Commit Graph

77156 Commits

Author SHA1 Message Date
Thomas Perale
0bccce3848 package/net-tools: fix regression introduced by CVE fix
Commit [1] backported an upstream patch to address CVE-2025-46836 that
included a regression.
Upstream later fixed this regression in commit [2].

This patch add that fix to correct the issue introduced by the original
patch.

[1] 323aaa9f54 package/net-tools: add upstream security fix for CVE-2025-46836
[2] ddb0e375fb/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d3274210f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:19:54 +02:00
Titouan Christophe
ab2b4f5a06 package/python-urllib3: security bump to v2.5.0
For release note, see:
https://github.com/urllib3/urllib3/releases/tag/2.5.0

This fixes the following vulnerabilities:
- CVE-2025-50181:
    urllib3 redirects are not disabled when retries are disabled on
    PoolManager instantiation

- CVE-2025-50182:
    urllib3 does not control redirects in browsers and Node.js

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to release note in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7006854ce1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:19:49 +02:00
Raphaël Mélotte
14b3716553 package/python-urllib3: bump to version 2.4.0
Release notes: https://github.com/urllib3/urllib3/releases/tag/2.4.0

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dff7ead045)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:19:42 +02:00
Titouan Christophe
66236201ab package/tinyxml: add patch for CVE-2023-34194
This fixes the following vulnerability:
- CVE-2023-34194:
    StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML
    through 2.6.2 has a reachable assertion (and application exit) via a
    crafted XML document with a '\0' located after whitespace.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 184a1b94a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:19:28 +02:00
Peter Korsgaard
5258af79bf package/jose: security bump to version 14
Jose-13 fixed the following security issue:

- CVE-2023-50967: latchset jose through version 11 allows attackers to cause
  a denial of service (CPU consumption) via a large p2c (aka PBES2 Count)
  value.
  https://github.com/latchset/jose/issues/151

In addition, jose-14 worked around another DoS issue related to
decompression:
https://github.com/latchset/jose/pull/157

Drop now upstreamed patches:

- 0001-lib-hsh.c-rename-hsh-local-variable.patch: Upstream as of
  3d5b287243

- 0002-man-add-option-to-skip-building-man-pages.patch: Upstream after
  getting reworked to use -Ddocs=disabled as of
  786b426df0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: remove .checkpackageignore entries to fix check-package errors]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 394a8fb406)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:19:20 +02:00
Bernd Kuhls
a03e122b4f {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f6d9a93c51)
[thomas: dropped 6.15]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:18:47 +02:00
Yann E. MORIN
4b7f821eb5 support/testing: enable lpxelinux for syslinux runtime test
The syslinux runtime test (which is in fact a build-only test) ensures
that syslinux does get build at least once a week (via the gitlab-CI
weekly pipeline). Runtime testing would need much more work, though, but
nothing in syslinux is currently runtime tested anyway.

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a6ddf2b91d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:48 +02:00
Thomas Perale
bd043b9828 package/kvmtool: fix build failure w/ musl
The following error occurs on the autobuilder for builds with musl
libc.

```
  CC       util/bitmap.o
In file included from include/linux/bitmap.h:7,
                 from util/bitmap.c:9:
include/linux/bitops.h:4:10: fatal error: bits/wordsize.h: No such file or directory
    4 | #include <bits/wordsize.h>
      |          ^~~~~~~~~~~~~~~~~
```

The error occurs because bits/wordsize.h is specific to glibc.

This patch applies an upstream fix that replaces the use of __WORDSIZE
with an internal macro, making the code portable across different libc.

Fixes: https://autobuild.buildroot.org/results/30d/30d6e407e6a0fc7d85062c2d56008755c70ca733/build-end.log
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 901b9e19ed)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:42 +02:00
Thomas Perale
92acdeea7e package/libavif: security bump to v1.3.0
Fixes the following security issues:

- CVE-2025-48174: makeRoom in stream.c has an integer overflow and
    resultant buffer overflow in stream->offset+size.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48174
  - https://github.com/AOMediaCodec/libavif/pull/2768/commits

- CVE-2025-48175: avifImageRGBToYUV in reformat.c has integer overflows
    in multiplications involving rgbRowBytes, yRowBytes, uRowBytes, and
    vRowBytes.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48175
  - 64d956ed5a

For more details on the version bump, see:
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.3.0
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.1
  - https://github.com/AOMediaCodec/libavif/releases/tag/v1.2.0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c1fa0bce1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:37 +02:00
Thomas Perale
288d63bfcd package/modsecurity2: security bump to v2.9.10
Fixes the following security issues:

- CVE 2025-47947: Versions up to and including 2.9.8 are vulnerable to
  denial of service in one special case (in stable released versions):
  when the payload's content type is application/json, and there is at
  least one rule which does a sanitiseMatchedBytes action. A patch is
  available at pull request 3389 and expected to be part of version
  2.9.9. No known workarounds are available.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-47947
  - https://github.com/owasp-modsecurity/ModSecurity/pull/3389

- CVE-2025-48866: Versions prior to 2.9.10 contain a denial of service
  vulnerability similar to GHSA-859r-vvv8-rm8r/CVE-2025-47947. The
  `sanitiseArg` (and `sanitizeArg` - this is the same action but an
  alias) is vulnerable to adding an excessive number of arguments,
  thereby leading to denial of service. Version 2.9.10 fixes the issue.
  As a workaround, avoid using rules that contain the `sanitiseArg` (or
  `sanitizeArg`) action.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-48866
  - 3a54ccea62

For more details on the version bump, see:
  - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.8
  - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.9
  - https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v2.9.10

Also this patch change the _SOURCE variable that now include a 'v'
prefixing the version.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: update hash source url in hash file comment]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3d593a8144)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:32 +02:00
Maxime Chevallier
0b54b252df package/elfutils: elfutils programs now require a c++ toolchain
The 0.192 release of elfutils introduced the src/srcfiles.cxx program,
that lists all source files of a given ELF binary. As this is a C++
program, we need a toolchain that supports it.

Without it, the build system tries to use "no" as the CXX compiler,
resulting in the following errors :

  /bin/sh: line 1: no: command not found

as can be seen here for example :

https://autobuild.buildroot.net/results/849/849221c794a469a423857a290db775d150b84900

Add a dependency to a CPP toolchain for the elfutils programs.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 268d7ad180)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:28 +02:00
Maxime Chevallier
b672f9e988 package/elfutils: Show a comment explaining that elfutils progs need glibc
The elfutils programs require Glibc to be used as the C library. Show a
comment when this libc isn't used in the toolchain.

Suggested-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 52ba3ed657)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:21 +02:00
Thomas Perale
70350cc4ef package/gstreamer1/gstreamer1-editing-services: fix COPYING hash
With the version bump to v1.24.11 (see [1]) the license hash changed for
the gstreamer1-editing-services package (see [2]).

This patch update the hash accordingly.

Fixes: https://autobuild.buildroot.org/results/9e1/9e1807cf5ac7bb69ae9bbe7a6a71411eb500188c/build-end.log

[1] fd00502ee0 package/gstreamer1/gstreamer1-editing-services: bump version to 1.24.11
[2] 2a56edb6af

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fc1387b4a5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-10 11:14:15 +02:00
Marcus Hoffmann
f11fc14734 package/systemd: bump to 256.16
Systemd stable versions don't really have release notes, so best we can
do is link to the diff between the two tags:

https://github.com/systemd/systemd/compare/v256.7...v256.16

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 11:21:23 +02:00
Florian Larysch
4d73a8b554 package/libssh2: bump to version 1.11.1
Release notes: https://libssh2.org/changes.html#1.11.1

Among other things, this release includes the patches previously carried
by Buildroot and also has fixes for build issues with mbedTLS 3.6.x. It
also includes a purely cosmetic copyright bump[1].

Builds with test-pkg against all three crypto providers.

Fixes: https://autobuild.buildroot.org/results/306/30699f986c6bcd1ab247d92c4ba0999f09aa226f

[1] 187d89bb07

Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 980b8c7e54)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 11:14:14 +02:00
James Hilliard
f6c4655bde package/mbedtls: bump to version 3.6.3.1
As specified in the 2.28.10 release notes:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Mbed TLS 2.28.10 is the last release of the 2.28 LTS and won't receive bug
fixes or security fixes anymore.  Users are advised to upgrade to a
maintained version.

So move to 3.6.x, which is the new LTS version:

Mbed TLS 3.6 is a long-term support (LTS) branch.  It will be supported with
bug-fixes and security fixes until at least March 2027.

Drop BR2_PACKAGE_MBEDTLS_COMPRESSION and all related references
as native zlib support has been entirely removed from mbedtls.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Peter: add note about 2.28.x / 3.6.x, add Config.in.legacy]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3481a9643f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 11:13:56 +02:00
Bram Oosterhuis
87d2320a45 package/libgcrypt: bump to v1.11.1
For release note, see:
https://dev.gnupg.org/T7166

This version fixes a build error which can happen with 32-bit arm
configurations.

The issue can be reproduced with commands:

    cat >.config <<EOF
    BR2_arm=y
    BR2_cortex_a8=y
    BR2_ARM_INSTRUCTIONS_THUMB2=y
    BR2_TOOLCHAIN_EXTERNAL=y
    BR2_PACKAGE_LIBGCRYPT=y
    EOF
    make olddefconfig
    make libgcrypt

Build is failing with output:

    ec-nist.c: In function '_gcry_mpi_ec_nist256_mod':
    ec-inline.h:902:5: error: 'asm' operand has impossible constraints or there are not enough registers
      902 |     __asm__ ("subs %3, %7, %10\n" \
          |     ^~~~~~~

Details for this buggix: https://dev.gnupg.org/T7226

Signed-off-by: Bram Oosterhuis <dev@bybram.com>
[Julien: reword commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 89ca1bd4f4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 10:07:47 +02:00
Yann E. MORIN
22d808b108 boot/syslinux: fix install with top-level parallel build
syslinux is... special. It is a target package, but it is installed in
HOST_DIR *in the target install commands*: in addition to the boot files
that run on the target, syslinux installs a set of host tools that are
to be used at build time (e.g. extlinux, to prepare bootable media, like
an iso96660 image). Then, from HOST_DIR, the actual boot files are
copied into BINARIES_DIR (i.e. images/); we do it that way because the
boot files are scattered about everywhere in the build tree, while they
are all packed together in a single directory once installed.

However, there is no dependency between the target and image install
steps. So, when using top-level parallel builds, there is no guarantee
that the target install commands are finished before the image install
commands are started.

We fix that by first installing into a temporary location, as part of
the build step, and by then copying from there as part of the install
step. This ensures that the boot files are easily available, without
needing a dependency on the target install step, that we can't express.

Note that we do not change the actual installation into HOST_DIR: it can
be set up differently that our temporary location, and we do not want
to duplicate that setup here (it's going to diverge over time).

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90e76818a1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 10:07:20 +02:00
Titouan Christophe
f44ee51eb9 package/libmpeg2: add CPE_ID_VENDOR
At the moment, package stats indicates that libmpeg2 is affected by
https://nvd.nist.gov/vuln/detail/CVE-2022-37416

However, this CVE applies to a completely different piece of software,
that has the same name "libmpeg2" [1].

To avoid the confusion, let's add a proper CPE vendor to Buildroot's libmpeg2.
The library itself does not clearly identify any vendor name, and there isn't
any existing CPE on the NVD website. Since this library is not updated for
many years (maybe even before the introduction of the CPE system), but the
code is somehow related to the Videolan project, let's add this as the
vendor, which sould solve the matched CVE issue.

[1] https://github.com/ittiam-systems/libmpeg2

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: fix typo in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 585ee147dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 10:06:58 +02:00
Titouan Christophe
6e0cd7765c package/libmpeg2: switch to videolan Gitlab repository
The source code archives don't seem to be available anymore from the libmpeg2
website (Sourceforge) [1], and their SVN repository [2] doesn't seem
reachable either.

This fixes recent autobuilder failures, such as
https://autobuild.buildroot.net/results/ede/edeef6a480350880b12eebd94654644e43c2670e/

[1] https://libmpeg2.sourceforge.io/
[2] svn://svn.videolan.org/libmpeg2/trunk

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2f2a83fdc4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 10:06:49 +02:00
Julien Olivain
e5e602118c package/gcc/Config.in.host: hide gcc version for unsupported CPUs
When a new gcc version is introduced, for example gcc 15 in
commit [1], it should have also added a "depends on
!BR2_ARCH_NEEDS_GCC_AT_LEAST_15" to the previous gcc version.

This logic is described for external toolchains in commit [2],
for example. The internal Buildroot toolchains should have the
same logic. This logic existed for previous gcc version. See for
example the removal of gcc 12 in commit [3].

There is usually no problem, because all the three latest active gcc
versions supports all CPUs present in Buildroot.

However, the commit [4] recently added the support for the Arm
Cortex-A720 CPU, which needs at least gcc 14. Since there is no
logic preventing the selection of the gcc version, it is possible
to select an unsupported gcc version (i.e. gcc 13).

In such a case, the host-gcc-initial package configuration fails
with output:

    Unknown cpu used in --with-cpu=cortex-a720

This commit fixes the issue by adding those missing dependencies.

Fixes:
https://autobuild.buildroot.org/results/918b90aee0b65f01efc241622015cb847b4e23a8/

[1] 75891397ab
[2] f577d8218f
[3] 58cf7c51da (66f7e875db173e5538d3511c8297acc1ba30da33_27_25)
[4] de374e06d8

Cc: Romain Naour <romain.naour@gmail.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f231d3003)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:59:23 +02:00
Raphaël Mélotte
f980395994 support/testing: new runtime test for gumbo-parser
The new test requires a br2-external directory because we compile a
small test program on the host and install it on the target, but it's
not useful to have it in the main Buildroot package tree.

The test program loads and parses a sample HTML document. Taking
inspiration from 'examples/get_title.c' in gumbo-parser, it also
searches for the title of the document just to check that we can do
more than the parsing.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit da23be6338)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:58:54 +02:00
Raphaël Mélotte
9d8bde1172 package/gumbo-parser: update upstream repository
Development on Google's GitHub repository has stopped a long time ago.
A fork exists on Codeberg, and multiple distributions (Fedora, Arch
Linux, ...) are already using it (see [1]).

Update the source URL to use the new upstream location.

The new upstream has a different hash for the 0.10.1 tarball, so
update it as well.

[1]: https://repology.org/project/gumbo-parser/versions

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1e106d8412)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:58:08 +02:00
Raphaël Mélotte
bf74711514 support/testing: add new test for nginx-modsecurity
This test verifies that we can run nginx with the modsecurity
directives.
It also checks a very simple rule that blocks requests containing the
keyword "blockme".

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[Julien:
 - add / at directory end in DEVELOPERS
 - sort DEVELOPERS entries alphabetically
 - remove unneeded test configs already present in
   BASIC_TOOLCHAIN_CONFIG
 - sort test config directives alphabetically
]
Signed-off-by: Julien Olivain <ju.o@free.fr>

(cherry picked from commit 5cda85cb56)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:57:40 +02:00
Raphaël Mélotte
6fd0878189 package/binutils: fix build with gcc 15
Backport the upstream patch that fixes the following build error when
compiling for mips with gcc 15:

In file included from mips-opc.c:29:
mips-opc.c: In function 'decode_mips_operand':
mips-formats.h:86:7: error: expected identifier or '(' before
'static_assert'
   86 |       static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
         |       ^~~~~~~~~~~~~

The patch is already part of upstream binutils 2.44, so we only need
it for 2.42 and 2.43.1.

All 3 versions we have of host-binutils were build-tested using the
defconfig from the autobuilder failure (see the link below) and gcc 15
on the host.

Fixes:
- https://autobuild.buildroot.org/results/873/873ec25cf01d5f2b9ae7044e0b1d8d8791b781e6/

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 430aa91c3d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:57:16 +02:00
Titouan Christophe
91895774f8 package/libarchive: security bump to v3.8.1
This fixes the following CVEs:

- CVE-2025-5914
    Libarchive: double free at archive_read_format_rar_seek_data()
    in archive_read_support_format_rar.c
    https://www.cve.org/CVERecord?id=CVE-2025-5914

- CVE-2025-5915
    Libarchive: heap buffer over read in copy_from_lzss_window()
    at archive_read_support_format_rar.c
    https://www.cve.org/CVERecord?id=CVE-2025-5915

- CVE-2025-5916
    Libarchive: integer overflow while reading warc files
    at archive_read_support_format_warc.c
    https://www.cve.org/CVERecord?id=CVE-2025-5916

- CVE-2025-5917
    Libarchive: off by one error in build_ustar_entry_name()
    at archive_write_set_format_pax.c
    https://www.cve.org/CVERecord?id=CVE-2025-5917

- CVE-2025-5918
    Libarchive: reading past eof may be triggered for piped file streams
    https://www.cve.org/CVERecord?id=CVE-2025-5918

See the release notes:
- https://github.com/libarchive/libarchive/releases/tag/v3.8.0
- https://github.com/libarchive/libarchive/releases/tag/v3.8.1

In addition to the version bump, the following changes are required:
- The COPYING file has been edited upstream because of filename change on a
  sub-licensed component; see
  c26f037745
- The upstream "sha256sums" is currently unavailable, so the archive checksum
  has been computed locally
- Drop patches for libiconv in configure.ac, which has been properly addressed
  upstream in https://github.com/libarchive/libarchive/pull/2611
- Following the above, AUTORECONF is not needed any longer
- Drop mbedtls patch that has been applied upstream

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 95db5707df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:56:44 +02:00
Titouan Christophe
8154e1226d package/libwebsock: remove package
The upstream Github repository payden/libwebsock is no longer available,
and its URL now redirects to some completely unrelated software.
We don't know for sure what happened, but at least the package does not
build anymore, because its source code has vanished.

Since no other buildroot package depends on libwebsock, and it hasn't
received any update; let's simply remove it from here.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9f2dbf1486)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:56:14 +02:00
Titouan Christophe
608cbd7755 package/libbpf: add patch for CVE-2025-29481
This fixes the following CVE:

- CVE-2025-29481:
    Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to
    execute arbitrary code via the bpf_object__init_prog` function of libbpf.

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-29481

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add direct link to CVE in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fba60c7732)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:53:59 +02:00
Giulio Benetti
1ee325b12d board/freescale/mxs: fix Linux booting
Actually DTB_LIST accepts only file and not files with relative path
preprended. This leads to have vfat without .dtb files and so Linux
doesn't start. Let's fix this by including slash in sed command as done
for mxc as well as basename in front of $dt.dtb to remove possible
useless folders present in the dts path. Let's also add set -e at the
top of the script to make it more verbose on error and modify this
section according to spellcheck as done for mxc.

This commit align this "mxs/post-image.sh" with its "imx/post-image.sh"
counterpart which was improved for arm64 in commit [1].

[1] 4755bf2bd4

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien:
 - change space indentation to tabs for consistency
 - add note in commit log about imx/post-image.sh
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 50297207a8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:53:29 +02:00
Julien Olivain
4c3660a215 boot/edk2: add security fix for CVE-2024-38805
This commit adds a security fix from the upstream commit:
b3a2f7ff24

It fixes CVE-2024-38805:
https://www.cve.org/CVERecord?id=CVE-2024-38805
Note: at the time of this commit, this CVE is "reserved" by a CNA.
Details will come later.

See also the associated pull request:
https://github.com/tianocore/edk2/pull/11042

This commit also adds the corresponding _IGNORE_CVES entry.

Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 14d07d1914)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:52:22 +02:00
Peter Korsgaard
e3681379ec Makefile: unexport TOPDIR to fix gnu-efi >= 3.0.18 build issue
gnu-efi fails to build if TOPDIR is exported in the environment since the
move to version 3.0.18 in commit 9efeb7e914 ("package/gnu-efi: bump to
version 3.0.18").

The reason is the change in TOPDIR logic introduced by upstream commit
31913f8489 ("Make: make TOPDIR actually work and get rid of unused CDIR"):

31913f8489

export TOPDIR=foo; make gnu-efi
...
/path/to/buildroot/output-gnuefi/host/bin/aarch64-linux-ld: cannot find
 /path/to/buildroot/output-gnuefi/build/gnu-efi-4.0.0//apps/../aarch64/gnuefi/crt0-efi-aarch64.o:
 No such file or director
make[2]: *** [Makefile:89: apps] Error 2
make[1]: *** [package/pkg-generic.mk:273: /path/to/buildroot/output-gnuefi/build/gnu-efi-4.0.0/.stamp_built] Error 2
make: *** [Makefile:23: _all] Error 2

As a workaround, unexport TOPDIR like we do for other sensitive environment
variables.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2b5544ab7a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:52:12 +02:00
Peter Korsgaard
d036fffda8 Makefile: sort unexport lines
The list of environment variables to unexport has grown organically over the
years and is no longer sorted. Sort it alphabetically for clarity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit da04cfa26c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:51:46 +02:00
Raphaël Mélotte
a6486068f6 package/modsecurity2: update upstream URLs
'https://github.com/SpiderLabs/ModSecurity' now redirects to
'https://github.com/owasp-modsecurity/ModSecurity', so update our
URLs accordingly.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 602fb43d34)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:49:53 +02:00
Raphaël Mélotte
4e9e8040ca package/nginx-modsecurity: update upstream URLs
'https://github.com/SpiderLabs/ModSecurity-nginx' now redirects to
'https://github.com/owasp-modsecurity/ModSecurity-nginx', so update our
URLs accordingly.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d9551d303)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:49:17 +02:00
Raphaël Mélotte
d6f3fc4db7 package/mupdf: update homepage URL
The current homepage URL leads to an HTTP 404 error.

Fix it by using the homepage URL currently mentioned in mupdf's git
repository.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d1ea9a64e6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:49:08 +02:00
Maxime Chevallier
704f1fb3cd configs/globalscale_espressobin: Bump linux to v5.15.186
Bump from v5.15.1 to the latest patchlevel bump, v5.15.186.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: reword commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3953bd3e9c)
[thomas: bump to latest 5.15 instead of 6.12]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:44:21 +02:00
Peter Korsgaard
6fb1518be0 package/libcurl: unbreak threads + c-ares conditional
Commit 0fce7a9623 ("package/libcurl: fix build w/ threads + c-ares") added a
conditional for threads + c-ares, but ended up with a end-parenthesis too
many - so the condition is never true.  Fix that.

Reported-by: Tibault Damman <tibault.damman@basalte.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 17399baa7c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:37:57 +02:00
Maxime Chevallier
f6f69ba11b package/linux-tools: rtla: Pass TARGET_LD to the make arguments
In Linux v6.8,  the rtla Makefile was rewritten :

  01474dc706ca ("tools/rtla: Use tools/build makefiles to build rtla")

The new Makefile uses default linker values, so the host linker being used to
produce the final rtla binary.

This results in the following error :

ld: [...] trace.o: error adding symbols: file in wrong format

Add LD=$(TARGET_LD) to the RTLA_MAKE_OPTS to fix rtla cross-compilation.

Signed-off-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f28f34e200)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:37:03 +02:00
Thomas Petazzoni
78e4c8ebf4 package/cifs-utils: bump to version 7.4
According to
https://lists.samba.org/archive/samba-technical/2025-June/139484.html:

A new update, version 7.4, of cifs-utils has been released today.
Users of cifs-utils version 7.3 on older kernels are encouraged to
update to 7.4 since it includes a fix for a mount problem with version
7.3 of cifs-utils on older kernels when using namespaces.

[...]

Detailed list of changes since version 7.3 was released
----------------------------------------------------------------
Enzo Matsumiya (1):
      mount.cifs: retry mount on -EINPROGRESS

Henrique Carvalho (1):
      cifs.upcall: correctly treat UPTARGET_UNSPECIFIED as UPTARGET_APP

Paulo Alcantara (1):
      cifs.upcall: fix memory leaks in check_service_ticket_exits()

Pavel Shilovsky (1):
      cifs-utils: bump version to 7.4

Z. Liu (2):
      getcifsacl, setcifsacl: use <libgen.h> for basename
      cifscreds: use <libgen.h> for basename

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4abd7bb9df)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:23:08 +02:00
Thomas Petazzoni
5da15192c3 package/cifs-utils: bump to version 7.3
Changes 7.1..7.2:

- Security enhancements including support for password rotation,
  better credential management, and namespaces
- Various improvements to man pages

Changes 7.2..7.3:

- Three fixes, including a fix for "guest" mount problem introduced
  with version 7.2

Our patch is upstream as of 7.2, so we can drop it.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit efdf0cdbcb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:23:01 +02:00
Bernd Kuhls
5c1230a90b package/mpv: remove stale patch
Buildroot commit 8f69974c20 switched the
buildsystem of mpv from waf to meson but forgot to remove a patch which
fixed a waf-related build error.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 942b88e693)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-03 09:11:14 +02:00
Francois Perrad
291415ced9 package/lua: bump to version 5.4.8
For differences with 5.4.7, see:
https://www.lua.org/work/diffs-lua-5.4.7-lua-5.4.8.html

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien: add link to diff with previous version]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 393d7e4d21)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-07-02 18:38:08 +02:00
Fred Lefranc
06a92ffdcc package/haproxy: bump version to 2.6.22
Changelog: http://www.haproxy.org/download/2.6/src/CHANGELOG

Signed-off-by: Fred Lefranc <fred.lefranc+evs@gmail.com>
[thomas: fixed the '.hash' file from patch to apply]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-25 23:02:36 +02:00
Bernd Kuhls
9eb5e71313 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7a1d7189a0)
[thomas: dropped 6.15]
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:01:42 +02:00
Giulio Benetti
54a1ed543f package/libblockdev: security bump to version 3.3.1
This version fixes CVE-2025-6019, see:
https://github.com/storaged-project/libblockdev/blob/3.3.1/NEWS.rst

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-6019

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: add link to CVE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0233c854b1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:19 +02:00
Romain Naour
3045f77545 package/squashfs: update URL to source archive after Github changes
The squashfs 4.6.1 archive hash has been changed suddenly two weeks
ago by Github without any intended changes from the squashfs maintainer
[1].

The orginal squashfs 4.6.1 archive has been manually uploaded again.

Update the URL to download the archive that match the expected hash.

Since we don't use the github download helper anymore, the squashfs
archive name is changed from squashfs-4.6.1.tar.gz to
squashfs-tools-4.6.1.tar.gz.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/10355448207
(and many more...)

See:
[1] https://github.com/plougher/squashfs-tools/issues/313

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e374ae03b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:13 +02:00
Bernd Kuhls
df5f63f7a0 package/clamav: security bump version to 1.0.9
Fixes CVE-2025-20260:
"The code flaw was present prior to version 1.0.0, but a change in
 version 1.0.0 that enables larger allocations based on untrusted data
 made it possible to trigger this bug."
https://blog.clamav.net/2025/06/clamav-143-and-109-security-patch.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 09f6aa642d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:08 +02:00
Fiona Klute (WIWA)
3b609f1b0c package/libndp: fix build with GCC 14 and musl
Patch has been pending upstream for a while [1], Alpine has merged an
older version that includes some whitespace damage but is functionally
equivalent.

[1] https://github.com/jpirko/libndp/pull/29

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0c2aa35fbe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 21:00:02 +02:00
Gwenhael Goavec-Merou
6fb63beb84 package/python-remi: bump to master commit and fixes build failure
REMI hasn't received new release since July 2022 and is currently broken
with error:

Traceback (most recent call last):
  File "<string>", line 26, in <module>
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 116, in setup
    _install_setup_requires(attrs)
    ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 89, in _install_setup_requires
    _fetch_build_eggs(dist)
    ~~~~~~~~~~~~~~~~~^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 94, in _fetch_build_eggs
    dist.fetch_build_eggs(dist.setup_requires)
    ~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 80, in fetch_build_eggs
    raise SetupRequirementsError(specifier_list)
setuptools.build_meta.SetupRequirementsError: ['setuptools_scm']

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 389, in <module>
    main()
    ~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 373, in main
    json_out["return_val"] = hook(**hook_input["kwargs"])
                             ~~~~^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/pyproject_hooks/_in_process/_in_process.py", line 143, in get_requires_for_build_wheel
    return hook(config_settings)
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 331, in get_requires_for_build_wheel
    return self._get_build_requires(config_settings, requirements=[])
           ~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 301, in _get_build_requires
    self.run_setup()
    ~~~~~~~~~~~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 512, in run_setup
    super().run_setup(setup_script=setup_script)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/build_meta.py", line 317, in run_setup
    exec(code, locals())
    ~~~~^^^^^^^^^^^^^^^^
  File "<string>", line 31, in <module>
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/__init__.py", line 117, in setup
    return distutils.core.setup(**attrs)
           ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/_distutils/core.py", line 148, in setup
    _setup_distribution = dist = klass(attrs)
                                 ~~~~~^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 323, in __init__
    _Distribution.__init__(self, dist_attrs)
    ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/_distutils/dist.py", line 309, in __init__
    self.finalize_options()
    ~~~~~~~~~~~~~~~~~~~~~^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 786, in finalize_options
    ep(self)
    ~~^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools/dist.py", line 806, in _finalize_setup_keywords
    ep.load()(self, ep.name, value)
    ~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^
  File "/workdir/instance-0/output-1/host/lib/python3.13/site-packages/setuptools_scm/_integration/setuptools.py", line 82, in version_keyword
    assert isinstance(value, dict), "version_keyword expects a dict or True"
           ~~~~~~~~~~^^^^^^^^^^^^^
AssertionError: version_keyword expects a dict or True

ERROR Backend subprocess exited when trying to invoke get_requires_for_build_wheel
make: *** [package/pkg-generic.mk:273: /workdir/instance-0/output-1/build/python-remi-2022.7.27/.stamp_built] Error 1
make: Leaving directory '/workdir/instance-0/buildroot'

Since last release code has been corrected and now build end
successfully.

Another issue with remi is related to python CGI library no more available with
python 3.13. This patch also updates Config.in to add a select BR2_PACKAGE_PYTHON_LEGACY_CGI

This commit also updates the LICENSE file hash, because line ending
changed from "CR-LF" (Windows) in old release archive to "LF" (Unix)
in the github download. Apart from that, the content is the same.

Fixes:
- https://autobuild.buildroot.org/results/f0409533ebdc31e522f2ee2ea8a5acc11dbc7430/
- https://autobuild.buildroot.org/results/a16cf5105d4b726b5d4136a2d8f82abcfdc0faba/
- https://autobuild.buildroot.org/results/e7ac28e20ad92863d337e96c225463346ee6c690/

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
[Julien:
 - use "git describe --abbrev=40" format in _VERSION
 - fix LICENSE hash
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 14ce0d2e6e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:59:51 +02:00
Marcus Hoffmann
ac4c28953a package/ca-certificates: bump to 20250419
Changelog: https://metadata.ftp-master.debian.org/changelogs//main/c/ca-certificates/ca-certificates_20250419_changelog

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a085462e4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-06-24 20:59:45 +02:00