Commit Graph

83531 Commits

Author SHA1 Message Date
Raphaël Mélotte
30173a8c58 package/qemu/Config.in.host: fix typo in comment dependency
The "host-qemu needs a host gcc >= 8" comment depends on
BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORT, missing the trailing "S"
of the actual symbol BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS,
defined a few lines above and used correctly everywhere else in
this file.

Because this typo'd symbol is never defined anywhere, it is always
considered false by Kconfig, so the comment's "depends on" clause
silently loses one of its two intended conditions.

Assisted-by: LLM
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 280e9755d5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:46:23 +02:00
Thomas Perale
849098d886 utils/checkpackagelib: check IGNORE_CVES identifiers match patch trailers
The ability to check with `make check-package` the 'IGNORE_CVES'
variable content reference an existing patches was added in commit [1].

This commit extend it to actually check that the entries that are
referenced in the 'IGNORE_CVES' variable are matching the trailers in
the referenced patch.

With this change the following `foo.mk` content:

```
FOO_IGNORE_CVES += CVE-2000-1234
```

Running `make check-package` will output an error if the content of the
patch is the following:

```
CVE: CVE-2001-1234
```

[1] b00ac4e346 utils/checkpackagelib: add new check MissingCVEPatch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: adapt to the trailers to using regex]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 40abc660d4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:46:17 +02:00
Thomas Perale
7205564777 utils/checkpackagelib: support other identifiers than CVE
Currently the MissingCVEPatch check will complain if another
identifiers than a CVE-YYYY-XXXX is passed after the 'CVE: '
trailer in the patch header introduced in [1].

If a package 'foo' defines the following:

FOO_IGNORE_CVES += GHSA-abcd-1234-efgh

And correctly references it in a patch header:

CVE: GHSA-abcd-1234-efgh

check-package will report the following:

package/foo/foo.mk: patch file '0001-some-patch.patch' is missing 'CVE:' tag

While we could argue that GHSA identifier should not be present in the
'IGNORE_CVES' variable, it's still valuable for users to have a way to
correctly ignore and link a patch for their vulnerability report.

From our point of view it allows us to track GHSA vulnerabilities that
could later be assigned a CVE so we can update the IGNORE_CVES variable.

This commit relaxes the constraint on the 'CVE' trailer to just check
for the presence of any identifier. We still only allow alphanumerical
characters and dashes, to be sure that any tooling that uses the
identifiers won't break.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
 - keep the regex but allow any alphanumerical string;
 - add a test that FOO:123 doesn't match]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 552bf40db1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:46:10 +02:00
Thomas Perale
949aebfaa6 utils/checkpackagelib: remove unused variable
The `self.pending_patch` is set but unused.

Fixes: b00ac4e346 utils/checkpackagelib: add new check MissingCVEPatch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 3ac595bdd1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:46:05 +02:00
Thomas Petazzoni
a682d7e1aa package/flutter-engine: don't write into $HOME
gclient.py tries to not only read from $HOME/.config, but actually
create some directories/files in there. As $HOME can be inaccessible,
let's override XDG_CONFIG_HOME to tell the depot-tools code to write
its stuff into $(@D)/dl-tmp instead (which we already use as a scratch
directory in this package).

Fixes:

>>> flutter-engine 3.29.2 Downloading
/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient.py:3367: SyntaxWarning: invalid escape sequence '\s'
  dot_git_pattern = re.compile('^(\s*)url(\s*)=.*\.git$')
/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient_scm.py:436: SyntaxWarning: invalid escape sequence '\.'
  tokens = re.search('//(.+).googlesource.com/(.+?)(?:\.git)?$',
Traceback (most recent call last):
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/home/br-user/.config/depot_tools'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient.py", line 108, in <module>
    import gclient_scm
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient_scm.py", line 23, in <module>
    import gerrit_util
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gerrit_util.py", line 42, in <module>
    import metrics
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/metrics.py", line 23, in <module>
    CONFIG_FILE = utils.depot_tools_config_path('metrics.cfg')
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/utils.py", line 48, in depot_tools_config_path
    pathlib.Path(config_dir).mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 726, in mkdir
    self.parent.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/home/br-user/.config'
make[1]: *** [package/pkg-generic.mk:181: /home/thomas/buildroot/br/output-all/build/flutter-engine-3.29.2/.stamp_downloaded] Error 1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2a69b8c7ed)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:45:59 +02:00
Thomas Petazzoni
682dac6c38 support/docker/Dockerfile: make $HOME folder read-only
The $HOME folder of the br-user inside the container is currently
read-write for the br-user. However, practically speaking, it is only
read-write when the UID of the user running the container from the
host machine is 1000, equal to the UID of the br-user inside the
container. For any other UID on the host machine, the $HOME folder is
in fact already read-only.

Because we do not expect Buildroot to write into $HOME, and in order
to have a consistent behavior regardless of the UID of the user on the
host machine, we change our Docker image to make the $HOME folder of
the br-user entirely non-writable.

Suggested-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fac6d92a27)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:45:53 +02:00
Neal Frager
576f2979fe package/gcc: add microblaze frame unwinding fix to v15 and v16
Add microblaze signal-frame unwinding fix back port to gcc 15.3.0 and 16.2.0.

Upstream: https://gcc.gnu.org/cgit/gcc/commit/?id=4ef64ad1aa9bbbe9471610e2de6ef0c8afed8b1f

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 56992f7825)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:45:46 +02:00
Raphaël Mélotte
836392d641 package/util-linux: adding cfdisk enablement comment
This commit introduces a menu comment to users to indicate whether the
`cfdisk` can be built, even when the basic set binaries option is
enabled.

For users wishing to support `fdisks` utilities (cfdisk, fdisk and
sfdisk) in Buildroot, these utilities are enabled through a
`BR2_PACKAGE_UTIL_LINUX_BINARIES` option. This option configures
`all-programs`, which will default enable `fdisks` (along with other
program options that do not have an explicit configuration). While a
user can enable "all programs", there is no guarantee that the
`cfdisk` utility will be built if ncurses is not enabled. Even if an
explicit Buildroot menu option is added for `cfdisk` (where we can
force select ncurses), there is no specific configuration option in
util-linux to toggle the enablement of `cfdisk`.

(alternative to commit f7019acad2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:41:10 +02:00
Stephan Henningsen
3422727b3d package/util-linux: fix mount helper lookup path
When using /bin/mount to mount filesystems that are not supported
directly by the kernel, it delegates the mount operatin to helper
programs, e.g. mount.fuse.sshfs.  Normally /bin/mount searches
these directories in order for a helper: /sbin, /sbin/fs.d, /sbin/fs.

In reality, Buildroot installs e.g. mount.fuse.sshfs into /usr/sbin,
and as a result /bin/mount fails to mount sshfs entries defined in
/etc/fstab.

The patch changes the default search path at configuration.

Signed-off-by: Stephan Henningsen <stephan@asklandd.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 725cea53c7)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:38 +02:00
Bernd Kuhls
19cb3b1e50 package/util-linux: fix non-MMU build
Buildroot commit 31af509b4f bumped the
package from 2.40.2 to 2.41.1. This bump includes upstream commit
a3f1255f18
which was added to version 2.41 and includes the usage of
pthread_atfork() causing build errors on non-MMU platforms:

libuuid/src/gen_uuid.c: In function 'uuid_generate_time_generic':
libuuid/src/gen_uuid.c:629:17: error: implicit declaration of function
 'pthread_atfork'; did you mean 'pthread_join'?
 [-Wimplicit-function-declaration]
  629 |                 pthread_atfork(NULL, NULL, reset_uuidd_cache);

The oldest build error of this kind can be found on the 2025.11.x
branch with version 2.41.1:
https://autobuild.buildroot.net/results/87c/87c74435be14956fd45f730269eac102e70d56da/

The issue occurs because uClibc-ng is not very consistent with its
pthread_atfork() definition: it doesn't provide a prototype for it on
!MMU platforms (causing the build failure), but it does provide a stub
implementation (causing the configure script to believe pthread_atfork
is available). This issue was reported to upstream uClibc-ng at
https://mailman.openadk.org/mailman3/hyperkitty/list/devel@uclibc-ng.org/thread/WEA7IQC3YAWTSFDHCLYRQJZTC4IUIY7J/.

A backport of this patch to the LTS branches should be considered, but
probably not 2025.02.x as it uses version 2.40.x.

Fixes:
https://autobuild.buildroot.org/results/a21e81e64eccc866b575a4f3b1376c50f2ffd837/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d42fa91227)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:34 +02:00
Thomas Perale
deb11f1c6d testing/tests/utils/test_generate_cyclonedx.py: test vuln with different analysis
Add test for CycloneDX vulnerability generation.

If multiple packages ignore the same vulnerability but provide different
analyses, the generator must produce multiple vulnerability entries with
the same vulnerability ID but different analysis information.

This situation can occur when generating a CycloneDX SBOM from the
output of 'make show-info-all'. The resulting SBOM includes packages
that exist in multiple versions within Buildroot (gnupg for instance).

In such a case, one package version may ignore a vulnerability because
it is not affected, while another package version may address it through
a patch.

Therefore, multiple vulnerability entries must be generated, each with
its own analysis and reference information.

This adds a test case for this scenario.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: give next() a None default to return None instead of raise
 StopIteration]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 03e9ac7d9c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:32 +02:00
Thomas Perale
d3ad19688d utils/generate-cyclonedx: split vulnerabilities per state
If a vulnerability is present in multiple components and only one of
them has a patch that addresses that vulnerability, all components will
currently have that vulnerability marked as `resolved_with_pedigree`.

Right now, this issue does not affect any packages, but in the future it
might affect packages that provide multiple version options (e.g.
gnupg and gnupg2).

There is a small chance this happens in a real-world use case, but it
may occur in the context of maintenance when running
`make show-info-all`.

This commit changes how vulnerabilities fixed by a patch are stored.
Instead of placing all vulnerabilities into a single set, it now keeps an
index of the component for which the patch has been applied.

When generating the vulnerability list, the component reference is
checked instead of only the vulnerability ID. If a vulnerability ID has
multiple states for different references, multiple vulnerability
entries are created with distinct analyses.

Consider the hypothetical case where gnupg ignores a vulnerability
because it was introduced in a later version, while gnupg2 has patched
that vulnerability. This would result in the following JSON:

```json
[
    {
        "id": "CVE-1234-1234",
        "analysis": {
            "state": "in_triage",
            "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
        },
        "affects": [
            {"ref": "gnupg"}
        ]
    },
    {
        "id": "CVE-1234-1234",
        "analysis": {
            "state": "resolved_with_pedigree",
            "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
        },
        "affects": [
            {"ref": "gnupg2"}
        ]
    }
]
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
 - update the VULN_WITH_PEDIGREE comment to match the code
 - use set() as default instead of {}]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 345c8ffc96)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:27 +02:00
Thomas Perale
5e2d464641 utils/generate-cyclonedx: support for v1.7, 1.7.1
See changes:

- https://cyclonedx.org/news/cyclonedx-v1.7-released/
- https://github.com/CycloneDX/specification/releases/tag/1.7
- https://github.com/CycloneDX/specification/releases/tag/1.7.1

Since some tools like DependencyTrack don't support CycloneDX SBOM v1.7
this bump is optional and default remains v1.6.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6e77b6ff69)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:22 +02:00
Thomas Perale
1054e4fc0e utils/generate-cyclonedx: support custom schema version
Support using minor revision for CycloneDX 1.6 by passing the version
from the command line. Currently supported:

- 1.6
- 1.6.1 [1]
- 1.6.2 (default) [2]

This is used to fetch the latest SPDX license list available upstream.

[1] https://github.com/CycloneDX/specification/releases/tag/1.6.1
[2] https://github.com/CycloneDX/specification/releases/tag/1.6.2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: also rename the SPDX schema in the test]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 504bb61bc6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:19 +02:00
Thomas Perale
26330fc155 utils/generate-cyclonedx: move license download in a function
Move the code that retrieves the SPDX licenses into a function instead of
doing it top-level.

This allows to pass the CycloneDX version as a function argument instead
of defining it as a top-level constant.
The next commit introduces support for different CycloneDX spec versions.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4ba8e2869b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:15 +02:00
Thomas Perale
99ad4d7059 utils/generate-cyclonedx: mark host packages as excluded
Mark Buildroot's host packages as 'excluded' with the scope
property [1]. The excluded scope is defined like the following:

> Components that are excluded provide the ability to document component
> usage for test and other non-runtime purposes. Excluded components are
> not reachable within a call graph at runtime.

This fits the usage of 'host' packages : a package without a runtime
purpose.

See the mailing list discussion around this property [2][3][4][5]

[1] https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_scope
[2] https://lore.kernel.org/r/<de0bb761-ca88-4bc6-8d7b-6bd14e9d1cbe@cherry.de>
[3] https://lore.kernel.org/r/<20260409204208.302842-1-thomas.perale@mind.be>
[4] https://lore.kernel.org/r/<bd0f43c9-ebdc-4717-b8d4-783ec712bed2@cherry.de>
[5] https://lore.kernel.org/r/<176c5c42-50bc-4b39-a7b3-845b085f010e@rnout.be>

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit d8d02d28fb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:09 +02:00
Thomas Perale
26723c2fd1 utils/generate-cyclonedx: add "id" property to resolves
The CycloneDX spec defines the "components.pedigree.patches.resolves"
object [1] as supporting both a "name" & "id" property.

The definition provided for the "id" property is the following [2]:

> The identifier of the issue assigned by the source of the issue

And for the "name" property [3]:

> The name of the issue

The "resolves" object was introduced in commit [4] and only used the
"name" property to link to the vulnerability it resolves.

In example [5] provided on the CycloneDX website, both the "name" & "id"
properties are set in the security example.

In the vulnerability context, and more precisely the CVEs, the "name"
and the "id" are the same and thus the value can be duplicated across
the two properties.

This commit replicates the behavior documented in [5] to improve
compatibility with tools.

[1] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves
[2] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_id
[3] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_name
[4] 9415529923 utils/generate-cyclonedx: add support for 'resolved_with_pedigree'
[5] https://cyclonedx.org/use-cases/pedigree/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 074e650219)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:06 +02:00
Thomas Perale
d2e9e37a39 utils/generate-cyclonedx: make urllib.error import explicit
Commit [1] introduced a code block that references
'urllib.error.URLError'. There is no explicit import of 'urllib.error'.
While this is not an issue in practice, ruff complains that the import
is not explicit.

[1] 17c9deb115 utils/generate-cyclonedx: hint at missing Buildroot host package on a specific error

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit f680fe2a61)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:15:02 +02:00
Thomas Perale
db245058c1 testing/tests/utils/test_generate_cyclonedx.py: test scp-style git sites
The commit [1] fixed a formatting bug with the SCP style git sites
declaration.

Add this style of link to the test case to keep a track of it.

[1] ebcfdb8b0a utils/generate-cyclonedx: fixup scp-style git sites

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 072ed8e5d6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:58 +02:00
Alexander Shirokov
941072daed package/nnn: add BR2_TOOLCHAIN_HAS_THREADS dependency
nnn links against pthread. Specify the dependency to avoid
unexpected build failures on toolchains lacking thread support (e.g.
br-arm-full-nothread).

Fixes:

  https://autobuild.buildroot.net/results/5cd2b7a288a1681068448de6715e731580908206/

Fixes: 7856e41685 ("package/nnn: new package")
Signed-off-by: Alexander Shirokov <shirokovalexs@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1b8cd6665b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:52 +02:00
Yegor Yefremov
500860e2f0 package/iproute2: fix build failure due to missing BR2_PACKAGE_LIBTIRPC_RPCDB
iproute2's configure script enables HAVE_RPC as soon as libtirpc is
found, and misc/ss.c then calls getrpcbynumber() from its RPC service
resolver. Since the bump of libtirpc to version 1.3.7 in Buildroot
commit 3f3d6e43de, which includes upstream
commit:
https://git.linux-nfs.org/?p=steved/libtirpc.git;a=commit;h=7cea8ad66aecc21e6caae330b5d31075af399193
that symbol is only exported when libtirpc is configured with
--enable-rpcdb. On non-glibc toolchains there is no libc fallback
either, so linking ss fails:

  ld: ss.o: in function `init_service_resolver':
  ss.c:(.text+0x2558): undefined reference to `getrpcbynumber'

Select BR2_PACKAGE_LIBTIRPC_RPCDB when libtirpc is enabled, like lsof
and other users of these functions already do.

Fixes:
https://autobuild.buildroot.org/results/390b7ed00da20c2349fe069ade4a65404834a484/

Fixes: 3f3d6e43de ("package/libtirpc: bump to version 1.3.7")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fc23067ac6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:50 +02:00
Yegor Yefremov
a6a37ba0db package/iproute2: add optional dependency on libtirpc
iproute2's configure script probes for libtirpc through pkg-config and,
when found, enables HAVE_RPC and links ss against it. libtirpc was never
listed in IPROUTE2_DEPENDENCIES though, so whether the feature ends up
enabled depended on whether libtirpc happened to be built before
iproute2.

Add the missing optional dependency to make the build reproducible.

iproute2's configure script checks for libtirpc availability since
v5.18.0 of iproute2, which Buildroot started using in commit
10990c576b ("package/iproute2: bump version to 5.18.0")

Fixes: 10990c576b ("package/iproute2: bump version to 5.18.0")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2b9d1a8aa6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:48 +02:00
Bernd Kuhls
3ac0f22f90 package/cpp-httplib: link with libatomic if needed
Buildroot commit 8dad17ea06 bumped the
package from 0.27.0 to 0.37.2. This bump includes upstream commit
464867a9ce
which added WebSocket support to version 0.33.0 and causes a build error
detected by the Gitlab pipelines for bootlin-sparc-uclibc:

/builds/bkuhls/buildroot/br-test-pkg/bootlin-sparc-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
 /tmp/cciyXsAR.ltrans6.ltrans.o: in function
 `httplib::ws::WebSocket::close(httplib::ws::CloseStatus,
 std::__cxx11::basic_string<char, std::char_traits<char>,
 std::allocator<char> > const&)':
<artificial>:(.text+0x6408): undefined reference to `__atomic_exchange_1'

To fix the problem we add -latomic to LDFLAGS when needed.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit eedb2067d8)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:44 +02:00
Julien Olivain
dce16261bd boot/edk2/Config.in: remove empty line to fix check-package error
Buildroot commit [1] introduced the check-package error:

   boot/edk2/Config.in:19: line contains trailing whitespace

This commit fixes the issue by removing those extra spaces.

[1] ea0f27d64f

Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9054c08eb6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:41 +02:00
Raphaël Mélotte
b18021117a package/wmenu: switch to Git download
Codeberg has changed the way it generate hashes for at least some of
the generated tarballs (see [1]). Since we cannot update the hash
without changing the file name, we switch to Git download in order to
have a different file name.

[1]: https://codeberg.org/Codeberg/Community/issues/2861

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 39fdbe5bfe)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:14:35 +02:00
Raphaël Mélotte
ee301c0b16 package/gumbo-parser: switch to Git download
Codeberg has changed the way it generate hashes for at least some of
the generated tarballs (see [1]). Since we cannot update the hash
without changing the file name, we switch to Git download in order to
have a different file name.

[1]: https://codeberg.org/Codeberg/Community/issues/2861

Fixes:

  https://autobuild.buildroot.net/results/7e4e5d6f1ba4222306cd88944b39a75c730db771/

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bde76bfe85)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 15:12:37 +02:00
Yegor Yefremov
66eaacb941 package/atop: fix musl build
Since the bump to version 2.13.0 in Buildroot commit [1],
atop fails to build with musl:

drawbar.c:2336:33: error: implicit declaration of function 'waddwstr'; did you mean 'waddstr'? [-Wimplicit-function-declaration]

(Before 2.13.0, the same configurations already failed earlier on
uClibc because _POSIX_C_SOURCE was defined without a value. Upstream
fixed that in 2.13.0 by giving it an explicit value, but the same
pattern remains for _XOPEN_SOURCE.)

ncurses only declares its wide-character API, including waddwstr(),
when NCURSES_WIDECHAR is set. If the application does not set it,
curses.h derives it from the feature test macros:

  #if defined(_XOPEN_SOURCE_EXTENDED) || \
      (defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE - 0 >= 500))

drawbar.c defines _XOPEN_SOURCE with an empty value, which makes the
check evaluate as 0 >= 500 and fail.

This only breaks with musl because of the C library's <features.h>,
which curses.h pulls in through <stdio.h> before doing the check.
glibc and uClibc both redefine _XOPEN_SOURCE to 700 and define
_XOPEN_SOURCE_EXTENDED whenever _GNU_SOURCE is set, which drawbar.c
does, so the empty definition gets fixed up. musl never modifies the
application's feature test macros, so the empty value reaches
curses.h and the wide-character prototypes are left out.

Add a patch that defines _XOPEN_SOURCE as 700, matching the
_POSIX_C_SOURCE value of 200809L that is already used.

Fixes:
 - https://autobuild.buildroot.org/results/914c1d8fa0fc8bbef64e4a64d58e5941d0077a3e
 - https://autobuild.buildroot.org/results/b91ea0722202de0d1fdeeaeea167fd1b21b6d5d6

[1] 2110131cab

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Tested-By: Thomas Perale <thomas.perale@mind.be>
[Julien: add link to Buildroot commit introducing the issue]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99909a8a95)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:19 +02:00
Cherniaev Andrei
7baaf34fa5 boot/edk2: extend help text
Signed-off-by: Cherniaev Andrei <dungeonlords789@naver.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ea0f27d64f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:17 +02:00
Peter Korsgaard
4ff6a490e3 package/pkg-generic.mk: drop PKGDIR variable for {, actual-}source step
This was added in commit 2d4fd5d358 ("pkg-infra: also set PKGDIR for the
download step") for the DOWNLOAD macro, which was reworked in commit
155f752d8a ("core/download: do not hard-code the path to the package hash
file") to instead use <FOO>_HASH_FILE, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f454580f0f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:11 +02:00
Peter Korsgaard
d4da32b15c package/pkg-generic.mk: drop PKGDIR variable for patch step
This was added in commit 604d261fb0 ("infra: remove variable
FOO_DIR_PREFIX") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_PKGDIR, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5c668c42e2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:08 +02:00
Peter Korsgaard
c82b49c285 package/pkg-generic.mk: drop RAWNAME variable
This was added in commit 7a41cbf938 ("package: fix patching procedure for
host packages") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_RAWNAME, so drop it.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ade0757d7f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:04 +02:00
Yegor Yefremov
0b98157406 package/haveged: needs threads
Since the bump to version 1.9.15 in commit
2a28d25d0c ("package/haveged: bump to version 1.9.15"), haveged
unconditionally includes <semaphore.h> and uses named semaphores
(sem_open() and friends) to synchronize command instances. As a
result, the build fails with toolchains without threads support:

haveged.c:37:10: fatal error: semaphore.h: No such file or directory

Add a dependency on BR2_TOOLCHAIN_HAS_THREADS. Since threads are now
always available, unconditionally pass --enable-threads.

Fixes:
  https://autobuild.buildroot.org/results/814cb7b5537d8b7b2c23f3d90e37b2b41de7ee3f

Fixes: 2a28d25d0c ("package/haveged: bump to version 1.9.15")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cec5f7af80)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:36:00 +02:00
Sebastien Guillaume
af0cac3258 package/x11r7/xkeyboard-config: add CPE
The resulting CPE ID is:

cpe:2.3:a:xkeyboard_config_project:xkeyboard-config:2.38:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2012-0064

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6a625034ca)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:56 +02:00
Sebastien Guillaume
30122f7a12 package/seatd: add CPE
The resulting CPE ID is:

cpe:2.3:a:seatd_project:seatd:0.9.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2021-41387

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 763dcabf6d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:52 +02:00
Sebastien Guillaume
83eaa5f8b6 package/qt6/qt6svg: add CPE
The resulting CPE ID is:

cpe:2.3:a:qt:qtsvg:6.11.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2021-45930

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 6d335ea39f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:48 +02:00
Sebastien Guillaume
8ad5be182c package/qt6/qt6declarative: add CPE
The resulting CPE ID is:

cpe:2.3:a:qt:qtdeclarative:6.11.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2025-14576

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ef0f032677)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:45 +02:00
Sebastien Guillaume
1cde8415af package/patchelf: add CPE
The resulting CPE ID is:

cpe:2.3:a:patchelf_project:patchelf:0.13:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2022-44940

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit ee8a99137d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:40 +02:00
Sebastien Guillaume
48a296c33c package/nano: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:nano:9.2:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2026-6843

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a07499c8f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:36 +02:00
Sebastien Guillaume
fde871cb3a package/m4: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:m4:1.4.21:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2008-1687

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 7fa4b3c8b4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:35:32 +02:00
Sebastien Guillaume
43bcd4d4de package/kbd: add CPE
The resulting CPE ID is:

cpe:2.3:a:kbd-project:kbd:2.10.0:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2011-0460

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 93df82900d)
[raphael: resolve conflict]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:34:01 +02:00
Raphaël Mélotte
e20d53bb75 package/kbd: reorder .mk variables
We usually put the metadata variables at the beginning of the file and
the variables related to how to build it (like _CONF_OPTS) later.  Apply
this principle.

(alternative to commit 35dc65563d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:30:16 +02:00
Sebastien Guillaume
06485a7867 package/htop: add CPE
The resulting CPE ID is:

cpe:2.3:a:htop:htop:3.5.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2008-5076

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 444d769c0a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:12:14 +02:00
Sebastien Guillaume
d4acf5377e package/gcc/gcc-initial: add CPE
gcc-final already had a CPE.

The resulting CPE ID is:

cpe:2.3:a:gnu:gcc:15.3.0:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2019-15847

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 32d08d1945)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:12:08 +02:00
Sebastien Guillaume
736e6bb469 package/gawk: add CPE
The resulting CPE ID is:

cpe:2.3:a:gnu:gawk:5.4.1:-:*:*:*:*:*:*

The vendor and product are valid, see e.g.
https://nvd.nist.gov/vuln/detail/CVE-2023-4156

Signed-off-by: Sebastien Guillaume <sebastien.guillaume@vendeeconcept.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2ee591714d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:59 +02:00
Yegor Yefremov
265e33686b package/pkg-autotools.mk: also handle libtool 2.6.x
Fixes:
https://autobuild.buildroot.org/results/e6159cee14f84569c85a61f77824b2b58d68a4bc/

Libtool 2.6.x is starting to be used by upstreams when generating
release tarballs (e.g. cryptsetup-2.8.8). As LIBTOOL_PATCH_HOOK does
not know about it, ltmain.sh is left unpatched, so libtool relinks
libraries at install time and adds -L/usr/lib, which is rejected by
the toolchain wrapper:

i686-buildroot-linux-gnu-gcc: ERROR: unsafe header/library path used in cross-compilation: '-L/usr/lib'

The v2.4.4 patch no longer applies cleanly, so add a v2.6 variant,
rebased on libtool 2.6.2, and use it for 2.6.x versions.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5dbba2616f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:55 +02:00
Thomas Petazzoni
23e6fb3ef2 package/sqlitecpp: fixup Config.in comment
Commit 8b651fd817 added a dependency on
gcc >= 4.9 and as part of that updated the Config.in comment to
mention C++11 instead of C++. This is not consistent with Buildroot
convention, where we only mention C++, and separately the GCC version
requirement. This commit aligns the Config.in comment with the
Buildroot convention.

Fixes: 8b651fd817 ("package/sqlitecpp: require C++11")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c12e9327c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:51 +02:00
Michael Nosthoff
a049d34e64 package/sqlitecpp: needs threads
SQLiteCpp has an unconditional dependency on threads.

fixes:
br-test-pkg/br-arm-full-nothread
https://gitlab.com/heinemml/buildroot/-/jobs/16865965420

The problem exists since the package was added in Buildroot.

Fixes: e74059b39c ("package/sqlitecpp: new package")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ce4fc125fb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:47 +02:00
Michael Nosthoff
aab81c2f63 package/sqlitecpp: disable stack protection
SQLiteCpp has an internal setting for stack protection which defaults
to "on". Since Buildroot handles stack protection itself this is not
needed and more importantly it causes problems as the option enables
stack protection support even when the toolchain doesn't support it,
as can be reproduced using the following defconfig:

BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_I686_MUSL_BLEEDING_EDGE=y
BR2_PACKAGE_SQLITECPP=y

Fixes:
br-test-pkg/bootlin-x86-i686-musl
https://gitlab.com/heinemml/buildroot/-/jobs/16865965418

Oddly enough, there are no autobuilder failures recorded for this
issue.

Fixes: e74059b39c ("package/sqlitecpp: new package")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 39235638d1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:43 +02:00
Michael Nosthoff
9d96d396ec support/testing: sqlitecpp: new runtime test
build and run an SQLiteCpp example to check database writes and queries.

Assisted-by: GitHub Copilot:GPT-6 Sol
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 93c6c91955)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:39 +02:00
Thomas Petazzoni
95f448c511 utils/docker-run: add NO_NETWORK variable
It is sometimes useful to be able to do an offline build, to make sure
the build works properly without network access, so this commit adds a
NO_NETWORK environment variable to our docker-run script, which for
example allows to do:

$ ./utils/docker-run make source
$ NO_NETWORK=1 ./utils/docker-run make

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d6f816facc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
2026-10-15 14:11:34 +02:00