Since Buildroot commit [1] (package/gnutls: security bump to
version 3.8.11), gnutls fails to build with gcc or host-gcc
version < 11, with error:
In file included from audit.h:22,
from audit.c:26:
crau/crau.h:255:23: error: missing binary operator before token "("
__has_c_attribute (__maybe_unused__)
This commit adds a patch fixing the issue.
[1] 81dbfe1c2a
Reported-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Tested-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
As of Buildroot commit [1] which updated
the python-httplib2 package from 0.22.0 to 0.31.0, gclient.py has
been broken due to the internal socks.py file being removed from
the httplib directory (in upstream commit [2]).
As the depot-tools package doesn't have a build step, and is only
used when generating a flutter-engine tarball, no autobuild failures
have occured.
Add a simple patch that changes `import httplib2.socks` to
`import socks` and depend on the host-python-pysocks package.
[1] 55a80f89d7
[2] 1a6ff78179
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/12188741354
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien:
- change commit id to urls
- add "Fixes:" link
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The host-depot-tools package now requires a host variant of the
python-pysocks package due to the python-httplib2 update on
commit [1].
Httplib2 removed the internal socks.py file on commit [2].
[1] 55a80f89d7
[2] 1a6ff78179
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: change commit id to urls]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The bump of e2fsprogs to 1.47.3 in Buildroot commit
bb004ddba2 causes the package to fail
building when the kernel headers are >= 5.10 but < 5.12.
Indeed the new version of e2fsprogs detects the presence of
<linux/fsverity.h> (which occurred in 5.10), and when it's available,
enables some fsverity functionality, which uses an ioctl() that was
only introduced in 5.12. This causes some build breakage if the
headers used are 5.10 or 5.11.
We fix this by introducing a patch, submitted upstream, that not only
verifies the availability of the header file, but also the
availability of the ioctl().
Fixes:
https://autobuild.buildroot.net/results/c573233b1f871c61f916eda9c402c84070902432/ (host-e2fsprogs)
https://autobuild.buildroot.net/results/0ed16cad1d1f500d0e577d03166c06381be73ffc/ (e2fsprogs)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For a list of changes, see:
b147624d48...0.4.1
Removed patches which are included in this release.
Also, since Buildroot commit [1] (package/php: bump version to 8.4.13)
php-pecl-dbus is failing to build with error:
/builds/buildroot.org/buildroot/test-output/TestPhpPeclDbus/build/php-pecl-dbus-b147624d480c3353e6c700e9a2d0c6f14d853941/php_dbus.h:52:9: error: implicit declaration of function 'rebuild_object_properties'; did you mean 'rebuild_object_properties_internal'? [-Wimplicit-function-declaration]
This commits fixes the issue.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/12184413758
[1] a9e5cf6ac2
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add commit log info about build failure]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog: https://pecl.php.net/package-changelog.php?package=yaml
Since Buildroot commit [1] (package/php: bump version to 8.4.13)
php-yaml is failing to build with errors such as:
/buildroot/output/build/php-yaml-2.2.3/parse.c: In function ‘handle_sequence’:
/buildroot/output/build/php-yaml-2.2.3/parse.c:534:39: error: passing argument 1 of ‘zval_ptr_dtor’ from incompatible pointer type [-Wincompatible-pointer-types]
This commits fixes the issue.
[1] a9e5cf6ac2
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add commit log info about build failure]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog: https://xdebug.org/updates#x_3_4_7
Since Buildroot commit [1] (package/php: bump version to 8.4.13)
php-xdebug is failing to build with error:
/buildroot/output/build/php-xdebug-3.3.1/src/coverage/code_coverage.c: In function ‘xdebug_find_jumps’:
/buildroot/output/build/php-xdebug-3.3.1/src/coverage/code_coverage.c:349:34: error: ‘ZEND_EXIT’ undeclared (first use in this function); did you mean ‘ZEND_GINIT’?
This commits fixes the issue.
[1] a9e5cf6ac2
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add commit log info about build failure]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 2ecb2d2847 removed the
dependency to BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS while still
selecting packages which depend on it:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_JSONSCHEMA
Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
Selected by [y]:
- BR2_PACKAGE_PYTHON_FLASK_RESTX [=y] && BR2_PACKAGE_PYTHON3 [=y]
WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_REFERENCING
Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
Selected by [y]:
- BR2_PACKAGE_PYTHON_FLASK_RESTX [=y] && BR2_PACKAGE_PYTHON3 [=y]
Seen with defconfig:
https://autobuild.buildroot.org/results/ebf9a81f7e225ecdab20bbad8ad8daa136fddb46/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 1187c34d88 (support/scripts: move merged-usr errors message
into check-merged-usr.sh) introduced the use of getopt to parse its
options; doing so allowed to use long option (with two leading dashes),
which is more descriptive than the usual one-character options.
However, getopt is part of util-linux; it is not a shell built-in.
util-linux is not a prerequisite of Buildroot, so we may end up running
on a system where it is missing.
We could add host-util-linux as a dependency when the system does not
provide getopt, but that's not very nice; even though host-skeleton does
not need to check for merged-bin for now, it does not need getopt, and
thus we could add host-util-linux (which depends on host-skeleton) as a
dependency of skeleton-custom. But that will not be tenable over the
long run, especially if/when we do a merged-bin in host dir.
Requiring that util-linux be installed system-wide is not nice either;
it's an additional requirement on the host.
We can do like we do in the oter scripts, though: use the shell built-in
getopts. Its usage is slightly different, and does not support long
options. As it's just for use in an internal script, we can live with
the less descriptive options, though.
Switch to using getopts, it removes the need for a new host dependency.
Fixes: 1187c34d88
Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The bump of netsnmp to version 5.9.4 with buildroot commit
1799cfebfd broke musl builds:
../include/net-snmp/net-snmp-config.h:1614:30: error: unknown type name 'unknown'; did you mean 'union'?
due to broken detection of __fd_mask introduced in 5.9.4 by upstream
commit 97df191ff8
Added two upstream patches for __fd_mask detection to fix musl builds.
Fixes:
https://autobuild.buildroot.net/results/9d7/9d75061ca917689381c3b32f3e01640701d833a7/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This patch adds information on how to generate a CycloneDX SBOM in
Buildroot. It also mentions how to track CVEs with that given SBOM.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: reword slightly]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Enriches the input CycloneDX SBOM with vulnerability information and
analysis from the NVD database.
The NVD database is cloned using a mirror of it and the content is compared
locally. By default the path 'dl/buildroot-nvd' is used.
Example usage to analyse vulnerabilities of an input CycloneDX SBOM:
$ make show-info | utils/generate-cyclonedx | support/script/cve-check
The 'cve-check' can also be used to only enrich the vulnerabilities
present on the input SBOM with a set metadata (description, cvss,
references, ...) without applying an analysis.
With the following command the vulnerabilities ignored by Buildroot
present in the CycloneDX SBOM are enriched with description, cvss, etc
...
$ make show-info | utils/generate-cyclonedx | support/script/cve-check --enrich-only
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Peter: fix minor flake8 issues]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch move the 'download_nvd' call to the 'pkg-stats' script
instead of automatically calling 'read_nvd_dir'.
Since the cve.py file can be used as a library it's up to the caller to
decide whether or not to update the NVD database.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 3963c3c06e added this
package which selects python-paramiko but forgot to add its dependency.
Fixes warning:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_PARAMIKO
Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS [=n]
Selected by [y]:
- BR2_PACKAGE_PYTHON_SCP [=y] && BR2_PACKAGE_PYTHON3 [=y]
seen with https://autobuild.buildroot.net/results/423/4235283218bc49f53bf7cafd4a67f380dba659c0/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixed the following security issues:
CVE-2025-64458: Potential denial-of-service vulnerability in
HttpResponseRedirect and HttpResponsePermanentRedirect on Windows
CVE-2025-64459: Potential SQL injection via _connector keyword argument
https://docs.djangoproject.com/en/5.2/releases/5.2.8/
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
