Commit Graph

76708 Commits

Author SHA1 Message Date
Yann E. MORIN
283fc0ea2e package/freerdp: bump to latest commit on legacy stable branch
FreeRDP fails to build on newer gcc:

    /freerdp-2.11.7/libfreerdp/core/info.c:88:39: error: initialization of 'const WCHAR *' {aka 'const short unsigned int *'} from incompatible pointer type 'BYTE *' {aka 'unsigned char *'} [-Wincompatible-pointer-types]
       88 |                 const WCHAR* domain = Stream_Pointer(s);
          |                                       ^~~~~~~~~~~~~~

There is a patch upstream [0] to fix that one, but then another similar
build failure triggers, which is also fixed upstream, but then a third
failre triggers, again fixed upstream [2], but then...

FreeRDP 2.x has been kinda discontinued, and the new stable is 3.x.
However, bumping to 3.x looks like a huge leap.

So, rather than backport, just bump to the latest commit on the
stable-2.0 branch, which carries 12 non-merge commits with build fixes:
    562ae3588 [winpr,pubsub] add NULL parameter checks
    68c7c21b9 X11 client: ignore grab related LeaveNotify events
    a9deecc99 fix [core]: 'invalid hHandle' errors
    052c525e0 [core] eliminate rdpRdp::instance
    be23ed4ba [server,proxy] deactivate capture module
    5b2b53b15 [warnings] fix -Wincompatible-pointer-types
    67818bddb [client,wayland] fix const correctness
    d2b6771c7 X11: fix pointer/integer type mismatch
[2] 7894a7dfc redirection: Fix incompatible pointer type
[1] f3ed1f1ac redirection: Fix incompatible pointer type
[0] 4f411197d info: Fix incompatible pointer type
    a383740a2 next-dev-2.11.8-dev

Fixes:
    http://autobuild.buildroot.org/results/e1b/e1b95b4fb0005d4e933b027b508cec9ad510bd73/
    http://autobuild.buildroot.org/results/ba0/ba0beae13e1be2573878ee50b1566f4427b269a3/
    ...

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15f15cfe01)
2025-04-07 15:33:11 +02:00
Yann E. MORIN
b4bc8f0791 package/libcap: do not attempt to run ldconfig
The libcap Makefile is hand-coded (i.e. not autotools), and hard-codes
calls to /sbin/ldconfig, unless it is installed out-of-tree. For target
packages, this is done, but for host package this is not done, as we
do set PREFIX instead, which causes libcap's Makefile to call ldconfig
and emits a spurious warning (twice):

    install -m 0755 libcap.so.2.73 /home/ymorin/dev/buildroot/O/master/per-package/host-libcap/host/lib/libcap.so.2.73
    ln -sf libcap.so.2.73 /home/ymorin/dev/buildroot/O/master/per-package/host-libcap/host/lib/libcap.so.2
    ln -sf libcap.so.2 /home/ymorin/dev/buildroot/O/master/per-package/host-libcap/host/lib/libcap.so
    /sbin/ldconfig
    /sbin/ldconfig: Can't create temporary cache file /etc/ld.so.cache~: Permission denied
    make[4]: [Makefile:200: install-shared-cap] Error 1 (ignored)

This is just a warning, but it is incorrect still.

Fake an out-of-tree install with a non-empy DESTDIR that is just '/',
and thus does in fact not install out-of-tree. This is enough to
actually silence the warning. Add a little comment to explain that.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd@kuhls.net>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e172bb48d3)
2025-04-07 15:33:10 +02:00
Peter Seiderer
d023e7ad22 package/v4l2loopback: fix v4l2loopback-ctl compile/install
Since upstream commit [1] the original v4l2loopback-ctl bash script was
replaced by a C version, so add a proper compile step (and remove bash
runtime dependency) to fix '[help] v4l2loopback package build fails for
raspberrypi5' [2].

The issue can be reproduced with the commands:

    cat <<EOF >.config
    BR2_aarch64=y
    BR2_TOOLCHAIN_EXTERNAL=y
    BR2_LINUX_KERNEL=y
    BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
    BR2_PACKAGE_V4L2LOOPBACK=y
    BR2_PACKAGE_V4L2LOOPBACK_UTILS=y
    EOF
    make olddefconfig
    make v4l2loopback

Note: upstream commit [1] was introduced in version v0.13.0.
Buildroot bumped v4l2loopback to v0.13.2 in [3].

Fixes:

  /usr/bin/install: cannot stat
  '.../build/v4l2loopback-0.13.2/utils/v4l2loopback-ctl':
  No such file or directory

[1] 33922fa4e9
[2] https://lists.busybox.net/pipermail/buildroot/2025-March/775911.html
[3] 02540771bc

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien:
 - add commands to reproduce the issue
 - add reference to buildroot commit introducing the issue
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d85d23e16)
2025-04-07 15:33:09 +02:00
Thomas Petazzoni
b8dd91d81c package/gdb: bump 16.x series to 16.2
This is a corrective release over GDB 16.1, fixing the following issues:

    PR build/32578 (cannot build GDB 16.1 out of tree when calling the configure script with a relative path)
    PR tui/32592 ([gdb/tui] internal error in tui-winsource.c:340:refresh_window)
    PR remote/32593 (Incompatibilities between GDB's and LLDB's 'x' packet implementation)
    PR build/32610 (Missing #include file in darwin_nat.c)

None of which is really super important for Buildroot, but at least
we're using the latest without wondering why we're not.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0a5a0772c2)
2025-04-07 15:33:08 +02:00
Bernd Kuhls
54664369d1 package/tor: bump version to 0.4.8.16
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
https://forum.torproject.org/t/stable-release-0-4-8-16/18062

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fed4ccb181)
2025-04-07 15:33:07 +02:00
Peter Korsgaard
357fd1b657 package/mbedtls: security bump to version 2.8.10
Fixes the following security issues:

- CVE-2025-27809: Note that TLS clients should generally call
  mbedtls_ssl_set_hostname() if they use certificate authentication (i.e.
  not pre-shared keys).  Otherwise, in many scenarios, the server could be
  impersonated.  The library will now prevent the handshake and return
  MBEDTLS_ERR_SSL_CERTIFICATE_VERIFICATION_WITHOUT_HOSTNAME if
  mbedtls_ssl_set_hostname() has not been called.

  https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-1/

- CVE-2025-27810: Zeroize temporary heap buffers used in PSA operations.
  Fix a vulnerability in the TLS 1.2 handshake.  If memory allocation
  failed or there was a cryptographic hardware failure when calculating the
  Finished message, it could be calculated incorrectly.  This would break
  the security guarantees of the TLS handshake.

  https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/

For more details, see the release notes:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 91bfce113e)
2025-04-07 15:33:06 +02:00
Bernd Kuhls
41d3983526 package/exim: security bump version to 4.98.2
Fixes CVE-2025-30232:
https://lists.exim.org/lurker/message/20250326.140105.6b97555b.en.html
https://exim.org/static/doc/security/CVE-2025-30232.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e242a5908c)
2025-04-07 15:33:05 +02:00
Peter Korsgaard
31c0a801f5 package/xserver_xorg-server: security bump to version 21.1.16
21.1.14 fixes the following security issues:

1) CVE-2024-9632: Heap-based buffer overflow privilege escalation in
_XkbSetCompatMap

Introduced in: xorg-server-1.1.1 (2006)
Fixed in: xorg-server-21.1.14 and xwayland-24.1.4
Fix:
85b7765714
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The _XkbSetCompatMap() function attempts to resize the `sym_interpret`
buffer.

However, It didn't update its size properly. It updated `num_si` only,
without updating `size_si`.

This may lead to local privilege escalation if the server is run as root
or remote code execution (e.g. x11 over ssh).

xorg-server-21.1.14 and xwayland-24.1.4 have been patched to fix this issue.

https://lists.x.org/archives/xorg-announce/2024-October/003545.html
https://lists.x.org/archives/xorg-announce/2024-October/003546.html

21.1.16 fixes the following security issues:

1) CVE-2025-26594: Use-after-free of the root cursor

Introduced in: Unknown - Prior to X11R6.6 Xorg baseline
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/01642f26
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b0a09ba6
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The root cursor is referenced in the xserver as a global variable. If
a client manages to free the root cursor, the internal reference points
to freed memory and causes a use-after-free.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

2) CVE-2025-26595: Buffer overflow in XkbVModMaskText()

Introduced in: Prior to X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/11fcda87
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The code in XkbVModMaskText() allocates a fixed sized buffer on the
stack and copies the names of the virtual modifiers to that buffer.

The code however fails to check the bounds of the buffer correctly and
would copy the data regardless of the size, which may lead to a buffer
overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

3) CVE-2025-26596: Heap overflow in XkbWriteKeySyms()

Introduced in: initial version of xc/programs/Xserver/xkb/xkb.c in X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/80d69f01
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The computation of the length in XkbSizeKeySyms() differs from what is
actually written in XkbWriteKeySyms(), which may lead to a heap based
buffer overflow.

xorg-server-21.1.16 and xwayland-24.1.6 have been patched to fix this issue.

4) CVE-2025-26597: Buffer overflow in XkbChangeTypesOfKey()

Introduced in: X11R6.1
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/0e4ed949
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

If XkbChangeTypesOfKey() is called with 0 group, it will resize the key
symbols table to 0 but leave the key actions unchanged.

If later, the same function is called with a non-zero value of groups,
this will cause a buffer overflow because the key actions are of the wrong
size.

5) CVE-2025-26598: Out-of-bounds write in CreatePointerBarrierClient()

Introduced in: xorg-server-1.14.0
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/bba9df1a
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function GetBarrierDevice() searches for the pointer device based on
its device id and returns the matching value, or supposedly NULL if no
match was found.

However the code will return the last element of the list if no matching
device id was found which can lead to out of bounds memory access.

6) CVE-2025-26599: Use of uninitialized pointer in compRedirectWindow()

Introduced in: Xorg 6.8.0.
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/c1ff84be
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/b07192a8
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

The function compCheckRedirect() may fail if it cannot allocate the backing
pixmap. In that case, compRedirectWindow() will return a BadAlloc error
without the validation of the window tree marked just before, which leaves
the validate data partly initialized, and the use of an uninitialized pointer
later.

7) CVE-2025-26600: Use-after-free in PlayReleasedEvents()

Introduced in: X11R5
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/6e0f332b
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When a device is removed while still frozen, the events queued for that
device remain while the device itself is freed and replaying the events
will cause a use after free.

8) CVE-2025-26601: Use-after-free in SyncInitTrigger()

Introduced in: X11R6
Fixed in: xorg-server-21.1.16 and xwayland-24.1.6
Fix: https://gitlab.freedesktop.org/xorg/xserver/-/commit/16a1242d
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/f52cea2f
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/8cbc90c8
      https://gitlab.freedesktop.org/xorg/xserver/-/commit/c2857989
Found by: Jan-Niklas Sohn working with Trend Micro Zero Day Initiative

When changing an alarm, the values of the change mask are evaluated one
after the other, changing the trigger values as requested and eventually,
SyncInitTrigger() is called.
If one of the changes triggers an error, the function will return early,
not adding the new sync object.
This can be used to cause a use after free when the alarm eventually
triggers.

https://lists.x.org/archives/xorg-announce/2025-February/003584.html
https://lists.x.org/archives/xorg-announce/2025-February/003585.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 65be2c6ac0)
2025-04-07 15:33:04 +02:00
Yegor Yefremov
6b0e4d82c3 package/ncftp: bump to version 3.2.9
Remove upstreamed patches.

Autoreconf is broken. Hence, use the configure script directly.

Fixes:
https://autobuild.buildroot.org/results/60c3dbe02af354ff9820258ffd00eec088114d69/

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f8bc271115)
2025-04-07 15:33:03 +02:00
Julien Olivain
bc018bafdc support/testing: test_gstreamer1: fix test by using bootlin toolchain
Since Buildroot commit [1], the test_gstreamer1 runtime test is
failing to build the tesseract-ocr package. The root cause is that
the test uses the default arm external toolchain, which is the Linaro
ARM 2018.05 based on gcc 7.3.1.

Since [1], tesseract-orc no longer compiles with gcc 7 (it requires at
least gcc 8).

This commit fixes the issue by switching the toolchain to the
bootlin versions (based on gcc 14 at the time of this commit).

Also, changing the compiler version slightly slowed down the video
encoding. This commit also increases the encoding command timeout.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/9407846232

[1] f32da8b984

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 356c70677c)
2025-04-07 15:33:02 +02:00
Julien Olivain
333baf2f05 package/tesseract-ocr: needs gcc >= 8
Since Buildroot commit [1] tesseract-ocr fails to build with gcc 7,
with error:

    src/api/baseapi.cpp:67:10: fatal error: filesystem: No such file or directory
     #include <filesystem> // for std::filesystem
              ^~~~~~~~~~~~

In Buildroot, tesseract-ocr has a C++17 requirement captured as
gcc >= 7. Gcc 7 has only a partial and experimental C++17 support,
which was sufficient, prior [1].

The tesseract-ocr upstream commit [2] introduced a usage of
std::filesystem. This commit is included in version 5.5.0,
bumped in [1].

The C++17 with std::filesystem support was introduced in gcc 8.1.
See [3].

This commit fixes the issue by raising the gcc version requirement to
8.x.

Fixes: f32da8b984

[1] f32da8b984
[2] 4e42f9de54
[3] https://gcc.gnu.org/gcc-8/changes.html#libstdcxx

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
(cherry picked from commit 22ffdea9e6)
2025-04-07 15:33:01 +02:00
Julien Olivain
ba59edc803 support/testing: add git runtime test
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 24efb23a10)
2025-04-07 15:33:00 +02:00
Waldemar Brodkorb
9b24a8272b package/ruby: update to 3.4.2
See here for a changelog:
https://github.com/ruby/ruby/releases/tag/v3_4_2

This commit also update the LEGAL license hash:
8a86e52fb5

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: fix LEGAL license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 64b7774fc5)
2025-04-07 15:32:57 +02:00
Alex Bennée
d11ef1e7a4 support/testing: make time setting portable
The busybox date applet accepts the following:

  date @1234567

but this confuses the coreutils version which doesn't implicitly set
time. As some tests might need coreutils binaries we should ensure the
emulator login will work with both. Fix this by passing the -s (set)
option to the command.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bfb490799e)
2025-04-06 17:21:07 +02:00
Yann E. MORIN
ccbd64ef13 support/testing: set date in emulated machine
When time comes to check certificates, the date and time in the emulated
machine should be close enough to the actual values, so that certificate
validity can be checked.

Some Qemu machines have an RTC (e.g. arm vexpress-a9 has a pl031), and
the kernel needs a driver for those RTC. It is not guaranteed that the
machine used for a test meets those two conditions; in such a case, the
time in the machine starts way back in the past (1970-01-01T00:00:00Z on
sysv, or the release date of systemd). This is the case with the default
kernel, so such tests do not have the proper time.

Set the date to the date of the host system. This is going to be accurate
to the second, which is, by far, enough for our purpose.

To avoid having to consider what combination of emulated machine and kernel
configuration are being used, we always set the date, as this is a
generic step that should be done by the infra (like login in as root is).

The Emulator() class doesn't inherit from unittest.TestCase, so we can't
call any of the usual self.assertXXX() methods; instead, we just raise
a standard exception, like is done a few lines above to detect the login
prompt.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cf8641b73e)
2025-04-06 17:21:07 +02:00
Bernd Kuhls
e47a5d24b9 package/intel-mediadriver: bump version to 25.1.4
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4576a8d096)
2025-04-06 17:21:07 +02:00
Bernd Kuhls
21527b95eb package/intel-vpl-gpu-rt: bump version to 25.1.4
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ca417cea33)
2025-04-06 17:21:07 +02:00
Arnout Vandecappelle
f0a67991c0 docs/website: add current LTS sponsors
Add the LTS sponsors who engaged already for 2025: EVS, Open Home
Foundation, and Sense Labs. There is one more sponsor but they prefer to
remain anonymous.

For Open Home Foundation, we can reuse the existing logo. For the other
two, add their logo.

Add a new class panel-lts-sponsor for sizing the panels. It is different
from panel-sponsor because there doesn't need to be space for an
explanation of what type of sponsorship is done, we just need to have
space for the company name. So the minimum height is 200px instead of
350px.

Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b111e07fd5)
2025-04-06 17:21:07 +02:00
Arnout Vandecappelle
e66ca1741d docs/website/images/openhomefoundation-logo.png: crop for better layout
The Open Home Foundation logo is in a white area that is too large for
how we display it on the sponsors page. As a result, it ends up at the
bottom of the logo area and it looks very unbalanced.

Crop the logo to a tigher area. Since it is going to end up being
scaled, it's difficult to predict what the best size it is, but cropping
at a height of 300 pixels gives a visually pleasing layout at at least
some resolutions.

Signed-off-by: Arnout Vandecappelle <arnout@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e287bc7f44)
2025-04-06 17:21:07 +02:00
Maxim Kochetkov
5300d0736a package/libgeos: bump version to 3.13.1
Changelog: https://github.com/libgeos/geos/releases/tag/3.13.1

Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 76c588ed56)
2025-04-06 17:21:07 +02:00
Bernd Kuhls
936fda5040 package/tinyxml2: security bump version to 11.0.0
Release notes:
https://github.com/leethomason/tinyxml2/releases/tag/10.1.0
https://github.com/leethomason/tinyxml2/releases/tag/11.0.0

Fixes CVE-2024-50615: https://github.com/advisories/GHSA-884x-p7qm-gq3f

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4087461203)
2025-04-06 17:21:07 +02:00
Bernd Kuhls
9e8f32b159 package/mc: bump version to 4.8.33
Changelog: https://github.com/MidnightCommander/mc/blob/master/doc/NEWS

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9494da280d)
2025-04-06 17:21:07 +02:00
Fiona Klute (WIWA)
ca971b2810 package/mesa3d-demos: fix build failure on musl
Patch has been on upstream main for close to 2 years.

The "uint" use was introduced with [1] and [2], released with
mesa3d-demos 9.0.0 from March 2023, and added to Buildroot with commit
80304d9911 "package/mesa3d-demos: bump version to 9.0.0". The affected
code is built only if Wayland and Vulkan support are enabled, that is:

BR2_PACKAGE_LIBDECOR=y
BR2_PACKAGE_VULKAN_LOADER=y
BR2_PACKAGE_WAYLAND=y

[1] 813ebef767
[2] 5aaa7faeb4

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cf4f2f858d)
2025-04-06 17:21:06 +02:00
Fiona Klute (WIWA)
250336547c package/mesa3d-demos: depend on vulkan-loader if enabled
Vulkan support in mesa3d-demos requires vulkan-loader. Without an
explicit config flag it is autodetected, and may or may not be enabled
depending on build order, leading to unpredictable results.

Fix this by explicitly enabling Vulkan support and depending on
vulkan-loader if BR2_PACKAGE_VULKAN_LOADER=y, and disabling Vulkan
support otherwise.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7a55e82cb8)
2025-04-06 17:21:06 +02:00
Bernd Kuhls
0d0a58d687 package/tor: bump version to 0.4.8.15
Release notes:
https://gitlab.torproject.org/tpo/core/tor/-/raw/release-0.4.8/ReleaseNotes
https://forum.torproject.org/t/stable-release-0-4-8-15/17998

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f9a02e7b80)
2025-04-06 17:21:06 +02:00
Bernd Kuhls
d5e6d6594b package/kodi-pvr-waipu: bump version to 21.9.2-Omega
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd8a9eba01)
2025-04-06 17:21:06 +02:00
Flávio Tapajós
aebe29ce64 package/python-sqlalchemy: bump to version 2.0.39
For change log, see:
https://docs.sqlalchemy.org/en/20/changelog/changelog_20.html#change-2.0.39

Signed-off-by: Flávio Tapajós <flavio.tapajos@newtesc.com.br>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 12bdfa42e9)
2025-04-06 17:21:06 +02:00
James Hilliard
77ba1810f8 package/python-tortoise-orm: bump to version 0.24.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5c3df37dbd)
2025-04-06 17:21:06 +02:00
James Hilliard
6355ac3851 package/python-maturin: bump to version 1.8.3
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: rebase patch after merge of next branch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 76f9e5dede)
2025-04-06 17:21:06 +02:00
James Hilliard
e33639d6ac package/python-maturin: bump to version 1.8.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9c9a07668a)
2025-04-06 17:21:06 +02:00
James Hilliard
cfd6ac3d04 package/python-aiohttp: bump to version 3.11.14
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: rebase patch after merge of next branch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 03cda9370f)
2025-04-06 17:21:06 +02:00
James Hilliard
ae2ee09119 package/python-aiohttp: bump to version 3.11.12
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 02e41b516c)
2025-04-06 17:21:06 +02:00
James Hilliard
52ebdca76f package/python-aerich: bump to version 0.8.2
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5d35180b8a)
2025-04-06 17:21:06 +02:00
Niklas Cassel
7c3b82579a package/linux-tools: selftests: Add path containing BPF binary to _BIN_ARCH_EXCLUDE
Enabling BR2_PACKAGE_LINUX_TOOLS_SELFTESTS (on rock5b_defconfig,
which uses kernel 6.12 at the time of writing), results in:

make[1]: Leaving directory '/br/output/build/linux-endpoint-test/tools/testing/selftests'
ERROR: architecture for "/usr/lib/kselftests/tc-testing/action-ebpf" is "Linux BPF", should be "AArch64"
make: *** [package/pkg-generic.mk:402: /br/output/build/linux-tools/.stamp_installed] Error 1

To solve this, add /usr/lib/kselftests/tc-testing/ to
LINUX_TOOLS_BIN_ARCH_EXCLUDE.

Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a03cb2ad6)
2025-04-06 17:21:06 +02:00
Niklas Cassel
3404767ab3 package/linux-tools: perf: Fix _BIN_ARCH_EXCLUDE
support/scripts/check-bin-arch has an option -i to exclude a path
(or many paths by using -i multiple times).

This was implemented in commit 01d90f0d09 ("spport/check-bin-arch:
accept arbitrary per-package ignore paths").

Looking at this feature (which hasn't changed since being added),
we can see that check-bin-arch automatically adds a trailing slash
to all entries specified using -i.

Thus, specifying a path to a file, e.g.
"/usr/libexec/perf-core/tests/pe-file.exe" will cause check-bin-arch
to add "/usr/libexec/perf-core/tests/pe-file.exe/" to the IGNORES array.

When running the main loop, the file
"/usr/libexec/perf-core/tests/pe-file.exe" will thus not be ignored,
since it will not trigger a match the pattern that was added to the
IGNORES array ("/usr/libexec/perf-core/tests/pe-file.exe/").

This means that the -i option in check-bin-arch only supports directories
and not files.

Fix the LINUX_TOOLS_BIN_ARCH_EXCLUDE in
package/linux-tools/linux-tool-perf.mk.in to specify a directory, as the
existing LINUX_TOOLS_BIN_ARCH_EXCLUDE can never have actually worked.

Fixes: a7ad781626 ("package/linux-tools: Exclude checking PE binaries from perf test")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4d7292675a)
2025-04-06 17:21:06 +02:00
Bernd Kuhls
b25ad599d7 package/intel-vpl-gpu-rt: bump version to 25.1.3
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f786d9d3b8)
2025-04-06 17:21:06 +02:00
Bernd Kuhls
9be3caee67 package/intel-mediadriver: bump version to 25.1.3
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e9fc78d9fa)
2025-04-06 17:21:06 +02:00
Luca Ceresoli
8ea9c11a1a boot/xilinx-embeddedsw: fix menuconfig visualization
Due to how menuconfig works, a 'comment' entry following a 'config' entry
prevents correct indentation of items depending on the 'config'
entry. xilinx-embeddedsw currently shows as:

  [*] xilinx-embeddedsw
      *** xilinx-embeddedsw needs a bare metal toolchain for tuple microblazeel-xilinx-elf ***
  (xilinx_v2024.2) xilinx-embeddedsw version (NEW)
  [ ] versal plm (NEW)
  [ ] versal psmfw (NEW)
  [ ] zynqmp pmufw (NEW)
  [ ] xilinx-prebuilt

So the 'versal *' and 'zynqmp pmufw' items are not indented even though
they should be.

Do like most other Config.in files which have the 'comment' before the
'config' entry, makeing it render as expected:

      *** xilinx-embeddedsw needs a bare metal toolchain for tuple microblazeel-xilinx-elf ***
  [*] xilinx-embeddedsw
  (xilinx_v2024.2) xilinx-embeddedsw version (NEW)
  [ ]   versal plm (NEW)
  [ ]   versal psmfw (NEW)
  [ ]   zynqmp pmufw (NEW)
  [ ] xilinx-prebuilt

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 088808ccc7)
2025-04-06 17:21:06 +02:00
Sébastien Szymanski
e5600040ff support/kconfig: handle backspace (^H) key
This is in the mainline kernel since v5.1-rc3:
9c38f1f04408 ("kconfig/[mn]conf: handle backspace (^H) key")

Quoting the commit's log:

"
Backspace is not working on some terminal emulators which do not send the
key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127).
But currently only '^?' is handled. Let's also handle '^H' for those
terminals.
"

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d65c10c20a)
2025-04-06 17:21:06 +02:00
Colin Evrard
8c10983c40 package/libmodsecurity: security bump to 3.0.14
The project has been updated, including
security fixes to issues present in version 3.0.13.

- Fixes:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27110

- For a full changelog, visit:
  https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.14/CHANGES

Signed-off-by: Colin Evrard <colin.evrard@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29cf86b8d0)
2025-04-06 17:21:06 +02:00
Peter Korsgaard
aa2d7ca53f Update for 2025.02
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025.02
2025-03-17 18:54:20 +01:00
Yann E. MORIN
27ab880ebb package/libopenssl do not build in parallel
With highly parallel builds on a heavily loaded machine, the libopenssl
build often (about half of the time) fails with spurious missing rules
in its Makefile:

    >>> host-libopenssl 3.4.1 Installing to host directory
    [...] /usr/bin/make  -C [...]/build/host-libopenssl-3.4.1 install
    "/usr/bin/make" depend && "/usr/bin/make" _build_libs
    "/usr/bin/make" depend && "/usr/bin/make" _build_modules
    "/usr/bin/make" depend && "/usr/bin/make" _build_programs
    [...]
    make[3]: *** No rule to make target '_build_modules'.  Stop.
    make[2]: *** [Makefile:3159: build_modules] Error 2
    make[2]: *** Waiting for unfinished jobs....
    make[3]: Nothing to be done for '_build_programs'.
    make[3]: Nothing to be done for '_build_libs'.
    make[1]: *** [package/pkg-generic.mk:283: [...]/build/host-libopenssl-3.4.1/.stamp_host_installed] Error 2
    make[1]: *** Waiting for unfinished jobs....
    [...]
    make: *** [Makefile:23: _all] Error 2

Ideally, we'd like to fix the issue. However, the Nakefile is generated
by the Configure script, written in perl, from the template in
Configurations/unix-Makefile.tmpl, which also uses some kind of special
(perl-related, probably) templating language. That makes it pretty
difficult to see what is going on, though, and nigh impossible to fix
without a deep understanding of the openssl buildsystem.

So, we can only disable parallel builds until the issue is fixed
upstream [0]. Add a comment to both build commands (host and target) to
reference the upstream issue report.

Note that the issue has mostly been observed in the build of the host
variant so far, but there is no reason why it can't happen in the build
of the target variant.

[0] https://github.com/openssl/openssl/issues/27074

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-17 18:32:11 +01:00
Waldemar Brodkorb
dcd6bea6ae package/expat: security update to 2.7.0
Fixes CVE-2024-8176.

For more details, see:
https://blog.hartwork.org/posts/expat-2-7-0-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-17 18:23:29 +01:00
Peter Korsgaard
9679ddbcd0 package/rauc: needs libopenssl, not libressl
Fixes http://autobuild.buildroot.net/results/6efc1275d3aac9f0a4c000f3d0911b5a880e495d/

Rauc uses X509_PURPOSE_get_by_id() since rauc-1.3 with commit 375dbb16dd94
("src/signature: add support for codesigning certificate purpose"):

../src/signature.c: In function 'signature_init':
../src/signature.c:97:13: warning: implicit declaration of function 'X509_PURPOSE_get_by_id'; did you mean 'X509_PURPOSE_get_id'? [-Wimplicit-function-declaration]
   97 |         if (X509_PURPOSE_get_by_id(id) >= 0) {

Which is not provided by LibreSSL:

nm -D target/usr/lib/libcrypto.so | grep X509_PURPOSE_
00000000001377b0 T X509_PURPOSE_get0
0000000000137850 T X509_PURPOSE_get0_name
0000000000137860 T X509_PURPOSE_get0_sname
00000000001377d0 T X509_PURPOSE_get_by_sname
00000000001377a0 T X509_PURPOSE_get_count
0000000000137840 T X509_PURPOSE_get_id

So force the use of libopenssl.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 20:44:34 +01:00
Alex Bennée
fc690631ca package/fio: explicitly control libnfs dependency
The upstream uses pkg-config to detect and enable libnfs usage if it
is found [1]. This can get confused by the host configuration so at the
least we should disable detection if we are not planning to build with
it.

Note: the fio configure script accept both --enable-libnfs
and --disable-libnfs since upstream commit [2], first included
in fio v3.31. In Buildroot, this is supported since [3].

[1] https://github.com/axboe/fio/blob/fio-3.38/configure#L2360
[2] 98ab12629c
[3] 256395d8e5

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 20:58:04 +01:00
Bernd Kuhls
a79c862fa1 {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 19:15:42 +01:00
Brandon Lumbra
9f60aa973d package/rt-tests: fix build with glibc 2.41+
Since glibc bump to 2.41 in Buildroot commit [1], rt-tests is failing
to build with error:

    In file included from src/lib/rt-utils.c:28:
    src/include/rt-sched.h:45:8: error: redefinition of 'struct sched_attr'
       45 | struct sched_attr {
          |        ^~~~~~~~~~

glibc 2.41 adds sched_*attr, conflicting with rt-sched.h in the rt-tests
package. This commit resolves the conflict by applying a patch from
upstream which excludes the conflicting code when using glibc >= 2.41.

Fixes:
https://autobuild.buildroot.org/results/30308c74291004c328d6c3603ce68d600c5ef281/

[1] 6ecab31fad

Signed-off-by: Brandon Lumbra <brandon.lumbra@sense.com>
[Julien:
 - add extra info in commit log
 - add missing Signed-off-by line in commit log
 - add missing Signed-off-by in patch
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 19:01:50 +01:00
Bernd Kuhls
befd90b765 package/php: security bump version to 8.3.19
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_3

Release notes: https://news-web.php.net/php.announce/455
"(The 8.3.18 release was skipped due to the erroneous omission of a
non-security related patch.)"

Fixes CVE-2024-11235, CVE-2025-1219, CVE-2025-1736, CVE-2025-1861,
CVE-2025-1734, and CVE-2025-1217.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 18:47:25 +01:00
Peter Korsgaard
873407b46c docs/website/news.html: refer to gitlab bug tracker
We moved the issue tracking to gitlab some time ago.  Adjust the bug tracker
references in news.html to point to there instead of bugzilla for clarity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 11:40:10 +01:00
Peter Korsgaard
53f74f49c0 Update for 2025.02-rc2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025.02-rc2
2025-03-13 11:09:27 +01:00