When using /bin/mount to mount filesystems that are not supported
directly by the kernel, it delegates the mount operatin to helper
programs, e.g. mount.fuse.sshfs. Normally /bin/mount searches
these directories in order for a helper: /sbin, /sbin/fs.d, /sbin/fs.
In reality, Buildroot installs e.g. mount.fuse.sshfs into /usr/sbin,
and as a result /bin/mount fails to mount sshfs entries defined in
/etc/fstab.
The patch changes the default search path at configuration.
Signed-off-by: Stephan Henningsen <stephan@asklandd.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 725cea53c7)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit 31af509b4f bumped the
package from 2.40.2 to 2.41.1. This bump includes upstream commit
a3f1255f18
which was added to version 2.41 and includes the usage of
pthread_atfork() causing build errors on non-MMU platforms:
libuuid/src/gen_uuid.c: In function 'uuid_generate_time_generic':
libuuid/src/gen_uuid.c:629:17: error: implicit declaration of function
'pthread_atfork'; did you mean 'pthread_join'?
[-Wimplicit-function-declaration]
629 | pthread_atfork(NULL, NULL, reset_uuidd_cache);
The oldest build error of this kind can be found on the 2025.11.x
branch with version 2.41.1:
https://autobuild.buildroot.net/results/87c/87c74435be14956fd45f730269eac102e70d56da/
The issue occurs because uClibc-ng is not very consistent with its
pthread_atfork() definition: it doesn't provide a prototype for it on
!MMU platforms (causing the build failure), but it does provide a stub
implementation (causing the configure script to believe pthread_atfork
is available). This issue was reported to upstream uClibc-ng at
https://mailman.openadk.org/mailman3/hyperkitty/list/devel@uclibc-ng.org/thread/WEA7IQC3YAWTSFDHCLYRQJZTC4IUIY7J/.
A backport of this patch to the LTS branches should be considered, but
probably not 2025.02.x as it uses version 2.40.x.
Fixes:
https://autobuild.buildroot.org/results/a21e81e64eccc866b575a4f3b1376c50f2ffd837/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d42fa91227)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Add test for CycloneDX vulnerability generation.
If multiple packages ignore the same vulnerability but provide different
analyses, the generator must produce multiple vulnerability entries with
the same vulnerability ID but different analysis information.
This situation can occur when generating a CycloneDX SBOM from the
output of 'make show-info-all'. The resulting SBOM includes packages
that exist in multiple versions within Buildroot (gnupg for instance).
In such a case, one package version may ignore a vulnerability because
it is not affected, while another package version may address it through
a patch.
Therefore, multiple vulnerability entries must be generated, each with
its own analysis and reference information.
This adds a test case for this scenario.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: give next() a None default to return None instead of raise
StopIteration]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 03e9ac7d9c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
If a vulnerability is present in multiple components and only one of
them has a patch that addresses that vulnerability, all components will
currently have that vulnerability marked as `resolved_with_pedigree`.
Right now, this issue does not affect any packages, but in the future it
might affect packages that provide multiple version options (e.g.
gnupg and gnupg2).
There is a small chance this happens in a real-world use case, but it
may occur in the context of maintenance when running
`make show-info-all`.
This commit changes how vulnerabilities fixed by a patch are stored.
Instead of placing all vulnerabilities into a single set, it now keeps an
index of the component for which the patch has been applied.
When generating the vulnerability list, the component reference is
checked instead of only the vulnerability ID. If a vulnerability ID has
multiple states for different references, multiple vulnerability
entries are created with distinct analyses.
Consider the hypothetical case where gnupg ignores a vulnerability
because it was introduced in a later version, while gnupg2 has patched
that vulnerability. This would result in the following JSON:
```json
[
{
"id": "CVE-1234-1234",
"analysis": {
"state": "in_triage",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg"}
]
},
{
"id": "CVE-1234-1234",
"analysis": {
"state": "resolved_with_pedigree",
"detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
},
"affects": [
{"ref": "gnupg2"}
]
}
]
```
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
- update the VULN_WITH_PEDIGREE comment to match the code
- use set() as default instead of {}]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 345c8ffc96)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Move the code that retrieves the SPDX licenses into a function instead of
doing it top-level.
This allows to pass the CycloneDX version as a function argument instead
of defining it as a top-level constant.
The next commit introduces support for different CycloneDX spec versions.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 4ba8e2869b)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Commit [1] introduced a code block that references
'urllib.error.URLError'. There is no explicit import of 'urllib.error'.
While this is not an issue in practice, ruff complains that the import
is not explicit.
[1] 17c9deb115 utils/generate-cyclonedx: hint at missing Buildroot host package on a specific error
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit f680fe2a61)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The commit [1] fixed a formatting bug with the SCP style git sites
declaration.
Add this style of link to the test case to keep a track of it.
[1] ebcfdb8b0a utils/generate-cyclonedx: fixup scp-style git sites
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 072ed8e5d6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
iproute2's configure script probes for libtirpc through pkg-config and,
when found, enables HAVE_RPC and links ss against it. libtirpc was never
listed in IPROUTE2_DEPENDENCIES though, so whether the feature ends up
enabled depended on whether libtirpc happened to be built before
iproute2.
Add the missing optional dependency to make the build reproducible.
iproute2's configure script checks for libtirpc availability since
v5.18.0 of iproute2, which Buildroot started using in commit
10990c576b ("package/iproute2: bump version to 5.18.0")
Fixes: 10990c576b ("package/iproute2: bump version to 5.18.0")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2b9d1a8aa6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit 8dad17ea06 bumped the
package from 0.27.0 to 0.37.2. This bump includes upstream commit
464867a9ce
which added WebSocket support to version 0.33.0 and causes a build error
detected by the Gitlab pipelines for bootlin-sparc-uclibc:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-sparc-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
/tmp/cciyXsAR.ltrans6.ltrans.o: in function
`httplib::ws::WebSocket::close(httplib::ws::CloseStatus,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&)':
<artificial>:(.text+0x6408): undefined reference to `__atomic_exchange_1'
To fix the problem we add -latomic to LDFLAGS when needed.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit eedb2067d8)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] introduced the check-package error:
boot/edk2/Config.in:19: line contains trailing whitespace
This commit fixes the issue by removing those extra spaces.
[1] ea0f27d64f
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9054c08eb6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since the bump to version 2.13.0 in Buildroot commit [1],
atop fails to build with musl:
drawbar.c:2336:33: error: implicit declaration of function 'waddwstr'; did you mean 'waddstr'? [-Wimplicit-function-declaration]
(Before 2.13.0, the same configurations already failed earlier on
uClibc because _POSIX_C_SOURCE was defined without a value. Upstream
fixed that in 2.13.0 by giving it an explicit value, but the same
pattern remains for _XOPEN_SOURCE.)
ncurses only declares its wide-character API, including waddwstr(),
when NCURSES_WIDECHAR is set. If the application does not set it,
curses.h derives it from the feature test macros:
#if defined(_XOPEN_SOURCE_EXTENDED) || \
(defined(_XOPEN_SOURCE) && (_XOPEN_SOURCE - 0 >= 500))
drawbar.c defines _XOPEN_SOURCE with an empty value, which makes the
check evaluate as 0 >= 500 and fail.
This only breaks with musl because of the C library's <features.h>,
which curses.h pulls in through <stdio.h> before doing the check.
glibc and uClibc both redefine _XOPEN_SOURCE to 700 and define
_XOPEN_SOURCE_EXTENDED whenever _GNU_SOURCE is set, which drawbar.c
does, so the empty definition gets fixed up. musl never modifies the
application's feature test macros, so the empty value reaches
curses.h and the wide-character prototypes are left out.
Add a patch that defines _XOPEN_SOURCE as 700, matching the
_POSIX_C_SOURCE value of 200809L that is already used.
Fixes:
- https://autobuild.buildroot.org/results/914c1d8fa0fc8bbef64e4a64d58e5941d0077a3e
- https://autobuild.buildroot.org/results/b91ea0722202de0d1fdeeaeea167fd1b21b6d5d6
[1] 2110131cab
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Tested-By: Thomas Perale <thomas.perale@mind.be>
[Julien: add link to Buildroot commit introducing the issue]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 99909a8a95)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This was added in commit 2d4fd5d358 ("pkg-infra: also set PKGDIR for the
download step") for the DOWNLOAD macro, which was reworked in commit
155f752d8a ("core/download: do not hard-code the path to the package hash
file") to instead use <FOO>_HASH_FILE, so drop it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f454580f0f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This was added in commit 604d261fb0 ("infra: remove variable
FOO_DIR_PREFIX") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_PKGDIR, so drop it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5c668c42e2)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This was added in commit 7a41cbf938 ("package: fix patching procedure for
host packages") to figure out where to find patches, but this was reworked
in commit 99d4180eda ("package/pkg-generic.mk: factor out patch
directories") to instead use <FOO>_RAWNAME, so drop it.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ade0757d7f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since the bump to version 1.9.15 in commit
2a28d25d0c ("package/haveged: bump to version 1.9.15"), haveged
unconditionally includes <semaphore.h> and uses named semaphores
(sem_open() and friends) to synchronize command instances. As a
result, the build fails with toolchains without threads support:
haveged.c:37:10: fatal error: semaphore.h: No such file or directory
Add a dependency on BR2_TOOLCHAIN_HAS_THREADS. Since threads are now
always available, unconditionally pass --enable-threads.
Fixes:
https://autobuild.buildroot.org/results/814cb7b5537d8b7b2c23f3d90e37b2b41de7ee3f
Fixes: 2a28d25d0c ("package/haveged: bump to version 1.9.15")
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cec5f7af80)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
We usually put the metadata variables at the beginning of the file and
the variables related to how to build it (like _CONF_OPTS) later. Apply
this principle.
(alternative to commit 35dc65563d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes:
https://autobuild.buildroot.org/results/e6159cee14f84569c85a61f77824b2b58d68a4bc/
Libtool 2.6.x is starting to be used by upstreams when generating
release tarballs (e.g. cryptsetup-2.8.8). As LIBTOOL_PATCH_HOOK does
not know about it, ltmain.sh is left unpatched, so libtool relinks
libraries at install time and adds -L/usr/lib, which is rejected by
the toolchain wrapper:
i686-buildroot-linux-gnu-gcc: ERROR: unsafe header/library path used in cross-compilation: '-L/usr/lib'
The v2.4.4 patch no longer applies cleanly, so add a v2.6 variant,
rebased on libtool 2.6.2, and use it for 2.6.x versions.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5dbba2616f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Commit 8b651fd817 added a dependency on
gcc >= 4.9 and as part of that updated the Config.in comment to
mention C++11 instead of C++. This is not consistent with Buildroot
convention, where we only mention C++, and separately the GCC version
requirement. This commit aligns the Config.in comment with the
Buildroot convention.
Fixes: 8b651fd817 ("package/sqlitecpp: require C++11")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c12e9327c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
SQLiteCpp has an internal setting for stack protection which defaults
to "on". Since Buildroot handles stack protection itself this is not
needed and more importantly it causes problems as the option enables
stack protection support even when the toolchain doesn't support it,
as can be reproduced using the following defconfig:
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_I686_MUSL_BLEEDING_EDGE=y
BR2_PACKAGE_SQLITECPP=y
Fixes:
br-test-pkg/bootlin-x86-i686-musl
https://gitlab.com/heinemml/buildroot/-/jobs/16865965418
Oddly enough, there are no autobuilder failures recorded for this
issue.
Fixes: e74059b39c ("package/sqlitecpp: new package")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 39235638d1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
build and run an SQLiteCpp example to check database writes and queries.
Assisted-by: GitHub Copilot:GPT-6 Sol
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 93c6c91955)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
It is sometimes useful to be able to do an offline build, to make sure
the build works properly without network access, so this commit adds a
NO_NETWORK environment variable to our docker-run script, which for
example allows to do:
$ ./utils/docker-run make source
$ NO_NETWORK=1 ./utils/docker-run make
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d6f816facc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot boards use a mixture of the GPT Partition Type "L" (generic
Linux filesystem) and "root-x86", "root-arm", etc (UAPI Root
Filesystem) for root filesystem partitions.
To have consistent guidance on building disk images with genimage,
update the docs to recommend using the UAPI Root Filesystem types. The
UAPI Root Filesystem types are part of the UAPI Discoverable Partitions
Specification (DPS) which helps set a wider standard for system boot.
See https://uapi-group.org/specifications/specs/discoverable_partitions_specification/
Signed-off-by: Brandon Maier <brandon.maier@gmail.com>
[Arnout: some additional rewording mainly based on input from Niklas
Cassel]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 529df0b580)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since commit 5fc10e76fa2a9 in linux v6.5-rc1, the kernel does a
recursive make call to add the --no-print-directory flag if it is not
set.
Buildroot sets MAKEOVERRIDES empty, which causes none of the
command-line overrides to be propagated to sub-makes. This only goes one
level deep, so it is not a problem. However, if the user sets
MAKEOVERRIDES in their environment, the environment _does_ get
propagated down to sub-makes. Therefore, the recursive call from within
the kernel will not get any of the command-line overrides we give it.
As a result, INSTALL_HDR_PATH will not get passed down to the kernel's
sub-make, thereby breaking the installation to staging.
Note that if Buildroot itself does a sub-make call (e.g. because O= is
set, or umask is different), --no-print-directory is already added so
the issue doesn't occur.
Set --no-print-directory explicitly, which avoids the kernel's sub-make
call, which preserves INSTALL_HDR_PATH. It is only really needed for the
staging install, since the local install in _CONFIGURE_CMDS just sets it
to the default value. For consistency though, set it there as well.
Setting --no-print-directory when it is not needed doesn't hurt.
Signed-off-by: Francesco Mancino <francesco.mancino@tutus.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 77faecb13a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit 00317f0aff bumped the
package to 2.15.0 which first included upstream commit
262d5f7dff
that added the miniz submodule.
The version of miniz used by luvi contains commit
05ab4dc05c
which removed "C" from the project variable causing a dependency to c++
which causes build errors when the toolchain does not support c++:
-- Check for working CXX compiler: /bin/false - broken
This dependency was not intended so we add an upstream commit to fix the
problem.
Fixes:
https://autobuild.buildroot.net/results/2a5/2a5cf09dc9303b11e2a2769c5b0b319284ec1bbb/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d267b59fa9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The upstream repository was renamed from shadowsocks-libev to
shadowsocks-c. GitHub still redirects the old URL, but the README names
shadowsocks/shadowsocks-c as the canonical repository.
The v3.3.6 tag points to the same commit in the renamed repository, so
the tarball and its hash are unchanged.
See upstream commits:
bdc77408cbbff687bd34
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
[Julien: add references to upstream commits renaming the project]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0522d9af89)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Bump to go1.27.0. The go-bootstrap-stage5 package (go1.25.x) still
satisfies the bootstrap requirement, so no bootstrap stage changes are
needed.
Remove the workaround for https://github.com/golang/go/issues/77436,
which the go.mk comment scheduled for removal at this bump: restore the
plain CGO_CFLAGS and CGO_CXXFLAGS settings in HOST_GO_TARGET_ENV.
https://go.dev/doc/go1.27#bootstrap
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 798741f4dc)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
