Commit Graph

73870 Commits

Author SHA1 Message Date
Roy Kollen Svendsen
3cf1a6f80d package/qt6/qt6declarative: fix typo
Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 23:31:12 +02:00
Dario Binacchi
4cf319c267 package/cache-calibrator: fix build failure for implicit declaration
Fixes:
 - http://autobuild.buildroot.org/results/db996c894c810ff5c7f4263975d1def0edef6d55

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2024-09-03 22:49:25 +02:00
Dario Binacchi
73a5ae259d DEVELOPERS: add Dario Binacchi for armadillo
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 22:09:44 +02:00
Dario Binacchi
f69fe48404 package/armadillo: temporarily update the site URL
Following an email exchange with Conrad Sand, one of the maintainers of
the project, I learned that version 9.900.2 has been moved to
https://sourceforge.net/projects/arma/files/retired/.

This patch fixes the package download error, waiting for a subsequent
patch that will restore the previous URL to bump to a more recent
version.

Adding the .RETIRED suffix to the downloaded tarball generated the
following error:

armadillo-9.900.2.tar.xz.RETIRED: OK (sha256: d78658c9442addf7f718eb05881150ee3ec25604d06dd3af4942422b3ce26d05)
>>> armadillo 9.900.2 Extracting
buildroot/dl/armadillo/armadillo-9.900.2.tar.xz.RETIRED | buildroot/output/host/bin/tar --strip-components=1 -C buildroot/output/build/armadillo-9.900.2   -xf -
/bin/bash: line 1: buildroot/dl/armadillo/armadillo-9.900.2.tar.xz.RETIRED: Permission denied
buildroot/output/host/bin/tar: This does not look like a tar archive
buildroot/output/host/bin/tar: Exiting with failure status due to previous errors
make[1]: *** [package/pkg-generic.mk:213: buildroot/output/build/armadillo-9.900.2/.stamp_extracted] Error 2

which required the addition of ARMADILLO_EXTRACT_CMDS to be fixed.

Finally, it was also necessary to modify the tarball's hash.

Fixes:
- http://autobuild.buildroot.org/results/d4e9e7b453960a4f62a199344b30b729a4f235bc

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 22:03:26 +02:00
Dario Binacchi
ec12fde5d5 package/gerbera: fix build against fmt 11
The commit adds a backported upstream patch to fix the following build
failure:

build/gerbera-1.12.1/src/cds/cds_objects.cc: In static member function 'static std::string CdsObject::mapFlags(int)':
build/gerbera-1.12.1/src/cds/cds_objects.cc:174:35: error: 'join' is not a member of 'fmt'

Upstreaming the patch was added in version 2.2.0.

Fixes:
 - http://autobuild.buildroot.org/results/aaf054b0bb336d45203b0d869ec6f9e00528ec8e

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 21:57:43 +02:00
Julien Olivain
8d9628acba configs/imx8mqevk: bump TF-A, U-Boot and Linux Kernel version
The imx8mqevk_defconfig is failing to build the arm-trusted-firmware
package, with the error message:

    plat/imx/imx8m/hab.c: In function 'imx_hab_handler':
    plat/imx/imx8m/hab.c:65:57: error: array subscript 0 is outside array bounds of 'uint32_t[0]' {aka 'unsigned int[]'} [-Werror=array-bounds=]
       65 | #define HAB_RVT_CHECK_TARGET_ARM64      ((unsigned long)*(uint32_t *)(HAB_RVT_BASE + 0x18))
          |                                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

This is happening since commit dc0f721 "package/gcc: switch to 13.x
as default".

This commit fixes this build failure by updating the TF-A, U-Boot and
Linux Kernel. Note: this imx8mqevk_defconfig uses the upstream Kernel
(in contrast of the freescale_imx8mqevk_defconfig which is using the NXP
BSP Kernel version).

Also, this new uboot version needs gnutls and openssl, so the
corresponding options are added to the defconfig.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/7691701411

Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 21:53:59 +02:00
Sergey Matyukevich
c6a47974b0 package/wpa_supplicant: macsec offload needs headers >= v5.7
Hardware offload in Linux macsec driver is enabled in compile time if
libnl version is >= v3.6. However this is not enough for successful
build since enum 'macsec_offload' has been added to Linux headers only
since Linux >= v5.7.

Add upstream commit that extends compile time condition for the
enablement of the macsec hardware offload adding Linux headers version
check.

Fixes:
- http://autobuild.buildroot.net/results/b59d5bc5bd17683a3a1e3577c40c802e81911f84/

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 21:40:10 +02:00
Dario Binacchi
09324c843b DEVELOPERS: add Dario Binacchi for babeld
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 21:08:32 +02:00
Dario Binacchi
9172ffc3b4 package/babeld: update URL site
As reported in [1], version 1.9.2 has been moved to another archive, and
it is recommended to use https://github.com/jech/babeld as the official
repository.

The use of the github macro:

$(call github,jech,babeld,babeld-$(BABELD_VERSION))

would have downloaded a file with the same name (e.g. babeld-1.9.2.tar.gz)
but with a different hash from the one downloaded from the previous URL,
creating unacceptable backward compatibility issues.
Therefore, it was decided to download the package via the git method. In
this way, the downloaded file is babeld-babeld-1.9.2-git4.tar.gz, thus
with a different name, to which its SHA can be associated without side
effects, except for breaking the release monitoring process.
Unfortunately, for now, we will have to live with this limitation.

Particularly interesting are the explanations provided by Yann E. Morin,
which you can find in [2], that guided the creation of this patch.

Fixes:
- http://autobuild.buildroot.org/results/2447060c86acf1bd8d6ee0bcf8f9b6adcdfc50c9

[1] https://alioth-lists.debian.net/pipermail/babel-users/2024-August/004187.html
[2] https://patchwork.ozlabs.org/project/buildroot/patch/20240901063634.3504315-1-dario.binacchi@amarulasolutions.com/

Co-Developed-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 21:07:01 +02:00
Waldemar Brodkorb
8194a727a2 package/tllist: update download URL
Fix download URL. Tarball is renamed, too.

Fixes:

 http://autobuild.buildroot.org/results/950/950688493021c12c4dea98ac4b220355d917ff69

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-09-03 20:57:25 +02:00
J. Neuschäfer
e40c6f2156 package/aer-inject: switch upstream
According to a commit in Linux[1], the upstream of aer-inject changed to
https://github.com/intel/aer-inject.

[1]: https://git.kernel.org/linus/a29e5290e3566ae4db4e6fe5f31caf23118c82b6

Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2024-09-02 17:50:19 +02:00
Thomas Devoogdt
88f120d031 package/midori: drop package
The original WebKitGTK-based Midori is no longer maintained and doesn't build
since WebKitGTK moved to libsoup3 as of commit 38a098df13.

Last WebKitGTK based release: https://github.com/midori-browser/core/tree/v9.0.
New browser, based on Gecko/Firefox: https://github.com/goastian/midori-desktop.

The intention is also to start migrating WebKitGTK to GTK4, as this is now the default
version. See: https://webkitgtk.org/2024/03/27/webkigit-2.44.html.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2024-09-02 17:36:45 +02:00
Peter Korsgaard
1bab2c9374 configs/pandaboard_defconfig: drop defconfig
The defconfig has failed to build since May with the change to GCC 13.x,
E.G.:

https://gitlab.com/buildroot.org/buildroot/-/jobs/6865597768

I no longer have access to a pandaboard.  Pandaboard/omap4 support has
recently been dropped from u-boot:
https://lists.denx.de/pipermail/u-boot/2024-July/558846.html

And (part of) the kernel support is also getting removed:
https://patchwork.kernel.org/project/linux-media/patch/815a789d-85a5-44a1-8b9c-429ac0101e3f@xs4all.nl/

So drop the defconfig here as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
2024-09-02 17:32:06 +02:00
Peter Korsgaard
30450215ae Update for 2024.08-rc3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024.08-rc3
2024-09-01 21:48:24 +02:00
Peter Korsgaard
2bd1723c0a support/scripts/genimage.sh: drop gzip compression
Commit 6889056f1e (support/scripts/genimage.sh: support creating a bmap
image) added unconditional gzip compression of the genimage outputs if
bmap-tools is enabled, which is problematic for a number of reasons:

- The gzip invocation is not reproducable (E.G. does not use -n)

- The original file is removed, dropping the sparse info

- It hardcodes policy, E.G.  bmap supports a number of different compression
  algorithms / compression may not be desired for all images / different
  compression levels may be desired

So drop the compression step.  If desired, compression can be done with a
post-image script.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-30 19:09:17 +02:00
Bernd Kuhls
0b5feb52af {linux, linux-headers}: bump 6.{1, 6, 10}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-30 19:07:27 +02:00
Roy Kollen Svendsen
6677d9c4e1 docs/manual: fix description of how to reply to <message-id>
Patch v1 not set to 'superseded' when replying to <message-id> with v2.

I'm using git version 2.46.0. The manual says the following is the
correct way to use the '--in-reply-to' option:

git send-email --in-reply-to=<message-id>

Signed-off-by: Roy Kollen Svendsen <roykollensvendsen@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-30 18:58:50 +02:00
Waldemar Brodkorb
180216631a package/szip: update SZIP_SITE
Fix broken link.

While at it, use $(SZIP_VERSION) inside SZIP_SITE instead of
duplicating the version.

Fixes:

 http://autobuild.buildroot.org/results/35d/35d08103bbd0da22a5e111f1f86f28aba7062ee6

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-27 18:59:26 +02:00
Waldemar Brodkorb
62ccb5b25d package/comix-cursors: update COMIX_CURSORS_SITE
The project moved to Gitlab and renamed it's archive.
Fix the download URL and update the hash.

Fixes:

 http://autobuild.buildroot.org/results/734/734917ff9f613f07e6995c1f333eab1ee8bc5760

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-27 18:51:30 +02:00
Waldemar Brodkorb
250a9b7c0a package/enscript: fix gcc 14.x compile issue
Fixes:

 http://autobuild.buildroot.org/results/eb5/eb53b42db0d4bcaf574380d5a89a096cc4ce4b14

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-27 18:26:40 +02:00
Peter Korsgaard
e5cc7ad5fd package/python3: security bump to version 3.12.5
Fixes the following security issues:

- gh-121957: Fixed missing audit events around interactive use of Python,
  now also properly firing for python -i, as well as for python -m asyncio.
  The event in question is cpython.run_stdin.

  https://github.com/python/cpython/issues/121957

For more details, see the changelog:

https://docs.python.org/release/3.12.5/whatsnew/changelog.html#python-3-12-5

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-27 18:24:38 +02:00
Waldemar Brodkorb
23b6c3f58c package/freeipmi: fix gcc 14.x issues
Directly from upstream stable git repository, fixes for gcc 14.x
issues. Only the changelog entries, which do not apply, where removed.

Fixes:

 http://autobuild.buildroot.org/results/b33/b33e72b3348427f2f772e5c29dd3753958597058

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-27 18:19:54 +02:00
Waldemar Brodkorb
345c94ad4e package/zabbix: fixup download URL
Fixes:
 http://autobuild.buildroot.org/results/9ff/9ffb4a9e3b2291498d0ccf3c9124bebc466860bc

Zabbix 6.2.x is EOL and the tarballs have now been moved under oldstable/.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Peter: extend commit message]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-27 13:41:41 +02:00
Thomas Petazzoni
4780e11726 package/gcc: add GCC patch to fix PowerPC64/musl build issue
PowerPC64/musl toolchains currently fail to build with:

In file included from ../../../libquadmath/math/sqrtq.c:13:
../../../libquadmath/math/../../libgcc/soft-fp/quad.h:69:1: error: unable to emulate 'TF'
   69 | typedef float TFtype __attribute__ ((mode (TF)));
      | ^~~~~~~
make[4]: *** [Makefile:979: math/sqrtq.lo] Error 1

This issue has been reported upstream as
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116007, and has been
fixed as
https://gcc.gnu.org/g:3ac02e67503ccffa3dfeeffc0a60fce6bdaca43b.

This commit simply backports the upstream GCC fix. This issue was new
with GCC 14.x, so only GCC 14.x needs to be fixed.

Fixes:

  http://autobuild.buildroot.org/results/529bec7ef338842030d3340d9b21d8fd16d8639d/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-27 13:31:31 +02:00
Thomas Petazzoni
f14e03ba21 package/libuecc: switch to a functional Github repo
The https://projects.universe-factory.net/attachments/download/85 URL
no longer works, so let's switch to what appears to be the official
Github repo:

  https://github.com/neocturne/libuecc

The v7 in this Github is 100% identical to the v7 that was available
from https://projects.universe-factory.net/attachments/download/85.

Also at
https://metadata.ftp-master.debian.org/changelogs//main/libu/libuecc/libuecc_7-5_copyright
Debian lists https://github.com/NeoRaider/libuecc as the source, and
this URL redirects to https://github.com/neocturne/libuecc.

Thanks to the original tarball being a .tar.xz, and our Github macro
generating a .tar.gz, the filename is different, and therefore the
different hash will not be an issue.

Fixes:

  http://autobuild.buildroot.org/results/c4c24bd06bc7889c46d78e14d5bef528340d4463/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 22:41:30 +02:00
Fabio Estevam
42d95c00a9 configs/mx25pdk: remove defconfig
The imx25pdk board has been removed from U-Boot and I no
longer have access to the board.

Remove its support.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-26 18:38:58 +02:00
Bernd Kuhls
4f0243567d package/php: fix build on arm
Fixes:
http://autobuild.buildroot.org/results/5e8ef91d84018ccdf85f2156292feb3460bfe698/

Without this patch configure wrongfully detects aarch64 support:

    checking for aarch64 CRC32 API... yes

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-26 18:34:19 +02:00
Woodrow Douglass
2965632a31 package/chicken: security bump to 5.4.0
This release includes a fix for CVE-2022-45145. Also, a copyright date
in the LICENSE file changed, so the hash for it has changed too.

Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-26 18:31:45 +02:00
Waldemar Brodkorb
c1a6987da9 package/fbset: update download URL
Fixes:

 http://autobuild.buildroot.org/results/13e/13e28650fc58fc62c801a664d79616c6dd39a8ac

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-26 18:28:55 +02:00
Thomas Petazzoni
cf647b69fb package/norm: fix build issue with waf >= 2.1.0
To fix build issues with modern Python versions, commit
8012a86f5c ("package/norm: use external
waf") switched the norm package from using its internal waf copy to
using our external waf package.

Then, in fd5623150d ("package/waf: bump
to v2.1.1"), we updated out external waf to a newer version, which
breaks the API around ArgParse, see upstream commit:

  bd5c22d484:

This causes breakage when building the norm package. Fabrice had
already submitted patches upstream, to both the "protolib"
project (which is used as a submodule in norm) and to the "norm"
project. These pull requests are still pending, but let's backport the
patches that seem reasonable and that fix the build issue.

Fixes:

  http://autobuild.buildroot.net/results/f005d513434d42d26e601096b94b4070586118b2/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 11:31:49 +02:00
Mattia Narducci
2383768cdf package/proftpd: fix group name preventing server from starting
Replace the group name 'nogroup' with 'nobody' in the default ProFTPD
configuration file. This fixes the following error when starting the
server:

  proftpd[110]: fatal: Group: Unknown group 'nogroup' on line 30 of '/etc/proftpd.conf'

Fixes: 0d887cc2b4 ("system: replace nogroup with nobody")
Signed-off-by: Mattia Narducci <mattianarducci1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 10:05:02 +02:00
Scott Fan
74f327e286 package/postgresql: fix typo in init script info printout
Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 10:02:09 +02:00
Scott Fan
10088427cf package/postgresql: security bump version to 16.4
Release notes:
 - https://www.postgresql.org/docs/release/16.4/
 - https://www.postgresql.org/about/news/postgresql-164-158-1413-1316-1220-and-17-beta-3-released-2910/

Fixes CVE-2024-7348:
 - https://www.postgresql.org/support/security/CVE-2024-7348/

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 10:01:43 +02:00
Waldemar Brodkorb
e33db30aab package/xserver_xorg-server: security update to 21.1.13
Fixes the following security issues:

- CVE-2024-31080: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
- CVE-2024-31081: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
- CVE-2024-31082: Heap buffer overread/data leakage in ProcAppleDRICreatePixmap
- CVE-2024-31083: User-after-free in ProcRenderAddGlyphs

For more details, see thee security page of Xorg:
https://www.x.org/wiki/Development/Security/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Peter: add actual list of CVEs]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-26 09:59:43 +02:00
J. Neuschäfer
0196ec4198 package/x264: disable assembly code on x86 + musl + PIC/PIE
The x264 package uses large amounts of non-PIC assembly code
(e.g. common/x86/dct-a.asm), which results in textrels, which aren't
supported by musl-libc's dynamic linker.

Disable x264's assembly code when compiling for x86 with PIC/PIE and
musl-libc to avoid this particular incompatibility.

Reported-by: Yann Morin <yann.morin@orange.com>
Fixes: https://lore.kernel.org/buildroot/ZrsirnrvgsEIpAJI@tl-lnx-nyma7486-2/
Signed-off-by: J. Neuschäfer <j.neuschaefer@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-25 14:58:29 +02:00
Bernd Kuhls
71f54e0780 package/sofia-sip: fix static build with openssl >= 3.2.0
Fixes:
http://autobuild.buildroot.org/results/de08bd5c68f5fcdaa5c0374a4f5051c4751ebb88/
and many others.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-25 12:04:07 +02:00
Bernd Kuhls
5dae8cddee package/dovecot-pigeonhole: bump version to 0.5.21.1
Release note of this bugfix release:
https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/4KDY5GDGPVG5ZMXKTBEKPKK764LT56WU/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-24 18:40:44 +02:00
Bernd Kuhls
786484e631 package/dovecot: security bump version to 2.3.21.1
Fixes CVE-2024-23184 & CVE-2024-23185:
https://dovecot.org/mailman3/hyperkitty/list/dovecot-news@dovecot.org/thread/2CSVL56LFPAXVLWMGXEIWZL736PSYHP5/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-24 18:40:21 +02:00
Julien Olivain
ed34c4c77b package/unbound: security bump to version 1.21.0
Fixes the following security issue:

- CVE-2024-43167: A NULL pointer dereference flaw was found in the
  ub_ctx_set_fwd function in Unbound.  This issue could allow an attacker
  who can invoke specific sequences of API calls to cause a segmentation
  fault

See announcement:
https://nlnetlabs.nl/news/2024/Aug/15/unbound-1.21.0-released/

See also change log:
https://nlnetlabs.nl/projects/unbound/download/#unbound-1-21-0

This commit also updates the _SITE url from [1] to [2], to follow the
HTTP redirect, and the url published on the download page [3].

Finally, this commit adds a comment in the hash file that the PGP
signature was checked.

[1] https://www.unbound.net/downloads
[2] https://nlnetlabs.nl/downloads/unbound
[3] https://nlnetlabs.nl/projects/unbound/download

Signed-off-by: Julien Olivain <ju.o@free.fr>
[Peter: Mark as security bump, add CVE info]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024-08-24 18:33:46 +02:00
Dario Binacchi
d0d23b4739 package/libcuefile: fix build failure due to implicit declaration
Fixes:
- http://autobuild.buildroot.org/results/28f1e34166e836bf3b984f228bb09842840de82a

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-24 09:14:15 +02:00
Waldemar Brodkorb
b331217a50 package/libglob: update download URL
Fixes:

 http://autobuild.buildroot.org/results/92c/92c697697c07f63f0e03ceb655b5d558e85c392e

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 19:41:51 +02:00
Waldemar Brodkorb
1e8eca5e65 package/elf2flt: fix riscv64 C++ compilations
Fixes:

 http://autobuild.buildroot.org/results/63f/63f32c9d5d4097ef2b3cbba1ce665e13e9dbd430

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 19:41:31 +02:00
James Hilliard
ea6bb507b1 utils/genrandconfig: allow overriding KCONFIG_PROBABILITY
Tweaking this variable should allow us to get better coverage of
packages with larger dependency trees.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 19:40:12 +02:00
Marcus Hoffmann
65247fcc6a package/python-sqlparse: security bump to version 0.5.1
Changelog:
* https://sqlparse.readthedocs.io/en/latest/changes.html#release-0-5-1-jul-15-2024
* https://sqlparse.readthedocs.io/en/latest/changes.html#release-0-5-0-apr-13-2024

Version 0.5.0 fixes the following security issue [1]:
Parsing heavily nested list leads to Denial of Service

Build backend switched from flit to hatchling in [2].

[1] https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-2m57-hf25-phgg
[2] 326a316446

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 19:33:30 +02:00
Bernd Kuhls
ebef582bd2 {linux, linux-headers}: bump 4.19.x / 5.{4, 10, 15}.x / 6.{1, 6, 10}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 19:08:07 +02:00
Bernd Kuhls
e656625b8a package/libcurl: security bump to version 8.9.1
Changelog: https://curl.se/changes.html#8_9_1

Fixes CVE-2024-7264.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 18:38:23 +02:00
Peter Korsgaard
8b483b3032 board/qemu/patches/arm-trusted-firmware: add v2.10 hash
Fixes https://gitlab.com/buildroot.org/buildroot/-/jobs/7644930127
ERROR: No hash found for arm-trusted-firmware-v2.10-git4.tar.gz

Commit d037d9c2d6 (configs/qemu: Update defconfigs to Linux 6.6.32)
enabled BR2_DOWNLOAD_FORCE_CHECK_HASHES, but forgot to take into
consideration that qemu_aarch64_ebbr_defconfig uses arm-trusted-firmware
v2.10 since commit 73813c56c8 (configs/qemu_{arm, aarch64}_ebbr: bump
Linux, U-Boot and TF-A).

Add the hash to fix the build.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 17:52:54 +02:00
Thomas Huth
ed2d440a08 package/frotz: remove the "frotz" package
I'm not much interested anymore in maintaining the "frotz" package
in buildroot, and since I likely was the only one who really used
it in the past years, I guess it's time remove it now.

Fixes:

  http://autobuild.buildroot.net/results/077e4756e56903f094b935af4ee8829507e0c3de/

Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 16:31:09 +02:00
Thomas Huth
6fdbab87a2 DEVELOPERS: drop some entries from Thomas Huth's section
I lack the time (and interest) to properly keep these entries up to
date, so drop them from my section.

Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 16:27:46 +02:00
Thomas Petazzoni
e2f46ed03d boot/grub2: ignore CVE-2023-4001
This vulnerability is irrelevant to Buildroot, as it affects only some
downstream changes from Redhat.

See:

  https://security-tracker.debian.org/tracker/CVE-2023-4001
  https://www.openwall.com/lists/oss-security/2024/01/15/3

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2024-08-23 16:27:30 +02:00