mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity
68,314 Commits 6 Branches 483 Tags
50834a50e172847ab35be918c4b92a2fb2d46f39
Commit Graph

68314 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Fabrice Fontaine
50834a50e1 package/libvips: update LIBVIPS_CPE_ID_VENDOR 
cpe:2.3:a:libvips_project:libvips has been deprecated in favor of
cpe:2.3:a:libvips:libvips in September 2023:

<cpe-item name="cpe:/a:libvips_project:libvips:8.10.6:-" deprecated="true" deprecation_date="2023-09-29T11:18:01.067Z">
    <title xml:lang="en-US">libvips Project libvips 8.10.6 -</title>
      <reference href="https://libvips.github.io/libvips/">Project</reference>
      <reference href="https://github.com/libvips/libvips/releases">Change Log</reference>
    <cpe-23:cpe23-item name="cpe:2.3:a:libvips_project:libvips:8.10.6:-:*:*:*:*:*:*">
        <cpe-23:deprecated-by name="cpe:2.3:a:libvips:libvips:8.10.6:-:*:*:*:*:*:*" type="NAME_CORRECTION"/>

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5e4eba6414)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:14:30 +01:00
Fabrice Fontaine
c3203317ec package/minizip: fix CPE variables 
cpe:2.3:a:minizip_project:minizip added by commit
425339dcdf is not a valid CPE identifier
for this package, cpe:2.3:a:zlib-ng:minizip-ng is the correct one:

  https://nvd.nist.gov/products/cpe/detail/64E392F1-65DD-42E5-B618-AD893BA37FB3

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f1e05a8199)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:13:57 +01:00
Fabrice Fontaine
5e5a8f7383 package/lvm2: fix CPE variable 
Commit d70da0be78 wrongly set
LVM2_CPE_ID_PRODUCT instead of LVM2_CPE_ID_VENDOR

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8c0d9795a7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:13:39 +01:00
Fabrice Fontaine
ed4b9473c3 package/mpfr: fix CPE variables 
cpe:2.3:a:gnu:mpfr added by commit
63332c33aa has never been a valid CPE
identifier for this package

cpe:2.3:a:mpfr:gnu_mpfr is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/7B981E0A-5BAC-4A80-A734-5FD4B51B04EF

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 186883f497)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:13:02 +01:00
Fabrice Fontaine
535bac39d5 package/crda: drop CRDA_CPE_ID_VENDOR 
cpe:2.3:a:kernel:crda added by commit
63332c33aa has never been a valid CPE ID
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3:a:kernel:crda

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 85d300f102)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:11:58 +01:00
Bernd Kuhls
92a53b9062 {linux, linux-headers}: bump 6.{1, 6}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 52a15667b1)
[Peter: drop 6.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:11:22 +01:00
Fabrice Fontaine
f2f446133d package/freerdp: security bump to version 2.11.5 
- Fix CVE-2024-22211
- Update Upstream tag in patches

https://github.com/FreeRDP/FreeRDP/blob/2.11.5/ChangeLog

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dbe037dc99)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:08:44 +01:00
Sébastien Szymanski
a643262322 docs/manual/contribute.txt: fix typo 
"who sponsored who sponsored" -> "who sponsored"

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f24e85238f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:01:02 +01:00
Fabrice Fontaine
b348beb358 package/lynx: fix openssl static build 
Use LDFLAGS instead of LIBS to fix the following openssl static build
failure raised because lynx filters out duplicates (i.e. -lz) in
CF_ADD_LIBS:

configure:12958: checking for inet_ntoa
configure:12995: /home/autobuild/autobuild/instance-7/output-1/host/bin/x86_64-buildroot-linux-uclibc-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Ofast -g0 -static -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -DLINUX  -static conftest.c -L/home/autobuild/autobuild/instance-7/output-1/host/bin/../x86_64-buildroot-linux-uclibc/sysroot/usr/lib64 -lssl -L/home/autobuild/autobuild/instance-7/output-1/host/bin/../x86_64-buildroot-linux-uclibc/sysroot/usr/lib64 -lz -pthread -lcrypto -lz -pthread  >&5
configure:12998: $? = 0
configure:13001: test -s conftest
configure:13004: $? = 0
configure:13014: result: yes
configure:13095: checking for gethostbyname
configure:13151: result: yes
configure:13232: checking for strcasecmp
configure:13288: result: yes
configure:13401: checking for inet_aton function
configure:13443: /home/autobuild/autobuild/instance-7/output-1/host/bin/x86_64-buildroot-linux-uclibc-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Ofast -g0 -static -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -DLINUX  -static conftest.c  -L/home/autobuild/autobuild/instance-7/output-1/host/bin/../x86_64-buildroot-linux-uclibc/sysroot/usr/lib64 -lssl -lz -pthread -lcrypto >&5

[...]

/home/autobuild/autobuild/instance-7/output-1/host/bin/x86_64-buildroot-linux-uclibc-gcc -DHAVE_CONFIG_H  -DLOCALEDIR=\"/usr/share/locale\" -I. -I.. -Ichrtrans -I./chrtrans -I.. -I../src -I.././WWW/Library/Implementation    -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_GNU_SOURCE -DLINUX -I/home/autobuild/autobuild/instance-7/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/include -I/home/autobuild/autobuild/instance-7/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/include/openssl  -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -Ofast -g0 -static  -Wl,-rpath,/home/autobuild/autobuild/instance-7/output-1/host/bin/../x86_64-buildroot-linux-uclibc/sysroot/usr/lib64 -Wl,-rpath,/home/autobuild/autobuild/instance-7/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/lib   -L/home/autobuild/autobuild/instance-7/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/lib -static -o lynx  LYebcdic.o LYClean.o LYShowInfo.o LYEdit.o L
 YStrings.o LYMail.o HTAlert.o GridText.o LYGetFile.o LYMain.o LYMainLoop.o LYCurses.o LYBookmark.o LYmktime.o LYUtils.o LYOptions.o LYReadCFG.o LYSearch.o LYHistory.o LYForms.o LYPrint.o LYrcFile.o LYDownload.o LYNews.o LYKeymap.o HTML.o HTFWriter.o HTInit.o DefaultStyle.o LYUpload.o LYLeaks.o LYexit.o LYJump.o LYList.o LYCgi.o LYTraversal.o LYEditmap.o LYCharSets.o LYCharUtils.o LYMap.o LYCookie.o LYStyle.o LYHash.o LYPrettySrc.o TRSTable.o parsdate.o UCdomap.o UCAux.o UCAuto.o  LYSession.o LYLocal.o  .././WWW/Library/Implementation/libwww.a -lz -static -lncurses -lssl -lcrypto -L/home/autobuild/autobuild/instance-7/output-1/host/bin/../x86_64-buildroot-linux-uclibc/sysroot/usr/lib64 -pthread
/home/autobuild/autobuild/instance-7/output-1/host/lib/gcc/x86_64-buildroot-linux-uclibc/11.4.0/../../../../x86_64-buildroot-linux-uclibc/bin/ld: /home/autobuild/autobuild/instance-7/output-1/host/x86_64-buildroot-linux-uclibc/sysroot/usr/lib/libcrypto.a(libcrypto-lib-c_zlib.o): in function `zlib_oneshot_expand_block':
c_zlib.c:(.text+0xb8b): undefined reference to `uncompress'

Patching aclocal.m4 is not possible as autoreconf fails due to missing
AC_DIVERT_HELP macro.

This build failure is only raised by autobuilders since 2024 for an
unknown reason.

Fixes:
 - http://autobuild.buildroot.org/results/6d4119b54fc6b6111a03f81e131e83bae0d844d1

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ef5d3327a1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 22:00:24 +01:00
Bernd Kuhls
c6767e03ba {linux, linux-headers}: bump 4.19.x / 5.{4, 10, 15}.x / 6.{1, 6}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 44292dabc0)
[Peter: drop 6.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 21:56:08 +01:00
Fabrice Fontaine
e2cc7eb278 package/joe: add JOE_CPE_ID_VENDOR 
cpe:2.3:a:joseph_allen:joe is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/5F530947-2060-4842-92B9-5BC61D9C5430

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2953cd2644)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 21:53:39 +01:00
Fabrice Fontaine
b4dee60f60 package/frr: security bump to version 8.5.4 
Fix CVE-2023-38802, CVE-2023-41360, CVE-2023-46752, CVE-2023-46753,
CVE-2023-47234 and CVE-2023-47235

https://frrouting.org/security/
https://frrouting.org/release/8.5.4/

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c3cf06e0a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:34:16 +01:00
Fabrice Fontaine
eb15ce67f5 package/x11r7/xserver_xorg-server: add CPE variables 
cpe:2.3:a:x.org:xorg-server is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/detail/79A86C02-31A5-4F25-8CA6-7C4A8CD92B7B

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b80705800a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:29:28 +01:00
Peter Korsgaard
78fb608576 package/gstreamer1-editing-services: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c55c1263ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:38 +01:00
Peter Korsgaard
b1e0f93416 package/gst-omx: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9f342e4a67)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:37 +01:00
Peter Korsgaard
9fd9fa1543 package/gst1-vaapi: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6f28c463cf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:37 +01:00
Peter Korsgaard
a31c7735fb package/gst1-rtsp-server: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 88a6cfefbf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:36 +01:00
Peter Korsgaard
a5c728ad23 package/gst1-python: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d948714037)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:35 +01:00
Peter Korsgaard
b249e43d69 package/gst1-libav: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit db9b4f3b0c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:35 +01:00
Peter Korsgaard
c88c6a1320 package/gst1-devtools: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 74c32bfa5d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:34 +01:00
Peter Korsgaard
53c2b299f1 package/gst1-plugins-ugly: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ca65df3da2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:33 +01:00
Peter Korsgaard
0b8eb25c54 package/gst1-plugins-bad: security bump to version 1.22.9 
Fixes the following security issue:

CVE-2024-0444: Heap-based buffer overflow in the AV1 codec parser when
handling certain malformed streams before GStreamer 1.22.9

https://gstreamer.freedesktop.org/security/sa-2024-0001.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3ee1148b00)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:33 +01:00
Peter Korsgaard
b8cab7e50f package/gst1-plugins-good: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 3407703f2c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:32 +01:00
Peter Korsgaard
bf4c7f70f3 package/gst1-plugins-base: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6b7db1bf64)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:31 +01:00
Peter Korsgaard
3880eba082 package/gstreamer1: bump to version 1.22.9 
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e81d29d551)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 18:28:31 +01:00
Peter Korsgaard
1ed1ff4c43 package/darkhttpd: security bump to version 1.15 
Fixes the following security issues:

CVE-2024-23770: Local Leak of Authentication Parameter in Process List

CVE-2024-23771: Basic Auth Timing Attack

https://security.opensuse.org/2024/01/22/darkhttpd-basic-auth-issues.html

Notice that CVE-2024-23770 is only documented as a known weakness, not
fixed.

Also change the license logic to use the dedicated COPYING file available
since 1.14:

a8ae2b1de0

This license is ISC, not MIT - So adjust DARKHTTPD_LICENSE to match.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0c7fd35947)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:42:57 +01:00
Fabrice Fontaine
5e057ff46e package/mbedtls: security bump to version 2.28.7 
- Fix CVE-2024-23170 and CVE-2024-23775
- Mbed TLS is now released under a dual Apache-2.0 OR GPL-2.0-or-later
  license. Users may choose which license they take the code under:
  f429557c59

https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-1/
https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2024-01-2/
https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.6
https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 52fd4753fe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:42:00 +01:00
Peter Korsgaard
6c8d4ea2ed package/environment-setup: do not export GIT_DIR 
Commit c07aafa087 (package/Makefile.in: set GIT_DIR=.  in {HOST,
TARGET}_MAKE_ENV) added GIT_DIR=.  to TARGET_MAKE_ENV (which is included in
TARGET_CONFIGURE_OPTS) to work around issues with packages getting confused
when building in a subdir of the Buildroot git repo.

This unfortunately also causes git commands to fail when
output/host/environment-setup is sourced:

git status
fatal: not a git repository: '.'

So strip GIT_DIR= from TARGET_CONFIGURE_OPTS when generating
environment-setup.

Reported-by: Mircea Gliga <gliga.mircea@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 48874afb9d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:41:22 +01:00
Yann E. MORIN
e8f374db5c boot/syslinux: carry fix for build failures with binutils 2.31+ 
From a report on the syslinux mailing list [0]:

    The GNU linker now writes two segments of type PT_LOAD into the
    program header. However, this is not supported by the wrapper
    script that converts the shared object to an .efi executable.
    As per comment in that file:

        (...) Although there may be several LOAD program headers,
        only one is currently copied.

    A simple workaround I've found to work is to ask the linker to put
    everything into one PT_LOAD program header.

The issue is ackowledged in the syslinux wiki page about building
syslinux [1]. This page refers to various resources, of which a Debian
patch [2].

This information is also referenced in #11861.

Fixes: #11861

[0] https://www.syslinux.org/archives/2018-August/026167.html
[1] https://wiki.syslinux.org/wiki/index.php?title=Building
[2] https://salsa.debian.org/images-team/syslinux/-/blob/debian/master/debian/patches/0017-single-load-segment.patch

Reported-by: Sam Lancia <sam@gpsm.co.uk>
Reported-by: Meliodas <meliodasren01@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e53a8593b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:37:11 +01:00
Thomas Devoogdt
54be12aaed package/webkitgtk: bump to version 2.42.2 
Update to a new major release.

Release notes:

https://webkitgtk.org/2023/09/15/webkitgtk2.42.0-released.html
https://webkitgtk.org/2023/09/27/webkitgtk2.42.1-released.html
https://webkitgtk.org/2023/11/10/webkitgtk2.42.2-released.html

Security notes:

https://webkitgtk.org/security/WSA-2023-0008.html

- USE_JPEGXL is enabled by default now [1], so add a libjxl if used.

- ENABLE_GLES2 has been dropped, so drop it also here [2].
  Instead, enable USE_OPENGL_OR_ES if libgles is present. Beware that also
  libegl is needed for USE_OPENGL_OR_ES, but that one is most of the time a
  dependency for libgles, so leave it out here.

- Also raise the minimal GCC version to 10.2, which is required since webkitgtk-2.42.x [3].
  Similar to commit ec1ff802df,
  we do check on >= GCC 10, because we can't check on >= GCC 10.2.

[1] 93865414f3
[2] cfe917fec4
[3] 133498aaee

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Tested-by: Adrian Perez de Castro <aperez@igalia.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c4abff80b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:21:39 +01:00
Thomas Devoogdt
05292fbfdb package/webkitgtk: make gbm support optional 
This was added upstream in commit:

22e4c03866

The 'USE_OPENGL_OR_ES' flag is default ON, which will enable 'USE_GBM',
so ensure that we unset 'USE_GBM' if we don't have libgbm.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Tested-by: Adrian Perez de Castro <aperez@igalia.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c06c0197f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:20:38 +01:00
Adrian Perez de Castro
0617a0191a package/webkitgtk: allow both X11 and Wayland 
Allow enabling support for both the X11 and Wayland backends.

This in turn needs reorganizing how desktop GL or OpenGL ES is chosen,
as it no longer can depend on whether Wayland support is enabled: the
BR2_PACKAGE_HAS_LIBGL and BR2_PACKAGE_HAS_LIBGLES variables are both
checked, and ENABLE_GLES2 is set only if the package providing OpenGL
claims only GLES is supported; otherwise desktop GL is preferred. This
matches the existing logic.

The existing comment indicating that only one of both windowing systems
can be enabled was wrong: the same WebKitGTK build can target both
X11 and Wayland at the same time, as long as GTK itself has been built
accordingly. Enabling both is the approach taken by most Linux
distributions, and has been supported for years.

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a23251d3f7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:20:28 +01:00
Thomas Devoogdt
f94f04a957 package/webkitgtk: select wpebackend-fdo if wayland target is enabled 
libwep & wpebackend-fdo are mandatory if ENABLE_WAYLAND_TARGET and EGL_FOUND
2e35890b1f/Source/cmake/OptionsGTK.cmake (L388-L400)

egl is mandatory if ENABLE_WAYLAND_TARGET
2e35890b1f/Source/cmake/OptionsGTK.cmake (L462-L473)

So wpebackend-fdo (-> libwpe) has to be selected if BR2_PACKAGE_LIBGTK3_WAYLAND.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Tested-By: Adrian Perez de Castro <aperez@igalia.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b9c0e48f68)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 17:17:12 +01:00
Adrian Perez de Castro
a3c246ef72 package/wpewebkit: security bump to version 2.42.4 
The minimum GCC version is changed to 10.x, conditionals added for
USE_JPEGXL and USE_GBM. Both are optional and will be automatically
enabled if the relevent packages have been enabled. GBM is recommended
for performance, is it avoids a buffer copy on each frame rendered by
WebKit.

Release notes:

 - https://wpewebkit.org/release/wpewebkit-2.40.4.html
 - https://wpewebkit.org/release/wpewebkit-2.40.5.html
 - https://wpewebkit.org/release/wpewebkit-2.42.0.html
 - https://wpewebkit.org/release/wpewebkit-2.42.1.html
 - https://wpewebkit.org/release/wpewebkit-2.42.2.html
 - https://wpewebkit.org/release/wpewebkit-2.42.3.html
 - https://wpewebkit.org/release/wpewebkit-2.42.4.html

This update covers fixes for CVE-2023-37450, CVE-2023-38133,
CVE-2023-38572, CVE-2023-38592, CVE-2023-38594, CVE-2023-38595,
CVE-2023-38597, CVE-2023-38599, CVE-2023-38600, CVE-2023-38611,
CVE-2023-40397, CVE-2023-39928, CVE-2023-39434, CVE-2023-40451,
CVE-2023-41074, CVE-2023-41993, CVE-2023-32359, CVE-2023-41983,
CVE-2023-42852, CVE-2023-42916, CVE-2023-42917, CVE-2023-42883,
and CVE-2023-42890.

Relevant security advisories:

 - https://wpewebkit.org/security/WSA-2023-0006.html
 - https://wpewebkit.org/security/WSA-2023-0007.html
 - https://wpewebkit.org/security/WSA-2023-0008.html
 - https://wpewebkit.org/security/WSA-2023-0009.html
 - https://wpewebkit.org/security/WSA-2023-0010.html
 - https://wpewebkit.org/security/WSA-2023-0011.html
 - https://wpewebkit.org/security/WSA-2023-0012.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7a8c112df7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 14:45:00 +01:00
Fabrice Fontaine
0e54bc8af8 package/falcosecurity-libs: drop FALCOSECURITY_LIBS_CPE_ID_VENDOR 
FALCOSECURITY_LIBS_CPE_ID_VENDOR is plain wrong since the addition of
the package in commit a15e35c4eb, indeed
falco:falcosecurity-libs is not a valid CPE ID:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe:2.3:a:falco:falcosecurity-libs

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b36995c2c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 14:42:02 +01:00
Fabrice Fontaine
e51bb2ced9 package/faad2: force arm mode instead of Thumb mode 
Fix the following build failure in Thumb mode:

/tmp/ccfzn6FH.s:36: Error: selected processor does not support `smull r2,r3,r1,r0' in Thumb mode

Fixes:
 - http://autobuild.buildroot.org/results/838808b4751244ee01cde6b8261212b49e511a32

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: reword comment slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a338277608)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 14:39:05 +01:00
Peter Korsgaard
3a7b549b8c package/xserver_xorg-server: security bump to version 21.1.11 
Fixes the following security issues:

1) CVE-2023-6816 can be triggered by passing an invalid array index to
DeviceFocusEvent or ProcXIQueryPointer.

2) CVE-2024-0229 can be triggered if a device has both a button and a
key class and zero buttons.

3) CVE-2024-21885 can be triggered if a device with a given ID was
removed and a new device with the same ID added both in the same
operation.

4) CVE-2024-21886 can be triggered by disabling a master device with
disabled slave devices.

5) CVE-2024-0409 can be triggered by enabling SELinux
xserver_object_manager and running a client.

6) CVE-2024-0408 can be triggered by enabling SELinux
xserver_object_manager and creating a GLX PBuffer.

For details, see the advisory:
https://lists.x.org/archives/xorg-announce/2024-January/003444.html

Switch to .tar.gz as the announcement mail only contained hashes for that:
https://lists.x.org/archives/xorg-announce/2024-January/003442.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 219178ef3e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 14:35:13 +01:00
Peter Korsgaard
93385c55a7 package/xwayland: security bump to version 23.2.4 
Fixes the following security issues:

1) CVE-2023-6816 can be triggered by passing an invalid array index to
DeviceFocusEvent or ProcXIQueryPointer.

2) CVE-2024-0229 can be triggered if a device has both a button and a
key class and zero buttons.

3) CVE-2024-21885 can be triggered if a device with a given ID was
removed and a new device with the same ID added both in the same
operation.

4) CVE-2024-21886 can be triggered by disabling a master device with
disabled slave devices.

5) CVE-2024-0409 can be triggered by enabling SELinux
xserver_object_manager and running a client.

6) CVE-2024-0408 can be triggered by enabling SELinux
xserver_object_manager and creating a GLX PBuffer.

For details, see the advisory:
https://lists.x.org/archives/xorg-announce/2024-January/003444.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b8d9e75eb8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 14:34:42 +01:00
Bernd Kuhls
a3e0c97e51 package/php: bump version to 8.2.15 
Changelog: https://www.php.net/ChangeLog-8.php#8.2.15
Release notes: https://www.php.net/releases/8_2_15.php

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ed7335d256)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 12:46:22 +01:00
Bernd Kuhls
8c37a00e2d {linux, linux-headers}: bump 4.19.x / 5.{4, 10, 15}.x / 6.{1, 6}.x series 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 02692b723a)
[Peter: drop 6.6.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 12:45:07 +01:00
Fabrice Fontaine
33d1faaa6d package/xterm: bump to version 389 
- Update hash of COPYING (update in year)
- This bump will fix the following musl build failure raised since bump
  to version 384 in commit 164d635f37:

./main.c:802:34: error: 'TAB3' undeclared here (not in a function); did you mean 'TAB0'?
  802 |     { -1,       XTTYMODE__tabs,  TAB3 },
      |                                  ^~~~
      |                                  TAB0

https://invisible-island.net/xterm/xterm.log.html#xterm_389

Fixes:
 - http://autobuild.buildroot.org/results/51f98577b851bdbb0a0ab93c9ef94977776c1b1b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6a49c39492)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-28 12:39:21 +01:00
Peter Korsgaard
90f69f4277 package/{glibc, localedef}: security bump to version glibc-2.36-128-gb9b7d6a27aa0632f334352fa400771115b3c69b7 
Fixes the following security issues:

CVE-2023-6246: syslog: Fix heap buffer overflow in __vsyslog_internal
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2024-0001;hb=HEAD

CVE-2023-6779: syslog: Heap buffer overflow in __vsyslog_internal
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2024-0002;hb=HEAD

CVE-2023-6780: syslog: Integer overflow in __vsyslog_internal
https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2024-0003;hb=HEAD

For details, see the Qualys advisory:
https://www.openwall.com/lists/oss-security/2024/01/30/6

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-06 18:29:52 +01:00
Francois Perrad
95cbe9cc60 package/gnutls: security bump to 3.8.3 
see CVE-2024-0553: Fix more timing side-channel inside RSA-PSK key exchange
see CVE-2024-0567: Fix assertion failure when verifying a certificate chain with a cycle of cross signatures

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b136bed2fd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:52:09 +01:00
Bernd Kuhls
3ab50b7e59 package/gnutls: bump version to 3.8.2 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a91ad89fe3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:52:01 +01:00
Bernd Kuhls
4fc43a34d4 package/gnutls: bump version to 3.8.1 
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 05f4c2fd10)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:51:52 +01:00
Bernd Kuhls
79dc02abee package/gnutls: bump version to 3.8.0 
Updated license hashes due to upstream commit:
"Sync GPL/LGPL license files from Gnulib"
a39e528897

Removed configure options related to guile which were removed upstream:
100cc2a706

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4528d5093c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:51:45 +01:00
Giulio Benetti
c423dd4a45 package/uuu: fix build failure with host gcc 13.x 
With gcc version >= 13.x stdint.h must be explicitly included according to
[0] so backport a commit to explicitly include stdint.h.

[0]: https://gcc.gnu.org/gcc-13/porting_to.html

Fixes:
still not happened

Signed-off-by: Giulio Benetti <giulio.benetti+tekvox@benettiengineering.com>
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 04dfeff624)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:35:35 +01:00
Maximilian Senftleben
892d471112 package/opencv4-contrib: fix INSTALL_TARGET value 
The variable should be a YES/NO value, FALSE is not a valid value.
E.g. the yesno-to-bool cmd does not translate a FALSE value and therefore returns invalid JSON.

Signed-off-by: Maximilian Senftleben <maximilian.senftleben@frogblue-tec.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9fa01e3097)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:23:35 +01:00
Fabrice Fontaine
e4fa5ebff1 package/micropython: libffi is optional, not mandatory 
libffi is optional, not mandatory since bump to version 1.22.0 in commit
1e12b7dd49 and
89b3207376

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2c1cac10d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 22:10:52 +01:00
Yann E. MORIN
c1297bfb5a package/micropython: fix building after dropping GIT_DIR=. workaround 
The MICROPYTHON_MAKE_ENV variable contained two things;
  - the comon target environment variables CC, CFLAGS et al. defined in
    TARGET_MAKE_ENV,
  - the GIT_DIR workaround

Commit 9024e18665 (package/micropython: drop GIT_DIR=. workaround)
totally dropped the assignment to MICROPYTHON_MAKE_ENV, but did not
replace its expansin with TARGET_MAKE_ENV.

This yields build error like:

    LINK build-standard/micropython
    arm-linux-gcc: ERROR: unsafe header/library path used in cross-compilation: '-L/usr/lib64/../lib64'

Fix this by expanding TARGET_MAKE_ENV in lieu of MICROPYTHON_MAKE_ENV.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6c9be611a8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2024-02-04 16:07:35 +01:00