mpg123: bump to version 1.23.6

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

xerces: security bump to version 3.1.4

Fixes:
CVE-2016-4463 - XML Parser Crashes on Malformed DTD.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libinput: bump to version 1.3.3

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-meld3: bump to version 1.0.2

meld3 1.0.2 supports Python 3, so drop Python 2 only dependency.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pcmanfm: don't show comment about missing X.org

The comments are meant for toolchain dependencies, not packages. Adjust the
logic to match what we do for other X11 applications.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/Config.in: hide X.org subsections if XORG7 isn't enabled

(most of) the individual packages depends on BR2_PACKAGE_XORG7, but the
subsection comments do not, so we end up displaying them when Xorg isn't
enabled which isn't very useful:

[ ] X.org X Window System  ----
    *** X applications ***
    *** X libraries and helper libraries ***
    *** X window managers ***

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python: Fix rebased patch 011-remove-python-symlink.patch

While rebasing one line was accidently not removed, this patch fixes

http://autobuild.buildroot.net/results/018/018303a5d551aaa6c91013ab0352437e9a2c28bc/
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

binutils: bump 2.26.x series to 2.26.1

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

makedevs: add capability support

Add the support of capability to makedevs as extended attribute.
Now, it's possible to add a  line "|xattr <capability>" after a
file description to also add a capability to this file. It's
possible to add severals capabilities with severals lines.

[Peter: extend doc, reword Config.in, extend error message,
use HOST_MAKEDEVS_CFLAGS/LDFLAGS for all flags]
Signed-off-by: Philippe Reynes <philippe.reynes@sagemcom.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

toolchain: Bump ARC tools to arc-2016.09-eng005

With this commit we're starting a series of updates of ARC tools.
Significantly rewritten arc-2016.03 tools introduced way too many
problems highlighted by Buildroot autobuilder. Now in attempt to
resolve as many issues as possible by the time final release of
arc-2016.09 tools is cut we'll be executing arc-2016.09 series
with engineering snapshots like this one.

We decided to go this way instead of applying separate patches here
and there because ongoing development introduces quite a lot of
changes and separate patches are not practical in Buildroot.

Moreover this will give us very clean visibility of number of
issues we see (hopefully it will decrease over time).

One of the important changes introduced in this engineering build
is initial set of changes for proper support of PIE on ARC in terms
of both building on host and running on ARC target. I expect some
PIE-related build breakages to go away and new ones will be treated
as the high-priority issues to be fixed ASAP.

For now we only update Binutils and GCC while keeping GDB
as it is of arc-2016.03 release because there're some issues
we'd like to resolve before releasing it to wider audience.

So again note this is one of the first engineering builds of
arc-2016.09 series and it might have all kinds of breakages,
please don't use it for production builds.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: arc-buildroot@synopsys.com
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python3: bump to version 3.5.2

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python: bump version to 2.7.12

Rebased 011-remove-python-symlink.patch

[Peter: correct .hash file comment as pointed out by Baruch]
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/bash: bump to patchlevel 46

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nodm: new package

[Peter: propagate linux-pam dependencies/comment,
needs wordexp.h, not available on uClibc,
use /etc/default/nodm for config override,
correct github/site/source handling,
disable help2man]
Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/tegrarcm: fix license typo

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Reviewed-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

rt-tests: remove occurrence of eglibc

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/manual/known-issues: remove occurrences of eglibc

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gcc: remove occurrence of eglibc

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

glibc: remove additional occurrences of eglibc

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

docs/manual: don't mention eglibc, mention musl

Following the removal of eglibc, it no longer makes sense to talk about
it in the Buildroot manual as one of the supported C libraries. However,
it does make sense to indicate that we support musl.

[Peter: remove extra 'the' as suggested by Yann]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

Replace (e)glibc by glibc

Following the removal of eglibc support, this commit replaces all
occurences of "(e)glibc" by just "glibc". Most of the occurences are in
package Config.in comments.

In addition, when the form "an (e)glibc ..." was used, it is replaced by
"a glibc ...".

[Peter: add new efi* packages, s/uclibc/uClibc as suggested by Romain,
        systemd / liquid-dsp tweaks as suggested by Yann]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gettext: install ABOUT-NLS for the host

gettextize copies a number of files from usr/share/gettext into the project
when it is run.  One of these is ABOUT-NLS, which is simply a text file
explaining some details about gettext - So it isn't really critical but
autoreconf fails if gettext functionality is used and ABOUT-NLS is missing.

Normally this isn't an issue as the release tarball typically already
contains an ABOUT-NLS file, but as this is a generated file it normally
isn't checked into git so it fails for packages from git snapshots using
<foo>_GETTEXTIZE = YES (E.G. libuio):

configure.ac:42: error: required file './ABOUT-NLS' not found

As is evident from GETTEXT_REMOVE_UNNEEDED, this file normally gets
installed by gettext-runtime, but as we don't build/install that for the
host instead install it by hand.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

gettext: drop host-gettextize eye candy fixups

The real functional change (to not wait for confirmation) was alredy handled
below in HOST_GETTEXT_GETTEXTIZE_CONFIRMATION, and we otherwise don't patch
upstream purely for cosmetical reasons so drop it.

gettextize is also quite noisy as is, so the single 'Press return' line imho
isn't a big issue:

>>> fetchmail 6.3.26 Gettextizing
Copying file config.rpath
Not copying intl/ directory.
Copying file po/Makefile.in.in
Copying file po/Makevars.template
Copying file po/Rules-quot
Copying file po/boldquot.sed
Copying file po/en@boldquot.header
Copying file po/en@quot.header
Copying file po/insert-header.sin
Copying file po/quot.sed
Copying file po/remove-potcdate.sin
Creating po/ChangeLog
Copying file m4/gettext.m4
Copying file m4/iconv.m4
Copying file m4/lib-ld.m4
Copying file m4/lib-link.m4
Copying file m4/lib-prefix.m4
Copying file m4/nls.m4
Copying file m4/po.m4
Copying file m4/progtest.m4
Creating m4/ChangeLog
Updating configure.ac (backup is in configure.ac~)
Creating ChangeLog

Please update po/Makevars so that it defines all the variables mentioned
in po/Makevars.template.
You can then remove po/Makevars.template.

Please run 'aclocal -I m4 -I m4-local' to regenerate the aclocal.m4 file.
You need aclocal from GNU automake 1.9 (or newer) to do this.
Then run 'autoconf' to regenerate the configure file.

You might also want to copy the convenience header file gettext.h
from the /home/peko/source/buildroot/output-test/host/usr/share/gettext directory into your package.
It is a wrapper around <libintl.h> that implements the configure --disable-nls
option.

Press Return to acknowledge the previous three paragraphs.
>>> fetchmail 6.3.26 Autoreconfiguring

CC: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wpa_supplicant: add support for simple background scan

CONFIG_BGSCAN_SIMPLE is missing from the defconfig included with
wpa_supplicant.  Many programs that depend on wpa_supplicant assume
bgscan is enabled, for example connman will try to set bgscan by default.
It is safe to always enable CONFIG_BGSCAN_SIMPLE since it is only used if
wpa_supplicant is configured to do so.

Signed-off-by: Martin Bark <martin@barkynet.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

website: rephrase several hundreds of packages

The phrase "Supports several hundreds of packages" is unusual to hear in
English (or at least American English). The more common alternatives are
"Supports several hundred packages" or "Supports hundreds of packages".
The latter sounds like a larger amount, so change the phrase to that.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

python-xlrd: new package

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

minnowboard-max: Enable serial and HDMI consoles

Following what's done in Raspberry Pi's defconfigs, let's
unify the consoles in Minnowboard Max defconfigs, providing
consoles on HDMI and serial port.

[Peter: use tty1 like on rpi]
Signed-off-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/mono: fix sigcontext incorrect include

This patch solves incorrect inclusion of sigcontext.h on musl.
The patch was submitted upstream.

Fixes: http://autobuild.buildroot.net/results/bec/beced92f3ef81f201c0dc9178c7ff6fad0bc45e7/
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

nano: bump to version 2.6.1

And since we switched to non-gnu mirror better use the small xz tarball.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

xorriso: indentation cleanup

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

qt5webkit: indentation cleanup

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

fmc: remove empty leading line

Signed-off-by: Jerzy Grzegorek <jerzy.grzegorek@trzebnica.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wandboard: defconfig: simplify u-boot configuration

No functional change. The git hash used is actually just the 2015.07
release, so use the release tarball instead of git.  Likewise, we have a
dedicated option for u-boot.img, so use that instead of the custom format.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

wandboard: Use HTTP for accessing Linux kernel and U-Boot git repos

Quite often these days Git ports are blocked by firewalls
[this is especially true in corporate environment] so switching
to common HTTP(s) is a safe and pretty convenient move.

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Stephan Hoffmann <sho@relinux.de>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Sergio Prado <sergio.prado@e-labworks.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

glibc: bump default to version 2.23

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

beecrypt: arm assembly optimizations needs ARM instructions support

Fixes:
http://autobuild.buildroot.net/results/980/98034ebb086987fb8fc004672164f609f5a69543/
http://autobuild.buildroot.net/results/3bd/3bdba5cf7e901f8600e567b1b0eb0866d6dfc523/

So disable it for thumb(2)-only configurations (armv7m), similar to how we
do it for m68k coldfire.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

m68k: gcc coldfire does not provide _sync atomics

Trying to use __sync_fetch_and_add ends with a gcc ICE.
This fixes following autobuild failure, by actually disabling
the package for coldfire:
http://autobuild.buildroot.net/results/d719db11210d42501332586b4485ab0cc1e125dd/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

dbus-python: bump to version 1.2.4

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lvm2: bump version to 2.02.158

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

linux: bump default to version 4.6.3

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

glog: put hash in .hash file

github archives should be stable now.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gflags: put hash in .hash file

github archives should be stable now.

Fixes:
http://autobuild.buildroot.net/results/ac9/ac92ec88c9e26df579a5e44f58c34a3e4dd5b2b0/
http://autobuild.buildroot.net/results/79c/79cecd4fa98bdad5b5bdc57725d8cb8118b1cf2e/
http://autobuild.buildroot.net/results/bb2/bb2e04a643784beb78f38c016a1c621786b575fe/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

e2fsprogs: add fuse2fs libintl fix patch

Fixes:
http://autobuild.buildroot.net/results/ab5/ab5c5b0e234f3d9db78c968334a61a7aef206b7a/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gd: security bump to version 2.2.2

Drop upstreamed patches.
Drop autoreconf since it's no longer required.
Patch 0002-no-zlib.patch is no longer required, and is in fact harmful.
Update homepage URL.

Fixes:
CVE-2015-8874 - #215 Stack overflow with gdImageFillToBorder
CVE-2016-3074 - gd2: handle corrupt images better
CVE-2016-5767 - Integer Overflow in gdImagePaletteToTrueColor()
resulting in heap overflow

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lirc-tools: add optional support for portaudio

lirc-tools has optional support for portaudio, see configure.ac,
line 218+.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lirc-tools: add optional support for alsa-lib

lirc-tools has optional support for alsa-lib, see configure.ac,
line 230+.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lirc-tools: add optional support for udev

lirc-tools has optional support for udev, see configure.ac, line 303+.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lirc-tools: add optional support for libusb-compat

lirc-tools has optional support for libusb-compat, see configure.ac,
line 199+.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/lirc-tools: bump version to 0.9.4

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Thomas: update comment in the .mk file about autoreconf.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mpg123: bump to version 1.23.5

Drop upstreamed patch and related autoreconf.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

feh: bump to version 2.16.1

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5enginio: fix version for qt5 5.6.1-1 update

Fix qt5enginio version, is 1.6.1 for qt5.6.1-1 (hash
is already updated by previous qt5 bump version patch).

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

ethtool: bump to version 4.6

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

mpv: bump to version 0.18.0

gpl3 option removed so drop it otherwise it results in build failure.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/opencv: bump to version 2.4.13

Removed 0001-ffmpeg30.patch after being applied upstream.
Renumbered remaining patches.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

memcached: bump to version 1.4.27

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

sysstat: bump to version 11.2.5

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/i2c-tools: update download location

Since the shut down of www.lm-sensors.org we do not have a package
download location anymore, so we update the i2c-tools package to use
the git repository hosted at kernel.org.

Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/enlightenment: bump to 0.20.9

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libevas-generic-loaders: bump to 1.17.0

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/elementary: bump to 1.17.1

There is no elementary 1.17.2 release since there was no patch to
backport from upstream.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl: bump to 1.17.2

Update the untested configuration warning option.

Disable efl build for host/target gcc older than 4.7 (oldest tested version).
http://lists.busybox.net/pipermail/buildroot/2016-June/163606.html

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/efl: switch to luajit support

In efl 1.15.x, Lua "old" support is broken with Lua 5.2+ [1].

With the patch added in efl 1.16 to fixes this issue, libevas fail to link with
the following error:

CCLD bin/ecore_evas/ecore_evas_convert
host-efl-1.16.1/src/lib/evas/.libs/libevas.so: undefined reference to `luaL_openlib'
collect2: error: ld returned 1 exit status
Makefile:19021: recipe for target 'bin/ecore_evas/ecore_evas_convert' failed

Since 9ba8d1cce4ab00307827083bae234d87b37fb967, the luajit support can be
enabled in efl package.
In order to update the efl stack to 1.17, switch to luajit support and remove
Lua "old" support since it's not fixed upstream yet. But the drawback is the
efl stack depends implicitely on BR2_PACKAGE_LUAJIT_ARCH_SUPPORTS.

[1] https://phab.enlightenment.org/T2728

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

python-sip: bump to version 4.18

Signed-off-by: Akihiko Odaki <akihiko.odaki.4i@stu.hosei.ac.jp>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/php: security bump version to 7.0.8

Changelog is available here: http://php.net/ChangeLog-7.php#7.0.8

Fixes CVE-2015-8874 http://bugs.php.net/66387
Fixes CVE-2016-5766 http://bugs.php.net/72339
Fixes CVE-2016-5767 http://bugs.php.net/72446
Fixes CVE-2016-5768 http://bugs.php.net/72402
Fixes CVE-2016-5769 http://bugs.php.net/72455
Fixes CVE-2016-5772 http://bugs.php.net/72340
Fixes CVE-2016-5773 http://bugs.php.net/72434

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/x11r7/libxcb: force the use of python2

libxcb in its current state is not python3-compatible:
https://bugs.freedesktop.org/show_bug.cgi?id=96395

Fixes
http://autobuild.buildroot.net/results/c74/c74fa243bf319472dca66982323df6c2a983642b/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

bluez_utils: disable PIE for m68k

PIE for m68k seems broken even for non-static case.
Fixes following kind of autobuild failures:
http://autobuild.buildroot.net/results/5bb524a58575d57de1006ffa70be17ca713e7730/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

fs/tar: support passing long options to tar

Move TAR_OPTS so that long options (or any option with an initial '-')
may be passed to tar. Since TAR_OPTS is at the front of the list, single
letter options still work.

Signed-off-by: Frank Hunleth <fhunleth@troodon-software.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

qt5: bump version to 5.6.1-1

Removed obsolete patches:

  - qt5base/0001-Disable-c-standard-compiler-flags-for-the-host-build.patch (upstream committed [1])
  - qt5/qt5base/0007-build-with-explicitlib-after-all.patch (upstream committed [2])
  - qt5tools/0001-Disable-qdoc-needs-qtdeclarative.patch (fixed upstream by [3])
  - qt5webkit/0004-Fix-linking-with-libpthread.patch (upstream committed [4])

[1] http://code.qt.io/cgit/qt/qtbase.git/commit/?id=e69e69519661954716d59bfa5bbd0626515cfda9
[2] http://code.qt.io/cgit/qt/qtbase.git/commit/?id=523c7e3fd55c853dd424d57f28e225d57439cf89
[3] http://code.qt.io/cgit/qt/qttools.git/commit/?id=2b262fad86ef38a5fa692b4c73e6ec26a5d45a5f
[4] http://code.qt.io/cgit/qt/qtwebkit.git/commit/?id=5f359baacdf92fabcece83f0a2b30f74c7c02a3c

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

libsoc: add Python bindings support

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Thomas: add --disable-python, use 'else ifeq'.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

efivar: fix build with old gcc versions

The efivar build process starts by building one tool for the host,
which is needed for the rest of the build. This tool currently fails
to build with old gcc versions because the gcc.specs used by efivar
specifies -std=gnu11. To address this, this patch:

 - passes 'gcc_flags=' to the host build, so that the custom gcc specs
   are not passed. They are in practice not needed for the build of
   the simple makeguids host utility.

 - passes -std=gnu99 instead of -std=c99 in the build of host
   makeguids, because the source code uses anonymous structs and
   unions, which requires std=gnu99 and not just std=c99

In addition, the build by default assumes that the target toolchain is
LTO capable, and that therefore you can call gcc-ar, gcc-nm and
gcc-ranlib. This fails short when the target toolchain is for example
gcc 4.7. To address this, we explicitly specify AR, NM and RANLIB to
be used, but pass them as make options instead of in the environment,
in order to override the values specified in the package Makefile.

Fixes:

   http://autobuild.buildroot.net/results/fe40c1d139ba8ddeef3dafd5c1818a946f014d7c/

Cc: Erico Nunes <nunes.erico@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libva-intel-driver: bump version to 1.7.1

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/libva: bump version to 1.7.1

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/linux-headers: bump 3.{18, 14}.x and 4.{1, 4, 6}.x series

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gst1-plugins-bad: cleanup of build options

Remove non-existing options:
 * --disable-wsap
 * --disable-direct3d
 * --disable-gsettings

Remove options that are already handled later in the .mk file, using
optional dependencies:
 * --disable-rtmp
 * --disable-hls
 * --disable-dash

Rename disable->strp to disable-srtp, which essentially fixes a typo.

Remove liveadder plugin - no longer a separate built option, it's been
merged into audiomixer. Config.in.legacy handling is added for the
removed option.

Signed-off-by: Marcin Nowakowski <marcin.nowakowski@imgtec.com>
[Thomas: add Config.in.legacy handling for the liveaddr plugin option,
tweaks to the commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

gtest: fix typo in .pc file installation

Fixes:

  http://autobuild.buildroot.net/results/08e/08e1eb10f63f07378237ba72953d7201ea0786ab/build-end.log

Reported-by: Romain Naour <romain.naour@openwide.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/qt5base: add optional dependency on udev

Qt5 can optionally enable udev support, especially to enumerate input
devices dynamically. Without udev, devices are not properly enumerated,
and any device that is not present at launch time is never seen (there
is no support for hotplug, that is).

Currently, Qt5base has no explicit dependency on udev, so it will all
depend on the build order. Sometimes, a package that requires udev will
be built before qt5base and Qt5 will have support for udev, sometime no
such package is built before qt5base and Qt5 will not have support for
udev.

Add an explicit dependency on udev, but only if it is enabled.

Note: this only really requires libudev, but we do not yet have a
separate libudev; we still only have a udev provider (be it eudev or
systemd).

Signed-off-by: "Yann E. MORIN" <yann.morin@orange.com>
Cc: Cedric Chedaleux <cedric.chedaleux@orange.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[Thomas: drop comment, as suggested by Arnout.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/gtest: add and install a .pc file

Signed-off-by: "Yann E. MORIN" <yann.morin@orange.com>
Signed-off-by: Cedric Chedaleux <cedric.chedaleux@orange.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

package/gmock: install .pc file

Signed-off-by: "Yann E. MORIN" <yann.morin@orange.com>
Signed-off-by: Cedric Chedaleux <cedric.chedaleux@orange.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

nano: bump version to 2.6.0

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

nano: switch to official site

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

imagemagick: bump version to 7.0.2-1

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/legal-info: ensure legal-info works in off-line mode

Almost all packages which are saved for legal-info have their source
archives downloaded as part of 'make source', which makes an off-line
build completely possible [0].

However, for the pre-configured external toolchains, the source tarball
is different, as the main tarball is a binary package. And that source
tarball is only downloaded during the legal-info phase, which makes it
inconvenient for full off-line builds.

We fix that by adding a new rule, $(1)-legal-source which only
$(1)-all-source depends on, so that we only download it for a top-level
'make source', not as part of the standard download mechanism (i.e. only
what is really needed to build).

This new rule depends, like the normal download mechanism, on a stamp
file, so that we do not emit a spurious hash-check message on successive
runs of 'make source'.

This way, we can do a complete [0] off-line build and are still able to
generate legal-info, while at the same time we do not incur any download
overhead during a simple build.

Also, we previously downloaded the _ACTUAL_SOURCE_TARBALL when it was
not empty. However, since _ACTUAL_SOURCE_TARBALL defaults to the value
of _SOURCE, it can not be empty when _SOURCE is not. Thus, we'd get a
spurious report of a missing hash for the tarball, since it was not in
a standard package rule (configure, build, install..) and thus would
miss the PKG and PKGDIR variables to find the .hash file.

We fix that in this commit as well, by:

  - setting PKG and PKGDIR just for the -legal-source rule;

  - only downloading _ACTUAL_SOURCE_TARBALL if it is not empty *and* not
    the same as _SOURCE (to avoid a second report about the hash).

[0] Save for nodejs which invarriably wants to download stuff at build
time. Sigh... :-( Fixing that is work for another time...

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Cc: Peter Korsgaard <jacmet@uclibc.org>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/pkg-generic: reorder variables definitions for legal-info

Move the declarations of _ACTUAL_SOURCE and _ACTUAL_SITE earlier, so
that they are close to where _SOURCE and _SITE are handled.

This looks so far like a purely cosmetic change, but makes more sense
with the follow-up patch, where we'll need them earlier in the file.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/legal-info: generate a hash of all saved files

Having a hash of the saved files can be interesting for the recipient to
verify the integrity of the files.

We remove the warning file earlier, to exclude it from the hash
list.

We generate the hash list in a temporary file that will not be matched
by the "find" expression, and once the file is generated, we remain it
to its final name.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Acked-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[Thomas: adjust indentation, improve commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

legal-info: explicitly state how patches are licensed

Signed-off-by: Luca Ceresoli <luca@lucaceresoli.net>
Acked-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
[yann.morin.1998@free.fr: slightly tweak after Arnout's review]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/legal-info: also save extra downloads

Some packages, like perl, download extra files that end up as part of
the source that Buildroot builds. Up until now, those files were not
saved in the legal-info output.

Add those files to the legal-info output.

The unfortunate side-effect is that we will also save the secondary
archive for the external blackfin toolchains; however, we already do
save the binary release of some external toolchains when they do not
provide actual source archives.

This is inherently bad, as those are not source archives, but solving
this is a bigger concern, for another series...

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/legal-info: also save patches

Currently, the legal-info infra only saves the source archive of a
package. However, that's not enough as we may apply some patches on
packages sources.

We do suggest users to also redistribute the Buildroot sources as part
of their compliance distribution, so the patches bundled in Buildroot
would indeed be included in the compliance distribution.

However, that's still not enough, since we may download some patches, or
the user may use a global patch directory. Patches in there might not
end up in the compliance distribution, and there are risks of
non-conformity.

So, always include patches alongside the source archive.

To ensure reproducibility, we also generate a series file, so patches
can be re-applied in the correct order.

We get the list of patches to include from the list of patches that were
applied by the package infrastructure (via the apply-patches support
script). So, we need to get packages properly extracted and patched
before we can save their legal-info, not just in the case they define
_LICENSE_FILES.

Update the legal-info header accordingly.

Note: this means that, when a package is not patched and defines no
LICENSE_FILES, we will extract and patch it for nothing. There is no
easy way to know whether we have to patch a package or not. We can only
either duplicate the logic to detect patches (bad) or rely on the infra
actually patching the package. Also, a vast majority of packages are
either patched, or define _LICENSE_FILES, so it is best and easiest to
always extract and patch them prior to legal-info.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

support/apply-patches: bail-out on duplicate patch basenames

Patches we save can come from various locations:
  - bundled with Buildroot
  - downloaded
  - from one or more global-patch-dir

It is possible that two patches lying into different locations have the
same basename, like so (first is bundled, second is from an hypothetical
global-patch-dir):
    package/foo/0001-fix-Makefile.patch
    /path/to/my/patches/foo/0001-fix-Makefile.patch

In that case, when running legal-info, we'd save only the second patch,
overwriting the first. That would be problematic, because:

  - either the second patch depends on the first, and thus would no longer
    apply (this is easy to detect, though),

  - or the second patch does not depend on the first, and the compliance
    delivery will not be complete (this is much harder to detect).

We fix that by checking that no two patches have the same same basename.
If we find that the basename of the patch to be applied collides with
that of a previously applied patch, we error out and report the duplicate.

The unfortunate side-effect is that existing setups will now break in
that situation, but that's a minor, corner-case issue that is easily
fixed.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[Thomas: adjust coding style, fix minor typos in the commit log.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/apply-patches: store full path of applied patches

Currently, we only store the filename of the applied patches.

However, we are soon to want to install those patches in the legal-info
directory, so we'll have to know where those patches come from.

Instead of duplicating the logic to find the patches (bundled,
downloaded, from a global patch dir...), just store the full path to
each of those patches so we can retrieve them more easily later on.

Also always create the list-file, even if empty, so that we need not
test for its existence before reading it.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Luca Ceresoli <luca@lucaceresoli.net>
[Tested only with patches in the Buildroot sources]
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
[Thomas: used $PWD instead of $(pwd), as suggested by Arnout.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

core/legal-info: add package version to license directory

Now that we save the source archives in a directory named after the
package and its version, do the same for the license files, for
consistency.

It has a not-so-bad side-effect of also saving the version string in
the all-licenses list.

The only (small) side-effect, is that the warnings about undefined
_LICENSE_FILES now contains the version string, too. That's unavoidable,
since that's what is stored in the legal report.

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Luca Ceresoli <luca@lucaceresoli.net>
Acked-by: Luca Ceresoli <luca@lucaceresoli.net>
Tested-by: Luca Ceresoli <luca@lucaceresoli.net>
Reviewed-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>

pulseaudio: fix udev configure option

enable-libudev doesn't exist as a configure option. The right one is
enable-udev.

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

webrtc-audio-processing: bump to version 0.3

Needed by the recent pulseaudio version bump:

https://lwn.net/Articles/692424/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libsoc: bump to version 0.8.2

License file changed from COPYING to LICENCE.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

libarchive: security bump to version 3.2.1

Fixes:
CVE-2016-4302 - Libarchive Rar RestartModel Code Execution Vulnerability
CVE-2016-4300 - Libarchive 7zip read_SubStreamsInfo Code Execution
Vulnerability
CVE-2016-4809 - Memory allocate error in corrupted cpio archives

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

expat: security bump to version 2.2.0

Fixes:

CVE-2016-4472 - Improve insufficient fix to CVE-2015-1283 /
CVE-2015-2716 introduced with Expat 2.1.1

CVE-2016-5300 - Use more entropy for hash initialization than the
original fix to CVE-2012-0876

CVE-2012-6702 - Resolve troublesome internal call to srand that was
introduced with Expat 2.1.0 when addressing CVE-2012-0876

Signed-off-by: Gustavo Zacarias <gustavo.zacarias@free-electrons.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

lft: bump to version 3.76

Drop upstream patches, and disable strip via the STRIP make environment
variable.

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

busybox: disable nsenter/unshare in default config

These require newer toolchain components. Since they didn't exist in
previous versions no functionality is lost. Fixes:
http://autobuild.buildroot.net/results/b63/b6312626b3938555c4e5a68ad42f6951b02d7760/

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

sshfs: bump to version 2.8

Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

pulseaudio: bump version to 9.0

Signed-off-by: Vicente Olivert Riera <Vincent.Riera@imgtec.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>