package/emlog: bump to version 0.70

Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/go: bump to 1.13.5

go1.13.5 (released 2019/12/04) includes fixes to the go command, the runtime,
the linker, and the net/http package.

https://github.com/golang/go/issues?q=milestone%3AGo1.13.5

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website: update for 2019.02.8

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2019.02.8

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aaa1437b110f886ee24757595542f715a77d702a)
[Peter: drop Makefile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website: update for 2019.08.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2019.08.3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 21e50b5598625bda1f6f98566113cce1dba976ae)
[Peter: drop Makefile changes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/luajit: switch to moonjit fork

This fork is based on LuaJIT 2.1.0-beta3 which supports ARM64.

The license file is changed with the copyright from the Moonjit
developers, and an additional copy of the MIT license. Therefore the
license terms are still the same: MIT.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Thomas: add details about why the hash of the license file changes]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/spidermonkey: depends on host gcc >= 4.9

If GCC on the host is older than 4.9, during the configure stage an
error is thrown such as:

checking whether the host C compiler can be used... no
ERROR: Only GCC 4.9 or newer is supported (found version 4.8.2).

Depend on the host gcc version being >= 4.9

Fixes:
http://autobuild.buildroot.net/results/192661452fd522bf46b23d5a7a522eb853a984bf

Signed-off-by: Adam Duskett <aduskett@greenlots.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/arptables: bump to version 0.0.5

- Update site to retrieve latest version
- Remove first, second and third patches (already in version)
- Use the new COPYING file as the license file
- arptables binary is now named arptables-legacy since
  http://git.netfilter.org/arptables/commit/?id=28b22d55615447c94c5058e0aacec612ebc27f2a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/pkg-python: use _CONFIGURE_OPTS in the build environment

When building host or target python packages, we need to ensure that
the build environment utilize {HOST|TARGET}_CONFIGURE_OPTS. This
ensures that the correct linker and compiler environment variables are
set to compile utilizing either the host or target folders.

It was discovered that when compiling a host-python package, it was
using linking against the build machines library folder instead of the
host folder because LDFLAGS was not properly set and was improperly
detecting whether or not a shared or static library was present in the
host folder.

CC: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-daphne: bump to version 2.4.0

Other changes:
  - Update hash for PKG-INFO due to a version bump in the file.
  - select BR2_PACKAGE_PYTHON_TWISTED_TLS as a runtime dependency.
  - Update 0001-remove-pytest-runner-requirement.patch to work with the new
    version.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-twisted: add config for HTTP2 support

Add an option that selects all of the necessary python packages to
ensure that twisted has HTTP2 support.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-twisted: add config for TLS support

Add an option that selects all of the necessary python packages to
ensure that twisted has TLS support.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-twisted: bump to version 19.10.0

Tested with
run-tests tests.package.test_python_twisted.TestPythonPy3Twisted -d ./dl -o ./o

Ran 1 test in 388.506s
OK

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/{mesa3d, mesa3d-headers}: bump version to 19.2.7

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

{linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{3, 4}.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/x11r7/xserver_xorg-server: bump version to 1.20.6

Removed patches 0006 & 0007 which were applied upstream as single
commit on the server-1.20-branch branch:
https://gitlab.freedesktop.org/xorg/xserver/commit/07efd81b819f21046afc0bb7e19a6cdf7f3c7ea9

Updated upstream URL for patch 0001.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mosquitto: bump to v1.6.8

This is a bugfix release, see:
https://mosquitto.org/blog/2019/11/version-1-6-8-released/

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

toolchain/toolchain-buildroot: allow ARC big endian glibc builds

The current ARC glibc version in buildroot arc-2019.09-rc1 allows to
build an ARC big endian configuration, so let's allow this.

Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

DEVELOPERS: remove Daniel Nystrom

<daniel.nystrom@timeterminal.se>: host ASPMX.L.GOOGLE.COM[172.217.218.26] said:
    550-5.1.1 The email account that you tried to reach does not exist. Please
    try 550-5.1.1 double-checking the recipient's email address for typos or
    550-5.1.1 unnecessary spaces. Learn more at 550 5.1.1
    https://support.google.com/mail/?p=NoSuchUser o14si10209151edi.116 - gsmtp
    (in reply to RCPT TO command)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/testing: test_python_django: add missing line

flake8 complains with:

test_python_django.py:25:1: E302 expected 2 blank lines, found 1

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

.gitlab-ci.yml: add missing python-gobject test

Commit 600132f8c08a5ae3d399559dd9c17d3b7b4c6ae3 added a test for
python-gobject but failed to update .gitlab-ci.yml. Do that now.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/e2tools: bump to version 0.0.16.4

Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/pigpio: bump to version 72

Signed-off-by: Grzegorz Blach <grzegorz@blach.pl>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-http-date: bump to version 6.05

license lives now in its own file

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-http-cookies: bump to version 6.08

years updated in LICENSE:
< This software is copyright (c) 2002-2017 by Gisle Aas.
> This software is copyright (c) 2002-2019 by Gisle Aas.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-mail-dkim: bump to version 0.58

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-libwww-perl: bump to version 6.43

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-http-entity-parser: bump to version 0.22

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-file-slurp: bump to version 9999.29

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-date-manip: bump to version 6.79

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/perl-apache-logformat-compiler: bump to version 0.36

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/glibc: drop dependency of utilities on bash

The dependency was added because ldd uses bash-specific syntax to
localize messages. Add a post-patch hook, instead, to replace the
occurrences of $"foo" by "foo", simply, so the code becomes POSIX
sh compliant if bash is not selected.

Also set the configuration environment accordingly to replace the
/bin/bash hashbang by /bin/sh.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/testing: add python-django test

This test comprises of four simple steps:
  1: Start a new simple project called testsite.
  2: Run ./manage.py migrate on the new testsite.
  3: Run ./manage.py runserver 0.0.0.0:1234 & sleep 30
    - The sleep 30 is necessary as it may take several seconds for
      the django server to fully start.
  4: Run netstat to ensure the server opened port 1234.

Signed-off-by: Adam Duskett <aduskett@greenlots.com>
[Thomas: use self.assertRunOk() when appropriate]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-django: bump to version 3.0

Other changes:
  - Select BR2_PACKAGE_PYTHON_ASGIREF as a new runtime dependency.
  - Select BR2_PACKAGE_PYTHON_SQLPARSE as a new runtime dependency.

Signed-off-by: Adam Duskett <aduskett@greenlots.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/atmel: use tarballs to fetch U-Boot and at91bootstrap

Use tarballs for U-Boot and at91bootstrap instead of cloning the
repositories.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Acked-by: Ludovic Desroches <ludovic.desroches@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libnspr: bump to version 4.24

All patches have been upstreamed so remove them.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libepoxy: bump to version 1.5.4

This release contains two minor improvements (smaller library size, and
updates to the GL registry), plus a couple of build fixes which are not
relevant for Buildroot (one for Solaris; another for unit tests, which
we do not build):

  https://github.com/anholt/libepoxy/releases/tag/1.5.4

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: properly propagate libargon2 dependencies

Fixes:
 - http://autobuild.buildroot.org/results/72412a68da44d7ecc87656436a17542cafcf1f95

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/openjdk: use official hg.openjdk.java.net repository

Since Java 11 (and possibly earlier), OpenJDK now has its own official
repository at hg.openjdk.java.net which is referenced in all OpenJDK
documentation.  This patch brings buildroot into line with that
source, reducing the opportunity for code injection, and allowing
consistent patching both across projects and for patches specific to
buildroot environments.

diff -ru shows that the only changes between the downstream and upstream files at
this point in time is the addition of a .hg_archive.txt file,  containing:

repo: fd16c54261b32be1aaedd863b7e856801b7f8543
node: 7b6accc7c009304dd2979ea16c1cb15bf749a1fc
branch: default
tag: jdk-12.0.2+10
tag: jdk-12.0.2-ga

This does, however, change the hash for the tar.gz file (but not for the license).

With respect to the concern regarding upstream hash consistency, we have now been
using these archives for just over a year (since OpenJDK 11) and we haven't seen an
archive hash change in that time.  This was a vast improvement on the previous
Mercurial forest.  /archive is exactly as is sounds.  It's an archive that doesn't
change, which is why it effectively negates the need for a "downstream" mirror.

Tests completed successfully (which is not surprising since there are no code changes here):

$ ./support/testing/run-tests -d ./dl/ -k -o test_dir tests.package.test_openjdk.TestOpenJdk
14:35:25 TestOpenJdk                              Starting
['Hello, World']
['Test: Get JNI Version passed', 'Test: Read Native String Constant passed', 'Test: Write Java String to Native Library passed', 'Test: Write Java Char Array to Native Library passed', 'Test: Write String Member to Native Library passed', 'Test: Set String Member from Native Library passed', 'Test: Execeute Java Function from Native Library passed', 'Test: Instantiate Java Class passed', 'Test: Call Native Library to Set System Time passed']
14:35:46 TestOpenJdk                              Cleaning up
.
----------------------------------------------------------------------
Ran 1 test in 20.614s

OK

Signed-off-by: Tudor Holton <tudor@tudorholton.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/rauc: select fw_printenv for uboot based systems

When operating on a uboot based system, rauc interacts with
the bootloader environment using fw_printenv and fw_setenv [1].

These commands should therefore be present on the target if
the system being built uses uboot.

[1] See:
https://github.com/rauc/rauc/blob/v1.2/src/bootchooser.c#L21-L22
https://github.com/rauc/rauc/blob/v1.2/src/bootchooser.c#L644-L645

Signed-off-by: Titouan Christophe <titouan.christophe@railnova.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/python-brotli: fix build failure due to gcc bug 68485

The python-brotli package exhibits gcc bug 68485 when built for the
Microblaze architecture with optimization enabled, which causes a build
failure.

As done for other packages in Buildroot work around this gcc bug by
setting optimization to -O0 if BR2_TOOLCHAIN_HAS_GCC_BUG_68485=y.

Fixes:

http://autobuild.buildroot.net/results/24b/24b23175ab27615fb377bb4d5f6c656dccf10a86/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/pkg-kconfig: fix reconfigure for kconfig packages

Commit 4b81badbcc0b25678ac6627548160702731cf393

    Currently, calling foo-reconfigure for a kconfig-based package will not
    re-trigger the configuration (kconfig-wise) step for the package.

was supposed to solve this problem and lately we had

Commit 05fea6e4a60a38a797d9bacbf318a2cd7dbd435f

    infra/pkg-kconfig: do not rely on package's .config as a timestamp

that introduced the .stamp_dotconfig file.

For this reason, to trigger a kconfig package reconfigure is now
necessary to remove the .stamp_dotconfig file.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mender: bump to version 2.1.2

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/mender-artifact: bump to version 3.2.1

Other changes:
  - Add a sha256sum for LIC_FILES_CHKSUM.sha256
  - Remove duplicated license file vendor/github.com/stretchr/testify/LICENSE

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

utils/genrandconfig: test per-package directories

Now that the support for per-package directories has been merged, it
is time to get some exposure for it in the autobuilders, so let's
build 1 out of 15 builds with this feature enabled, at least as an
initial step.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

support/testing: add python-gobject test

Add a simple test case that imports the module.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/python-gobject: depend on python2

Version 2.86.6 of python-gobject is quite old and no longer works with
Python versions > 3.7. When importing a user will recieve the following error:

Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
  File "/usr/lib/python3.8/site-packages/gobject/__init__.py", line 26, in
  <module>
  File "/usr/lib/python3.8/site-packages/glib/__init__.py", line 22, in <module>
SystemError: initialization of _glib raised unreported exception

Because new versions of python-gobject require gobject-introspection, which is
not currently available in Buildroot, add a dependency on python2 to prevent
users from receiving the above error.

Fixes: https://bugs.busybox.net/show_bug.cgi?id=12286
Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

utils/scancpan: follow Perl version

linked to https://git.busybox.net/buildroot/commit?id=01134ca99a2c83932aee42984c81e51cc0428425

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/tini: compile executable static

One usecase for tini is as the init process for a container which has
a single executable and no C runtime library. It therefore needs to be
independent of any C runtime library within the container.

Previously, we didn't build statically to avoid problems with
BR2_SHARED_LIBS=y. However, it turns out that tini can successfully link
statically even with glibc and BR2_SHARED_LIBS=y, because libc.a is
still included in staging, and tini doesn't use any NSS functionality.

Signed-off-by: Simon Rowe <simon.rowe@citrix.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/postgresql: fix minor typo

pgsql as a tool does not exist, it's called psql

Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

utils/genrandconfig: fix runtime issue with Python 3

With Python 3.7, genrandconfig fails with:

'str' object has no attribute 'decode'

We are already working on str objects, and there is no need to decode
them, so we drop the call to decode_byte_list() and its definition as
it was only used there.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/alsa-lib: fix build without mixer

Fixes:
 - http://autobuild.buildroot.org/results/4d91c9f82a2a61c50c457a851073b85cc09ea345

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>

package/webrtc-audio-processing: bump to version 0.3.1

Drop 0001-configure.ac-fix-architecture-detection.patch as it is now
upstream.  Aarch64 is now supported, so update _ARCH_SUPPORTS to match.

Add a hash for the license file.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/alsa-lib: bump to version 1.2.1.1

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/alsa-utils: bump to version 1.2.1

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/nanopi_neo: update kernel to 5.3 and u-boot to 2019.10

Signed-off-by: Viktar Palstsiuk <viktar.palstsiuk@promwad.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/nanopi_neo: remove custom post-build/post-image script

Instead use the generic infrastructure for u-boot scripts and genimage.

Signed-off-by: Viktar Palstsiuk <viktar.palstsiuk@promwad.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cmocka: fix build on riscv64

Fixes:
 - http://autobuild.buildroot.org/results/30922c18150ea62aefe123d1b7cd1444efab963f

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Joel Carlson <JoelsonCarl@gmail.com>
Tested-by: Joel Carlson <JoelsonCarl@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nss-mdns: disable tests

Disable tests that depend on check and have been added in version 0.11
with
https://github.com/lathiat/nss-mdns/commit/7b649a32836af3578a2bb60aa713588f0d9f9a83

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/nss-mdns: bump to version 0.14.1

Switch site to https://github.com/lathiat/nss-mdns to retrieve latest
version

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/kyua: bump to version 0.13

COPYING was renamed into LICENSE since version 0.12 and
https://github.com/jmmv/kyua/commit/db509f9d9ece719bf8452d6ddbc842ae311b1bc2

So update KYUA_LICENSE_FILES and add hash for LICENSE file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

configs/warp7: Bump the kernel version

Bump the kernel to version 5.4.1

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/moarvm: bump to version 2019.11

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gr-osmosdr: bump to version 0.1.5

Add hash for license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rabbitmq-c: security bump to version 0.10.0

Add additional input validation to prevent integer overflow when parsing
a frame header. This addresses CVE-2019-18609.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-django: security bump to version 2.2.8

Fixes the following security vulnerabilities:

- CVE-2019-19118: Privilege escalation in the Django admin

Additionally, 2.2.8 (and 2.2.7) fixes a number of bugs and adds python 3.8
support.

For more details, see the release notes:
https://docs.djangoproject.com/en/dev/releases/2.2.8/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bubblewrap: new package

Bubblewrap is a sandboxing tool based on kernel namespaces, typically
used as lower-level infastructure by other end-user tools e.g. Flatpak.

https://github.com/containers/bubblewrap

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[Peter: needs mmu and !musl toolchain]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/binutils: remove version 2.30

Now that binutils 2.33.1 has been introduced, and we have moved to
2.32 as the default version, it is time to drop support for binutils
2.30.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/binutils: switch to use 2.32 as the default version

Now that binutils 2.33.1 has been released, it is time to move to
binutils 2.32 as the default binutils version, instead of 2.31.1.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/binutils: add binutils 2.33.1

Keep sh-conf and poison-system-directories patches.
Remove xtensa patches already in this version [1] [2] [3].

Revert an upstream patch since it prevent booting a sh4 system under
Qemu as reported on the Binutils mailing list [5] [6].
This commit is not related to sh4, it's weird that it is the
only affected architecture.

[1] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=2487ef07c28b961c6e2b8c51161f88f93b181d07
[2] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=403b0b61f6d4358aee8493cb1d11814e368942c9
[3] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=548791769dc737f05cb12e5ee4190b7e853beac9
[4] https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=commitdiff;h=ebd2263ba9a9124d93bbc0ece63d7e0fae89b40e
[5] https://sourceware.org/ml/binutils/2019-10/msg00105.html
[6] https://sourceware.org/ml/binutils/2019-11/msg00407.html

See:
https://www.sourceware.org/ml/binutils/2019-10/msg00103.html

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: Apply fix for CVE-2018-19540

Add 0003-test-asclen-CVE-2018-19540.patch:
If txtdesc->asclen is < 1, the array index of
txtdesc->ascdata will be negative which causes the heap based overflow.

Patch was proposed upstream[1] but upstream is very inactive. Linux
distributions use the same fix to patch their packages.

1: https://github.com/mdadams/jasper/pull/198
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: Apply fix for CVE-2018-19542

Add 0002-check-null-in-jp2_decode.patch:

Patch was proposed upstream[1] but upstream is very inactive.
Linux distributions use the same fix to patch their packages.

1: https://github.com/mdadams/jasper/pull/200
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: Apply fix for CVE-2018-19541

Add 0001-verify-data-range-CVE-2018-19541.patch:
We need to verify the data is in the expected range. Otherwise we get
problems later.

Patch was proposed upstream[1] but upstream is very inactive. Linux
distributions use the same fix to patch their packages.

1: https://github.com/mdadams/jasper/pull/211
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

board/pc/post-image-efi.sh: fail on any error

As already done in post-build.sh, to prevent hiding errors.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: add Michael Vetter for libstrophe

Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

DEVELOPERS: change email address for Alexander Lukichev

Signed-off-by: Alexander Lukichev <alexander.lukichev@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openpgm: drop release- prefix to match release-monitoring.org

Autobuild has a "version bump" checker that sends message to a package
maintainer if its declared version does not match the latest one on
release-monitoring.org.  In case of openpgm the version _is_ the latest one,
but a mismatch is caused by including a "release-" prefix into tags on
upstream and excluding them on other websites when referring to the
package's version.

This also fixes sha256 value for the downloaded archive.

Signed-off-by: Alexander Lukichev <alexander.lukichev@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/gcc: bump to version 7.5.0

Remove upstream patch [1]
1002-xtensa-backport-fix-for-PR-target-90922.patch

[1] https://github.com/gcc-mirror/gcc/commit/0110ab63c006fe8f1a86142cd6e86d5534f8bc8e

See:
https://gcc.gnu.org/ml/gcc/2019-11/msg00099.html

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 5.4 series to 5.4.1

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: add version 5.4

Signed-off-by: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Merge branch 'next'

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Kickoff 2020.02 cycle

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/website/news.html: add 2019.11 announcement link

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Update for 2019.11

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/{pkg-generic, python, python3}: rename .py file exclusion variable to not conflict

Fixes:
http://autobuild.buildroot.net/results/3b6/3b6280b0b7a9634b747db2865b21c6266007c725/

The PYTHON_KEEP_PY_FILES global variable conflicts with the per-package
<pkg>_KEEP_PY_FILES variable for the python package, causing make to
complain:

package/zlib/zlib.mk:7: *** Recursive variable 'PYTHON_KEEP_PY_FILES' references itself (eventually).  Stop.

As a workaround, rename the global variable to KEEP_PYTHON_PY_FILES so it
cannot conflict with the per-package variable.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/musl-fts: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mp4v2: update the upstream URL in Config.in

Update the upstream URL in the help text in Config.in. This
addresses the 'Invalid(405)' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-startup-monitor: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-panel: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-lib: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-keyboard: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-fakekey: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-desktop: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/matchbox-common: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/linux-fusion: add an upstream URL to Config.in

Add an upstream URL to the help text in Config.in. This
addresses the 'Missing' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/luasql-sqlite3: update the upstream URL in Config.in

Update the upstream URL in the help text in Config.in. This
addresses the 'Invalid(406)' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/luasyslog: update the upstream URL in Config.in

Update the upstream URL in the help text in Config.in. This
addresses the 'Invalid(Err)' URL status in the package stats
web page output.

Signed-off-by: Mark Corbin <mark@dibsco.co.uk>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: bump to 2.0.16

Changes:
  * Fix assertion failure JPC_NOMINALGAIN (CVE-2016-9396) (#50)
  * Fix build on Windows 10 (#162)
  * Improve README
  * Fix build with CMake 2.x
  * Add missing dereference operators (#178, #157)
  * Check data in jas_image (CVE-2018-19539) (#196)
Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/openvmtools: only try to start vmtoolsd on vmware

adds ConditionVirtualization=vmware to vmtoolsd.service

Signed-off-by: Pascal de Bruijn <p.debruijn@unilogic.nl>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>