The commit b4006287f8 "package/go: security bump to version 1.23.6"
removed the go source from the go-bin package `.hash` file.
Since that commit, a number of autobuild errors for the host-go-bin
package started spawning during the 'legal-info' step.
Because the package 'go-bin' defines the '_ACTUAL_SOURCE_TARBALL'
variable the source hash is still required for the legal-info.
Similarly to the 'nodejs' package, the hash files for both the `go-bin`
and `go-src` package are shared in the `package/go` directory with the
help of a symbolic link used to make the subdirectories point to that
common `.hash` file.
Fixes:
https://autobuild.buildroot.org/results/337/33763441a065ddb07e944e26ad8f1f6d43b68592
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8b79823577)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The error was introduced by the libcurl bump to 8.12.0 with buildroot
commit 2da031c2e5.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e85cd58fc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 52154e5206 (package/zstd: build multithreaded library if
supported) added an override of a previously defined variable, so an
explicit check-package exception was added in 0f0e913f10
(package/zstd: rework build and install). Eventually, in 253a951c4f
(package/zstd: fix build without threads) the variable override was
removed.
However, the check-package exception was left out during the rework in
253a951c4f, so it now excludes nothing.
Drop this exception now.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad25dd6159)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As pointed out by shellcheck, the exit code of the start/stop/restart/reload
command is clobbered by the 'echo "FAIL'" statement:
In package/mdnsd/S50mdnsd line 52:
exit $?
^-- SC2320 (warning): This $? refers to echo/printf, not a previous command. Assign to variable to avoid it being overwritten.
So introduce a $status variable to keep track of it, similar to how it is
done in S40iwd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be20c12e15)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
As host-heimdal is only used by samba4, and samba4 already depends on
host-flex and host-bison, the build issue fixed by this commit is not
directly visible, but can be reproduced by doing "make host-heimdal"
for example in our official Buildroot Docker container:
/home/thomas/projets/buildroot/outputs/foo/build/host-heimdal-f4faaeaba371fff3f8d1bc14389f5e6d70ca8e17/missing: line 81: flex: command not found
WARNING: 'flex' is missing on your system.
You should only need it if you modified a '.l' file.
You may want to install the Fast Lexical Analyzer package:
<https://github.com/westes/flex>
make[4]: *** [Makefile:753: lex.c] Error 127
[...]
updating lex.yylex.c
../../ylwrap: line 176: -d: command not found
make[4]: *** [Makefile:756: parse.c] Error 127
Fix this by adding the missing dependencies.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 44e739d031)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot fails to build Linux kernel configurations where BTF support
is enabled together with zstd compression of debugging information.
The reason is in host-elfutils zstd support being explicitly disabled.
So enable zstd support in host-elfutils by default to fix such builds.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 315672feec)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Chris email address at boundarydevices is bouncing:
Chris Dimich is no longer with Ezurio. Please contact Gary Bisson by
email at Gary.Bisson@ezurio.com. Thank you!"
Move his package to Gary Bisson as suggested.
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 892d1ae27f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since commit [1], test_atf is failing. See [2].
Passing -no-pie to ld does not produce the bl31.elf file (and does not
generate an error). TF-A 2.11 reworked its makefiles and switched to
gcc to link files. This commit fixes this failing test by updating to
this newer TF-A version.
Fixes: [2].
[1] 248c2d045e
[2] https://gitlab.com/buildroot.org/buildroot/-/jobs/8609307891
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit b0ff88423f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes http://autobuild.buildroot.net/results/b24a96b999676990995a466686fe1eacf6cddfef
Some of the optional packages in swipl are written in C++, so CMake thinks a
C++ compiler is needed even though we build with -DSWIPL_PACKAGES=OFF since
the bump to 9.2.6 in commit 33d45b9c67 ("package/swipl: bump version to
9.2.6").
Add -DCMAKE_CXX_COMPILER=true to satisfy this check even in setups without
C++:
-- Check for working CXX compiler: /usr/bin/true
-- Check for working CXX compiler: /usr/bin/true - works
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 868f2dd183)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit [1] introduced the BR2_BROKEN hidden symbol. The intent of
this symbol is to temporarily mark a configuration known to be broken.
This commit was added to fix an undefined usage of the symbol, in a
previous commit [2].
With this somewhat special symbol, it is also perfectly normal to
have no use of it.
Running the command "utils/check-symbols" in a state there is no usage
of the BR2_BROKEN, the script fails with output:
Config.in:15: BR2_BROKEN defined but not referenced
This commit adds an exception for this symbol, allowing it to be
unused in the whole Buildroot tree.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/8925433382
[1] 2ddc5808cd
[2] 11a8cdd2bb
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit fa98239074)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The k3-am62a7-sk.dts describes an I2C PMIC TPS659312 which features a
number of regulators. One of them, ldo1, is used as power supply for the
SD card host controller regulator. When the rootfs is on the SD
card (like with this configuration), we need support for these three
components (Regulator driver, I2C PMIC glue and PMIC MFD driver) to be
built-in in order to avoid boot failures.
Tested on an AM62A LP SK.
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Bryan Brattlof <bb@ti.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8ba6459ac1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
ARC support was added in 0.10.0 by
4997efa59a
so drop the architecture dependency on !BR2_arc.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 99140408b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since Buildroot commit [1], util-linux libuuid is failing to build
with uclibc toolchains, when there is no thread support
(that is, when BR2_PTHREADS_NONE=y).
Builds are failing with error:
libuuid/src/gen_uuid.c:83:10: fatal error: pthread.h: No such file or directory
83 | #include <pthread.h>
| ^~~~~~~~~~~
This failure is due to the upstream commit [2], which introduced the
pthread dependency.
This commit fixes the issue by adding package patches, disabling
the uuidd cache in case the libptread (or the pthread_atfork function)
is not available.
Fixes:
https://autobuild.buildroot.org/results/e5856cf6f3b8512ededa17d20db2b330a478dd8e/
[1] f14929c657
[2] 25bd5396ab
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8489cb0932)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When glibc was bumped from 2.39 to 2.40 in commit
74cb378aff ("package/{glibc, localdef}:
bump to version 2.40"), the IGNORE_CVES entries should have been
dropped, as they were applicable to the 2.39 branch. Drop them now.
We did verify the pkg-stats output, and those CVEs don't show up as
affecting glibc even after this change, as expected.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4b133efbd3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Take a patch from meta-riscv, which was submitted upstream by Khem Raj
to fix a build issue on RISC-V 32-bit musl configurations. This issue
has been discussed with musl developers who believe this is a Busybox
issue. The patch from Khem works around the issue by making it a
runtime failure just affecting hwclock on RISC-V 32-bit musl instead
of a build failure. The correct fix is not really clear, as there
seems to be a disagreement between Busybox people and musl people on
what the C library settimeofday() function should do, and that's why
Busybox is bypassing settimeofday() on musl by making a direct system
call, except this system call doesn't exist on RISC-V 32-bit.
In the mean time, this patch fixes the long standing Gitlab CI issue:
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslStable
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291684
- tests.toolchain.test_external_bootlin.TestExternalToolchainBootlinRiscv32ilp32dMuslBleedingEdge
https://gitlab.com/buildroot.org/buildroot/-/jobs/8954291683
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a956eeb96b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit adds patches, which were all backported from upstream, or
submitted upstream, and that fix various CVEs. To facilitate the
backporting work, we took the backports from openembedded-core.
CVE-2021-42380: this one is not marked by NVD as affecting 1.36.1, but
its fix was merged after 1.36.1, so it seems like the NVD data is
incorrect. Therefore, no need for a BUSYBOX_IGNORE_CVES entry. Patch
is upstream, backport taken from openembedded-core.
CVE-2023-42363, CVE-2023-42364, CVE-2023-42365: patches are upstream,
backports taken from openembedded-core.
CVE-2023-42366: patch has been submitted upstream but not merged,
patch taken from openembedded-core.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75c594d446)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
cuserid is deprecated and breaks the compilation on some new toolchains.
This patch fixes this issue.
Fixes:
#81
Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a141b117e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It fixes an arbitrary file overwrite vulnerability in the readline.sh.
(CVE-2024-54661)
see - http://www.dest-unreach.org/socat/contrib/socat-secadv9.html
README hash changed due to version update.
Note: Buildroot is not impacted by this vulnerability as the
readline.sh is not installed on target.
Quoting changelog [1]:
Mitigating factors: readline.sh is usually neither installed in a bin
directory nor is it documented. Major Linux distributions install it in
examples/ or doc/; however it is invoked by test.sh script.
[1] https://repo.or.cz/socat.git/blob/refs/tags/tag-1.8.0.2:/CHANGES
Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: add note that Buildroot is not impacted in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d70df3ab44)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
7.2.6:
- (CVE-2024-31449) Lua library commands may lead to stack overflow and
potential RCE
- (CVE-2024-31227) Potential Denial-of-service due to malformed ACL
selectors
- (CVE-2024-31228) Potential Denial-of-service due to unbounded pattern
matching
7.2.7:
- (CVE-2024-46981) Lua script commands may lead to remote code execution
- (CVE-2024-51741) Denial-of-service due to malformed ACL selectors
https://github.com/redis/redis/releases/tag/7.2.6https://github.com/redis/redis/releases/tag/7.2.7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f3e99436ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security vulnerabilities:
Worker permission bypass via InternalWorker leak in diagnostics
(CVE-2025-23083) - (high)
With the aid of the diagnostics_channel utility, an event can be hooked into
whenever a worker thread is created. This is not limited only to workers
but also exposes internal workers, where an instance of them can be fetched,
and its constructor can be grabbed and reinstated for malicious usage.
This vulnerability affects Permission Model users (--permission) on Node.js
v20, v22, and v23.
GOAWAY HTTP/2 frames cause memory leak outside heap (CVE-2025-23085) - (medium)
A memory leak could occur when a remote peer abruptly closes the socket
without sending a GOAWAY notification. Additionally, if an invalid header
was detected by nghttp2, causing the connection to be terminated by the
peer, the same leak was triggered. This flaw could lead to increased memory
consumption and potential denial of service under certain conditions.
This vulnerability affects HTTP/2 Server users on Node.js v18.x, v20.x, v22.x and v23.x.
For more details, see the announcement:
https://nodejs.org/en/blog/vulnerability/january-2025-security-releases
Update the LICENSE hash for a an addition of the (MIT licensed) nlohmann
JSON library:
27bcd103e7
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15891236db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The commit 6889056f1e (support/scripts/genimage.sh) adds support for
creating bmap images.
Since then, the script genimage.sh looses the error returned by the
genimage command.
As a consequence, the target-finalize target looses the error as well,
and so on up to make.
This adds the shell option -e to exit immediately if a command ends with
an error, so the error is not ignored.
Fixes:
gportay@archlinux ~/src/rtone-br2-external $ make
(...)
>>> Executing post-image script support/scripts/genimage.sh
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"/*" (stderr):
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp"" (stderr):
INFO: cmd: "cp -a "/tmp/tmp.EclKGwtA4R" "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/root"" (stderr):
INFO: cmd: "mkdir -p "/home/gportay/src/rtone-br2-external/output/images"" (stderr):
INFO: vfat(efi-part.vfat): cmd: "mkdosfs '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat'" (stderr):
INFO: vfat(efi-part.vfat): adding file 'efi-part/EFI' as 'EFI' ...
INFO: vfat(efi-part.vfat): cmd: "MTOOLS_SKIP_CHECK=1 mcopy -sp -i '/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat' '/home/gportay/src/rtone-br2-external/output/images/efi-part/EFI' '::EFI'" (stderr):
Disk full
INFO: vfat(efi-part.vfat): cmd: "rm -f "/home/gportay/src/rtone-br2-external/output/images/efi-part.vfat"" (stderr):
ERROR: vfat(efi-part.vfat): failed to generate efi-part.vfat
INFO: cmd: "rm -rf "/home/gportay/src/rtone-br2-external/output/build/genimage.tmp/"" (stderr):
make[1]: Leaving directory '/home/gportay/src/rtone-br2-external/buildroot'
gportay@archlinux ~/src/rtone-br2-external $ echo $?
0
Signed-off-by: Gaël PORTAY <gael.portay+rtone@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 294d13bb85)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
- CVE-2024-56826: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56826
- CVE-2024-56827: A flaw was found in the OpenJPEG project. A heap buffer
overflow condition may be triggered when certain options are specified
while using the opj_decompress utility. This can lead to an application
crash or other undefined behavior.
https://access.redhat.com/security/cve/CVE-2024-56827
Release notes: https://github.com/uclouvain/openjpeg/blob/v2.5.3/NEWS.md
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3bfa5ebcbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When the Xen tools are built, a number of init scripts are installed to
the target.
Some of those Xen scripts require bash to run:
- /etc/init.d/S50xencommons
- /etc/init.d/S50xen-watchdog
- /etc/init.d/S60xendomains
- /etc/xen/scripts/launch-xenstore
- /usr/lib/xen/bin/xendomains
Make sure to select bash when the Xen tools are selected (we need to
select "busybox show others" for that, too).
Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Alistair Francis <alistair@alistair23.me>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bf18fd4cd1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
