Commit Graph

84144 Commits

Author SHA1 Message Date
Bernd Kuhls
60f60962a6 package/cmake: bump version to 4.4.4
https://cmake.org/cmake/help/latest/release/4.4.html#id4

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 17:32:35 +02:00
Julian Vetter
2af78232fc package/php: make sure ca-certificates can be found
If BR2_PACKAGE_CA_CERTIFICATES is present, add the ca-certificates.crt
to the php.ini, to not get SSL errors when using PHP.

Signed-off-by: Julian Vetter <julian@outer-limits.org>
Reviewed-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 16:50:55 +02:00
Shubham Chakraborty
66754d7f50 icu: fix static linking by adding -lstdc++ to pkg-config
The ICU library requires C++ standard library when linking statically.
Without this, applications using pkg-config --libs --static icu-uc
(e.g. xmlcatalog in libxml2) will fail to link with undefined reference
errors to C++ symbols.

Extend the existing fix for static linking to also add -lstdc++ to the
Libs field, not only Libs.private, when building in static-only mode
(ENABLE_SHARED is not set).

Fixes: https://autobuild.buildroot.org/results/80c/80ce2a1b8ec356dc13e3c51474fe4cac9cbe3cd6
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Acked-by: Andreas Ziegler <br025@umbiko.net>
[Arnout:
 - Remove checkpackageignore entry.
 - Improve patch comment.]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 16:41:49 +02:00
Sergey Matyukevich
213e01ae9c package/binutils: install libsframe to target
Starting from v2.40, binutils provides libsframe, a library for
manipulating the SFRAME debug format. Buildroot installs libsframe
to the target image only if BR2_PACKAGE_BINUTILS_TARGET option is
enabled. However other dynamic libraries from binutils are linked
against libsframe, including libbfd and libopcodes. Any binary
linked dynamically against libbfd, e.g. perf, will need libsframe
as well. So libsframe should always be installed the target together
with other binutils libraries such as libbfd and libopcodes.

Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:46:05 +02:00
Thomas Perale
1a72cf3fa8 DEVELOPERS: adding myself in packages with LTS policies
To better track the version of a package before a Buildroot LTS release
is made I'm adding myself to DEVELOPERS file for those one so I receive
alerts for this subset of packages.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:42:23 +02:00
James Hilliard
ca81f734c9 package/python-httpx2: new package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:41:51 +02:00
James Hilliard
053898a9c1 package/python-httpcore2: new package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:41:50 +02:00
James Hilliard
3eec853901 package/python-truststore: new package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:41:50 +02:00
James Hilliard
31fd7de7a8 package/python-uv-dynamic-versioning: new host package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:41:49 +02:00
James Hilliard
68a0b32df9 package/python-dunamai: new host package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:41:48 +02:00
Fiona Klute
ddd4788c1f utils/docker-run: mount and pass BR2_EXTERNAL dirs
The BR2_EXTERNAL environment variable is passed into the container,
and each path listed in it mounted. This allows using external trees
when running a build using utils/docker-run. Testing the existence of
the variable instead of a non-empty value allows passing an empty
BR2_EXTERNAL variable to disable currently set external trees.

The --mount option needs an absolute path for the destination. Make the
paths absolute the same way br2-external itself does it. Do not use
realpath since that resolves symlinks and would make it different from
what is in the BR2_EXTERNAL variable.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 15:38:19 +02:00
James Hilliard
f1fae6867b package/python-idna: bump to version 3.20
Update license hash due to copyright year update:
21cd5ddac6

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:31:45 +02:00
Vladimir Savelev
fa668003c0 configs/{orangepi-zero2w,orangepi-zero3}: set the hostname
Give both boards a recognizable hostname instead of the generic
"buildroot". The name is used for the login banner and sent as the
DHCP hostname (option 12), so the board is easy to identify on the
network.

Signed-off-by: Vladimir Savelev <anykey196@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 15:19:07 +02:00
Titouan Christophe
5e8705263c linux: add first-class support for all upstream linux versions
Add new KConfig symbols for all actively supported longterm versions of the
Linux kernel. This makes it easier for individual configs to follow updates
of their kernels, without having to frequently update them. This should
generally improve the security of the target systems, which receive frequent
security updates while preserving a stable feature set.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Peter: move BR2_LINUX_KERNEL_LATEST_SERIES outside the choice to make
	utils/check-symbols happy, add version symlinks]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 15:12:50 +02:00
Titouan Christophe
0f7c08d8fb linux: always select host-uboot-tools for mips
Since Buildroot commit 40e266ccb9 [1], host-uboot-tools was always selected
for the latest Linux kernel. This change is intended for autobuilders, and
was introduced in Buildroot while the latest kernel was 6.12.

However, further investigation seem to indicate that itb images were
generated for mips for a much longer time. Linux commit eed0eabd12 [2]
seem to enable that image format, and was released in Linux 4.9.

This version being EOL for quite some time, we can therefore assume
any "not so old" Linux for mips will need host-uboot-tools to finalize
this image, and therefore we should select it when building Linux.

[1] linux: select host-uboot-tools with FIT on mips
    https://gitlab.com/buildroot.org/buildroot/-/commit/40e266ccb9
[2] MIPS: generic: Introduce generic DT-based board support
    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eed0eabd12ef061821cbfa20d903476e07645320

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 15:12:48 +02:00
Nikita Kiryushin
f350991abf docs/manual/contribute.adoc: mention mailing list subscription requirement
The mail address used to contribute via buildroot mailing list
is required to be subscribed to the mailing list. Otherwise,
messages sent to the mailing list will be automatically rejected,
as server only accepts email from mailing list subscribers.

This behavior is not explicitly stated in the documentation
for contributors (aside from recommendation to subscribe
as the first thing for contributor to do). This may lead to an
unpleasant surprise to developers, who prefer reading mailing
lists using archives.

Add mention of mailing list subscription requirement to 'Preparing
a patch series' section of contribution manual.

Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
2026-10-11 14:51:59 +02:00
Thomas Perale
319aa2b9ed utils/generate-cyclonedx: add comment to explain spec_version
The commit [1] introduced the `cdx_spec_version` variable.
The reason for that variable is not immediately clear. Only the license
schema can use patch revision while the spec version should always
exclude the patch revision.

This commit adds a comment clarifying this.

[1] 504bb61bc6 utils/generate-cyclonedx: support custom schema version

Suggested-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 12:18:15 +02:00
Thomas Perale
c13eabf18f utils/generate-cyclonedx: improve help text
The argparse has a set of arguments you can pass to the ArgumentParser
object to improve the looks of the help message.

The example usage used to be defined in the "description" but a "usage"
field exists [1].

Also link to the documentation in the epilog [2].

[1] https://docs.python.org/3/library/argparse.html#usage
[2] https://docs.python.org/3/library/argparse.html#epilog

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 12:18:14 +02:00
Thomas Perale
358f226809 utils/generate-cyclonedx: use argparse defaults help formatter
The argparse library documentation [1] suggest the usage of
'ArgumentDefaultsHelpFormatter' in the ArgumentParser declaration to
show the default value of every arguments.

Use this to avoid declaring this value ourself which possibly gets
outdated with the actual default value.

Note that this also adds an unnecessary default: FALSE to the --virtual
option, but that's a minor annoyance.

[1] https://docs.python.org/3/library/argparse.html#argparse.ArgumentDefaultsHelpFormatter

Suggested-by: Quentin Schulz <quentin.schulz@cherry.de>
Suggested-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 12:18:13 +02:00
Flaviu Nistor
bd4b90e81b package/python-cramjam: new package
Add cramjam, a python bindings to de/compression algorithms.
It is needed by python-snappy package in order to bump the version.

Signed-off-by: Flaviu Nistor <flaviu.nistor@gmail.com>
[Peter: add BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS dependency, drop
        upstream tarball hash.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 12:16:33 +02:00
Raphaël Mélotte
48e4bab464 utils/check-symbols: check for undefined host symbols
get_warnings_for_symbols_without_definition() skips any symbol
matching BR2_PACKAGE_HOST_* or BR2_PACKAGE_HAS_HOST_*, via
br.re_host_symbol. This blanket exclusion was needed because
we don't require a Config.in.host to be present for host packages,
so BR2_PACKAGE_HOST_FOO may in fact be undefined and that's
perfectly fine.

However, this also excludes any other options that should be defined in
the Config.in.host, e.g. a BR2_PACKAGE_HOST_FOO_BAR suboption. If such
an option is misspelled in the .mk file, we will not notice.

We already treat the BR2_PACKAGE_* symbols specially. They are
considered as "used" even if there is no direct reference to them in the
.mk file. This is done in the handle_eval function. Depending on the
package infra and the type of package (bootloader, toolchain, ...) it
sets the corresponding kconfig symbol as "used".

At that point, we can also handle the special case of the host kconfig
symbols. Instead of a blanket exclusion, we say that the
BR2_PACKAGE_HOST_FOO option is implicitly defined by the eval statement.
We only add BR2_PACKAGE_HOST_FOO as implicitly defined, so any
suboptions will still be checked by
get_warnings_for_symbols_without_definition().

We could alternatively also have skipped the "usage" marking of host
packages. This approach felt more consistent though.

Make handle_eval() in checksymbolslib/makefile.py record the
implicitly defined symbols directly, at the $(eval $(host-...))
line that creates them:
- BR2_PACKAGE_HOST_<PKG> as a definition, for host-*-package and
  host-virtual-package;
- BR2_PACKAGE_HAS_HOST_<PKG> as virtual, for host-virtual-package,
  mirroring how the plain virtual-package case already registers
  BR2_PACKAGE_HAS_<PKG>.

This makes br.re_host_symbol and its use in
get_warnings_for_symbols_without_definition() unnecessary, so drop
them. The check now flags a real symbol name once it lacks both an
explicit and an implicit definition, instead of ignoring the whole
BR2_PACKAGE_HOST_*/BR2_PACKAGE_HAS_HOST_* namespace.

Assisted-by: LLM
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 12:06:34 +02:00
Raphaël Mélotte
280e9755d5 package/qemu/Config.in.host: fix typo in comment dependency
The "host-qemu needs a host gcc >= 8" comment depends on
BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORT, missing the trailing "S"
of the actual symbol BR2_PACKAGE_HOST_QEMU_USER_ARCH_SUPPORTS,
defined a few lines above and used correctly everywhere else in
this file.

Because this typo'd symbol is never defined anywhere, it is always
considered false by Kconfig, so the comment's "depends on" clause
silently loses one of its two intended conditions.

Assisted-by: LLM
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 12:06:33 +02:00
Thomas Perale
40abc660d4 utils/checkpackagelib: check IGNORE_CVES identifiers match patch trailers
The ability to check with `make check-package` the 'IGNORE_CVES'
variable content reference an existing patches was added in commit [1].

This commit extend it to actually check that the entries that are
referenced in the 'IGNORE_CVES' variable are matching the trailers in
the referenced patch.

With this change the following `foo.mk` content:

```
FOO_IGNORE_CVES += CVE-2000-1234
```

Running `make check-package` will output an error if the content of the
patch is the following:

```
CVE: CVE-2001-1234
```

[1] b00ac4e346 utils/checkpackagelib: add new check MissingCVEPatch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: adapt to the trailers to using regex]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 10:23:35 +02:00
Thomas Perale
552bf40db1 utils/checkpackagelib: support other identifiers than CVE
Currently the MissingCVEPatch check will complain if another
identifiers than a CVE-YYYY-XXXX is passed after the 'CVE: '
trailer in the patch header introduced in [1].

If a package 'foo' defines the following:

FOO_IGNORE_CVES += GHSA-abcd-1234-efgh

And correctly references it in a patch header:

CVE: GHSA-abcd-1234-efgh

check-package will report the following:

package/foo/foo.mk: patch file '0001-some-patch.patch' is missing 'CVE:' tag

While we could argue that GHSA identifier should not be present in the
'IGNORE_CVES' variable, it's still valuable for users to have a way to
correctly ignore and link a patch for their vulnerability report.

From our point of view it allows us to track GHSA vulnerabilities that
could later be assigned a CVE so we can update the IGNORE_CVES variable.

This commit relaxes the constraint on the 'CVE' trailer to just check
for the presence of any identifier. We still only allow alphanumerical
characters and dashes, to be sure that any tooling that uses the
identifiers won't break.

[1] 1167d0ff3d docs/manual: mention CVE trailer

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
 - keep the regex but allow any alphanumerical string;
 - add a test that FOO:123 doesn't match]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 10:23:35 +02:00
Thomas Perale
3ac595bdd1 utils/checkpackagelib: remove unused variable
The `self.pending_patch` is set but unused.

Fixes: b00ac4e346 utils/checkpackagelib: add new check MissingCVEPatch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-11 09:23:32 +02:00
Yegor Yefremov
470faf4e6d package/szip: remove package
szip is not maintained upstream anymore: 2.1.1 is the last release,
there is no public repository, and the source is only available from
the HDF Group archive. Its license is not a standard open source one,
and the HDF Group itself recommends libaec as a replacement.

The package also fails to build with GCC >= 15 on non-glibc
toolchains, as only linux-gnu hosts get -ansi from szip's configure
and the code relies on pre-C23 empty parameter lists:

  rice.c:1323:15: error: too many arguments to function 'winner_ref_function'; expected 0, have 2

libaec provides libsz, a drop-in replacement with the same API and
soname, so select it through the legacy option.

Fixes:
  https://autobuild.buildroot.org/results/5e400d0e13480c58e8b1b0178bf7e5537dd31751

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 09:06:21 +02:00
Yegor Yefremov
7e05cbe06e package/libaec: new package
libaec provides fast lossless compression of 1 up to 32 bit wide
signed or unsigned integers. It implements the Golomb-Rice compression
method under the BSD license and includes libsz, a drop-in replacement
for the SZIP library with the same API (szlib.h) and soname
(libsz.so.2).

https://github.com/Deutsches-Klimarechenzentrum/libaec

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-11 09:06:20 +02:00
Thomas Petazzoni
2a69b8c7ed package/flutter-engine: don't write into $HOME
gclient.py tries to not only read from $HOME/.config, but actually
create some directories/files in there. As $HOME can be inaccessible,
let's override XDG_CONFIG_HOME to tell the depot-tools code to write
its stuff into $(@D)/dl-tmp instead (which we already use as a scratch
directory in this package).

Fixes:

>>> flutter-engine 3.29.2 Downloading
/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient.py:3367: SyntaxWarning: invalid escape sequence '\s'
  dot_git_pattern = re.compile('^(\s*)url(\s*)=.*\.git$')
/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient_scm.py:436: SyntaxWarning: invalid escape sequence '\.'
  tokens = re.search('//(.+).googlesource.com/(.+?)(?:\.git)?$',
Traceback (most recent call last):
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: '/home/br-user/.config/depot_tools'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient.py", line 108, in <module>
    import gclient_scm
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gclient_scm.py", line 23, in <module>
    import gerrit_util
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/gerrit_util.py", line 42, in <module>
    import metrics
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/metrics.py", line 23, in <module>
    CONFIG_FILE = utils.depot_tools_config_path('metrics.cfg')
  File "/home/thomas/buildroot/br/output-all/host/share/depot_tools/utils.py", line 48, in depot_tools_config_path
    pathlib.Path(config_dir).mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 726, in mkdir
    self.parent.mkdir(parents=True, exist_ok=True)
    ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/thomas/buildroot/br/output-all/host/lib/python3.13/pathlib/_local.py", line 722, in mkdir
    os.mkdir(self, mode)
    ~~~~~~~~^^^^^^^^^^^^
PermissionError: [Errno 13] Permission denied: '/home/br-user/.config'
make[1]: *** [package/pkg-generic.mk:181: /home/thomas/buildroot/br/output-all/build/flutter-engine-3.29.2/.stamp_downloaded] Error 1

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 08:52:51 +02:00
Thomas Petazzoni
fac6d92a27 support/docker/Dockerfile: make $HOME folder read-only
The $HOME folder of the br-user inside the container is currently
read-write for the br-user. However, practically speaking, it is only
read-write when the UID of the user running the container from the
host machine is 1000, equal to the UID of the br-user inside the
container. For any other UID on the host machine, the $HOME folder is
in fact already read-only.

Because we do not expect Buildroot to write into $HOME, and in order
to have a consistent behavior regardless of the UID of the user on the
host machine, we change our Docker image to make the $HOME folder of
the br-user entirely non-writable.

Suggested-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-11 08:04:53 +02:00
Neal Frager
56992f7825 package/gcc: add microblaze frame unwinding fix to v15 and v16
Add microblaze signal-frame unwinding fix back port to gcc 15.3.0 and 16.2.0.

Upstream: https://gcc.gnu.org/cgit/gcc/commit/?id=4ef64ad1aa9bbbe9471610e2de6ef0c8afed8b1f

Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 23:07:40 +02:00
James Knight
f7019acad2 package/util-linux: adding cfdisk enablement comment
This commit introduces a menu comment to users to indicate whether the
`cfdisk` can be built, even when the basic set binaries option is
enabled.

For users wishing to support `fdisks` utilities (cfdisk, fdisk and
sfdisk) in Buildroot, these utilities are enabled through a
`BR2_PACKAGE_UTIL_LINUX_BINARIES` option. This option configures
`all-programs`, which will default enable `fdisks` (along with other
program options that do not have an explicit configuration). While a
user can enable "all programs", there is no guarantee that the
`cfdisk` utility will be built if neither ncurses or slang is
enabled. Even if an explicit Buildroot menu option is added for
`cfdisk` (where we can force select ncurses, if slang is not yet
enabled), there is no specific configuration option in util-linux to
toggle the enablement of `cfdisk`.

Signed-off-by: James Knight <james.d.knight@live.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 23:05:15 +02:00
James Knight
2e6f9749b1 package/util-linux: allow using slang as an alternative to ncurses
Both cfdisk and irqtop can either use ncurses or slang. We currently
only support using ncurses, this commit extends that to be able to use
slang as an alternative.

Signed-off-by: James Knight <james.d.knight@live.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 23:05:15 +02:00
James Hilliard
0c198828a6 package/python-serialx: new package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-10-10 22:47:38 +02:00
Stephan Henningsen
725cea53c7 package/util-linux: fix mount helper lookup path
When using /bin/mount to mount filesystems that are not supported
directly by the kernel, it delegates the mount operatin to helper
programs, e.g. mount.fuse.sshfs.  Normally /bin/mount searches
these directories in order for a helper: /sbin, /sbin/fs.d, /sbin/fs.

In reality, Buildroot installs e.g. mount.fuse.sshfs into /usr/sbin,
and as a result /bin/mount fails to mount sshfs entries defined in
/etc/fstab.

The patch changes the default search path at configuration.

Signed-off-by: Stephan Henningsen <stephan@asklandd.dk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 22:33:27 +02:00
James Hilliard
409b8bf716 package/python-pydantic: bump to version 2.13.5
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-10-10 22:31:25 +02:00
James Hilliard
9f3326812b package/python-pydantic-core: bump to version 2.46.5
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-10-10 22:31:25 +02:00
Bernd Kuhls
d42fa91227 package/util-linux: fix non-MMU build
Buildroot commit 31af509b4f bumped the
package from 2.40.2 to 2.41.1. This bump includes upstream commit
a3f1255f18
which was added to version 2.41 and includes the usage of
pthread_atfork() causing build errors on non-MMU platforms:

libuuid/src/gen_uuid.c: In function 'uuid_generate_time_generic':
libuuid/src/gen_uuid.c:629:17: error: implicit declaration of function
 'pthread_atfork'; did you mean 'pthread_join'?
 [-Wimplicit-function-declaration]
  629 |                 pthread_atfork(NULL, NULL, reset_uuidd_cache);

The oldest build error of this kind can be found on the 2025.11.x
branch with version 2.41.1:
https://autobuild.buildroot.net/results/87c/87c74435be14956fd45f730269eac102e70d56da/

The issue occurs because uClibc-ng is not very consistent with its
pthread_atfork() definition: it doesn't provide a prototype for it on
!MMU platforms (causing the build failure), but it does provide a stub
implementation (causing the configure script to believe pthread_atfork
is available). This issue was reported to upstream uClibc-ng at
https://mailman.openadk.org/mailman3/hyperkitty/list/devel@uclibc-ng.org/thread/WEA7IQC3YAWTSFDHCLYRQJZTC4IUIY7J/.

A backport of this patch to the LTS branches should be considered, but
probably not 2025.02.x as it uses version 2.40.x.

Fixes:
https://autobuild.buildroot.org/results/a21e81e64eccc866b575a4f3b1376c50f2ffd837/

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 22:28:14 +02:00
Thomas Perale
03e9ac7d9c testing/tests/utils/test_generate_cyclonedx.py: test vuln with different analysis
Add test for CycloneDX vulnerability generation.

If multiple packages ignore the same vulnerability but provide different
analyses, the generator must produce multiple vulnerability entries with
the same vulnerability ID but different analysis information.

This situation can occur when generating a CycloneDX SBOM from the
output of 'make show-info-all'. The resulting SBOM includes packages
that exist in multiple versions within Buildroot (gnupg for instance).

In such a case, one package version may ignore a vulnerability because
it is not affected, while another package version may address it through
a patch.

Therefore, multiple vulnerability entries must be generated, each with
its own analysis and reference information.

This adds a test case for this scenario.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: give next() a None default to return None instead of raise
 StopIteration]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:33 +02:00
Thomas Perale
345c8ffc96 utils/generate-cyclonedx: split vulnerabilities per state
If a vulnerability is present in multiple components and only one of
them has a patch that addresses that vulnerability, all components will
currently have that vulnerability marked as `resolved_with_pedigree`.

Right now, this issue does not affect any packages, but in the future it
might affect packages that provide multiple version options (e.g.
gnupg and gnupg2).

There is a small chance this happens in a real-world use case, but it
may occur in the context of maintenance when running
`make show-info-all`.

This commit changes how vulnerabilities fixed by a patch are stored.
Instead of placing all vulnerabilities into a single set, it now keeps an
index of the component for which the patch has been applied.

When generating the vulnerability list, the component reference is
checked instead of only the vulnerability ID. If a vulnerability ID has
multiple states for different references, multiple vulnerability
entries are created with distinct analyses.

Consider the hypothetical case where gnupg ignores a vulnerability
because it was introduced in a later version, while gnupg2 has patched
that vulnerability. This would result in the following JSON:

```json
[
    {
        "id": "CVE-1234-1234",
        "analysis": {
            "state": "in_triage",
            "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
        },
        "affects": [
            {"ref": "gnupg"}
        ]
    },
    {
        "id": "CVE-1234-1234",
        "analysis": {
            "state": "resolved_with_pedigree",
            "detail": "The CVE 'CVE-1234-1234' has been marked as ignored by Buildroot"
        },
        "affects": [
            {"ref": "gnupg2"}
        ]
    }
]
```

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout:
 - update the VULN_WITH_PEDIGREE comment to match the code
 - use set() as default instead of {}]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:33 +02:00
Thomas Perale
6e77b6ff69 utils/generate-cyclonedx: support for v1.7, 1.7.1
See changes:

- https://cyclonedx.org/news/cyclonedx-v1.7-released/
- https://github.com/CycloneDX/specification/releases/tag/1.7
- https://github.com/CycloneDX/specification/releases/tag/1.7.1

Since some tools like DependencyTrack don't support CycloneDX SBOM v1.7
this bump is optional and default remains v1.6.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:32 +02:00
Thomas Perale
504bb61bc6 utils/generate-cyclonedx: support custom schema version
Support using minor revision for CycloneDX 1.6 by passing the version
from the command line. Currently supported:

- 1.6
- 1.6.1 [1]
- 1.6.2 (default) [2]

This is used to fetch the latest SPDX license list available upstream.

[1] https://github.com/CycloneDX/specification/releases/tag/1.6.1
[2] https://github.com/CycloneDX/specification/releases/tag/1.6.2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: also rename the SPDX schema in the test]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:31 +02:00
Thomas Perale
4ba8e2869b utils/generate-cyclonedx: move license download in a function
Move the code that retrieves the SPDX licenses into a function instead of
doing it top-level.

This allows to pass the CycloneDX version as a function argument instead
of defining it as a top-level constant.
The next commit introduces support for different CycloneDX spec versions.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:30 +02:00
Thomas Perale
d8d02d28fb utils/generate-cyclonedx: mark host packages as excluded
Mark Buildroot's host packages as 'excluded' with the scope
property [1]. The excluded scope is defined like the following:

> Components that are excluded provide the ability to document component
> usage for test and other non-runtime purposes. Excluded components are
> not reachable within a call graph at runtime.

This fits the usage of 'host' packages : a package without a runtime
purpose.

See the mailing list discussion around this property [2][3][4][5]

[1] https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_scope
[2] https://lore.kernel.org/r/<de0bb761-ca88-4bc6-8d7b-6bd14e9d1cbe@cherry.de>
[3] https://lore.kernel.org/r/<20260409204208.302842-1-thomas.perale@mind.be>
[4] https://lore.kernel.org/r/<bd0f43c9-ebdc-4717-b8d4-783ec712bed2@cherry.de>
[5] https://lore.kernel.org/r/<176c5c42-50bc-4b39-a7b3-845b085f010e@rnout.be>

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:29 +02:00
Thomas Perale
074e650219 utils/generate-cyclonedx: add "id" property to resolves
The CycloneDX spec defines the "components.pedigree.patches.resolves"
object [1] as supporting both a "name" & "id" property.

The definition provided for the "id" property is the following [2]:

> The identifier of the issue assigned by the source of the issue

And for the "name" property [3]:

> The name of the issue

The "resolves" object was introduced in commit [4] and only used the
"name" property to link to the vulnerability it resolves.

In example [5] provided on the CycloneDX website, both the "name" & "id"
properties are set in the security example.

In the vulnerability context, and more precisely the CVEs, the "name"
and the "id" are the same and thus the value can be duplicated across
the two properties.

This commit replicates the behavior documented in [5] to improve
compatibility with tools.

[1] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves
[2] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_id
[3] https://cyclonedx.org/docs/1.6/json/#components_items_pedigree_patches_items_resolves_items_name
[4] 9415529923 utils/generate-cyclonedx: add support for 'resolved_with_pedigree'
[5] https://cyclonedx.org/use-cases/pedigree/

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:28 +02:00
Thomas Perale
f680fe2a61 utils/generate-cyclonedx: make urllib.error import explicit
Commit [1] introduced a code block that references
'urllib.error.URLError'. There is no explicit import of 'urllib.error'.
While this is not an issue in practice, ruff complains that the import
is not explicit.

[1] 17c9deb115 utils/generate-cyclonedx: hint at missing Buildroot host package on a specific error

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:27 +02:00
Thomas Perale
072ed8e5d6 testing/tests/utils/test_generate_cyclonedx.py: test scp-style git sites
The commit [1] fixed a formatting bug with the SCP style git sites
declaration.

Add this style of link to the test case to keep a track of it.

[1] ebcfdb8b0a utils/generate-cyclonedx: fixup scp-style git sites

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-10-10 22:24:26 +02:00
James Hilliard
f257f27aec package/python-zeroconf: bump to version 0.151.5
Update license hash due to restored historical copyright notices:
cb189247ad

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2026-10-10 22:23:29 +02:00
Peter Korsgaard
ab50df3c1f package/libcec: enable Linux kernel API support
The Linux kernel exposes a CEC API since v4.10.  Support only grows the
library with ~3%, so unconditionally enable support for it when building
with new enough kernel headers:

-rwxr-xr-x 1 peko peko 594K Oct 10 18:53 usr/lib/libcec.so.8.1.7.without
-rwxr-xr-x 1 peko peko 614K Oct 10 18:53 usr/lib/libcec.so.8.1.7.with

Reported-by: Stefan Ott <stefan@ott.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2026-10-10 22:15:53 +02:00
Waldemar Brodkorb
0bca001a5f package/runc: enable uClibc support
fexecve was added to uClibc in 2019 in commit
858ffad217076227089cc17eb832db0bd1497792.

Also containerd and docker can be used with uClibc.

Runtime tested on a Raspberry PI4 (64 Bit).
System compiled with Bootlin Toolchain.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 19:27:57 +02:00
Alexander Shirokov
1b8cd6665b package/nnn: add BR2_TOOLCHAIN_HAS_THREADS dependency
nnn links against pthread. Specify the dependency to avoid
unexpected build failures on toolchains lacking thread support (e.g.
br-arm-full-nothread).

Fixes:

  https://autobuild.buildroot.net/results/5cd2b7a288a1681068448de6715e731580908206/

Fixes: 7856e41685 ("package/nnn: new package")
Signed-off-by: Alexander Shirokov <shirokovalexs@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2026-10-10 19:24:52 +02:00