Commit Graph

77941 Commits

Author SHA1 Message Date
Waldemar Brodkorb
4288f056cb package/evilwm: fix compilation with external toolchains
Switch to generic-package, as the configure script isn't really a
autotool generated script. This fixes building evilwm with an
external toolchain.

Fixes:
 - https://autobuild.buildroot.org/results/250/25040ce7e94acf8f92c24db895d7dea081de1d7a

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d7f6ed49f8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:59:50 +01:00
Waldemar Brodkorb
f3490f35fb package/fontconfig: disable doc and tests for host
On Debian 13 doc generation fails. Disable it like for
the target.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 20f31f90ad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:58:08 +01:00
Dario Binacchi
8d47bca9a5 package/qt6/qt6base: use correct QT6BASE_CONF_OPTS variable for Vulkan
The Vulkan option was appended to QT6BASE_CONFIGURE_OPTS instead of
QT6BASE_CONF_OPTS, which is the variable actually used during CMake
configuration. This prevented the feature from being enabled/disabled
as expected.

Fixes: 1c27f3a12d ("package/qt6base: add vulkan option")
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 451e735aa0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:55:31 +01:00
Bernd Kuhls
611e3fe80d package/atf: update project URL
The old URL redirects to the new URL.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9d334c4abf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:53:43 +01:00
Bernd Kuhls
49c9f10bac package/libdill: update project URL
https://github.com/sustrik/libdill/pull/228

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f615dcb271)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:51:31 +01:00
Thomas Perale
3dc3519eed package/softether: fix various build errors
This patch add several upstream patches that fix build error we are
experiencing on the autobuilder related to host-gcc15 and gcc14.

- 0010-use-bool-from-stdbool.patch

Fix a host-gcc15 error with C23 bool reserved keyword when building
host-softether package. This appeared on the autobuilder.

```
                 from Cfg.c:116:
../../src/Mayaqua/MayaType.h:257:33: error: 'bool' cannot be defined via 'typedef'
  257 | typedef unsigned int            bool;
      |                                 ^~~~
../../src/Mayaqua/MayaType.h:257:33: note: 'bool' is a keyword with '-std=c23' onwards
../../src/Mayaqua/MayaType.h:257:1: warning: useless type name in empty declaration
  257 | typedef unsigned int            bool;
      | ^~~~~~~
```

- 0011-fix-implicit-declaration-of-function-getch.patch

Fix an implicit function declaration.

- 0012-vlanunix-fix-implicit-declaration-of-function-freetap.patch

Fix an implicit function declaration.

- 0013-fix-build-on-freebsd-version-140091.patch

Incompatible pointer type which appeared on the autobuilder as well:

```
Unix.c: In function 'UnixIgnoreSignalForThread':
Unix.c:324:25: error: assignment to 'void (*)(int,  siginfo_t *, void *)' from incompatible pointer type 'void * (*)(int,  siginfo_t *, void *)' [-Wincompatible-pointer-types]
  324 |         sa.sa_sigaction = signal_received_for_ignore;
      |                         ^
```

- 0014-cedar-hub-properly-set-value-for-hub-admin-options.patch

Fix an incompatible pointer type error.

- 0015-adjust-types-of-variables.patch

Fix an incompatible pointer type error which appeared on the autobuilder as
well.

```
Secure.c: In function 'OpenSec':
Secure.c:1829:56: error: passing argument 3 of 'sec->Api->C_GetSlotList' from incompatible pointer type [-Wincompatible-pointer-types]
 1829 |         if ((err = sec->Api->C_GetSlotList(true, NULL, &sec->NumSlot)) != CKR_OK || sec->NumSlot == 0)
      |                                                        ^~~~~~~~~~~~~
      |                                                        |
      |                                                        UINT * {aka unsigned int *}
```

- 0016-Cedar-Proto_IKE-fix-too-many-arguments-to-function-N.patch

Fix a function call.

Fixes: https://autobuild.buildroot.org/results/c43/c43a9a221896d37ee8a9d34c5b8e2725351c6eb5
Fixes: https://autobuild.buildroot.org/results/751/7517bb4d32c38d475d901769b0b2fd2c2f3dd543
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Acked-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5b5aebc085)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:43:06 +01:00
Florian Fainelli
c30b55858a package/cpulimit: correct function signature to use named parmeters
Update 0005-Correct-loop-function-signature.patch to include a named
parameter otherwise the following compiler warning turned error is
triggered:

busy.c:6:1: error: parameter name omitted
 void *loop(void *)
 ^~~~

Interestingly, this builds with GCC > 10.x, but fails fails with GCC
<= 10.

Fixes: https://autobuild.buildroot.org/results/8592e4eb5959124acc885a1cbc2f9d24fb7bcbd1
Fixes: https://autobuild.buildroot.org/results/cf12d080ddd7a2398a79be430d935071ca3250a3/
Fixes: e63181bc00 ("package/cpulimit: Backport fix for function signature")
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 04ca5dc2cd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:40:05 +01:00
Dario Binacchi
a804a6975c package/xinetd: fix build w/ gcc-14
Building xinetd with gcc-14 raises the following error:

cvt.c: In function 'fcvt_r':
cvt.c:113:9: error: implicit declaration of function 'strx_nprint' [-Wimplicit-function-declaration]
  113 |     n = strx_nprint (buf, len, "%.*" FLOAT_FMT_FLAG "f", ndigit, value);
      |

Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:33:55 +01:00
Thomas Petazzoni
eb03d1724a package/lttng-modules: bump to latest 2.13.x to fix build with recent kernels
lttng-modules fails to build in master and in our LTS branch
2025.02.x. Indeed, our LTS branch uses the 6.12 kernel as the latest
LTS, and lttng-modules in version 2.13.10 don't build with the 6.12
kernel:

BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
BR2_PACKAGE_LTTNG_MODULES=y

fails to build with 2025.02.x.

To fix this, let's bump to the latest point release in the 2.13.x
branch, which mostly contains fixes needed for the 2.13.x releases to
work with newer kernels. This is considered a reasonable bump for our
2025.02 LTS.

The hash of the license file is updated as the list of files under
each license has changed a bit, but that doesn't change the overall
list of licenses.

Fixes:

  https://autobuild.buildroot.net/results/78d05ded97877f866d2bd7aa600a2dafa01bb364/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 63d0611b0c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:32:11 +01:00
Thomas Devoogdt
51e8f2adaf package/openjdk: fix patch subdirectories
This commit fixes the wrong patch folders which should have been fixed
in commit 475c79d ("package/openjdk{-bin}: bump versions to 17.0.12+7
and 21.0.4+7")

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f2992604a3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:31:11 +01:00
Théo Lebrun
356d9a9206 gitignore: ignore utils/brmake log output named br.log
The `utils/brmake` tool runs `make all` with logs put into `br.log`.
That file is therefore the result of a build and committing it never
makes sense, neither upstream nor on any other remote/branch.

    ⟩ git status --short
    ⟩ make beaglebone_defconfig
    ⟩ ./utils/brmake
    ⟩ git status --short
    ?? br.log

Add a new `/br.log` entry in the root `.gitignore` file.
Append to the end because no ordering logic was found.

Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a5d29e752a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:30:11 +01:00
Fiona Klute
5826d197fb package/dbus: rewrite and rename SysV init script
This brings the script in line with current standards, except the
expected PIDFILE value because changing the PID file path would
require changing build options.

The stop action now uses the PID file instead of "killall", and reload
is supported using SIGHUP (with limitations described in D-Bus
documentation). "--syslog" is added to the dbus-daemon arguments to
ensure log messages will be available, otherwise log messages after
fork may be lost.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f51a475280)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:28:07 +01:00
Fiona Klute
6bfb1a51c4 package/dbus: remove broken "condrestart" action & comment from init script
The "servicename" environment variable was never set, so the condition
in the "condrestart" case would always evaluate to false. Nobody seems
to have noticed since it was introduced with commit
ceb2859765 in 2007, so simply remove it.

Likewise, the comment in the stop function that mentions $servicename
is incorrect, there is no safety check to the "killall" call.

With those, remove the /var/lock/subsys/dbus-daemon file that was
created but never used.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3dd3944097)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:27:40 +01:00
Fiona Klute
def51e9746 package/busybox: tidy up klogd init script
* Wait for process to stop before deleting PID file, instead of fixed
  wait during restart

* Use long form options

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b91258e424)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:23:50 +01:00
Giulio Benetti
55a3240a9e DEVELOPERS: add Giulio Benetti to Putty package
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5c6552cd60)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:23:39 +01:00
Joseph Kogut
1e177c568c package/x11r7/xlib_libxshmfence: set shared-memory-dir
libxshmfence has multiple paths available for the shared memory
directory, as some distros [0] opt to mount their tmpfs in a
non-standard location such as /run/shm rather than /dev/shm.

The default value of 'auto' will set this path to whatever the host is
using, leaking host configuration into the target. See [1].

With X configurations that depend on shared memory files for futexes,
(muvm [2] is a notable example), this results in applications silently
breaking during presentation with a blank window, as the configured
path doesn't have the required tmpfs mount.

Set this path explicitly to avoid situations where the host context
leaks into the package build, causing feature breakage.

[0] https://wiki.ubuntu.com/OneiricOcelot/ReleaseNotes?action=show&redirect=OneiricOcelot%2FTechnicalOverview#Upgrades
[1] https://gitlab.freedesktop.org/xorg/lib/libxshmfence/-/blob/libxshmfence-1.3.3/configure.ac#L144
[2] https://github.com/AsahiLinux/muvm

Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
[Julien:
 - add link to shared memory dir detection code in commit log
 - replace "+=" by "=" in _CONF_OPTS
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cb79eee7fe)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:23:31 +01:00
Thomas Petazzoni
9a4ef6c282 package/rpi-firmware: drop support for vcdbg
This tool has been removed from upstream rpi-firmware, so drop the
corresponding option and logic in rpi-firmware.mk.

The tool has been removed by upstream commit
d1fcc26038186aecc1501a0b749833300afba801 ("opt: Remove builds of
deprectated userland tools").

It is Buildorot commit
28e6953ba8 ("package/rpi-firmware: bump
version to 5476720") that did a bump to a version of rpi-firmware that
no longer provided vcdbg.

Cc: Köry Maincent <kory.maincent@bootlin.com>
Cc: Gaël PORTAY <gael.portay@rtone.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f53a1af56b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:21:48 +01:00
Thomas Petazzoni
f777594d19 package/zxing-cpp: drop support for Python bindings
Since the bump of zxing-cpp to version 2.3.0 in Buildroot commit
fb032bd34a ("package/zxing-cpp: bump to
version 2.3.0"), the build of the Python bindings has been broken. We
tried to figure things out, but couldn't, and nobody bothered fixing
this since February 2025, so let's drop support for the Python
bindings for the time being.

Fixes:

  https://autobuild.buildroot.net/results/93ffa69b9f92f142c65169f9c3a7c7ad0e733551/

Cc: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Cc: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f78163431c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:20:07 +01:00
Thomas Petazzoni
32dcee9454 package/python-pyqt5: disable qt5webkit module
Due to issues in the installation of qt5webkit, building the
corresponding Python binding fails:

Project ERROR: Unknown module(s) in QT: webkit
Error: /home/thomas/buildroot/br/output-all/host/bin/qmake failed to create a
makefile from PyQt5.pro.
make[1]: *** [package/pkg-generic.mk:263: /home/thomas/buildroot/br/output-all/build/python-pyqt5-5.15.6/.stamp_configured] Error 1
make: *** [Makefile:83: _all] Error 2

https://lore.kernel.org/buildroot/20220929181350.1026033-1-thomas.ballasi@savoirfairelinux.com/
was an attempt at fixing it, but this patch doesn't work and looks
weird.

So for the time being, disable the Webkit module in python-pyqt5. This
issue has indeed been around for as far as 2022.

Fixes:

  https://autobuild.buildroot.net/results/b9d69d21e734aa62a6e0b4d4124c2bcfc027ebe4/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b3e9dc303e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:44 +01:00
Thomas Petazzoni
fdfd19dc15 package/qt5/qt5webkit: fix gcc >= 14.x build issue
Add another patch from Fedora, also used in Arch Linux to fix a gcc >=
14.x build issue:

build/qt5webkit-5.212.0-alpha4/Source/WebCore/page/csp/ContentSecurityPolicy.cpp:235:56:   required from here
  235 |             if ((policy.get()->*allowed)(std::make_pair(algorithm, digest)))
      |                                          ~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~
host/opt/ext-toolchain/aarch64-buildroot-linux-gnu/include/c++/14.3.0/type_traits:1246:52: error: non-constant
condition for static assertion
 1246 |       static_assert(std::__is_complete_or_unbounded(__type_identity<_Tp>{}),
      |                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b79eb5a28f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:24 +01:00
Thomas Petazzoni
3d13a6de73 package/qt5/qt5webkit: add patch to fix missing <cstdint> include
It is not clear which change introduce this breakage, but we suspect
it is related to GCC 14.x. In any case, the fix does no harm and is
good to backport to 2025.02.x.

Fixes:

/home/thomas/buildroot/br/output-all/build/qt5webkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h:575:8: error: ‘uint32_t’ does not name a type
  575 | inline uint32_t RotL(uint32_t x, int8_t r)
      |        ^~~~~~~~
/home/thomas/buildroot/br/output-all/build/qt5webkit-5.212.0-alpha4/Source/ThirdParty/ANGLE/src/common/mathutil.h:19:1: note: ‘uint32_t’ is defined in header ‘<cstdint>’; this is probably fixable by adding ‘#include <cstdint>’
   18 | #include <stdlib.h>
  +++ |+#include <cstdint>
   19 |

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d10726a1a1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:17:12 +01:00
Bernd Kuhls
b33e415990 package/ledmon: update patch to fix musl build
Updated patch following an upstream review:
https://github.com/md-raid-utilities/ledmon/pull/272#issuecomment-3596495739

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b4668eded3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:13:40 +01:00
Fiona Klute
3eac10574c package/apache: fix checkpackage warnings in init script
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3862abb010)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:11:55 +01:00
Bernd Kuhls
55ce2b60c3 package/utfcpp: fix comments
Buildroot commit dc55e7eb51 added this
package as copy from the taglib package but forgot to change all taglib-
related comments.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b7b96c97f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:10:42 +01:00
Bernd Kuhls
3076134c1c package/libupnp: disable blocking-tcp
Suggested by Gerbera:
fcf3147223

CMake Warning at CMakeLists.txt:583 (message):
  !! It is strongly recommended to build libupnp with --disable-blocking-tcp-connections !!
  Without this option non-responsive control points can cause libupnp to hang.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 48c1e7cc6d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:09:01 +01:00
Thomas Perale
2f5143824b package/cmake: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entry introduced in [2] is then no longer matched to
the cmake package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 5ce1e773b9 package/cmake: ignore CVE-2016-10642

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ac47f65186)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:38 +01:00
Thomas Perale
72fc25bba7 package/dovecot: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entry introduced in [2] is then no longer matched to
the dovecot package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 948e71689a package/dovecot: ignore CVE-2016-4983

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9dbd14df22)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:31 +01:00
Thomas Perale
503adba18a package/freerdp: remove stale IGNORE_CVES
The NVD DB is now correctly tracking the vulnerability starting version
3.0 (see [1]). The IGNORE_CVES entry introduced in [2] is then no longer
needed.

[1] https://nvd.nist.gov/vuln/detail/CVE-2025-4478
[2] f741e8f6e6 package/freerdp: ignore CVE-2025-4478

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b3007ebcaf)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:24 +01:00
Thomas Perale
ad4df54b84 package/glibc: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

These IGNORE_CVES entries introduced in [2] are then no longer matched to
the glibc package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] adaae82c58 package/glibc: ignore CVEs not considered as security issues by upstream

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9383a3a726)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:10 +01:00
Thomas Perale
3c88e7efaa boot/grub2: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The IGNORE_CVES entries introduced in [2][3][4] are then no longer
matched to the grub2 package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 2495630383 boot/grub2: ignore CVE-2024-1048
[3] e2f46ed03d boot/grub2: ignore CVE-2023-4001
[4] a490687571 boot/grub2: ignore the last 3 remaining CVEs

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2a2184f317)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:04:02 +01:00
Thomas Perale
1b63d0ba08 package/libcurl: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2024-32928 introduced in [2] is then no longer matched to the
libcurl package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching
[2] 7e739d49b2 package/libcurl: ignore CVE-2024-32928

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b155395a52)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:54 +01:00
Thomas Perale
66bc81b5c1 package/libssh: remove stale IGNORE_CVES
The entry was added in commit [1]. But since then the NVD database
updated the version end specifier.

This IGNORE_CVES entry is then no longer needed.

[1] 51b1e1daf5 package/libssh: ignore CVE-2025-5318

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4aacd22a85)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:44 +01:00
Thomas Perale
8b87f2597b package/pixman: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2023-37769 is then no longer matched to the pixman package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5043af53ed)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:36 +01:00
Thomas Perale
e7918ae91a package/postgresql: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2017-8806 is then no longer matched to the postgresql package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b1ca8ca4ba)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:25 +01:00
Thomas Perale
90a58c761c package/rsyslog: remove stale IGNORE_CVES
Since Buildroot commit [1] the CVEs are no longer matched to CPEs with
versions using '-'.

The CVE-2015-3243 is then no longer matched to the rsyslog package.

For more information, see the explanation in commit [1].

[1] 35f376d88e support/scripts/cve.py: fix CPE matching

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1e48fde1cb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:19 +01:00
Thomas Perale
aba6ad016d package/tiff: remove stale IGNORE_CVES
The Buildroot commit [1] introduced this IGNORE_CVES entry that was due
to a bad NVD entry.

The NVD database has now fixed the annotation [2] and it can be removed.

[1] 740412aefc package/tiff: ignore CVE-2025-8851
[2] https://nvd.nist.gov/vuln/detail/CVE-2025-8851

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 237cd294b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:11 +01:00
Thomas Perale
fe357abb84 package/patch: add CVE trailer in patches
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patches header as well
as the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74b079d9e9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:03:05 +01:00
Thomas Perale
d23ec514a8 package/shellinabox: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7c9166cd86)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:59 +01:00
Thomas Perale
f81cb193a8 package/xinetd: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header
and adds the `Upstream` trailer.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7a8524a701)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:52 +01:00
Bernd Kuhls
f7dec4b0d2 package/liburiparser: security bump version to 1.0.0
https://github.com/uriparser/uriparser/blob/uriparser-1.0.0/ChangeLog

Added sha256 hash provided by upstream.

Fixes CVE-2025-67899.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3ef90e752b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:40 +01:00
Bernd Kuhls
34399ef8c2 package/liburiparser: bump version to 0.9.9
Changelog:
https://github.com/uriparser/uriparser/blob/uriparser-0.9.9/ChangeLog

Renamed license file due to upstream commit:
460ff9e573

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 74214bd80e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:02:34 +01:00
Pierre-Yves Kerbrat
df3818dff9 package/imagemagick: security bump to 7.1.2-12
Changelog:
https://github.com/ImageMagick/Website/blob/main/ChangeLog.md

CVE-2025-66628:

    In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser
    contains a critical integer overflow vulnerability in its
    ReadTIMImage function (coders/tim.c).

    For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2025-66628

Signed-off-by: Pierre-Yves Kerbrat <pkerbrat@free.fr>
[Julien: mark commit as security related and add cve info]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4a315e153f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:00:53 +01:00
Alexis Lothoré
4374b541aa packages/linux-tools: perf: enforce PKG_CONFIG_LIBDIR
For kernel patched with 440cf77625e3 ("perf: build: Setup
PKG_CONFIG_LIBDIR for cross compilation"), if neither PKG_CONFIG_LIBDIR,
PKG_CONFIG_PATH nor PKG_CONFIG_SYSROOT_DIR are provided, the perf
Makefile while try to set some default value for PKG_CONFIG_LIBDIR,
which will not point correctly to buildroot staging directory. This
issue will lead for example to a failure to find libtraceevent even
if it is correctly enabled and installed in the staging dir, and so it
will make perf fail to build.

Make sure to call the perf make command with PKG_CONFIG_LIBDIR variable
set and pointing to buildroot staging area to make sure to properly
detect perf dependencies.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f784c823ef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 16:00:32 +01:00
Alexis Lothoré
dbdae1cda2 package/linux-tools: perf: build with libtraceevent support when it is selected
When trying to perform a custom uprobe recording on a target with perf
built by buildroot, the recording step fails as perf can not record
uprobes without libtraceevent support:

  $ perf probe -x linked_list insert_name index
  Target program is compiled without optimization. Skipping prologue.
  Probe on address 0x808 to force probing at the function entry.

  Added new event:
    probe_linked_list:insert_name (on insert_name in /root/gdb/linked_list with index)

  perf is not linked with libtraceevent, to use the new probe you can use tracefs:

          cd /sys/kernel/tracing/
          echo 1 > events/probe_linked_list/insert_name/enable
          echo 1 > tracing_on
          cat trace_pipe
          Before removing the probe, echo 0 > events/probe_linked_list/insert_name/enable
  $ perf record -e probe_linked_list:insert_name ./linked_list
  event syntax error: 'probe_linked_list:insert_name'
                       \___ unsupported tracepoint

  libtraceevent is necessary for tracepoint support
  Run 'perf list' for a list of valid events

   Usage: perf record [<options>] [<command>]
      or: perf record [<options>] -- <command> [<options>]

      -e, --event <event>   event selector. use 'perf list' to list available events

libtraceevent support for perf has been disabled with commit
b4ab45a5c1 ("package/linux-tools: disable libtracevent detection")
because there was no libtraceevent package in buildroot to replace the
former libtraceevent removed from the kernel sources. Since then, commit
1474f1b34b ("package/libtraceevent: new package") has introduced a
libtraceevent package. We can then expose again the possibility to build
perf with libtraceevent support.

Make buildroot perf makefile detect if libtraceevent package has been
enabled, and if so, allow to build perf with libtraceevent support.

Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Tested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5396f730d7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:58:08 +01:00
Dario Binacchi
4096db6b07 package/embiggen-disk: fix EMBIGGEN_DISK_VERSION
Make EMBIGGEN_DISK_VERSION compliant with release-monitoring.org.

Fixes: 4ae18c511a
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9824b964a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:57:46 +01:00
Thomas Perale
4d2210dcfa package/libfreeimage: various vulnerability patches
This package’s last release dates back to July 2018. Since then, a
number of CVEs have accumulated. This patch applies several
vulnerability fixes from the Fedora project. Not all vulnerabilities are
addressed by this patch.

- CVE-2019-12211

    When FreeImage 3.18.0 reads a tiff file, it will be handed to the
    Load function of the PluginTIFF.cpp file, but a memcpy occurs in
    which the destination address and the size of the copied data are
    not considered, resulting in a heap overflow.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2019-12211

- CVE-2019-12213

    When FreeImage 3.18.0 reads a special TIFF file, the
    TIFFReadDirectory function in PluginTIFF.cpp always returns 1,
    leading to stack exhaustion.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2019-12213

- CVE-2020-24292

    Buffer Overflow vulnerability in load function in PluginICO.cpp in
    FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
    code via opening of crafted ico file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24292
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2020-24293

    Buffer Overflow vulnerability in psdThumbnail::Read in PSDParser.cpp
    in FreeImage 3.19.0 [r1859] allows remote attackers to run arbitrary
    code via opening of crafted psd file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24293
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2020-24295

    Buffer Overflow vulnerability in PSDParser.cpp::ReadImageLine() in
    FreeImage 3.19.0 [r1859] allows remote attackers to ru narbitrary
    code via use of crafted psd file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2020-24295
  - https://sourceforge.net/p/freeimage/discussion/36111/thread/afb98701eb/

- CVE-2021-33367

    Buffer Overflow vulnerability in Freeimage v3.18.0 allows attacker
    to cause a denial of service via a crafted JXR file.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-33367
  - https://sourceforge.net/p/freeimage/discussion/36109/thread/1a4db03d58/

- CVE-2021-40263

    A heap overflow vulnerability in FreeImage 1.18.0 via the ofLoad
    function in PluginTIFF.cpp.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-40263
  - https://sourceforge.net/p/freeimage/bugs/336/

- CVE-2021-40266

    FreeImage before 1.18.0, ReadPalette function in PluginTIFF.cpp is
    vulnerabile to null pointer dereference.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2021-40266
  - https://sourceforge.net/p/freeimage/bugs/334/

- CVE-2023-47995

    Memory Allocation with Excessive Size Value discovered in
    BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0
    allows attackers to cause a denial of service.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2023-47995

- CVE-2023-47997

    An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in
    FreeImage 3.18.0 leads to an infinite loop and allows attackers to
    cause a denial of service.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2023-47997

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6750719a20)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-09 15:56:31 +01:00
Thomas Perale
3f9e201663 package/pixman: fix patch reference in IGNORE_CVES
Since Buildroot commit [1] the
`0001-Disable-tests.patch` patch reference
was removed in favour of a build argument that disable the tests.

This update the reference in IGNORE_CVES accordingly.

[1] ba2fb599cd package/pixman: bump to version 0.44.2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f276648692)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:44 +01:00
Thomas Perale
9cb5a7f690 package/sdl: fix patch reference in IGNORE_CVES
Since Buildroot commit [1] the
`0003-SDL_x11yuv.c-fix-possible-use-after-free.patch` patch reference
was renamed.

This update the reference in IGNORE_CVES accordingly.

[1] 9fab7bb79d package/sdl: drop directfb support

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d372b654a4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:42 +01:00
Thomas Perale
23ccc3ab5c package/sdl: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ee647574b7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:40 +01:00
Thomas Perale
288e04ed50 package/libtomcrypt: add CVE trailer in patch
Since Buildroot commit [1] the patches that fixes a security
vulnerability needs to reference the fixed vulnerability.

This patch adds the relevant information to the patch header.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9265e69735)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-01-06 09:19:38 +01:00