mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 08:14:09 -09:00
Code Issues Packages Projects Releases Wiki Activity
70,495 Commits 6 Branches 483 Tags
078b8558b9e25917db680fdeb8d9c64db9aafc8e
Commit Graph

70495 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Thomas Petazzoni
078b8558b9 package/x11r7/xwayland: security bump to 23.2.3 
According to
https://lists.x.org/archives/xorg-announce/2023-December/003437.html:

  This release contains the fixes for CVE-2023-6377 and CVE-2023-6478
  in today's security advisory:
  https://lists.x.org/archives/xorg-announce/2023-December/003435.html

The release has only 10 commits compared to 23.2.2, all of which being
fixes, two of them being the security fixes. So it seems like bumping
the version is a reasonable trade-off vs. backporting the security
fixes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2023-12-27 17:20:57 +01:00
Thomas Petazzoni
64a5831679 package/libmpd: remove package 
Following the removal of gmpc, we can drop libmpd as well, which was
apparently developed/maintained by the same group of people. The URL
in Config.in, http://gmpcwiki.sarine.nl/index.php?title=Libmpd, no
longer works, and no new alternative upstream was found.

The reference MPD client library is libmpdclient, which is still
maintained.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 22:37:26 +01:00
Thomas Petazzoni
f93380ab1a package/gmpc: remove package 
This package is unmaintained upstream:

- The URL in our Config.in,
  http://gmpcwiki.sarine.nl/index.php?title=GMPC, no longer works

- https://github.com/DaveDavenport/gmpc says it's unmaintained

- The official lists of MPD clients at
  https://www.musicpd.org/clients/ says it's maintained, and points at
  http://gmpclient.org/, which is no longer owned by the developers of
  GMPC.

- It still uses libsoup (2) which we want to get rid of at some
  point.

- It was added by Gustavo Zacarias, and no version bumped occurred
  since 2011.

So let's kill this package.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 22:37:22 +01:00
Thomas Petazzoni
6d8c7aecbb package/flickcurl: remove package 
This package is causing some build issues, which are probably due to
the recent libxml2 upgrade:

  http://autobuild.buildroot.net/results/34d6f6c02f884ab9a2578a38ee8646e14632d6ff/

There has been no new commit upstream for the past 8 years:
https://github.com/dajobe/flickcurl, and the last release, 1.26 is
from 2014. So let's kill the package.

Fixes:

  http://autobuild.buildroot.net/results/34d6f6c02f884ab9a2578a38ee8646e14632d6ff/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 22:29:22 +01:00
Petr Vorel
9f6146acb8 package/iputils: fix IPUTILS_SITE URL 
Upstream in release 20231222 shipped self generated iputils-20231222.tar.gz,
which is signed and thus has different checksum than "Source code (tar.gz)"
generated by github. Therefore different URL needs to be used to get
correct checksum.

Fixes:

  http://autobuild.buildroot.net/results/e9b39e142d5f56bf589253a10ed4722dbbda375c

Fixes: 32da4422f9 ("package/iputils: bump version to 20231222")
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 22:08:41 +01:00
Fabrice Fontaine
c13199c932 package/squid: security bump to version 6.6 
- Drop patch (already in version)
- Fix CVE-2023-50269: This problem allows a remote client to perform
  Denial of Service attack by sending a large X-Forwarded-For header
  when the follow_x_forwarded_for feature is configured.

https://github.com/squid-cache/squid/security/advisories/GHSA-wgq4-4cfg-c4x3
https://github.com/squid-cache/squid/blob/SQUID_6_6/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 22:06:02 +01:00
Fabrice Fontaine
66a77af985 package/ksmbd-tools: security bump to version 3.5.1 
Fix potential NULL deference errors.

https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.1
https://github.com/cifsd-team/ksmbd-tools/releases/tag/3.5.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:45 +01:00
Fabrice Fontaine
69df189aea package/libebml: security bump to version 1.4.5 
Fix invalid memory access (reading beyond allocated memory) due to
missing integer overflow check.

https://github.com/Matroska-Org/libebml/blob/release-1.4.5/NEWS.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:41 +01:00
Fabrice Fontaine
37eb68c9fb package/opensc: security bump to version 0.24.0 
- Drop patches (already in version) and so drop autoreconf
- Fix the following security issues:
  - CVE-2023-40660: Fix Potential PIN bypass
  - CVE-2023-40661: Important dynamic analyzers reports
  - CVE-2023-4535: Out-of-bounds read in MyEID driver handling
    encryption using symmetric keys

https://github.com/OpenSC/OpenSC/releases/tag/0.24.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:37 +01:00
Fabrice Fontaine
9e5cbbb413 package/strongswan: security bump to version 5.9.13 
A vulnerability in charon-tkm related to processing DH public values was
discovered in strongSwan that can result in a buffer overflow and
potentially remote code execution. All versions since 5.3.0 are
affected.

https://www.strongswan.org/blog/2023/11/20/strongswan-vulnerability-(cve-2023-41913).html
https://github.com/strongswan/strongswan/blob/5.9.13/NEWS

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:33 +01:00
Fabrice Fontaine
158edd5aa9 package/libde265: security bump to version 1.0.15 
A couple of bug fixes, including the following CVEs:
 - CVE-2023-49465
 - CVE-2023-49467
 - CVE-2023-49468

https://github.com/strukturag/libde265/releases/tag/v1.0.15

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:29 +01:00
Fabrice Fontaine
01689a9a65 package/libheif: security bump to version 1.17.6 
A couple of build fixes and bug fixes detected by fuzzing.

Corrects these issues:
 - CVE-2023-49462
 - CVE-2023-49463

https://github.com/strukturag/libheif/releases/tag/v1.17.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:23:25 +01:00
Fabrice Fontaine
312f4ab4c8 package/onevpl-intel-gpu: add CPE variables 
cpe:2.3:a:intel:onevpl_gpu_runtime is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/7F7056CA-A41D-4AB5-B9CC-9DE24A27B8BA

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-26 21:21:21 +01:00
Fabrice Fontaine
449538348e package/cjson: security bump to version 1.7.17 
- Fix null reference in cJSON_SetValuestring (CVE-2023-50472)
- Fix null reference in cJSON_InsertItemInArray (CVE-2023-50471)

https://github.com/DaveGamble/cJSON/releases/tag/v1.7.17

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:09 +01:00
Fabrice Fontaine
3cc18e4085 package/python-httpx: add CPE variables 
cpe:2.3:a:encode:httpx is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/0B9D7A81-3934-40D1-A7E4-FD8132304152

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:07 +01:00
Fabrice Fontaine
3f9709f803 package/python-uvicorn: add CPE variables 
cpe:2.3:a:encode:uvicorn is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/D3AA1B54-4363-4E52-90AB-01DC2080D950

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:05 +01:00
Fabrice Fontaine
55c3fe590f package/python-fastapi: add CPE variables 
cpe:2.3:a:fastapi_project:fastapi is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/E6E33EA5-0404-4037-9B3E-FE718E1593E5

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:03 +01:00
Fabrice Fontaine
27182fcd35 package/python-starlette: add CPE variables 
cpe:2.3:a:encode:starlette is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/B4613D5C-E46D-443A-8738-58E4FBC0C127

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:13:02 +01:00
Fabrice Fontaine
7f7a7c34e5 package/python-asyncssh: add CPE variables 
cpe:2.3:a:asyncssh_project:asyncssh is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/detail/55866328-B495-4FDC-B9EF-C014E6885187

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-26 14:12:59 +01:00
Francois Perrad
814e7fcacf package/xz: bump to version 5.4.5 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:44:11 +01:00
Francois Perrad
1edafc4b48 package/lsof: bump to version 4.99.3 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:44:09 +01:00
Francois Perrad
a449898d82 package/libgtk3: bump to version 3.24.39 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:44:07 +01:00
Francois Perrad
248effdd9b package/libatomic_ops: bump to version 7.8.2 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:44:05 +01:00
Francois Perrad
be24c10472 package/dbus: bump to version 1.14.10 
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:44:03 +01:00
James Hilliard
ae9137661b package/python-httpx: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:25:19 +01:00
James Hilliard
3d743c1027 package/python-httpcore: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:24:37 +01:00
James Hilliard
607f0ecb7e package/python-fastapi-sessions: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:20:05 +01:00
James Hilliard
8e0ac9660c package/python-uvicorn: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:19:09 +01:00
James Hilliard
da1f15dbca package/python-fastapi: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 21:13:04 +01:00
James Hilliard
cfb0987517 package/python-starlette: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:33:10 +01:00
James Hilliard
111e725b08 package/python-anyio: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:30:16 +01:00
James Hilliard
02fddb29ab package/python-typing-extensions: bump to version 4.9.0 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Marcus Hoffmann <marcus.hoffmann@othermo.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:29:53 +01:00
James Hilliard
442b2af2d4 package/python-asyncssh: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:27:14 +01:00
Julien Olivain
ebe47e7605 package/python-ml-dtypes: new package 
ml_dtypes is a stand-alone implementation of several NumPy
dtype extensions used in machine learning libraries.

https://github.com/jax-ml/ml_dtypes

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:20:24 +01:00
James Hilliard
b48a195509 package/python-multipart: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:12:20 +01:00
James Hilliard
8dc5506c76 package/python-decouple: new package 
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-25 11:11:51 +01:00
Adam Duskett
31c169f556 package/sway/Config.in: Add a help note about the default terminal 
The default terminal used by sway is the foot terminal. Add a note in
the Config.in explaining that if a user is using the default sway config,
it is recommended to also enable the foot package.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 23:22:58 +01:00
Adam Duskett
4163b67c37 package/sway: enable swaynag support 
Add a config option to build sway with swaynag support.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 23:09:03 +01:00
Adam Duskett
31058f5fdf package/sway: enable swaybar tray support 
Add a config option to build swaybar with tray support.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 23:08:58 +01:00
Adam Duskett
b08df59fc6 package/sway: enable swaybar support 
Add a config option to build sway with swaybar support.
  - The bar requires dejavu fonts.
  - If bash-completions is selected, JQ is required.
  - Select dmenu-wayland as a runtime dependency.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: jq is a runtime dependency too]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 23:01:33 +01:00
Adam Duskett
b5b18f9eba package/sway: enable default-wallpaper support 
If swaybg is selected, set default-wallpaper to true.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 22:59:36 +01:00
Adam Duskett
cb39803ee3 package/sway: enable bash-completion support 
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 22:59:30 +01:00
Adam Duskett
453b993ac1 package/ncurses: install foot terminfo if foot is selected 
From foot/INSTALL.md:
```
As of ncurses 2021-07-31, ncurses includes a version of foot’s
terminfo. **The recommendation is to use those**, and only install the
terminfo definitions from this git repo if the system’s ncurses
predates 2021-07-31.
```

So it is best to follow the instructions and install the foot terminfo
provided by ncurses.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 22:48:26 +01:00
Adam Duskett
d62dda2065 package/foot: new package 
This is the default terminal sway uses.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr: add comment only for first-order deps]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 22:36:02 +01:00
Adam Duskett
2f6b1b8e68 package/dmenu-wayland: new package 
The traditional dmenu is only running under X; dmenu-wayland is an
implementation that runs only on (some) wayland compositors; Sway
uses it by default as its menu bar.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[yann.morin.1998@free.fr:
  - _SYNC_4 is an arch dependency, so comment should be hidden
  - add a few missing comments for first-level dependencies
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
 2023-12-24 19:48:59 +01:00
Christian Hitz
df89e73e92 package/imagemagick: add option to build host-imagemagick with XML support 
Since upstream commit
25e3a4f384
(which first appeared in version 7.1.1-19), ImageMagick does not trust
unvalidated XMP profiles in images anymore.

If such a XML profile is encountered inside e.g. a PNG image the
processing is aborted. Validating the XMP profile requires that
ImageMagick is compiled with XML support.
As host-imagemagick supports PNG file also activate XML support.

Signed-off-by: Christian Hitz <christian.hitz@bbv.ch>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-24 19:38:25 +01:00
Julien Olivain
c81af1667f package/perftest: bump to version 23.10.0-0.29 
For change log, see:
https://github.com/linux-rdma/perftest/releases/tag/23.10.0-0.29

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-24 19:18:25 +01:00
James Hilliard
80286eb5f1 package/python-certifi: bump to version 2023.11.17 
License hash changed due to inaccurate date cleanup:
2103453dd4

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-24 18:54:36 +01:00
Bernd Kuhls
58bf6a7f05 package/kodi-inputstream-adaptive: bump version to 20.3.15-Nexus 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-24 18:53:02 +01:00
Bernd Kuhls
d42683a055 {linux, linux-headers}: bump 4.{14, 19}.x / 5.{4, 10, 15}.x / 6.{1, 6}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 2023-12-24 18:52:57 +01:00