git.libre-soc.org Git - buildroot.git/log

xlib_libXfont{, 2}: add upstream security fixes

Fixes the following security issues:

CVE-2017-13720 - Check for end of string in PatternMatch

CVE-2017-13722 - pcfGetProperties: Check string boundaries

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lvm2: optionally depend on libselinux

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lvm2: disable selinux for host

There is no need for selinux support in the host lvm2 package.

Should fix:
http://autobuild.buildroot.net/results/6cd/6cde658da1fa815c157acf36b39c10a8d885e9a9/
http://autobuild.buildroot.net/results/430/43071433814a3176256687720c1d665f41748484/
http://autobuild.buildroot.net/results/ced/cedd7ff4b287d7b71612134444964dc847cc6062/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

ipset: bump to version 6.34

Add license hash.

Cc: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

audit: bump to version 2.7.8

Commit d1011f89a18 (audit: update legal info) set the libraries license
to "unclear" because of GPL license text in a few libraries source
files. Upstream audit package commit 239765162fa494 (Correct the
licensing description in lib/ and auparse/ to be LGPL as was always
intended) clarified the license in these files.

Add license files hashes.

Cc: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Rahul Bedarkar <rahulbedarkar89@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dbus: bump to version 1.10.24

Drop upstream patch.

Add license hash.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cryptsetup: fix host package option text

Host packages are called 'host foo', not 'host-foo'.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nginx/S50nginx: Do not assume start-stop-daemon knows -R.

start-stop-daemon fails on -R when not compiled with
CONFIG_FEATURE_START_STOP_DAEMON_FANCY. Thus, do not rely on -R
during stop to avoid a race condition during restart.

Use a sleep 1 during restart instead, as suggested by Peter Korsgaard
in <87bmluk4bm.fsf@dell.be.48ers.dk>.

Signed-off-by: Thomas Claveirole <thomas.claveirole@green-communications.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pdbg: needs host dtc

Fixes:
http://autobuild.buildroot.net/results/722/722e043ef7503abe5fd6517c82b0f12627f4b0f4/
http://autobuild.buildroot.net/results/891/8918121581f9834fef55169599766a9134600e89/
http://autobuild.buildroot.net/results/475/475106ec793e16bf8c250d3a69e853537e3e0def/

Cc: Joel Stanley <joel@jms.id.au>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-msgpack: bump to version 0.4.8, drop dependency on msgpack

This package doesn't actually rely on the msgpack runtime libraries, it's a
pure python implementation.

Signed-off-by: bradford barr <bradford@density.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

msgpack: bump version to 2.1.5

Modern versions of msgpack are hosted on Github. Msgpack switched
their build systems from autotools to cmake a while back. The licence
was also updated from Apache to Boost.

Signed-off-by: bradford barr <bradford@density.io>
[Thomas: drop custom install commands, add LICENSE_1_0.txt to license
files.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/freeswitch: Use mod_g729 only when freeswitch-mod-bcg729 is disabled

mod_g729 contained in freeswitch source provides pass-through:
https://freeswitch.org/confluence/display/FREESWITCH/mod_g729

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/freeswitch-mod-bcg729: new package

This package is based on the bcg729 library from Belledonne Communica-
tions which is wrapped into a freeswitch module to provide a native
G729.A codec.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/bcg729: new package

Quoting http://www.linphone.org/technical-corner/bcg729/downloads
regarding patent information:

"ITU G729 Annex A/B were offically released October/November 1996
(https://www.itu.int/rec/T-REC-G.729), hence all patents covering these
specifications shall have expired in November 2016.

Patent pool administrator confirmed most licensed patents under the
G.729 Consortium have expired (http://www.sipro.com/G729.html)."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

Revert "parted: properly link with libiconv"

This reverts commit 2a56de2dec3afdca15a58ec13cb5fc244682cab6, which
causes a large number of build failures, because parted now
unconditionally tries to link against -liconv.

Fixes:

http://autobuild.buildroot.net/results/cd5542eca077c2bbbcf43c1b00d25077056a7ea9/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

toolchain: Bump ARC tools to arc-2017.09-rc1

This commit bumps ARC toolchain to arc-2017.09-rc1.

The arc-2017.09 series is built on top of upstream GCC 7.1.1 and
Binutils 2.29 so please expect all kinds of breakages related to GCC
7.x as we saw earlier with the move from 4.8 to 6.x :)

Note patches for both GCC and Binutils were updated with
copies from corresponding mainline versions, i.e.
"package/gcc/7.2.0" and "package/binutils/2.29".

Please note that it is a release candidate and it might contain some
breakages, please don't use it for production builds.

Signed-off-by: Evgeniy Didin <didin@synopsys.com>
Cc: Alexey Brodkin <abrodkin@synopsys.com>
Cc: arc-buildroot@synopsys.com
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[Thomas: drop binutils patch related to the Blackfin architecture.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

musl: add patch to fix build on ARMv4 with new binutils

New binutils (since 2.27.51) cannot build musl-1.1.16 due to breakage in ARMv4
atomics asm. This patch from upstream musl repository is needed until
musl-1.1.17 is released:
https://git.musl-libc.org/cgit/musl/commit/?id=b261a24256792177a5f0531dbb25cc6267220ca5

Signed-off-by: Timothy Lee <timothy.ty.lee@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

configs/imx6-sabreauto: Add a new defconfig

Introduce imx6-sabreauto_defconfig that uses mainline U-Boot and
mainline kernel.

As mainline U-Boot supports SPL, it is possible to boot the same
sdcard.img in the three mx6sabreauto variants: imx6q, imx6dl and imx6qp.

Also update the readme.txt file to explain how to build an image for
mx6sabreauto boards using mainline U-Boot and kernel.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
[Thomas: regenerate gitlab-ci.yml file.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

swig: enable support for Node.js >= 7.x

Recent Node.js versions have removed some depreciated API calls,
that swig still relies on. Patches taken from this PR [1] fix
this issue.

[1] https://github.com/swig/swig/pull/968

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

sdl2: add KMS/DRM video driver support

Signed-off-by: Olivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

imx6-sabresd: Improve the explanation of the fragment file

Improve the explanation of the need for using the performance governor.

This problem is specific to mx6sabresd board and the Egalax touchscreen
running a mainline kernel, so make this clear.

Signed-off-by: Fabio Estevam <fabio.estevam@nxp.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

parted: properly link with libiconv

parted uses libiconv but doesn't link with it. All the checks are there
in configure, but the Makefile.am doesn't add it to the link. Add a
patch to fix this.

Also add an optional dependency on libiconv, so it is reproducible.

While we're at it, regenerate the existing patches on top of v3.2, and
make patch 0003 a properly git formatted one.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: srg.venema@gmail.com
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

jose: new package

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

eigen: bump to version 3.3.4

Bumped the version to 3.3.4, and added the hashes of the licence files to
eigen.hash.

Signed-off-by: bradford barr <bradford@density.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

ltp-testsuite: Bump to version 20170929

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pdbg: bump version to latest

I got this error when attempting to build:

aclocal: error: couldn't open directory 'm4': No such file or directory

So we now have the post patch hook to ensure the m4 directory is
present.

In addition, the package now sets a variable with the Git SHA1 so that
the binary contains the expected output for --version.

Specific configurations of uClibc cause a build failure in pdbg. This commit
adds a patch to remove the definition of the offending macro (it is unused in
the source).

In file included from usr/include/stdio.h:71:0,
from libpdbg/fake.c:17:
include/bits/uClibc_stdio.h:149:16: error: expected identifier or ‘(’ before ‘;’ token
void *__unused; /* Placeholder for codeset binding. */

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libiio: add support for Python 3.x bindings

Python3 support was added to libiio in version 0.10.
This commit adds the option to compile libiio bindings if python3 was
selected instead of python.

Signed-off-by: Béla Becker <bela.becker@pcbdesign.hu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

odroidc2_defconfig: bump kernel and u-boot versions

To the latest commits on the odroidc2-3.14.y / odroidc2-v2015.01 branches.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Dagg <daggs@gmx.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/intel-microcode: bump to version 20170707

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/iucode-tool: security bump to version 2.2

Version 2.1.1 fixed CVE-2017-0357:
https://gitlab.com/iucode-tool/iucode-tool/commit/657ce44ac462bcec35a3e12f9e7f53ca92ae62b7

Dropped IUCODE_TOOL_CONF_ENV after version 2.2 added a configure check
for libargp:
https://gitlab.com/iucode-tool/iucode-tool/commit/b14bed6771e7ab48371b272a0c68dd017767142a

Added hash for license file.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/xserver_xorg-server: rename patch directory after the last version bump

The last bump [1] forgot to rename the patch directory and remove
upstream patches.

We still need to fix the monotonic clock check which doesn't work
when cross-compiling.

[1] 436659c55f8d3c6155546cfc666a13c793d992f9

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Cc: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/enlightenment: bump to 0.21.10

https://www.enlightenment.org/news/e0.21.10_release

Add COPYING file hash

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

.gitlab-ci.yml: update with atmel_sama5d27_som1_ek_mmc_dev_defconfig

Commit 95cb1465f09dd7d88cc84d60c735b04e8f4ef244 added the
atmel_sama5d27_som1_ek_mmc_dev_defconfig but forgot to update
.gitlab-ci.yml. Update it now.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

boarde: icorem6: clarify the common vs. board-specific things in readme.txt

The parts of the readme.txt that specify the board-specific aspects
(DTB files, KMS config json file) were a bit confusing. For the DTB
files this is solved by putting the board it applies to after the DTB
file name. For the json files, this is solved by adding an extra line,
so the CinematicExperience-demo is clearly separated from the setting
of QT_QPA_EGLFS_KMS_CONFIG.

Also remove the 'for all boards' line in the beginning, it doesn't add
any value.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

board: icorem6: Add Qt5 configs for 1280x480 LVDS display

i.CoreM6 OF C.TOUCH 12 Kit has 1280x480 LVDS display, this patch adds
relevant qt5 configs with supports opensource Etnaviv graphical stack.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

engicam: icorem6: Add OF C.TOUCH 12 Kit

This patch add support for Open Frame C.TOUCH 12 Kit.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

board: icorem6: Add Qt5 configs for 1280x800 LVDS display

i.CoreM6 OF C.TOUCH 10.1 Kit has 1280x800 LVDS display, this patch adds
relevant qt5 configs with supports opensource Etnaviv graphical stack.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

engicam: icorem6: Add OF C.TOUCH 10.1 Kit

This patch add support for Open Frame C.TOUCH 10.1 Kit.

Since the defconfig is no longer only for the starter kit, remove that
from BR2_TARGET_GENERIC_ISSUE.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

board: icorem6: Add Qt5 configs for 800x480 LVDS display

i.CoreM6 Starter Kit has 800x480 LVDS display, this patch adds
relevant qt5 configs with supports opensource Etnaviv graphical stack.

Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
[Arnout: mention the qt5 defconfig in readme.txt, otherwise the demo
applications don't exist]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/freeswitch: install to staging

Needed for upcoming package freeswitch-mod-bcg729.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Arnout: made comment more explicit]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

lbase64: compile with -fPIC

Some architectures (e.g. x86_64, MIPS, microblaze, or1k) require to
build with -fPIC to build a shared library, but the lbase64 build
system doesn't add it. Therefore, we add it in CFLAGS.

Fixes:
http://autobuild.buildroot.net/results/b56/b567096cbfdb89b1895924051265c56204ffb512/

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Arnout: write commit log]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

libressl: fix musl build with older kernel headers

musl provides its own SYS_getrandom definition, but not GRND_NONBLOCK.
This breaks the build with kernel headers older than v3.17. Add a patch
adding a local definition of GRND_NONBLOCK to fix the build.

The following defconfig reproduces the build failure:

BR2_x86_pentium_mmx=y
BR2_TOOLCHAIN_BUILDROOT_MUSL=y
BR2_KERNEL_HEADERS_3_12=y
BR2_PACKAGE_LIBRESSL=y

The getentropy_linux.c file is in upstream tarball, but not in its git
repository. It originates from OpenBSD. For this reason the patch is
against the tarball, but not git formatted.

Cc: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
[Arnout: change filename to correspond to how git creates it]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

trinity: undefined UIO_MAXIOV need sys/io.h

This upstream patch fixes the build error produced by building for
powerpc 32bit after the glibc bump to 2.26 with the following internal
toolchain config.

gcc5.4.0
glibc2.26
bin2.28.1
linux4.1.43

Failure log:
  CC net/proto-ipv4.o
net/proto-ipv4.c: In function ‘ip_setsockopt’:
net/proto-ipv4.c:231:49: error: ‘UIO_MAXIOV’ undeclared (first use in this function); did you mean ‘_IO_MAGIC’?
   so->optlen = rnd() % sizeof(unsigned long)*(2*UIO_MAXIOV+512);
                                                 ^~~~~~~~~~
                                                 _IO_MAGIC

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
[Arnout: add Matthew's Sob to the patch]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: fix remaining code style

Fix the remaining code style warnings from flake8:
- properly indent continuation lines;
- use proper code to test a parameter is not None.

Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

.flake8: add config file for Python code style

We recommend wrapping at 80 columns but we accept 132 columns when it
makes more readable.

Follow up of discussion at this thread:
http://lists.busybox.net/pipermail/buildroot/2017-October/203624.html

Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

testing/tests/init: use lowercase method names

Use method naming convention from PEP8 as other test cases already do.

sed \
  -e 's,startEmulator,start_emulator,g' \
  -e 's,checkInit,check_init,g' \
  -e 's,checkNetwork,check_network,g' \
  -i support/testing/tests/init/*.py

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: fix code style

Fix the trivial warnings from flake8:
- remove modules imported but unused;
- use 2 lines before class or module level method;
- remove blank line at end of file.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: standardize defconfig fragments style

Change all defconfig fragments to take advantage of
"cf3cd4388a support/tests: allow properly indented config fragment".

Make each defconfig fragment:
- start after a backslash;
- be declared as a multi-line string literal;
- be indented one level more than the variable that contains it.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

support/testing: allow to indent ccache defconfig fragment

Move the strip out of leading spaces in defconfig fragments from the
BRTest class to the Builder class. It actually postpones the strip out,
consequentially allowing test cases to post-process the defconfig in
their own __init__ before calling the __init__ method from BRTest.

Moving this code to the Builder class also allows any new test class
that inherits from BRTest to reuse the same code even if the new class
overrides the setUp method.

At same time, prepend a newline to the jlevel handling otherwise it
would stop working for defconfig fragments that don't end in a newline.

Signed-off-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Cc: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

u-boot: add option to specify config fragments

U-Boot nowadays also uses kconfig, so we can handle config fragments like we
do for barebox/busybox/linux.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

mosh: bump to version 1.3.2

And add hashes for the license files while we're at it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/apache: bump to version 2.4.28

Fix for CVE-2017-9798 is included in this release, so this patch is
removed.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Update commit log: not a security bump]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

wireguard: bump to version 0.0.20171005

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/atmel: addition of the sama5d27 som1 ek board

Add the new SAMA5D27 SOM1 Evaluation Kit with linux4sam_5.7 components.

Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/atmel: bump to linux4sam_5.7

Bump at91sam9x5ek, atmel_sama5d2_xplained, atmel_sama5d3_xplained and
atmel_sama5d4_xplained all variants to linux4sam_5.7. The 3 foundation
components have their tags changed (AT91Bootstrap, U-Boot, Linux kernel).

Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xserver_xorg-server: security bump to version 1.19.4

Fixes CVE-2017-13721 & CVE-2017-13723:
https://lists.x.org/archives/xorg-announce/2017-October/002809.html

Added all hashes provided by upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xkeyboard-config: bump version to 2.22

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wireguard: needs 3.10+ kernel

The dependency is actually only for the kernel module (and thus on the
runtime kernel version rather than kernel headers), but as we don't know the
runtime version in kconfig and the user space part doesn't make much sense
without the kernel module this will have to do.

[Peter: extend commit message, add comment to Config.in as suggested by
Arnout, fix off-by-one in comment text]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

cryptsetup: add host variant

E.G. for generating dm-verity hashes or dm-crypt data at build time in a
post-image script.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lvm2: add host variant

This is only for the device-mapper library, so a user selectable
Config.in.host option isn't needed.

[Peter: add host-pkgconf dependency as pointed out by Arnout]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

shairport-sync: bump to version 3.1.3

Fixes a runtime startup issue on SysV init systems:
```
# shairport-sync -d
Daemon returned 2 as return value.
```

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libcurl: security bump to version 7.56.0

Drop upstreamed patch.

Fixes CVE-2017-1000254 - FTP PWD response parser out of bounds read:

https://curl.haxx.se/docs/adv_20171004.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iprutils: bump version to 2.4.15.1

Signed-off-by: Samuel Mendoza-Jonas <sam@mendozajonas.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qemu: change to .tar.xz format

And use the official download location.

Suggested-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qemu: security bump to version 2.8.1.1

Fixes the following security issues and adds a number of other bigfixes:

2.8.1: Changelog:
https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg06332.html

CVE-2017-2615 - display: cirrus: oob access while doing bitblt copy backward
mode

CVE-2017-2620 - display: cirrus: out-of-bounds access issue while in
cirrus_bitblt_cputovideo

CVE-2017-2630 - nbd: oob stack write in client routine drop_sync

2.8.1.1 Changelog:
https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg03460.html

CVE-2017-7471 - 9p: virtfs allows guest to change filesystem attributes on
host

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

openntpd: fix musl build with older kernel headers

musl provides its own SYS_getrandom definition, but not GRND_NONBLOCK.
This breaks the build with kernel headers older than v3.17. Add a patch
adding a local definition of GRND_NONBLOCK to fix the build.

The getentropy_linux.c file is in upstream tarball, but not in its git
repository. It originates from OpenBSD. For this reason the patch is
against the tarball, but not git formatted.

Fixes:
http://autobuild.buildroot.net/results/623/6235ddc095bc1984439e7339d590b11581a3e257/
http://autobuild.buildroot.net/results/648/648e7c91edcf893fa780de9bb44c05f5f842a2e8/
http://autobuild.buildroot.net/results/7da/7da71263a6e9b780031f1f6185c760d11dfc994e/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

vboot-utils: disable static futility

Possibly fixes
http://autobuild.buildroot.net/results/fbe/fbe7892539cc1bf18f89d18c6609a5aa747647d0/
http://autobuild.buildroot.net/results/4bc/4bc388618ff02dde26ae09db021434a936c8cc1b/
and similar errors.

Signed-off-by: Alex Suykov <alex.suykov@gmail.com>
Tested-by: Matt Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/tor: fix openssl detection for static builds

Fixes
http://autobuild.buildroot.net/results/8e6/8e639ab8912e7d884fd8e6dbb1ca8b49451dd766/

/home/test/autobuild/run/instance-1/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libcrypto.a(c_zlib.o):
In function `zlib_stateful_expand_block':
c_zlib.c:(.text+0x54): undefined reference to `inflate'
/home/test/autobuild/run/instance-1/output/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libcrypto.a(c_zlib.o):
In function `zlib_stateful_compress_block':
c_zlib.c:(.text+0xd4): undefined reference to `deflate'

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

HOST_DIR/lib: symlink respectively to lib32/64

Discovered the issue on a RHEL7.4 machine where
the cmake build dynamically selected HOST_DIR/lib64
as the installation path for the lzo2 library.

Fixes failures like the following:
host-mtd
http://autobuild.buildroot.net/results/d31/d31581d2e60f35cf70312683df99c768e2ea8516/

host-squashfs
http://autobuild.buildroot.net/results/d9c/d9c95231ac774ed71580754a15ebb3b121764310/

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

linux: bump default to version 4.13.5

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

linux-headers: bump 4.{4, 9, 13}.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

qemu: drop obsolete "--disable-uuid" configuration parameter

./configure: --disable-uuid is obsolete, UUID support is always built

Change-Id: I9e278418d19e15bbbd3ea233658cd62f75e3385c
Signed-off-by: Carlos Santos <casantos@datacom.ind.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/turbolua: Fix build with gcc7

gcc7 has -Wimplicit-fallthrough enabled by default. Together with
-Werror in turbolua makefile it gives -Werror=implicit-fallthrough=
build error.

Add upstreamable patch [1], which fixes typo in FALLTHROUGH comment,
so it makes the fallthrough explicit for gcc.

[1] https://github.com/kernelsauce/turbo/pull/323

Fixes:
http://autobuild.buildroot.net/results/6f107b62f105508044185576b071323e5d73dd83
http://autobuild.buildroot.net/results/d303929960c667a21181d0bbdab64ba8a8d56a4f

Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lua-basexx: new package

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lua-compat53: new package

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lua-cqueues: new package

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

lua-fifo: new package

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt: Allow enabling of QtWebKit with GCC 6+

Building Qt with QtWebKit on configuration step there is
a check which disables QtWebKit build with GCC 6+.
Back in the day nobody thought about building Qt with GCC
version greater than 5.x. And now with modern GCCs like
6.x and 7.x this assumption gets in the way.

Given in Buildroot today we don't have GCC older than 4.9
it should be safe to remove now meaningless check completely
by adding patch to qt.

Signed-off-by: Evgeniy Didin <didin@synopsys.com>
Cc: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

wireguard: bump version to 0.0.20171001

And add a hash for the license file while we're at it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bridge-utils: fix headers path

Currently, bridge-utils wants to grap the headers from the linux-headers
package, so we point it directly there, as has been the case since we
first added bridge-utils in 2003 (c8eea31d3f), and then further refined
in 2005 (178a317d26) which is the first moment we pointed to the linux-
headers directory.

However, ther are two things wrong with that.

First, the headers are not directly in $(LINUX_HEADERS_DIR). Instead,
they are in a sub-directory thereof. So, we could not have found them
the way we are doing now.

Second, this definitely does not work when using an external toolchain,
because there is not linux-headers package enabled then.

Yet, against all odds, bridge-utils has valiantly deflected all rocks
thrown its way, day-in day-out building without any issue in every
autobuilders it's been confronted with. Good boy, good boy. :-)

And indeed, it turns out that the required headers are easily found from
within the sysroot of the toolchain. Wonders! :-)

But there's still a gotcha: the default search path is still a hard
coded path pointing to the installed kernel source tree on the host.

So, we still have to pass this option, but we can simply point to the
sysroot.

[Peter: point to sysroot instead of non-existing directory]
Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/netsniff-ng: add missing header

Like for nfs-utils and strongswan, add stdint.h header for
UINT16_MAX definition

Reported-by: Ross <grunpferd@netscape.net>
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nfs-utils: add missing include of stdint.h

The Glibc bump to 2.26 exposed this missing header when building with the
following combination using an i386 internal toolchain:

gcc5.4.0
bin2.28.1
linux4.1.43

Logfile snippet:

2017-10-02T00:08:11 ^
2017-10-02T00:08:12 rpc.c: In function ‘nsm_recv_getport’:
2017-10-02T00:08:12 rpc.c:469:13: error: ‘UINT16_MAX’ undeclared (first use in this function)

Upstream: https://bugzilla.linux-nfs.org/show_bug.cgi?id=312

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

strongswan: add missing include of stdint.h

Recent releases of glibc don't include the full stdint.h
header in some network headers included by utils.h.
Upstream is targetting a 5.6.1 release of the fix.

Ustream: https://wiki.strongswan.org/issues/2425

Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dump1090: fix librtlsdr package name typo

Fixes:
http://autobuild.buildroot.net/results/720/720a4b23a47aa6677bde4418f21e6b073a72ea51/
http://autobuild.buildroot.net/results/14e/14edf051d113a6ec54b61738748764adeac7ba9d/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/icu: remove xlocale.h header include

Remove xlocale.h header include since it's removed from glibc 2.26.

Reported-by: Ross <grunpferd@netscape.net>
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/php: bump version to 7.1.10

Changelog: http://www.php.net/ChangeLog-7.php#7.1.10

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/{mesa3d, mesa3d-headers}: bump version to 17.2.2

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

x11r7: xdriver_xf86-input-tslib: add the hash for the COPYING license file

The COPYING file is part of the xf86-input-tslib project's source tree.
Let's include the hash for it's current version.

Signed-off-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wireguard: add new package

[Peter: Fix help text, drop suboptions, drop patches, fix dependencies,
handle optional bash dependency, use kernel-module infrastructure,
enable needed kernel options]
Signed-off-by: Aurélien Chabot <aurelien@chabot.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

jsoncpp: bump to version 1.8.3

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

arc/bfin: remove 60x cores

Those cores are not supported in upstream gcc, not even in master.

The only toolchain that supported those core was the 2014R1 ADI
rebuilt toolchain, but we removed it in 311bc13 (toolchain: kill
ADI Blackfin toolchain) because there was too many issues with it.
ADI has not released any newer toolchain since then.

There is little hope for those cores now, so remove them.

Support for those cores has been useless and unusable for a while
without nobody noticing, therefore we intentionally skip adding
Config.in.legacy. This would require keeping code in
arch/Config.in.bfin since the options being removed are inside a
choice...endchoice block.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Thomas: explain why we don't add the options to Config.in.legacy.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

arch/bfin: internal backend not suitable for some cores

Some cores are not supported by upstream gcc.

Use the newly-introduced symbol to state so, rather than have the
exclusion in the toolchain choice.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

arch/mips: internal backend not suitable for some cores

Some cores are not supported by upstream gcc.

Use the newly-introduced symbol to state so, rather than have the
exclusion in the toolchain choice.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

arch/csky: internal backend not suitable

Upstream gcc does not have support for C-Sky, and we do not have a
vendor tree for it either (yet?).

Use the newly-introduced symbol to state so, rather than have the
exclusion in the toolchain choice.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

arch: add option to disable internal toolchain backend

Some architectures or specific cores do not have support in upstream
gcc. Currently, they are individually listed as exclusions in the
toolchain choice.

This poses a maintainance burden, as the knowledge about what gcc
version supports what architecture is split across many places: the
toolchain choice, the gcc version choice, the external toolchains.

As a first step, add a blind option that architectures or individual
cores may select to indicate they lack support in our internal backend.

Actual use of the option will come in followup patches.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

tslib: add the hash for the COPYING license file

Since tslib's COPYING file in part of the source tree, we can easily
include it's hash for the given version here.

Signed-off-by: Martin Kepplinger <martink@posteo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

monit: bump to version 5.24.0

Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

dnsmasq: simplify build configuration

Drop direct sed'ing of config.h for HAVE_CONNTRACK, HAVE_LUASCRIPT, and
HAVE_DBUS. Use MAKE_OPTS COPTS parameters instead, like we do already
for all other options.

Rename DNSMASQ_ENABLE_LUA to DNSMASQ_TWEAK_LIBLUA since it now does only
that.

Merge two conntrack and three dbus conditional sections.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

dnsmasq: security bump to version 2.78

Supported Lua version is now 5.2.

Add licenses hash.

Fixes a number of security issues:

CVE-2017-13704 - Crash when DNS query exceeded 512 bytes (a regression
in 2.77, so technically not fixed by this bump)

CVE-2017-14491 - Heap overflow in DNS code

CVE-2017-14492 - Heap overflow in IPv6 router advertisement code

CVE-2017-14493 - Stack overflow in DHCPv6 code

CVE-2017-14494 - Information leak in DHCPv6

CVE-2017-14496 - Invalid boundary checks allows a malicious DNS queries
to trigger DoS

CVE-2017-14495 - Out-of-memory Dos vulnerability

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>