Commit Graph

51203 Commits

Author SHA1 Message Date
Bernd Kuhls
4f675137ca package/libexif: add security fix for CVE-2020-0198
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0606633608)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-13 19:07:59 +01:00
Fabrice Fontaine
371df00b28 package/davfs2: fix indent
Fix the following check-package warning added by commit
a2b98a6add:

package/davfs2/davfs2.mk:22: expected indent with tabs

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 62bb541d99)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 11:01:05 +01:00
Sven Klomp
cb56a4169e package/davfs2: add davfs2 user and group
mount.davfs expects the availability of the user and group davfs2.

Signed-off-by: Sven Klomp <mail@klomp.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a2b98a6add)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:52:20 +01:00
Fabrice Fontaine
fd430ccd80 package/lzlib: add license file
Add lzlib.c as the license file and, while at it, update indentation to
two spaces

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit afdaeab729)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:51:08 +01:00
Fabrice Fontaine
76bc74ddae package/darkhttpd: add license file
Add license file and, while at it, update indentation to two spaces

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1906912a04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:50:32 +01:00
Bernd Kuhls
dc54edd57a package/freetype: security bump version to 2.10.4
Fixes CVE-2020-15999, https://www.freetype.org/index.html#news

"This is an emergency release, fixing a severe vulnerability in embedded
 PNG bitmap handling [...].

 All users should update immediately."

Removed md5 hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1ffe654c6d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:44:48 +01:00
Bernd Kuhls
6a36c7f1a5 package/freetype: bump version to 2.10.2
Release notes:
https://sourceforge.net/projects/freetype/files/freetype2/2.10.2/

Reformatted hashes.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d32fc1f9c9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:44:17 +01:00
Bernd Kuhls
3fba9ffaa5 package/ghostscript: fix build with freetype >= 2.10.3
This patch is needed to fix the build with freetype >= 2.10.3.

https://www.freetype.org/index.html#news
"A warning for distribution maintainers: Version 2.10.3 and later may
 break the build of ghostscript, due to ghostscript's use of a with-
 drawn macro that wasn't intended for external usage."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5177f726a0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:43:36 +01:00
Bernd Kuhls
9bb3817d33 package/jsoncpp: security bump version to 1.9.4
Release notes of this "Security and build system fixes" release:
https://github.com/open-source-parsers/jsoncpp/releases/tag/1.9.4

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b2019a5183)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:37:44 +01:00
Bernd Kuhls
1383a8c6b1 package/jsoncpp: bump version to 1.9.3
Removed patch which was committed upstream.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bab0d6ef43)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:37:40 +01:00
Fabrice Fontaine
d4330f5dc6 package/oniguruma: security bump to version 6.9.6
Drop patch (already in version)

Fixed many problems found by OSS-Fuzz
Fixed many problems found by Coverity

https://github.com/kkos/oniguruma/releases/tag/v6.9.6

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 969fe10855)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:32:53 +01:00
Fabrice Fontaine
72a2393712 package/oniguruma: bump to version 6.9.5
Update hash of COPYING (update in year):
1952e8970a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ab8964ae77)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:32:44 +01:00
Fabrice Fontaine
83a9d9eb29 package/gstreamer1/gst1-plugins-bad: fix typo
dvdsub{enc,overlay} -> dvbsub{enc,overlay}

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8d6c60656e)
[Peter: drop dvbsubenc, only added in 1.18.0]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:29:54 +01:00
Fabrice Fontaine
65864c4cf4 package/opencv3: fix OPENCV3_CLEAN_INSTALL_{DOC, CMAKE}
opencv3 does not install anything in $(TARGET_DIR)/usr/share/OpenCV/doc
so drop OPENCV3_CLEAN_INSTALL_DOC

However it installs its licence files in
$(TARGET_DIR)/usr/share/licenses/opencv3 so add
OPENCV3_CLEAN_INSTALL_LICENSE

Moreover, the cmake hook does not catch all cmake files and missed the
valgrind files so update OPENCV3_CLEAN_INSTALL_CMAKE and add
OPENCV3_CLEAN_INSTALL_VALGRIND to delete those files:
OpenCVConfig.cmake  OpenCVConfig-version.cmake  OpenCVModules.cmake  OpenCVModules-release.cmake  valgrind_3rdparty.supp  valgrind.supp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 436f4804b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-09 10:20:00 +01:00
Vadym Kochan
2ef3e19b7b Revert "keepalived: needs headers >= 3.4"
This reverts commit d01b0bbad0.

Original commit  made restriction for Linux headers < 3.4 which was
related to keepalived version 1.3.5, but it compiles fine now at least
with a toolchain based on 3.2 headers and keepalived 2.0.15 together
with ipset enabled.

Probably it was fixed by this commit:

    5a7f895bb7

Signed-off-by: Vadym Kochan <vadym.kochan@plvision.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c69a88190a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-08 19:24:08 +01:00
Yann E. MORIN
60b751a126 package/busybox: update licensing info
Busybox is mainly licensed under the GPL-2.0, but the bzip2 part is a
modified copy of the bzip2/libbzip2 project, which comes with its own
license.

Update the licensing information accordingly.

Add the hash for the new license file, and fixup indentation (2 spaces).

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ca76d0336d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-08 19:14:23 +01:00
Arnout Vandecappelle (Essensium/Mind)
51a2114b60 systemd: clear telinit path
Since we don't enable sysv any support, it makes no sense to set the
path to telinit either.

The path we were setting was anyway wrong: we set a path into
TARGET_DIR, but this path is only used at runtime, on the target, where
TARGET_DIR doesn't exist (it should have been /usr/sbin/telinit).

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8bc9350963)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-08 18:50:09 +01:00
Norbert Lange
d8636f93e7 package/systemd: add missing path options
If paths are not set, then meson will search the host system for the
binaries (or the target, where those binaries are not yet installed).
So add the missing paths.

Signed-off-by: Norbert Lange <nolange79@gmail.com>
Reviewed-by: Adam Duskett <aduskett@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit acb62b3336)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-08 18:49:45 +01:00
Alexey Brodkin
f3b39430ab package/gcc: Fix libs building on ARC700 with atomics
As we many times by now discussed that - some ARC cores might
not have atomic instructions implemented. Namely that's ARC700
w/o explicitly added atomics during design creation/configuration.

Because of that when GCC gets configured for ARC700, i.e. via
"--with-cpu=arc700" atomic ops are assumed disabled.

Usually it's not a problem as we add "-matomics" in the wraper for
building all packages if targets CPU has atomis (BR2_ARC_ATOMIC_EXT).

But when bulding target's binaries which are essential parts of
the GCC itself we don't use the wrapper. Instead xgcc is being used.
That way we lose that important part of system's configuration about
atomics and:
 1. Atomic ops won't be used where otherwise they could have been used.
 2. Some configuration checks might end-up thinking there're no atomics

In particular (2) leads to pretty obscure failure on bulding of some
packages which use C++, for example:

log4cplus: http://autobuild.buildroot.net/results/a7732fdb2ba526a114d9fb759814236c5332f8d7
------------------------>8--------------------
./.libs/liblog4cplus.so: undefined reference to `std::__atomic_futex_unsigned_base::_M_futex_notify_all(unsigned int*)'
collect2: error: ld returned 1 exit status
------------------------>8--------------------

bitcoin: http://autobuild.buildroot.net/results/f73/f73d4c77e5fd6223abdbc83e344addcfc93227b8
------------------------>8--------------------
(.text+0x110c): undefined reference to `std::__atomic_futex_unsigned_base::_M_futex_wait_until(unsigned int*, unsigned int, bool, std::chrono::duration<long long, std::ratio<1ll, 1ll> >, std::chrono::duration<long long, std::ratio<1ll, 1000000000ll> >)'
collect2: error: ld returned 1 exit status
------------------------>8--------------------

apcupsd: http://autobuild.buildroot.net/results/7a2/7a2cc7a4ac2237c185817f75e55e05d144efd100
------------------------>8--------------------
/tmp/instance-0/output-1/host/lib/gcc/arc-buildroot-linux-uclibc/9.3.1/../../../../arc-buildroot-linux-uclibc/bin/ld: eh_throw.cc:(.text._ZL23__gxx_exception_cleanup19_Unwind_Reason_CodeP17_Unwind_Exception+0x24): undefined reference to `__gnu_cxx::__exchange_and_add(int volatile*, int)'
collect2: error: ld returned 1 exit status
------------------------>8--------------------

...and many more.

Interesting enough that was not seen earlier because "-matomic"
used to be added in TARGET_{C|CXX}FLAGS via TARGET_ABI,
but later "-matomic" was moved to ARCH_TOOLCHAIN_WRAPPER_OPTS, see
https://git.buildroot.org/buildroot/commit/?id=c568b4f37fa6d7f51e6d14d33d7eb75dfe26d7bf
and since then we started to see that new breakage which we now
attempt to fix right where it hapens on GCC configuration.

In contrast ARC HS family has atomic ops enabled by default thus
we never spotted that kind of problem for it.

More datails with analysis of what really happens under the hodd and
how do error messages above are related to libs of GCC configuration could
be found here: http://lists.busybox.net/pipermail/buildroot/2020-October/293614.html

Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@gmail.com>
[Peter: simplify conditional]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d2ae7eb2a2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-07 19:53:37 +01:00
Fabrice Fontaine
f744fc3a01 package/zeromq: add libbsd optional dependency
libbsd is an optional dependency which is enabled by default since
version 4.3.3 and
068385c951

Fixes:
 - http://autobuild.buildroot.org/results/51220b1b82774e8f6f6ed8593c58d2e3c31a1531

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 25b5dc747a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-07 18:45:19 +01:00
Fabrice Fontaine
57aabd3ca1 package/libass: security bump to version 0.15
- harfbuzz is mandatory since
  f3e2c97e18
- Fix CVE-2020-26682 (In libass 0.14.0, the `ass_outline_construct`'s
  call to `outline_stroke` causes a signed integer overflow.) through
  676f9dc5b5
  which does not apply cleanly over version 0.14.
  It should be noted that version 0.15 also fixes other integer
  overflows (which have no CVE assigned)
- Update indentation in hash file (two spaces)

https://github.com/libass/libass/releases/tag/0.15.0

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4ae8ecea8f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-07 18:41:06 +01:00
Gwenhael Goavec-Merou
de8089fbf4 package/gnuradio: backport patch to fix INTERFACE_INCLUDE_DIRECTORIES
gnuradio-runtimeTargets.cmake and gnuradio-pmtTargets.cmake are filled
using CMAKE_INSTALL_PREFIX for INSTALL_INTERFACE.

Since CMAKE_INSTALL_PREFIX, in buildroot, is set to /usr, these files contains
path to host system.

With BR2_COMPILER_PARANOID_UNSAFE_PATH package using gnuradio fails with:
arm-linux-gnueabihf-g++: ERROR: unsafe header/library path used in cross-compilation: '-isystem' '/usr/include'

By simply providing 'include', produced .cmake contains:
INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
instead of
INTERFACE_INCLUDE_DIRECTORIES "/usr/include"

[Upstream status: https://github.com/gnuradio/gnuradio/pull/3737]

Fix (many) gr-osmosdr build failure:
- http://autobuild.buildroot.net/results/66b76c07f15bb3e6db697c47796ae3dd15ecf4b9/

Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5209123494)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a81b187c16)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 17:58:51 +01:00
Fabrice Fontaine
ed28e24083 package/wireshark: add zstd optional dependency
zstd is available since version 3.1.1 and is enabled by default:
ad94c4d459

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 105004f72a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 11:16:47 +01:00
Fabrice Fontaine
913ff39ca4 package/wireshark: security bump to version 3.2.8
- Fix CVE-2020-26575: In Wireshark through 3.2.7, the Facebook Zero
  Protocol (aka FBZERO) dissector could enter an infinite loop. This was
  addressed in epan/dissectors/packet-fbzero.c by correcting the
  implementation of offset advancement.
  https://www.wireshark.org/security/wnpa-sec-2020-14.html
- Fix GQUIC dissector crash:
  https://www.wireshark.org/security/wnpa-sec-2020-15.html

https://www.wireshark.org/docs/relnotes/wireshark-3.2.8.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7da2b1ebf9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 11:12:44 +01:00
Gary Bisson
c1ca8b6b51 package/qt5/qt5base: fix imx6 eglfs support with imx-gpu-viv
Last commit fixed eglfs_kms support for i.MX8 platforms that required to
declare imx-gpu-viv as the gbm provider.
However, this broke the eglfs "fbdev" imx6 support as gbm isn't provided
in this case. So limit the gbm option to imx-gpu-viv when wayland
backend is used only.

Fixes: 82fb51d3b5 ("package/qt5/qt5base: allow to use imx-gpu-viv as GBM
provider")

Signed-off-by: Gary Bisson <gary.bisson@boundarydevices.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 25f2191ed2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 11:09:58 +01:00
Fabrice Fontaine
cb0cac5081 package/libraw: needs autoreconf
configure is older than configure.ac in official libraw 0.20.2 tarball:
https://github.com/LibRaw/LibRaw/issues/353

Fixes:
 - http://autobuild.buildroot.org/results/abef2ac14a959093a6391cad28e738558e15ceec

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 082d0fea3d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 11:04:18 +01:00
Fabrice Fontaine
66197f9760 package/fastd: libcap is optional not mandatory
libcap is an optional dependency which is available since version 7:
eaac494273

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 25ab2d8b11)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 10:39:38 +01:00
Michael Nosthoff
dbf5097d51 package/grpc: fix build on ubuntu gcc 4.8
gcc 4.8 on ubuntu 14.04 does some broken optimization at link-time
which causes grpc to create a grpc_cpp_plugin which quits because
of a failing assertion. The created plugin is itself used during
compilation which lets the build fail.
With the added -Wl,--no-as-needed flag the LTO is disabled and grpc
compiles successfully.

fixes:
- http://autobuild.buildroot.net/results/b554f6f2fb66892273f7520ad6e36923557b229e
- http://autobuild.buildroot.net/results/3ebb2880b9b3fd5154979016391dde897e2c039c
- http://autobuild.buildroot.net/results/c2078e821e0728fe980be2c849c25d82e791a4c2

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
[yann.morin.1998@free.fr: rewrap the comment]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 19dfe7f6e7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 10:27:16 +01:00
Fabrice Fontaine
7d275737cf package/fastd: fix CVE-2020-27638
receive.c in fastd before v21 allows denial of service (assertion
failure) when receiving packets with an invalid type code.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Alexander Dahl <post@lespocky.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7e4af3ce3f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 08:46:49 +01:00
Bernd Kuhls
4b576cf66f package/samba4: security bump version to 4.11.15
Fixes
o CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify.
o CVE-2020-14323: Unprivileged user can crash winbind.
o CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily
                  crafted records.

Release notes:
https://www.samba.org/samba/history/samba-4.11.14.html (bugfix-only)
https://www.samba.org/samba/history/samba-4.11.15.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3adbb6d296)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-03 08:42:41 +01:00
Bernd Kuhls
85edcc54c7 package/php: security bump version to 7.4.12
Changelog: https://www.php.net/ChangeLog-7.php#7.4.12

According to the release notes this is a "security bug fix release":
https://news-web.php.net/php.announce/300

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 69beb4dd98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-02 23:10:15 +01:00
Fabrice Fontaine
f8ad439d53 package/libpam-tacplus: fix CVE-2020-27743
libtac in pam_tacplus through 1.5.1 lacks a check for a failure of
RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a
non-random/predictable session_id.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 70499767e5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-02 22:55:30 +01:00
Fabrice Fontaine
374235351b package/libpam-tacplus: fix build when time_t is 64 bits
Fixes:
 - http://autobuild.buildroot.org/results/874433d8cb30d21332f23024081a8b6d7b3254ae

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit bcc02f5fe5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-02 22:55:00 +01:00
Fabrice Fontaine
d0637d7592 package/libpam-tacplus: fix build on musl
Retrieve two upstream patches to fix build on musl

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cca807a3a3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-02 22:54:49 +01:00
Doug Kehn
48052b57f6 DEVELOPERS: update email address
Signed-off-by: Doug Kehn <rdkehn@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b6c1441636)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-11-02 22:17:08 +01:00
Thomas Petazzoni
5cecde822f DEVELOPERS: replace Trent Piepho's e-mail address
Trent's e-mail address is no longer working:

<tpiepho@impinj.com>: host us-smtp-inbound-2.mimecast.com[205.139.110.221]
    said: 550 Invalid Recipient -
    https://community.mimecast.com/docs/DOC-1369#550
    [7R954rMIM8GCM0FMERvPAg.us536] (in reply to RCPT TO command)

Use another e-mail that Trent has recently used on the mailing list.

Cc: Trent Piepho <trent.piepho@synapse.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1c20802d4b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:48:41 +01:00
Thomas Petazzoni
44e5489a31 DEVELOPERS: change Julien Olivain's e-mail address
Julien's e-mail @cotds.org is no longer working:

<juju@cotds.org>: host mail.cotds.org[194.117.244.136] said: 451 4.3.5 Server
    configuration problem (in reply to RCPT TO command)

Use his @free.fr e-mail address instead.

Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr: adjust email address after Julien's review]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1194b5c81a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:45:37 +01:00
Thomas Petazzoni
dba08b1b95 DEVELOPERS: drop Mamatha Inamdar
His/her e-mail address is bouncing:

VMSDVM9.POK.IBM.COM unable to deliver following mail to recipient(s):
    <mamatha4@linux.ibm.com>
VMSDVM9.POK.IBM.COM received negative reply:
550 5.1.1 <mamatha4@linux.ibm.com>: Recipient address rejected: User unknown in local recipient table

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 656c34dc87)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:44:08 +01:00
Ryan Coe
e72ea47e4c DEVELOPERS: remove Ryan Coe
Signed-off-by: Ryan Coe <bluemrp9@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bbbbe9661f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:42:25 +01:00
Matt Weber
b01baed229 package/gcc: disable fortran use of libquadmath
The GCC package has a default conf option of disabling libquadmath and
the toolchain dependencies selectively enabled it if i386 / x64.

Fixes:
https://gitlab.com/bootlin/toolchains-builder/-/jobs/729359622

This patch fixes a build failure when (GCC + glibc) is being built for
the IBM Power8 arch and has libgfortran enabled + libquadmath disabled.
The libgfortran has a code condition for __float128 and includes the
quadmath headers. The bug occurs because Power8 has emulated
float128 support. The fix per GCC options is to also set
--disable-libquadmath-support which disables the
__float128/libquadmath support in gcc/fortran and in libgfortran [1].

Another option to fix the build failure was to enable libquadmath for
IBM Power8 (ISA 2.07), however this would be soft float based as the
ISA 3.0+ (Power9) first supports native float128 [2][3].

[1] https://fortran.gcc.gnu.narkive.com/8uSfoKUS/patch-build-pr-46540-add-disable-libquadmath-disable-libquadmath-support
[2] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66382#c7
[3] https://gcc.gnu.org/onlinedocs/gcc/RS_002f6000-and-PowerPC-Options.html

Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Matthew Weber <matthew.weber@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a07fc4b03b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:36:06 +01:00
Peter Korsgaard
957ff8fa25 package/cryptsetup: backport upstream security fixes
Fixes CVE-2020-14382: A vulnerability was found in upstream release
cryptsetup-2.2.0 where, there's a bug in LUKS2 format validation code, that
is effectively invoked on every device/image presenting itself as LUKS2
container.  The bug is in segments validation code in file
'lib/luks2/luks2_json_metadata.c' in function hdr_validate_segments(struct
crypt_device *cd, json_object *hdr_jobj) where the code does not check for
possible overflow on memory allocation used for intervals array (see
statement "intervals = malloc(first_backup * sizeof(*intervals));").  Due to
the bug, library can be *tricked* to expect such allocation was successful
but for far less memory then originally expected.  Later it may read data
FROM image crafted by an attacker and actually write such data BEYOND
allocated memory.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-30 09:32:00 +01:00
Michael Nosthoff
bdaa66edcb package/nginx: use /run instead of /var/run
This is a follow-up to 4027ba29f4 ("package/nginx: use /run for
PIDFile"), in which we missed that nginx is still built with /var/run
paths.

This commit changes the compile options to use /run instead of
/var/run for pid and lock file to make it consistent.

Further dropping the passing of the pid option in the service file as
this isn't neccessary. Neither debian nor nginx default .service does
it.

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d200ceffb2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 23:01:34 +01:00
Adrian Perez de Castro
46704f89e8 package/webkitgtk: disable JIT for ARMv5 and ARMv6
WebKit's JavaScriptCore does not support using JIT nor the LLint
interpreter on ARMv5 and ARMv6, so add those two cases when checking
for target CPUs which need to use the CLoop interpreter.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 594eb3df50)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 20:00:12 +01:00
Adrian Perez de Castro
35845ba676 package/webkitgtk: fix build with ENABLE_C_LOOP=ON
The ENABLE_C_LOOP option conflicts with ENABLE_SAMPLING_PROFILER, so
the WebKit CMake build system will emit an error when both are enabled
at the same time. To avoid hitting that situation, explicitly disable
ENABLE_SAMPLING_PROFILER as needed.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e6e78c1752)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 20:00:07 +01:00
Adrian Perez de Castro
4401bd205a package/wpewebkit: disable JIT for ARMv5 and ARMv6
WebKit's JavaScriptCore does not support using JIT nor the LLint
interpreter on ARMv5 and ARMv6, so add those two cases when checking
for target CPUs which need to use the CLoop interpreter.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f8eaccdddc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 19:59:57 +01:00
Adrian Perez de Castro
5a9db3ce3a package/wpewebkit: fix build with ENABLE_C_LOOP=ON
The ENABLE_C_LOOP option conflicts with ENABLE_SAMPLING_PROFILER, so
the WebKit CMake build system will emit an error when both are enabled
at the same time. To avoid hitting that situation, explicitly disable
ENABLE_SAMPLING_PROFILER as needed.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7a66e3e189)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 19:59:51 +01:00
Christian Stewart
f70d050e0e package/docker-engine: bump to version 19.03.13
The Docker developers appear to no longer be tagging releases on the
docker/engine repository on GitHub, but are tagging releases on the main
moby/moby repository, which still is the true home of "dockerd."

This commit changes the upstream repo to moby/moby with no changes required.

Signed-off-by: Christian Stewart <christian@paral.in>

v1 -> v2:

 - updated hash
 - changed upstream to moby/moby

Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ebd4d9a61)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 18:40:00 +01:00
Christian Stewart
ff6cc76c64 package/docker-cli: bump to version 19.03.13
Signed-off-by: Christian Stewart <christian@paral.in>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7534354563)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 18:39:55 +01:00
Fabrice Fontaine
a83dc6faef package/libraw: security bump to version 0.20.2
Fix CVE-2020-24890: libraw 20.0 has a null pointer dereference
vulnerability in parse_tiff_ifd in src/metadata/tiff.cpp, which may
result in context-dependent arbitrary code execution.

https://www.libraw.org/news/libraw-0-20-2-Release

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1a05b7cc7c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 17:38:51 +01:00
Ignacy Gawędzki
11f1178c14 package/angularjs: security bump version to 1.8.0
Fixes the following security issue:

- CVE-2020-11022: Potential XSS vulnerability in jQuery
  https://github.com/advisories/GHSA-gxr4-xjj5-5px2

Signed-off-by: Ignacy Gawędzki <ignacy.gawedzki@green-communications.fr>
[yann.morin.1998@free.fr: two spaces in hash file]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4fc87ffb50)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2020-10-29 17:27:29 +01:00