A new (and hopefully definitive) CPE is to be used for TF-A:
cpe:2.3:o:trustedfirmware:trusted_firmware-a:
as reported in TF-A directly[1]. NVD correctly reports[2] the new CPE
deprecates the "old" one Buildroot was using.
CVEs for projects under the TrustedFirmware umbrella are now seemingly
handled under the CPE vendor "trustedfirmware".
[1] efd7b189fa%5E%21/
[2] https://nvd.nist.gov/products/cpe/detail/2E1BD3E8-DF65-42E3-A0BA-747137D6DEF2
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
With qemu version 11.0.0, support for microblazeel has been folded into the
microblaze target. This means that the run command for microblazeel-mmu needs
to be changed to reflect this.
See the notes in the qemu bump commit to 11.0.0 for more details:
9a5369effd
See also qemu removed feature documentation:
https://gitlab.com/qemu-project/qemu/-/blob/v11.0.0/docs/about/removed-features.rst#qemu-system-microblazeel-removed-in-11-0
Run command for qemu versions prior to 11.0.0:
qemu-system-microblazeel -M petalogix-s3adsp1800 -kernel output/images/linux.bin -serial stdio
New run command since qemu version 11.0.0:
qemu-system-microblaze -M petalogix-s3adsp1800,endianness=little -kernel output/images/linux.bin -serial stdio
Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Kanak Shilledar <kanak.shilledar@axis.com>
[Julien:
- fix new command line in commit log
- add link to qemu removed feature documentation in commit log
- change link to buildroot commit from github to gitlab
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Packaging changes:
- Drop patch that is upstream (it was an upstream backport)
- double-conversion now requires CMake 3.29, so we select
BR2_HOST_CMAKE_AT_LEAST_3_29
Upstream changes:
CMake: Raised required version to 3.5 by @heirecka in #240
Bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot[bot] in #241
Always initialize decimal-point variable. by @floitsch in #244
Explain that ToShortest might not be the shortest. by @floitsch in #245
Add higher bound for cmake. by @floitsch in #246
Bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #248
Bump lukka/get-cmake from 4.0.2 to 4.0.3 by @dependabot[bot] in #250
Bump lukka/get-cmake from 4.0.3 to 4.1.0 by @dependabot[bot] in #252
Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #253
Bump lukka/get-cmake from 4.1.0 to 4.1.1 by @dependabot[bot] in #254
Add alias double-conversion::double-conversion by @Flamefire in #255
Revert "Add _ITERATOR_DEBUG_LEVEL=2 and _DEBUG defines (#202)" by @Osyotr in #256
Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #259
Install pkg-config file (from CMake build) by @Ericson2314 in #262
Update CI runners and minimal cmake. by @floitsch in #257
Bump lukka/get-cmake from 4.1.1 to 4.1.2 by @dependabot[bot] in #258
Bump lukka/get-cmake from 4.1.2 to 4.2.0 by @dependabot[bot] in #264
Bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #265
Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #266
Prepare new release. by @floitsch in #267
See https://github.com/google/double-conversion/releases/tag/v3.4.0
Tested in a defconfig that has the two reverse dependencies of
double-conversion in Buildroot:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON_UJSON=y
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changes:
Security and robustness release. Notable cramfsck changes:
* Reject dirent names containing "/", "." or ".." to close a path
traversal during `cramfsck -x` (reported in issue #12).
* Open regular files with O_CREAT|O_EXCL during extraction to
prevent duplicate-dirent attacks from truncating files reached
via a previously-extracted symlink.
* Fix outbuffer NUL termination and a 1-byte overflow in
do_symlink when running with both -v and -x.
* Harden romfs_read against truncated/malformed images by
zero-filling the window buffer and checking lseek/read returns.
* Reject directory entries that extend past their parent's size.
Documentation: README now documents cramfsck and lists all current
mkcramfs options; stale hard-link and endianness claims corrected;
NOTES trimmed of the 25-year-old Future Development section.
(See https://github.com/npitre/cramfs-tools/releases/tag/v2.2)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit
c66d1ba685b0d03b28967d2f7a48f6c64687efa2 ("Fortran: Add a shared
memory multi process coarray implementation [PR88076]"), libgfortran
now unconditionally uses fork(), which makes it impossible to build
Fortran support on noMMU architectures.
In follow-up commit efb497c23a6f4109bf8794342617cbc161c08301, it was
made even more clear: if you don't have fork() and you're not on
WIN32:
+#else
+#error "no way known to start child processes."
+#endif
There are apparently no autobuilder failures for this issue, but the
simple defconfig below allows to trigger the build failure:
BR2_arm=y
BR2_cortex_m7=y
BR2_GCC_VERSION_16_X=y
BR2_TOOLCHAIN_BUILDROOT_FORTRAN=y
Even though this issue is only starting from GCC 16.x, we make Fortran
unavailable on noMMU configurations regardless of the GCC version,
with the reasoning that:
1. Fortran on noMMU is unlikely to be in use
2. Moving forward, all future versions of GCC will have this
restriction
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog since 1.0.9:
Fix race in thread-per-connection mode on wake-up signal
between daemon and thread that could result in lost wake-ups
and thus connections that did not finish processing.
Fix rare assertion failure in relation to suspend-and-resume
processing (harmless if assertions were turned off).
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
"This is an important release containing extensive security hardening
across the core, mod_rtmp, mod_xml_rpc and mod_sofia, alongside the new
interface allowlist, stricter DTLS/STUN validation for media sessions,
and a modernized build system. We strongly encourage all users to
upgrade to v1.11.2 as soon as possible."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch which is included in this release.
Added patches to fix build of host utils and added dependency to
host-tiff. Otherwise build errors will occur when the host does not
provide tiffio.h.
These changes are necessary due to changes introduced by this version
bump which includes upstream commit
a60119408c
added in 2023. No LTS backport needed in buildroot.
Switched to github helper to download the current git tree instead of
using outdated tarball snapshots.
The currently used tarball contains the git tree as of 2020-08-14:
6ec23e5a7e
The newest tarball provided by upstream
https://files.freeswitch.org/downloads/libs/spandsp-3.0.0-0d2e6ac65e.tar.gz
contains the git tree as of 2023-06-16:
0d2e6ac65e
and lacks the fix for gcc-14.x added to buildroot in patch 0002.
Build-tested using this defconfig:
BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_INIT_NONE=y
BR2_PACKAGE_BLUEZ_ALSA=y
BR2_PACKAGE_FREESWITCH=y
BR2_PACKAGE_WIRESHARK=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Github repository has been renamed from dracut-ng to dracut. The
wiki still exists, but the actual documentation has been moved to
dracut-ng.github.io.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Redis 8.10 is a new feature release, see the changes:
https://github.com/redis/redis/blob/8.10.0/00-RELEASENOTES
Since upstream commit 4dd58caa7cc23225b01f31e7bd9a1ed0af7e49ad [1],
Redis must now be built with `make build redis` to avoid building extra
modules, which are distributed within the source code archive since 8.10.0
Moreover, because the default upstream configuration now includes those
modules, attempting to launch redis-server with this would fail, because
it cannot load the missing modules. Therefore, we use the provided
`make sync-redis-conf` to regenerate a full redis configuration that
take the absence of modules into account, and we install that config
file instead of the default one.
[1] 4dd58caa7c
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
in [1]. The IGNORE_CVES entry was removed while the patch is still
present in [2].
Re-introduce this IGNORE_CVES entry.
[1] 75c594d446 package/busybox: fix pending CVEs
[2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix patch number in comment (s/0008/0007/)]
Signed-off-by: Julien Olivain <ju.o@free.fr>
In commit e427f85e29 ("boot/grub2: fix
build issue since 2.14 version bump") we added some patches that
require regenerating the configure script. Consequently, we added
GRUB2_AUTORECONF = YES and HOST_GRUB2_AUTORECONF = YES.
Except that grub2 is special. While the host package is indeed using
host-autotols-package, the target package is using generic-package,
making GRUB2_AUTORECONF = YES basically a no-op.
Except that since we're patching configure.ac, the build realize at
build time that configure is older than configure.ac, regenerates it
at that time, and re-runs the configure script without the right
environment variables causing build failures.
We fix that by doing the autoreconf step "manually" for the target
grub2 package.
Fixes:
https://autobuild.buildroot.org/results/11802ca1762e046328df324d33a1ad813fcd92e8/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When adding the libldns and python_scp, the corresponding tests were not
added to DEVELOPERS, preventing correct notifications in case of tests
failures.
Add the missing entries to enable proper author notifications in case of
failing tests.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit 0c716a157be460006a4b762625de329b5e36dbf9 (first
release: v2026.07) mkeficapsule supports PKCS#11 keys, and in turn
requires GnuTLS with PKCS#11 support.
Without it, building mkeficapsule for the target fails:
HOSTLD tools/mkeficapsule
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: tools/mkeficapsule.o: in function `main':
mkeficapsule.c:(.text.startup+0x530): undefined reference to `gnutls_pkcs11_init'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x544): undefined reference to `gnutls_pkcs11_add_provider'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x5fc): undefined reference to `gnutls_pkcs11_obj_list_import_url4'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x620): undefined reference to `gnutls_x509_crt_import_pkcs11'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x1334): undefined reference to `gnutls_pkcs11_deinit'
collect2: error: ld returned 1 exit status
The error can be reproduced using "utils/test-pkg -c" with the
following config:
BR2_PACKAGE_UBOOT_TOOLS=y
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y
For host-uboot-tools this was solved in Buildroot commit
6597563da7 "package/gnutls: add host
support for pkcs11" by unconditionally enabling PKCS#11 support for
host-gnutls. For the target a more fine-grained approach is desirable,
so instead select BR2_PACKAGE_P11_KIT if
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y and propagate dependencies.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
