMOR_CPE_ID_VENDOR
cpe:2.3:a:canonical:apparmor is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Acanonical%3Aapparmor
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:48 +0000 (14:36 +0100)]
package/aircrack-ng: add AIRCRACK_NG_CPE_ID_VENDOR
cpe:2.3:a:aircrack-ng:aircrack-ng is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aaircrack-ng%3Aaircrack-ng
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:46 +0000 (14:36 +0100)]
package/wireshark: add WIRESHARK_CPE_ID_VENDOR
cpe:2.3:a:wireshark:wireshark is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Awireshark%3Awireshark
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:44 +0000 (14:36 +0100)]
package/jansson: add JANSSON_CPE_ID_VALID
cpe:2.3:a:jansson_project:jansson is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ajansson_project%3Ajansson
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:42 +0000 (14:36 +0100)]
package/cjson: set CJSON_CPE_ID_VALID
cpe:2.3:a:cjson_project:cjson is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cjson
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:40 +0000 (14:36 +0100)]
package/samba4: add SAMBA4_CPE_ID_VENDOR and SAMBA4_CPE_ID_NAME
cpe:2.3:a:samba:samba is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asamba%3Asamba
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:38 +0000 (14:36 +0100)]
package/cifs-utils: add CIFS_UTILS_CPE_ID_VENDOR
cpe:2.3:a:samba:cifs-utils is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asamba%3Acifs-utils
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:36 +0000 (14:36 +0100)]
package/libssh: add LIBSSH_CPE_ID_VENDOR
cpe:2.3:a:libssh:libssh is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibssh%3Alibssh
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:34 +0000 (14:36 +0100)]
package/apache: add APACHE_CPE_ID_VENDOR and APACHE_CPE_ID_NAME
cpe:2.3:a:apache:http_server is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aapache%3Ahttp_server
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:31 +0000 (14:36 +0100)]
package/rauc: add RAUC_CPE_ID_VENDOR
cpe:2.3:a:pengutronix:rauc is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/detail/850005?namingFormat=2.3&orderBy=CPEURI&keyword=rauc&status=FINAL
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:29 +0000 (14:36 +0100)]
package/angularjs: add ANGULARJS_CPE_ID_VENDOR and ANGULARJS_CPE_ID_NAME
cpe:2.3:a:angularjs:angular.js is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=angularjs
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:27 +0000 (14:36 +0100)]
package/alsa-lib: add ALSA_LIB_CPE_ID_VENDOR
cpe:2.3:a:alsa-project:alsa-lib is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=alsa-lib
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Thu, 21 Jan 2021 13:36:25 +0000 (14:36 +0100)]
package/iwd: add IWD_CPE_ID_VENDOR and IWD_CPE_ID_NAME
cpe:2.3:a:intel:inet_wireless_daemon is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=iwd
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Romain Naour [Wed, 20 Jan 2021 23:02:34 +0000 (00:02 +0100)]
package/gcc: fix gcc 8.4, 9.3 and 10.2 for sparcv8 (ss10)
As reported on IRC by sephthir, the qemu_sparc_ss10_defconfig doesn't
work as expected: the system generated when booted under Qemu produces
illegal instruction messages.
gcc 8.3, 9.2 are the latest working gcc version. git bisect between
gcc 8.3 and 8.4 allowed to identify the commit that introcuced the
regression.
Reverting this patch allowed to produce a working rootfs.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/
786589934
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Petr Vorel [Wed, 20 Jan 2021 20:22:10 +0000 (21:22 +0100)]
package/kmod: bump version to 28
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Korsgaard [Wed, 20 Jan 2021 08:36:52 +0000 (09:36 +0100)]
packago/go: security bump to version 1.15.7
Fixes the following security issues:
- cmd/go: packages using cgo can cause arbitrary code execution at build time
The go command may execute arbitrary code at build time when cgo is in use
on Windows. This may occur when running “go get”, or any other command
that builds code. Only users who build untrusted code (and don’t execute
it) are affected.
In addition to Windows users, this can also affect Unix users who have “.”
listed explicitly in their PATH and are running “go get” or build commands
outside of a module or with module mode disabled.
Thanks to RyotaK (https://twitter.com/ryotkak) for reporting this issue.
This issue is CVE-2021-3115 and Go issue golang.org/issue/43783.
- crypto/elliptic: incorrect operations on the P-224 curve
The P224() Curve implementation can in rare circumstances generate
incorrect outputs, including returning invalid points from ScalarMult.
The crypto/x509 and golang.org/x/crypto/ocsp (but not crypto/tls) packages
support P-224 ECDSA keys, but they are not supported by publicly trusted
certificate authorities. No other standard library or golang.org/x/crypto
package supports or uses the P-224 curve.
The incorrect output was found by the elliptic-curve-differential-fuzzer
project running on OSS-Fuzz and reported by Philippe Antoine (Catena cyber).
This issue is CVE-2021-3114 and Go issue golang.org/issue/43786.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Seiderer [Tue, 17 Nov 2020 22:34:36 +0000 (23:34 +0100)]
package/libcamera: add optional lttng-libust dependency
Add optional lttng-libust support and enable tracing support
in case.
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Tue, 17 Nov 2020 22:34:35 +0000 (23:34 +0100)]
package/libcamera: bump version to
de5d03673
- add new host-python3-jinja2 and host-python3-ply dependencies
- change android, documentation options from boolean to feature
- disable new tracing option (needs lttng-ust)
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Tue, 17 Nov 2020 22:34:34 +0000 (23:34 +0100)]
package/python3-ply: add special host variant
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Tue, 17 Nov 2020 22:34:32 +0000 (23:34 +0100)]
package/python3-jinja2: add special host variant
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Tue, 17 Nov 2020 22:34:33 +0000 (23:34 +0100)]
package/python3-markupsafe: add special host variant
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Andreas Hilse [Tue, 29 Dec 2020 18:11:25 +0000 (19:11 +0100)]
package/sysklogd: bump to version 2.1.2
- fixes: sysklogd 1.6 klogd with newer glibcs: kernel messages are
logged to user facility
- sysklogd removed klogd, functionality has been moved to syslogd
- now supports config fragments in /etc/syslog.d
- disabled sysklogd logger to not interfere with other loggers
- license has changed from GPL-2.0+ to BSD-3-Clause
Signed-off-by: Andreas Hilse <andreas.hilse@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 22:14:19 +0000 (23:14 +0100)]
package/unzip: switch to debian
https://sources.debian.org/data/main/u/unzip/6.0-25 is unreachable so
switch to the debian archive provided by snapshot.debian.org to retrieve
all debian patches at once.
While at it, also update indentation in hash file and add
UNZIP_IGNORE_CVES entries.
The Debian patch archive we refernce brings in a large set of patches,
some of them fixing CVEs. Since we only cary the Debian patch archive
as a single entity, just refer to it to identify all the CVEs the
individual patches there in are fixng.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr:
- don't wrap _SITE line that is anyway too long even when wrapped
- don't enumerate Debian patches one by one, just refere to them
globally
- as a consequence, reorder CVEs
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Sun, 3 Jan 2021 22:53:24 +0000 (23:53 +0100)]
package/dcron: switch site, bump version
- Use github as a source site, to get a newer version than 4.5, which
was released in May 2011
- Add upstream link to patch
- Use the new COPYING file
- Update indentation in hash file (two spaces)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Bernd Kuhls [Sun, 3 Jan 2021 17:23:42 +0000 (18:23 +0100)]
package/fetchmail: bump version to 6.4.15
Updated license hash due to copyright year bump:
https://sourceforge.net/p/fetchmail/git/ci/
87069e887226907ebb0e557ae09e387396ad9a6b/tree/COPYING
Release notes:
https://sourceforge.net/p/fetchmail/mailman/message/
37189309/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Mark Corbin [Sat, 2 Jan 2021 16:56:55 +0000 (16:56 +0000)]
package/chrony: bump to version 4.0
Update chrony to version 4.0 and add/remove configuration of
features as necessary.
Remove support for readline. Add support for nettle and
gnutls (required for NTS support). Add pkg-config support (for
nss, nettle and gnutls).
Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Raphaël Mélotte [Sun, 3 Jan 2021 18:53:27 +0000 (19:53 +0100)]
package/python-jmespath: bump to version 0.10.0
Signed-off-by: Raphaël Mélotte <raphael.melotte@essensium.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Grzegorz Blach [Sun, 3 Jan 2021 17:42:01 +0000 (18:42 +0100)]
package/python-bluezero: Bump to version 0.4.0
Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Tue, 19 Jan 2021 07:55:33 +0000 (08:55 +0100)]
package/libebml: add LIBEBML_CPE_ID_VENDOR
cpe:2.3:a:matroska:libebml is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amatroska%3Alibebml
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 07:13:02 +0000 (08:13 +0100)]
package/zziplib: set ZZIPLIB_CPE_ID_VALID
cpe:2.3:a:zziplib_project:zziplib is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Azziplib_project%3Azziplib
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 07:10:32 +0000 (08:10 +0100)]
package/ncmpc: set NCMPC_CPE_ID_VALID
cpe:2.3:a:ncmpc_project:ncmpc is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ancmpc_project%3Ancmpc
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 07:07:37 +0000 (08:07 +0100)]
package/libbluray: add LIBBLURAY_CPE_ID_VENDOR
cpe:2.3:a:videolan:libbluray is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Avideolan%3Alibbluray
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Fabrice Fontaine [Tue, 19 Jan 2021 18:11:25 +0000 (19:11 +0100)]
package/rhash: set RHASH_CPE_ID_VALID
cpe:2.3:a:rhash_project:rhash is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Arhash_project%3Arhash
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Tue, 19 Jan 2021 18:10:23 +0000 (19:10 +0100)]
package/rhash: bump to version 1.4.1
https://github.com/rhash/RHash/releases/tag/v1.4.1
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Tue, 19 Jan 2021 17:32:08 +0000 (18:32 +0100)]
package/xenomai: drop unrecognized option
--disable-doc-install is not available since version 3.0.6 and
https://gitlab.denx.de/Xenomai/xenomai/-/commit/
6076f0951c7c37917c625b1aa1cd6905c27310f6
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Tue, 19 Jan 2021 17:31:19 +0000 (18:31 +0100)]
package/xenomai: fix build with gcc 10
Fixes:
- http://autobuild.buildroot.org/results/
551228bcc7152d5e835f3cced6329269b6bad651
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: move to 3.0.10 subdir so it is only used for that version]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Nicolas Cavallari [Tue, 19 Jan 2021 18:09:08 +0000 (19:09 +0100)]
package/dnsmasq: security bump to 2.83
From the annoucement:
http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q1/014599.html
"There are broadly two sets of problems. The first is subtle errors in
dnsmasq's protections against the chronic weakness of the DNS protocol
to cache-poisoning attacks; the Birthday attack, Kaminsky, etc. [...]
[...] the second set of errors is a good old fashioned buffer overflow
in dnsmasq's DNSSEC code."
Fixes CVE-2020-25681, CVE-2020-25682, CVE-2020-25683, CVE-2020-25684,
CVE-2020-25685, CVE-2020-25686 and CVE-2020-25687
Details: https://www.jsof-tech.com/disclosures/dnspooq
Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Joeri Barbarien [Tue, 19 Jan 2021 15:46:05 +0000 (16:46 +0100)]
package/chartjs: security bump to 2.9.4
CVE-2020-7746 (https://nvd.nist.gov/vuln/detail/CVE-2020-7746)
The options parameter is not properly sanitized when it is processed.
When the options are processed, the existing options (or the defaults
options) are deeply merged with provided options. However, during this
operation, the keys of the object being set are not checked, leading to
a prototype pollution.
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Thomas De Schampheleire [Tue, 19 Jan 2021 15:46:04 +0000 (16:46 +0100)]
package/chartjs: move 'v' version prefix out of CHARTJS_VERSION
chartjs 2.9.3 has a security vulnerability (CVE-2020-7746) which is not
detected by the CVE scripts, presumably because our version variable starts
with a 'v'.
Move that 'v' prefix out of the version variable to fix that.
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Tue, 19 Jan 2021 07:53:00 +0000 (08:53 +0100)]
package/i7z: fix build with gcc 10
Fixes:
- http://autobuild.buildroot.org/results/
1a433611ba8676cf1ca276fccaf3633971bd562e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Mon, 18 Jan 2021 22:31:29 +0000 (23:31 +0100)]
package/screenfetch: make version compliant with release-monitoring
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Francois Perrad [Sun, 17 Jan 2021 16:31:55 +0000 (17:31 +0100)]
package/lua-curl: bump to version 0.3.12
diff LICENSE:
- Copyright (c) 2014-2019 Alexey Melnichuk
+ Copyright (c) 2014-2021 Alexey Melnichuk
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Francois Perrad [Sun, 17 Jan 2021 16:31:54 +0000 (17:31 +0100)]
package/lua-bit32: bump to version 5.3.5.1
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bernd Kuhls [Sun, 10 Jan 2021 17:56:41 +0000 (18:56 +0100)]
package/xscreensaver: bump version to 5.45
Changelog: https://www.jwz.org/xscreensaver/changelog.html
Remove dependency to libglade in favour of gdk-pixbuf.
Add dependency to libxml2 which is needed for gtk support.
Add various optional dependencies.
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fabrice Fontaine [Sun, 10 Jan 2021 19:21:24 +0000 (20:21 +0100)]
package/poppler: add gobject-introspection support
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 21:33:00 +0000 (22:33 +0100)]
package/xerces: renumber patch
Commit
7f115d2de4276972098b8f4cfeb0150c8e851d89 forgot to renumber the
remaining patch
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Grzegorz Blach [Mon, 11 Jan 2021 18:29:21 +0000 (19:29 +0100)]
package/python-pyjwt: bump to version 2.0.0
Since 2.0.0, pyjwt has dropped Python 2.x support, so Python 3.x is
mandatory.
Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Michael Walle [Mon, 11 Jan 2021 21:33:12 +0000 (22:33 +0100)]
boot/uboot: bump to version 2021.01
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Yann E. MORIN [Mon, 18 Jan 2021 18:16:12 +0000 (19:16 +0100)]
boot/barebox, package/linux-headers: carry site-method archive format version when overriding _SOURCE
Commit
5b95a5dc2 (support/download: change format of archives generated
from git) changed the way the archives generated from git repositories
are named, adding a "format-version" identifier right between the
package version and the file extension.
Commit
c043ecb20 (support/download: change format of archives generated
from svn) did so for archives generated from a subversion checkout.
However, for a few packages, we manually force the _SOURCE variable,
because we want to share the archive with another package, to avoid
downloading and storing those archives twice. This is the case for:
- linux-headers and linux
- barebox-aux and barebox
When the generated tarballs were renamed with the aforementioned
commits, those packages were not updated accordingly.
Fix that by manually propagating the per-site-method format-version.
Reported-by: "Stephane Viau (OSS)" <stephane.viau@oss.nxp.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: "Stephane Viau (OSS)" <stephane.viau@oss.nxp.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Heiko Thiery [Tue, 12 Jan 2021 08:30:43 +0000 (09:30 +0100)]
package/netsniff-ng: bump version to 0.6.8
Also drop upstream patches that are already in version.
Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Gwenhael Goavec-Merou [Tue, 12 Jan 2021 09:34:21 +0000 (10:34 +0100)]
package/gr-osmosdr: bump to 0.2.3
Bump to 0.2.3 and fix hash space.
Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Mon, 18 Jan 2021 21:27:00 +0000 (22:27 +0100)]
docs/manual/pkg-cmake.txt: add _INSTALL_OPTS description
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Mon, 18 Jan 2021 21:26:59 +0000 (22:26 +0100)]
docs/manual/pkg-cmake.txt: fix _INSTALL_STAGING_OPTS/_INSTALL_TARGET_OPTS description
Since commit
dfcc18f84b0d90b0ed5937bac3c4b12aba086cd5 cmake-package
_INSTALL_STAGING_OPTS/_INSTALL_TARGET_OPTS use 'install/fast'
instead of 'install', adjust documentation accordingly.
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Peter Seiderer [Mon, 18 Jan 2021 21:26:58 +0000 (22:26 +0100)]
package/pkg-cmake.mk: fix indent
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 17:52:08 +0000 (18:52 +0100)]
package/unzip: set UNZIP_CPE_ID_VALID
cpe:2.3:a:unzip_project:unzip is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aunzip_project%3Aunzip
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 17:52:04 +0000 (18:52 +0100)]
package/unzip: make version compliant with release-monitoring
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 16:27:11 +0000 (17:27 +0100)]
package/atop: set ATOP_CPE_ID_VALID
cpe:2.3:a:atop_project:atop is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aatop_project%3Aatop
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Thomas Claveirole [Mon, 18 Jan 2021 11:34:19 +0000 (12:34 +0100)]
package/openlayers: bump to version 6.5.0
Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 21:54:13 +0000 (22:54 +0100)]
package/boa: drop package
Drop boa package as it is affected by multiple CVEs (CVE-2017-9833,
CVE-2018-21027 and CVE-2018-21028) and is not maintained anymore (no
release since 2005):
https://nvd.nist.gov/vuln/search/results?form_type=Advanced&results_type=overview&seach_type=all&query=cpe:2.3:a:boa:boa:0.94.14.21:*:*:*:*:*:*:*
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 22:01:01 +0000 (23:01 +0100)]
Config.in.legacy: fix typo
oriq-rcw -> qoriq-rcw
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Michael Nosthoff [Mon, 18 Jan 2021 09:46:33 +0000 (10:46 +0100)]
package/grpc: drop host gcc 4.8 workaround
Due to libabseil dependencies the host gcc is at least 4.9.
So the fix for host gcc 4.8 is no longer needed.
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Laurent Hartanerot [Mon, 18 Jan 2021 19:13:34 +0000 (20:13 +0100)]
package/qoriq-rcw: bump to version LSDK-20.12
Signed-off-by: Laurent Hartanerot <laurent.hartanerot@atos.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Angelo Compagnucci [Sun, 17 Jan 2021 21:37:14 +0000 (22:37 +0100)]
package/htpdate: bump to version 1.2.6
Thi patch bumps htpdate to version 1.2.6.
Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Thomas De Schampheleire [Mon, 18 Jan 2021 20:37:52 +0000 (21:37 +0100)]
package/zstd: build multithreaded host-zstd
Under the assumption that all Buildroot build hosts nowadays are
multithreaded, we can boost performance of host-zstd by enabling
multithreaded operation.
See also commit
52154e52069d20105f62191e6c9f903f188a5129.
Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Romain Naour [Mon, 18 Jan 2021 20:32:12 +0000 (21:32 +0100)]
Config.in.legacy: fix selection of firmware-imx
In order to select firmware-imx we have to select freescale-imx first.
Reported-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 20:38:42 +0000 (21:38 +0100)]
package/coremark-pro: fix build with uclibc-ng
Fix the following linking error with uClibc-ng:
/nvme/rc-buildroot-test/scripts/instance-1/output-1/host/bin/arc-buildroot-linux-uclibc-gcc -o/nvme/rc-buildroot-test/scripts/instance-1/output-1/build/coremark-pro-1.1.2743/builds/linux/gcc/bin/cjpeg-rose7-preset cjpeg-rose7-preset.o /nvme/rc-buildroot-test/scripts/instance-1/output-1/build/coremark-pro-1.1.2743/builds/linux/gcc/obj/bench/consumer_v2/cjpeg/*.o /nvme/rc-buildroot-test/scripts/instance-1/output-1/build/coremark-pro-1.1.2743/builds/linux/gcc/obj/mith.a -lm -lpthread -lrt
/nvme/rc-buildroot-test/scripts/instance-1/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/10.2.0/../../../../arc-buildroot-linux-uclibc/bin/ld: /nvme/rc-buildroot-test/scripts/instance-1/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/10.2.0/libgcc.a(unwind-dw2-fde-dip.o): in function `_Unwind_Find_FDE':
/nvme/rc-buildroot-test/scripts/instance-1/output-1/build/host-gcc-final-arc-2020.09-release/build/arc-buildroot-linux-uclibc/libgcc/../../../libgcc/unwind-dw2-fde-dip.c:469: undefined reference to `dl_iterate_phdr'
/nvme/rc-buildroot-test/scripts/instance-1/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/10.2.0/../../../../arc-buildroot-linux-uclibc/bin/ld: /nvme/rc-buildroot-test/scripts/instance-1/output-1/build/host-gcc-final-arc-2020.09-release/build/arc-buildroot-linux-uclibc/libgcc/../../../libgcc/unwind-dw2-fde-dip.c:469: undefined reference to `dl_iterate_phdr'
/nvme/rc-buildroot-test/scripts/instance-1/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/10.2.0/../../../../arc-buildroot-linux-uclibc/bin/ld: GOT and PLT relocations cannot be fixed with a non dynamic linker
/nvme/rc-buildroot-test/scripts/instance-1/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/10.2.0/../../../../arc-buildroot-linux-uclibc/bin/ld: final link failed: bad value
collect2: error: ld returned 1 exit status
/nvme/rc-buildroot-test/scripts/instance-1/output-1/build/coremark-pro-1.1.2743/workloads/cjpeg-rose7-preset//Makefile:65: recipe for target '/nvme/rc-buildroot-test/scripts/instance-1/output-1/build/coremark-pro-1.1.2743/builds/linux/gcc/bin/cjpeg-rose7-preset' failed
Since uClibc-ng 1.0.18 a circular dependency between libc and libgcc
exist, when static linking is used. It can be resolved by the compiler
when -static is correctly passed in the linking step.
So use TARGET_LDFLAGS to pass LDFLAGS
Fixes:
- http://autobuild.buildroot.org/results/
ca86624b09fed961d2b9086fee8b2029845746ea
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 20:38:41 +0000 (21:38 +0100)]
package/coremark-pro: fix build without threads
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Mon, 18 Jan 2021 20:38:40 +0000 (21:38 +0100)]
Revert "package/coremark-pro: add dependency on threads"
This reverts commit
6627cea610ee11cbc02649c9b12cbe0b2b8e83b6.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 21:19:59 +0000 (22:19 +0100)]
package/xen: add CPE variables
cpe:2.3:o:xen:xen is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Ao%3Axen%3Axen
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 21:10:38 +0000 (22:10 +0100)]
package/sudo: add CPE variables
cpe:2.3:a:sudo_project:sudo is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Asudo_project%3Asudo
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 21:10:37 +0000 (22:10 +0100)]
package/sudo: security bump to version 1.9.5p1
- Fixes CVE-2021-23239, a potential information leak in sudoedit that
could be used to test for the existence of directories not normally
accessible to the user in certain circumstances. When creating a new
file, sudoedit checks to make sure the parent directory of the new
file exists before running the editor. However, a race condition
exists if the invoking user can replace (or create) the parent
directory. If a symbolic link is created in place of the parent
directory, sudoedit will run the editor as long as the target of the
link exists. If the target of the link does not exist, an error
message will be displayed. The race condition can be used to test for
the existence of an arbitrary directory. However, it cannot be used to
write to an arbitrary location.
- Fixes CVE-2021-23240, a flaw in the temporary file handling of
sudoedit's SELinux RBAC support. On systems where SELinux is enabled,
a user with sudoedit permissions may be able to set the owner of an
arbitrary file to the user-ID of the target user. On Linux kernels
that support protected symlinks setting
/proc/sys/fs/protected_symlinks to 1 will prevent the bug from being
exploited. For more information, see Symbolic link attack in
SELinux-enabled sudoedit.
- Update license hash:
- copyright of python bindings added with
https://github.com/sudo-project/sudo/commit/
6c1b155fed23348c58a03f6c1193922132b5b66a
- a few other files (ISC licenced) added with
https://github.com/sudo-project/sudo/commit/
d4b2db9078bd54f158261017dcb4d1340398a5fa
- year updated with
https://github.com/sudo-project/sudo/commit/
9e111eae57524ca72002ad1db36eb68ccd50b167
- Update indentation in hash file (two spaces)
https://www.sudo.ws/stable.html#1.9.5p1
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 18:30:18 +0000 (19:30 +0100)]
package/strace: set STRACE_CPE_ID_VALID
cpe:2.3:a:strace_project:strace is a valid CPE identifier for this
package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Astrace_project%3Astrace
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fabrice Fontaine [Sun, 17 Jan 2021 18:24:56 +0000 (19:24 +0100)]
package/thttpd: add THTTPD_CPE_ID_VENDOR
cpe:2.3:a:acme:thttpd is a valid CPE identifier for this package:
https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aacme%3Athttpd
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>