package/luv: disable temporarily with Lua 5.4

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua-sdl2: disable temporarily with Lua 5.4

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua-flu: disable temporarily with Lua 5.4

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua-cqueues: disable temporarily with Lua 5.4

Also take into account its lua-http reverse dependency.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/easybus: disable temporarily with Lua 5.4

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua-messagepack: add support of Lua 5.4

We need to use lua-MessagePack-lua53 for both Lua 5.3 and Lua 5.4.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua: add 5.4.0 version

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lua-compat53: depends on lua ABI 5.1

In preparation for the introduction of Lua 5.4, we need to adjust the
dependency of the lua-compat53 package: it only makes sense when a Lua
5.1-compatible interpreter is available (either Lua 5.1 or LuaJIT). We
use the recently introduced BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
symbol to achieve this.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/luabitop: depends on lua 5.1

In preparation for the introduction of Lua 5.4, clarify the dependency
of luabitop: it only makes sense when used with Lua 5.1.

Also update the comment to no longer mention Lua 5.2, since we don't
support Lua 5.2 in Buildroot anymore.

Note that as explained in https://luajit.org/extensions.html, LuaJit
already implements luabitop functions, so luabitop is really for Lua
5.1 only, not for all Lua interpreters that implemented the 5.1 ABI.

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/x11r7/xserver_xorg-server: add systemd init

run with same options as in S40xorg

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/busybox: bump version to 1.32.0

Dropped patches accepted upstream, refresh 2nd patch.

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libcamera: bump version to 565f95d

- add support for new qcam feature option

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: bump version to 7.4.9

Changelog of this bugfix release:
https://www.php.net/ChangeLog-7.php#7.4.9

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/x11r7/xlib_libX11: bump version to 1.6.11

Reformatted license hash.

Quoting release notes:
https://lists.x.org/archives/xorg-announce/2020-August/003053.html
"This release fixes a regression introduced by the security patches in
 1.6.10.
 See https://gitlab.freedesktop.org/xorg/lib/libx11/-/issues/116 for
 details."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/{mesa3d, mesa3d-headers}: bump version to 20.1.5

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/at91bootstrap3: bump version to 3.9.3

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gnuplot: bump version to 5.4.0

0001-configure-add-without-demo-option: adapt patch to 5.4.0 version

Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/libinput: bump version to 1.16.0

For details see [1], [2] and [3].

[1] https://lists.freedesktop.org/archives/wayland-devel/2020-July/041529.html
[2] https://lists.freedesktop.org/archives/wayland-devel/2020-July/041545.html
[3] https://lists.freedesktop.org/archives/wayland-devel/2020-August/041578.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

Update for 2020.08-rc1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/uboot: Fix kconfig to use $(BR2_MAKE)

U-Boot must use $(BR2_MAKE) as it uses a Make feature from v4.0. We
already use $(BR2_MAKE) in the BUILD_CMDS, but the kconfig commands
still uses $(MAKE). Without this fix, building U-Boot with kconfig will
fail with the following cryptic error.

> Makefile:37: *** missing separator.  Stop.

Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/pkg-kconfig: Support custom $(MAKE)

The U-Boot package requires GNU Make v4.0 or later, and so all U-Boot
"make" commands must use "$(BR2_MAKE)" so they use the host-make
package. Currently pkg-kconfig is hardcoded to uses $(MAKE), so add a
way to support $(BR2_MAKE). The package infra for pkg-automake and
pkg-cmake have a similar problem, and they solved it by defining a
$(PKG)_MAKE variable, and allowing each package to override it.

Signed-off-by: Brandon Maier <brandon.maier@rockwellcollins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

CHANGES: update for 2020.08-rc1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/config-fragments/autobuild: update bleeding-edge br-arm-internal-glibc

Update our bleeding edge br-arm-internal-glibc defconfig to use the
latest version of gcc and binutils, so that we test these in the
autobuilders.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/librtlsdr: bump to last commit

Last official release is 2 years ago.

Current master branch provides fixes and improvements:
- fix crash with usbfs mmap with usb controler has no DMA support and kernel < 5.6 [1].
- better SDR dongle configuration

This patch:
- bump librtlsdr to d794155ba65796a76cd0a436f9709f4601509320 (2020/03/18)
- adapt 0001-disable_shared_library_target_in_build.patch
  (http://lists.osmocom.org/pipermail/osmocom-sdr/2020-May/002075.html)
- add option to enable/disable zerocopy buffer on non arm platform

[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/usb/core?h=v5.8-rc3&id=a0e710a7def471b8eb779ff551fc27701da49599

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/busybox: enable flags for use as systemd pager

If the less package is not enable and systemd is enabled,
then configure the less applet to fully work with systemd.

systemd sets the flags for less in an environment variable
and requires a few options for correct display.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

support/testing/tests/boot/test_atf: update U-Boot/ATF use in TestATFVexpress

This simply updates to more modern versions of ATF and U-Boot.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ima-evm-utils: bump version to 1.3

added tpm2-tss as dependency (needed for ima_boot_aggregate cmd for
reading PCR; better to use libtss2-esys and libtss2-rc than require
tsspcrread binary in runtime)

added also sha1 hash from sourceforge

added 2 patches fixing build (both are 1.3 specific)

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/lxc: fix build when __NR_signalfd is not available

Fixes:
 - http://autobuild.buildroot.org/results/75096a48d2dbda57459523db3ed0952e63f93535

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/glibc: fix build on RISC-V with gcc 10.x

Backport upstream commit to use __has_include:
https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=28dd3939221ab26c6774097e9596e30d9753f758

Otherwise glibc fails to build with gcc 10:

warning: "__has_include__" is not defined, evaluates to 0 [-Wundef]
../sysdeps/unix/sysv/linux/riscv/flush-icache.c:24:21: error: missing binary operator before token "("
   24 | #if __has_include__ (<asm/syscalls.h>)
      |                     ^

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618374

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Alistair Francis <Alistair.Francis@wdc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu_mips64r6: fix Linux kernel build with gcc 10.x

From [1]

"GCC 10 (PR 91233) won't silently allow registers that are not architecturally
available to be present in the clobber list anymore, resulting in build failure
for mips*r6 targets in form of:
...
.../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
  146 |  __asm__ volatile (  \
      |  ^~~~~~~

This is because base R6 ISA doesn't define hi and lo registers w/o DSP extension.
This patch provides the alternative clobber list for r6 targets that won't include
those registers."

Since kernel 5.4 and mips support for generic vDSO [2], the kernel fails to build
for mips r6 cpus with gcc 10 for the same reason as glibc.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=24640f233b466051ad3a5d2786d2951e43026c9d

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618363
https://gitlab.com/kubu93/buildroot/-/jobs/655618364

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

configs/qemu_mips32r6: fix Linux kernel build with gcc 10.x

From [1]:

"GCC 10 (PR 91233) won't silently allow registers that are not architecturally
available to be present in the clobber list anymore, resulting in build failure
for mips*r6 targets in form of:
...
.../sysdep.h:146:2: error: the register ‘lo’ cannot be clobbered in ‘asm’ for the current target
  146 |  __asm__ volatile (  \
      |  ^~~~~~~

This is because base R6 ISA doesn't define hi and lo registers w/o DSP extension.
This patch provides the alternative clobber list for r6 targets that won't include
those registers."

Since kernel 5.4 and mips support for generic vDSO [2], the kernel fail to build
for mips r6 cpus with gcc 10 for the same reason as glibc.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=020b2a97bb15f807c0482f0faee2184ed05bcad8
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=24640f233b466051ad3a5d2786d2951e43026c9d

Fixes:
https://gitlab.com/kubu93/buildroot/-/jobs/655618359
https://gitlab.com/kubu93/buildroot/-/jobs/655618360

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/valgrind: bump version to 3.16.1

* 3.16.1 fixes two critical bugs discovered after 3.16.0 was frozen.
  for details see [1].
* changed SITE from ftp to https.

[1] https://www.valgrind.org/docs/manual/dist.news.html

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/php: add FFI extension support

Signed-off-by: Tom Marcuzzi <tom.marcuzzi@orolia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/nginx: drop gdlib-config

Drop gdlib-config and use pkg-config to find gd.
Indeed, gdlib.pc is available since version 2.1.0 and
https://github.com/libgd/libgd/commit/071a2a94ee9f9e5ce00ff689dfe67a0fcb885ad6
and gdlib-config has been dropped from version 2.3.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/meson: update rpath patch to upstream version

The version of this patch merged by upstream has some changes to rpath
syntax matching and handling for additional syntax edge cases.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: disable portabled

portabled is a container-like service, but so far its still a preview
and basically unknown as the portablectl is hidden in
/usr/lib/systemd.

Disable it for now.

See https://systemd.io/PORTABLE_SERVICES/

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove util-linux nologin dependency

if the tool is not enabled, then configure /bin/false
as fallback.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove util-linux binaries dependency

None of the tools in this set are necessary.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: remove libblkid dependency

this dependency is optional, it is used to
allow udev to add information to blockdevices.
Aslong as MOUNT or FSCK are enabled, it will end up enabled
anyway, but this seems more clear and correct.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: import does not need bzip2 and lz4

Those are optional dependencies.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: support new v246 options

This adds switches for new options:

initrd: Installs services if systemd is used on an initramfs,
useless otherwise

kernel-install: helper scripts to update kernel with an
systemd-boot partition

analyze: tool to analyze bootup and dependencies

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/systemd: bump version to 246

Add zstd as optional dependency, and
disable new options for host-systemd.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: keep X11 input 2.2+ enabled

Since efl 1.23, X11 input 2.2+ has been enabled by default [1].

>From [2]:
"It would be a pretty unusual system to have x and no xinput2.2 support."

While at it, enable explicitely X11 input 2 (enabled by default).

[1] https://git.enlightenment.org/core/efl.git/commit/?id=cf005ac54abdea843e5731765e41e5088275249f
[2] https://sourceforge.net/p/enlightenment/mailman/message/37065780/

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/enlightenment: bump to version 0.24.2

- Disable new dependency on polkit for now.
- Add OFL license for fonts.
- Update COPYING file hash.
- Update indentation in hash file (two spaces)

See:
https://www.enlightenment.org/news/e24.2

enlightenment 0.24 require efl >= 1.24.

https://git.enlightenment.org/core/enlightenment.git/commit/?id=4b6467685e7ac9ae68f08bd524f332a908f5fa74

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/terminology: bump to version 1.8.0

See:
https://www.enlightenment.org/news/2020-07-26-terminology-1.8.0

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: bump to version 1.24.3

- Remove upstream patch [1].
- evas-modules option removed since all evas-modules are now built shared. [2]
- Make sure that mono is disabled [3].
- gstreamer support removed from emotion & evas [4].
- emotion-loaders-disabler & emotion-generic-loaders-disabler removed [5].
- Add openjpeg dependency for jp2k evas loader [6] otherwise the build
  system fail when only libjpeg.so is provided (jpeg-turbo or libjpeg).
- Update COMPLIANCE file hash due to esacpe library removal [7].
- Update COPYING file hash due to new csharp,cxx libraries and esacpe,emotion
  removal [8].
- Remove bullet dependency from recommended option for efl [9].
- Add new patches to fix build with "Unknown variable" issue with meson.
- Fix Evas_Engine_GL_Drm.h include path.

[1] https://git.enlightenment.org/core/efl.git/commit/?id=a2afcfc872c29bd2c4a60fdafbc655c90f938d1e
    https://git.enlightenment.org/core/efl.git/commit/?id=c245b576aad09ac5faeb800de7f7c4fef87c6363
[2] https://git.enlightenment.org/core/efl.git/commit/?id=6d8e39a6425e721eb40e0cb1e67f1cbf5b223cc0
[3] https://git.enlightenment.org/core/efl.git/commit/?id=17a81bee4a53891e44a165a14ca20027f9aa0824
[4] https://git.enlightenment.org/core/efl.git/commit/?id=b8dc80c144fec54a521987535c57b995748ccece
[5] https://git.enlightenment.org/core/efl.git/commit/?id=075bab83c4288b5de20f6acfc6b0459656ea85e0
[6] https://git.enlightenment.org/core/efl.git/commit/?id=8ec6e28b7cc568a8bb636de90b2dd10f19db2be3
[7] https://git.enlightenment.org/core/efl.git/commit/?id=f3d9b8ee703621cfbb52a03d346335148318af7a
[8] https://git.enlightenment.org/core/efl.git/commit/?id=40a980174b7e29e6946f7425bd7a238ae45900f8
    https://git.enlightenment.org/core/efl.git/commit/?id=a3ade15d5a45e7d564b7c1304f561af9c4203991
    https://git.enlightenment.org/core/efl.git/commit/?id=31da42a0503556a59c190efcb0a79331e828bf6c
[9] https://git.enlightenment.org/core/efl.git/commit/?id=523a64d2265c13a82ba73022d10919f0e392bab2

See:
https://www.enlightenment.org/news/efl-1.24.0
https://www.enlightenment.org/news/efl-1.24.1
https://www.enlightenment.org/news/efl-1.24.2
https://www.enlightenment.org/news/efl-1.24.3

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/efl: bump to version 1.23.2

- Remove upstream patch [1].
- Switch to meson build system.
- The cryptography backend is now mandatory, use openssl for the host
  and use openssl by default for the target if gnutls is not selected.
- Add host-giflib since the dependency can't be disabled anymore.
  (even by adding gif in HOST_EFL_EVAS_LOADERS_DISABLER).
- Disable explicitely meson build options that was not previously handled
  (avahi, emotion, ecore-imf-loarders...)
- Elput support is now enabled through drm meson option [2], remove
  BR2_PACKAGE_EFL_ELPUT.
- Update license file hash (csharp licensing information, cxx bindings
  licensing)
- Add COPYING.images and licenses/COPYING.ASL license file.
- The evas png loader is now mandatory [3] (even by adding png in
  EFL_EVAS_LOADERS_DISABLER).
- Same for the evas gif loader [4].
- Backport an upstream patch to fix the evas build with -Dwl=false.
- Update indentation of hash file (two spaces)

See:
https://www.enlightenment.org/news/efl-1.23.0
https://www.enlightenment.org/news/efl-1.23.1
https://www.enlightenment.org/news/efl-1.23.2

[1] https://git.enlightenment.org/core/efl.git/commit/?id=c46a8143916f0d3f66bbdffc7107c97c88df212d
[2] https://git.enlightenment.org/core/efl.git/tree/meson.build?h=v1.23.3#n297
[3] https://git.enlightenment.org/core/efl.git/tree/src/modules/evas/meson.build?h=v1.23.3#n2
[4] https://git.enlightenment.org/core/efl.git/tree/src/modules/evas/meson.build?h=v1.23.3#n4

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/sam-ba: bump to version 3.3.1

sam-ba tool moved to github, changed license to GPLv2 and dropped x86
support.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/fmt: bump to version 7.0.2

See full changelog: https://github.com/fmtlib/fmt/releases/tag/7.0.2

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

boot/at91bootstrap3: enable for cortexa7

Enable this bootloader for cortex a7 based SoCs: support for the
sama7g5 SoC is now in upstream at91bootstrap3, and it is a Cortex-A7
based SoC.

Signed-off-by: Eugen Hristev <eugen.hristev@microchip.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/ruby: security bump to version 2.4.10

Fixes the following security issues:

- CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional
  fix)
  https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/cups: bump to version 2.3.3

This patch bumps cups to version 2.3.3.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Tested-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/cups: add proper init script

Cups service for systemv was erroneously installed in /etc/rcX.d and
therefore not working. Also, its init script installed in /etc/init.d
was definitely not a Buildroot-style init script.

This patch adds a Buildroot style init script instead of using the
example provided by the package.

Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/gd: fix CVE-2018-14553 and CVE-2019-6977

- Fix CVE-2018-14553 : gdImageClone in gd.c in libgd 2.1.0-rc2 through
  2.2.5 has a NULL pointer dereference allowing attackers to crash an
  application via a specific function call sequence.

- Fix CVE-2019-6977: gdImageColorMatch in gd_color_match.c in the GD
  Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch
  function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14,
  and 7.3.x before 7.3.1, has a heap-based buffer overflow. This can be
  exploited by an attacker who is able to trigger imagecolormatch calls
  with crafted image data.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wayland: fix build with toolchains without c++

Fixes
http://autobuild.buildroot.net/results/fb2/fb205601cac2bbf8e70ec2bf4eaf22264d8edc96/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/jasper: security bump to version 2.0.19

Fixes the following security issues:
* Fix CVE-2018-9154
  https://github.com/jasper-software/jasper/issues/215
  https://github.com/jasper-software/jasper/issues/166
  https://github.com/jasper-software/jasper/issues/175
  https://github.com/jasper-maint/jasper/issues/8

* Fix CVE-2018-19541
  https://github.com/jasper-software/jasper/pull/199
  https://github.com/jasper-maint/jasper/issues/6

* Fix CVE-2016-9399, CVE-2017-13751
  https://github.com/jasper-maint/jasper/issues/1

* Fix CVE-2018-19540
  https://github.com/jasper-software/jasper/issues/182
  https://github.com/jasper-maint/jasper/issues/22

* Fix CVE-2018-9055
  https://github.com/jasper-maint/jasper/issues/9

* Fix CVE-2017-13748
  https://github.com/jasper-software/jasper/issues/168

* Fix CVE-2017-5503, CVE-2017-5504, CVE-2017-5505
  https://github.com/jasper-maint/jasper/issues/3
  https://github.com/jasper-maint/jasper/issues/4
  https://github.com/jasper-maint/jasper/issues/5
  https://github.com/jasper-software/jasper/issues/88
  https://github.com/jasper-software/jasper/issues/89
  https://github.com/jasper-software/jasper/issues/90

* Fix CVE-2018-9252
  https://github.com/jasper-maint/jasper/issues/16

* Fix CVE-2018-19139
  https://github.com/jasper-maint/jasper/issues/14

* Fix CVE-2018-19543, CVE-2017-9782
  https://github.com/jasper-maint/jasper/issues/13
  https://github.com/jasper-maint/jasper/issues/18
  https://github.com/jasper-software/jasper/issues/140
  https://github.com/jasper-software/jasper/issues/182

* Fix CVE-2018-20570
  https://github.com/jasper-maint/jasper/issues/11
  https://github.com/jasper-software/jasper/issues/191

* Fix CVE-2018-20622
  https://github.com/jasper-maint/jasper/issues/12
  https://github.com/jasper-software/jasper/issues/193

* Fix CVE-2016-9398
  https://github.com/jasper-maint/jasper/issues/10

* Fix CVE-2017-14132
  https://github.com/jasper-maint/jasper/issues/17

* Fix CVE-2017-5499
  https://github.com/jasper-maint/jasper/issues/2
  https://github.com/jasper-software/jasper/issues/63

* Fix CVE-2018-18873
  https://github.com/jasper-maint/jasper/issues/15
  https://github.com/jasper-software/jasper/issues/184

* Fix CVE-2017-13750
  https://github.com/jasper-software/jasper/issues/165
  https://github.com/jasper-software/jasper/issues/174

Furthermore, drop now upstreamed patches and change to the new
jasper-software upstream location.

Signed-off-by: Michael Vetter <jubalh@iodoru.org>
[Peter: reword for security bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/cc-tool: bump to version 0.27

- Switch site to get latest version
- Drop patches (already in version)
- Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/vdr: fix build with glibc 2.31

Fixes:
 - http://autobuild.buildroot.org/results/b8475cfddee94d2938be98356e53328b5cd064b5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/unbound: bump version to 1.11.0

Signed-off-by: Stefan Ott <stefan@ott.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libmbim: bump version to 1.24.2

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/waffle: bump version to 1.6.1

Release notes for v1.6.1:
https://lists.freedesktop.org/archives/mesa-announce/2020-March/000575.html

Removed patch 0001 which was applied upstream.

Switched _SITE to gitlab according to release notes for v1.6.0:
https://lists.freedesktop.org/archives/mesa-announce/2019-June/000520.html

Added -Dwaffle_has_nacl=OFF to CONF_OPTS to disable nacl support, this
avoids adding a dependency to C++:
https://gitlab.freedesktop.org/mesa/waffle/-/commit/6ca943584e593aec2bd4f9c66d91859e63e02d61#9a2aa4db38d3115ed60da621e012c0efc0172aae_27_26

Added support for mesa3d surfaceless egl:
https://gitlab.freedesktop.org/mesa/waffle/commit/7318f22c4761035c03e99420edf3e92f07e06c9c

Added support for bash-completion:
https://gitlab.freedesktop.org/mesa/waffle/-/blob/maint-1.6/CMakeLists.txt#L189

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cryptography: bump to version 3.0

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cbor2: bump to version 5.1.2

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-pycryptodomex: bump to version 3.9.8

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-yarl: bump to version 1.5.1

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/sysdig: Fix check-package

This patch fixes a couple of 'check-package' errors:

package/sysdig/sysdig.mk:23: remove trailing backslash
package/sysdig/sysdig.mk:25: consecutive empty lines

Signed-off-by: Stephane Viau <stephane.viau@oss.nxp.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

boot/grub2: Backport Boothole securify fixes

Details: https://lists.gnu.org/archive/html/grub-devel/2020-07/msg00034.html

Fixes the following security issues:

 * CVE-2020-10713
   A flaw was found in grub2, prior to version 2.06. An attacker may
   use the GRUB 2 flaw to hijack and tamper the GRUB verification
   process. This flaw also allows the bypass of Secure Boot
   protections. In order to load an untrusted or modified kernel, an
   attacker would first need to establish access to the system such as
   gaining physical access, obtain the ability to alter a pxe-boot
   network, or have remote access to a networked system with root
   access. With this access, an attacker could then craft a string to
   cause a buffer overflow by injecting a malicious payload that leads
   to arbitrary code execution within GRUB. The highest threat from
   this vulnerability is to data confidentiality and integrity as well
   as system availability.

 * CVE-2020-14308
   In grub2 versions before 2.06 the grub memory allocator doesn't
   check for possible arithmetic overflows on the requested allocation
   size. This leads the function to return invalid memory allocations
   which can be further used to cause possible integrity,
   confidentiality and availability impacts during the boot process.

 * CVE-2020-14309
   There's an issue with grub2 in all versions before 2.06 when
   handling squashfs filesystems containing a symbolic link with name
   length of UINT32 bytes in size. The name size leads to an
   arithmetic overflow leading to a zero-size allocation further
   causing a heap-based buffer overflow with attacker controlled data.

 * CVE-2020-14310
   An integer overflow in read_section_from_string may lead to a heap
   based buffer overflow.

 * CVE-2020-14311
   An integer overflow in grub_ext2_read_link may lead to a heap-based
   buffer overflow.

 * CVE-2020-15706
   GRUB2 contains a race condition in grub_script_function_create()
   leading to a use-after-free vulnerability which can be triggered by
   redefining a function whilst the same function is already
   executing, leading to arbitrary code execution and secure boot
   restriction bypass

 * CVE-2020-15707
   Integer overflows were discovered in the functions grub_cmd_initrd
   and grub_initrd_init in the efilinux component of GRUB2, as shipped
   in Debian, Red Hat, and Ubuntu (the functionality is not included
   in GRUB2 upstream), leading to a heap-based buffer overflow. These
   could be triggered by an extremely large number of arguments to the
   initrd command on 32-bit architectures, or a crafted filesystem
   with very large files on any architecture. An attacker could use
   this to execute arbitrary code and bypass UEFI Secure Boot
   restrictions. This issue affects GRUB2 version 2.04 and prior
   versions.

Signed-off-by: Stefan Sørensen <stefan.sorensen@spectralink.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/rauc: bump version to 1.4

Signed-off-by: Yair Ben Avraham <yairba@protonmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/x11r7/xlib_libX11: security bump version to 1.6.10

Fixes CVE-2020-14344:
https://lists.x.org/archives/xorg-announce/2020-July/003050.html

Removed md5 & sha1 hashes, upstream does not provide them anymore.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/python-cython: bump to version 0.29.21

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-pynacl: bump to version 1.4.0

We need to backport a commit to fix a build failure cased by a spurious
wheel dependency.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-six: bump to version 1.15.0

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/python-txaio: bump to verison 20.4.1

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/{protobuf, python-protobuf}: bump to version 3.12.4

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/mesa3d: xvmc needs x11

This is a follow-up patch to

https://git.buildroot.net/buildroot/commit/package/mesa3d?id=e79ee3b0f91aa3eb1b20d86701a195e3bd9a26d3

to make sure that MESA3D_PLATFORMS contains x11 needed by xvmc:
https://cgit.freedesktop.org/mesa/mesa/tree/meson.build?h=20.1#n510

Fixes
http://autobuild.buildroot.net/results/dae/dae41e30d2ac69b768ec0a5b795a2e559c35bcd3/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

Revert "package/pkg-generic.mk: create directories upfront in the configure step"

This _partially_ reverts commit 2dbb0660fb4d89f8eac86fcff08e9b3d0a705917.

Indeed, before 2dbb0660fb, the per-package ../host/ directory was
explicitly created right before it was populated. With 2dbb0660fb, it
is now created only at the beginning of the configure step.

However, some packages may have download or extract host dependencies,
and when we are trying to rsync them, the destination .../host/
directory does not yet exist at the download or extract steps, thus the
build fails. E.g., with wget which needs host-lzip if the system does
not have it yet:

    rsync -a --link-dest=/home/ymorin/dev/buildroot/O/per-package/host-lzip/host/ /home/ymorin/dev/buildroot/O/per-package/host-lzip/host/ /home/ymorin/dev/buildroot/O/per-package/wget/host
    rsync: mkdir "/home/ymorin/dev/buildroot/O/per-package/wget/host" failed: No such file or directory (2)
    rsync error: error in file IO (code 11) at main.c(682) [Receiver=3.1.3]
    make[1]: *** [package/pkg-generic.mk:170: /home/ymorin/dev/buildroot/O/build/wget-1.20.3/.stamp_extracted] Error 11

Kudos to Raphael for pin-pointing the culprit commit.

Fixes:
    http://autobuild.buildroot.org/results/4c8/4c895c7ac0a635d38f5015b5df0393581ad7b508/
    and a slew of similar failures

Notes:
An alternative solution would be to move the creation of the directories
from the configure step to the download step *and* to the rsync step,
but this is not so nice in the end... Let's just ensure they are created
where needed: at the configure step, and when populating them.

Reported-by: Raphael Jacob <r.jacob2002@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

package/zbar: bump to version 0.23.1

- Add new NLS dependency as well as a patch to fix a build failure
  without it
- Drop host-gettext (not needed since autoreconf was dropped with
  8729c4ef881b02ff85b7645b0ad309d6ae44fccf)
- Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/testing: drop explicit docker kernel options from docker test

Since commit 0390777bfaff6c6 (package/docker-engine: needs some kernel
options), docker-engine now automatically ensures the needed kernel options
are enabled, so drop the explicit options from the kernel config.

23:19:27 TestDockerCompose                        Starting
23:19:28 TestDockerCompose                        Building
00:14:41 TestDockerCompose                        Building done
00:15:30 TestDockerCompose                        Cleaning up
.
----------------------------------------------------------------------
Ran 1 test in 3362.784s

OK

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

support/testing: drop explicit CGROUPFS_MOUNT from docker test

Since commit 4f8229653 (package/docker-engine: needs more runtime
dependencies), docker-engine now automatically pulls in cgroupfs-mount, so
drop the explicit handling of it in TestDockerCompose.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/feh: bump version to 3.4.1

Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/webkitgtk: security bump to version 2.28.4

This is a minor release which provides fixes for CVE-2020-9862,
CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, and
CVE-2020-9925.

Full release notes can be found at:

  https://webkitgtk.org/2020/07/28/webkitgtk2.28.4-released.html

A detailed security advisory can be found at:

  https://webkitgtk.org/security/WSA-2020-0007.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/wpewebkit: security bump to version 2.28.4

This is a minor release which provides fixes for CVE-2020-9862,
CVE-2020-9893, CVE-2020-9894, CVE-2020-9895, CVE-2020-9915, and
CVE-2020-9925.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.28.4.html

A detailed security advisory can be found at:

  https://wpewebkit.org/security/WSA-2020-0007.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/kodi: bump version to 18.8-Leia

Removed patch which was applied upstream:
https://github.com/xbmc/xbmc/commit/920cc74da069216d19f724ecf5246cf997861bc6

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/dbus: disable systemd for host build

This fixes an issue if host-dbus happens to be rebuilt after systemd, in
which case it autodetects systemd support but then ignored the prefix
when installing unit files.  That means that is tries to write to the
host system's /usr/lib/ which fails.

There is no reason to build and install systemd support in the host
build, so disable it explicitly.

Signed-off-by: John Keeping <john@metanate.com>
Tested-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/easydbus: bump to version 0.1.0

Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/iprutils: bump to version 2.4.18.1

Update indentation in hash file (two spaces)

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

{linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 7}.x series

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/linux-headers: drop support for 5.6.x headers

The 5.6.x series is now EOL so remove the option and add legacy
handling for it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/linux-headers: drop support for 5.5.x headers

The 5.5.x series is now EOL so remove the option and add legacy
handling for it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

package/libcurl: fix build against gnutls with proxy disabled

Add upstream patch (#4) fixing build with gnutls when
BR2_PACKAGE_LIBCURL_PROXY_SUPPORT is disabled.

Patch #4 depends on #3 to apply so add this one as well.

Fixes:
http://autobuild.buildroot.net/results/31d7204869ff71319ea055688c919a646bfb200b/
http://autobuild.buildroot.net/results/f8d2fb919475cdff4a36ad93071048ee09193b98/
http://autobuild.buildroot.net/results/2f07a0ac1240a6040a3509d2ebf06906a31fd172/

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/lz4: simplify build/install logic

No functional change.

Rather than tracking both build targets and sub directory to run 'make
install' from, use a make loop for the staging/target install logic, similar
to how we are doing it to for the build step and directly use the Makefile
in the sub directory rather than the helper lib/lz4 targets in the top level
Makefile.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/luaposix: select bit32 based on lua ABI version 5.1

Since the bit32 module is needed by all lua ABI 5.1 providers we can
select based on the lua ABI version instead of both lua 5.1 and luajit.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/solarus: depend on lua ABI version 5.1

Since solarus is compatible with lua interpreters that provide the
version 5.1 ABI we should depend on that instead of unconditionally
selecting luajit.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/collectd: depend on luainterpreter for lua support

Since collectd lua support is compatible with any luainterpreter
implementation we should depend on BR2_PACKAGE_HAS_LUAINTERPRETER
instead of unconditionally selecting BR2_PACKAGE_LUA.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr: use luainterpreter as dependency]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/sysdig: depend on lua ABI version 5.1

Since sysdig is compatible with lua interpreters that provide the
version 5.1 ABI we should depend on that instead of unconditionally
selecting luajit.

Use luainterpreter as the dependency, now that either lua or luajit
can be used.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - reorder dependencies in Config.in: package deps go after toolchain
    deps
  - keep the toolchain deps together in the comment
  - switch to using luainterpreter as a build dependency
  - split the now-long _DEPENDENCIES list
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/luainterpreter: gather the ABI version string defaults

Now that we have booleans to represent the Lua ABI version, and that
every Lua providers do select those, there is no longer any reason
for them to also handle the ABI version string anymore.

Move the defaults into the common luainterpreter.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Francois Perrad <francois.perrad@gadz.org>

package/luainterpreter: add abi version options

Since a number of packages depend on specific ABI version that are
provided by lua and luajit packages we should have a kconfig variable
that those packages can depend on.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/prosody: don't depend on !lua 5.3

The current version of prosody is compatible with Lua 5.3.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/minetest: depend on LuaJIT

Luajit is a provider for luainterpreter. We can't select providers of
virtual packages; we can only depend on them.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - a lua interpreter is needed, so don't drop the dependency
  - make it a "depends on" rather than a "select"
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>

package/efl: depend on LuaJIT

Luajit is a provider for luainterpreter. We can't select providers of
virtual packages; we can only depend on them.

Note also that it is not very clear whether the host and target variants
of EFL need to be built with the same lua interpreter. Today, this is
guaranteed as we inly use luajit in both cases. But there were issues
with lua 5.1 in the past, so stick to only using luajit.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[yann.morin.1998@free.fr:
  - depend on luajit, not "any" luainterpreter
  - which keeps the host and target variants built with the same
    interpreter
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>