Commit Graph

76769 Commits

Author SHA1 Message Date
Bernd Kuhls
693d850fe8 package/intel-gmmlib: bump version to 22.7.0
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 21:25:45 +01:00
Luca Ceresoli
06dc0cc353 boot: move package options to a submenu
Change all Kconfig entries for packages in the "Bootloaders" menu to
submenus.

Currently many bootloaders and firmwares in this menu use a 'config'
keyword and thus menuconfig presents their sub-options as a flat list in
the same menu. This is not very convenient as some have a lot of
sub-options, and in (more and more common) configurations with multiple
such packages enabled the menuconfig screen becomes very crowded. Moreover
options of 'string' type don't have a visible indentation when their value
exceeds a few characters, thus making it visually hard to grasp which
package the various options belong to.

Non-bootloader packages having suboptions usually use a 'menuconfig'
keywork to have sub-options in a submenu. Do the same for packages in the
"Bootloaders" menu which have more than one sub-option.

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 21:16:00 +01:00
Luca Ceresoli
088808ccc7 boot/xilinx-embeddedsw: fix menuconfig visualization
Due to how menuconfig works, a 'comment' entry following a 'config' entry
prevents correct indentation of items depending on the 'config'
entry. xilinx-embeddedsw currently shows as:

  [*] xilinx-embeddedsw
      *** xilinx-embeddedsw needs a bare metal toolchain for tuple microblazeel-xilinx-elf ***
  (xilinx_v2024.2) xilinx-embeddedsw version (NEW)
  [ ] versal plm (NEW)
  [ ] versal psmfw (NEW)
  [ ] zynqmp pmufw (NEW)
  [ ] xilinx-prebuilt

So the 'versal *' and 'zynqmp pmufw' items are not indented even though
they should be.

Do like most other Config.in files which have the 'comment' before the
'config' entry, makeing it render as expected:

      *** xilinx-embeddedsw needs a bare metal toolchain for tuple microblazeel-xilinx-elf ***
  [*] xilinx-embeddedsw
  (xilinx_v2024.2) xilinx-embeddedsw version (NEW)
  [ ]   versal plm (NEW)
  [ ]   versal psmfw (NEW)
  [ ]   zynqmp pmufw (NEW)
  [ ] xilinx-prebuilt

Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Reviewed-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 21:15:56 +01:00
Andreas Ziegler
25af5a3b3a package/mpd: update version to 0.24
Require C++20, drop dependency on boost, require new minimum versions for
tools and libraries:

package        mpd-0.24 buildroot
  gcc          12       12.4.0
  meson         1.0      1.7.0
  alsa-lib      1.1      1.2.13
  ffmpeg        4.0      6.1.2
  libfmt        9       11.0.2
  libmpdclient  2.15     2.22
  libnfs        4.0      5.0.3
  libsoxr       0.1.2    0.1.3

The GenParseName tool compiled and run on the build machine now needs
host-gcc 10, because the parsed structure uses constexpr (P1143R2). [1][2]

Due to the introduction of openat2 system calls (available since Linux
kernel 5.6), MPD now has a minimum kernel header requirement. [3][4]

Release note: https://musicpd.org/news/2025/03/mpd-0-24-released/
Change log: https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24/NEWS

$ utils/check-package package/mpd/*
919 lines processed
0 warnings generated

$ gcc --version
gcc (Ubuntu 10.5.0-4ubuntu2) 10.5.0

$ mkdir ~/output
$ echo "BR2_PACKAGE_MPD=y" > ~/output/mpd.config
$ utils/test-pkg -a -c ~/output/mpd.config -d ~/output -p mpd
                             arm-aarch64 [ 1/40]: SKIPPED
                   bootlin-aarch64-glibc [ 2/40]: SKIPPED
               bootlin-arcle-hs38-uclibc [ 3/40]: SKIPPED
                    bootlin-armv5-uclibc [ 4/40]: SKIPPED
                     bootlin-armv7-glibc [ 5/40]: OK
                   bootlin-armv7m-uclibc [ 6/40]: SKIPPED
                      bootlin-armv7-musl [ 7/40]: SKIPPED
                bootlin-m68k-5208-uclibc [ 8/40]: SKIPPED
               bootlin-m68k-68040-uclibc [ 9/40]: SKIPPED
             bootlin-microblazeel-uclibc [10/40]: SKIPPED
                bootlin-mipsel32r6-glibc [11/40]: SKIPPED
                   bootlin-mipsel-uclibc [12/40]: SKIPPED
                 bootlin-openrisc-uclibc [13/40]: SKIPPED
        bootlin-powerpc64le-power8-glibc [14/40]: SKIPPED
           bootlin-powerpc-e500mc-uclibc [15/40]: SKIPPED
                   bootlin-riscv32-glibc [16/40]: OK
                   bootlin-riscv64-glibc [17/40]: OK
                    bootlin-riscv64-musl [18/40]: SKIPPED
                 bootlin-s390x-z13-glibc [19/40]: OK
                      bootlin-sh4-uclibc [20/40]: SKIPPED
                   bootlin-sparc64-glibc [21/40]: SKIPPED
                    bootlin-sparc-uclibc [22/40]: SKIPPED
                    bootlin-x86-64-glibc [23/40]: OK
                     bootlin-x86-64-musl [24/40]: SKIPPED
                   bootlin-x86-64-uclibc [25/40]: SKIPPED
                   bootlin-x86-i686-musl [26/40]: SKIPPED
                   bootlin-xtensa-uclibc [27/40]: SKIPPED
                            br-arm-basic [28/40]: SKIPPED
                    br-arm-full-nothread [29/40]: SKIPPED
                      br-arm-full-static [30/40]: SKIPPED
                   br-i386-pentium4-full [31/40]: SKIPPED
                      br-mips64-n64-full [32/40]: SKIPPED
                 br-mips64r6-el-hf-glibc [33/40]: SKIPPED
               br-powerpc-603e-basic-cpp [34/40]: SKIPPED
               br-powerpc64-power7-glibc [35/40]: SKIPPED
                       linaro-aarch64-be [36/40]: SKIPPED
                          linaro-aarch64 [37/40]: SKIPPED
                              linaro-arm [38/40]: SKIPPED
                         sourcery-mips64 [39/40]: SKIPPED
                           sourcery-mips [40/40]: SKIPPED
40 builds, 35 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed

[1] https://github.com/MusicPlayerDaemon/MPD/blob/master/src/tag/Names.cxx#L9
[2] https://gcc.gnu.org/projects/cxx-status.html#cxx20
[3] https://github.com/MusicPlayerDaemon/MPD/commit/dda85e0
[4] https://man7.org/linux/man-pages/man2/openat2.2.html

Signed-off-by: Andreas Ziegler <br015@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 20:53:21 +01:00
Sébastien Szymanski
d65c10c20a support/kconfig: handle backspace (^H) key
This is in the mainline kernel since v5.1-rc3:
9c38f1f04408 ("kconfig/[mn]conf: handle backspace (^H) key")

Quoting the commit's log:

"
Backspace is not working on some terminal emulators which do not send the
key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127).
But currently only '^?' is handled. Let's also handle '^H' for those
terminals.
"

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 20:46:36 +01:00
Vincent Fazio
d63e207eb8 package/python3: bump to 3.13.2
Update CPython to 3.13.2.

The package selection logic has changed to require time64 support for
uClibc by mirroring the logic from uclibc.mk (kernel headers >=5.1).

The following patches have been removed:
  - Quirking ac_cv_buggy_getaddrinfo on cross compile
  * This is resolved by always assuming it's not bugged via
    ac_cv_buggy_getaddrinfo=no

  - Disabling lib2to3 in builds
  * CPython 3.13 no longer ships lib2to3

  - Fix cross compiles when host and target are on the same SOABI
  * This was fixed upstream [0]

  - Fixing the MULTIARCH value for musl/uClibc
  * CPython 3.13 moved to new platform triplet detection logic [1] which
    supports musl. uClibc does not generate a platform triplet so will
    not fail the check against MULTIARCH. See also [2].

One patch has been added that fixes thread identifiers on 32bit musl.

This commit also updates the license hash, after year change. See [3].

[0]: 909d5ac295
[1]: c163d7f0b6
[2]: https://github.com/python/cpython/issues/118942
[3]: c86571e4c9

Signed-off-by: Vincent Fazio <vfazio@gmail.com>
[Julien: fix license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-19 00:07:17 +01:00
Marcus Hoffmann
ba8bce8a11 package/zlib-ng: bump to 2.2.4
Remove patch that is included upstream now.
License hash changed due to copyright year update [1].

Release Notes: https://github.com/zlib-ng/zlib-ng/releases

[1] fc63426372

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-18 21:55:39 +01:00
Andreas Klinger
2248c732c6 package/ply: bump version to 2.4.0
Bump to new available version.

For change log, see:
https://github.com/wkz/ply/releases/tag/2.4.0

Signed-off-by: Andreas Klinger <ak@it-klinger.de>
[Julien: replaced the change log url]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-18 21:53:24 +01:00
Bernd Kuhls
b8dfcb4f04 {linux, linux-headers}: bump 6.13.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-18 21:40:57 +01:00
Colin Evrard
29cf86b8d0 package/libmodsecurity: security bump to 3.0.14
The project has been updated, including
security fixes to issues present in version 3.0.13.

- Fixes:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27110

- For a full changelog, visit:
  https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.14/CHANGES

Signed-off-by: Colin Evrard <colin.evrard@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-18 21:34:15 +01:00
Peter Korsgaard
781987d67e Merge branch 'next' 2025-03-18 15:41:43 +01:00
Peter Korsgaard
55cfcf52e1 Kickoff 2025.05 cycle
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-18 15:38:53 +01:00
Peter Korsgaard
d55efe967e docs/website/news.html: add 2025.02 announcement link
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-18 15:38:17 +01:00
Peter Korsgaard
aa2d7ca53f Update for 2025.02
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025.02
2025-03-17 18:54:20 +01:00
Yann E. MORIN
27ab880ebb package/libopenssl do not build in parallel
With highly parallel builds on a heavily loaded machine, the libopenssl
build often (about half of the time) fails with spurious missing rules
in its Makefile:

    >>> host-libopenssl 3.4.1 Installing to host directory
    [...] /usr/bin/make  -C [...]/build/host-libopenssl-3.4.1 install
    "/usr/bin/make" depend && "/usr/bin/make" _build_libs
    "/usr/bin/make" depend && "/usr/bin/make" _build_modules
    "/usr/bin/make" depend && "/usr/bin/make" _build_programs
    [...]
    make[3]: *** No rule to make target '_build_modules'.  Stop.
    make[2]: *** [Makefile:3159: build_modules] Error 2
    make[2]: *** Waiting for unfinished jobs....
    make[3]: Nothing to be done for '_build_programs'.
    make[3]: Nothing to be done for '_build_libs'.
    make[1]: *** [package/pkg-generic.mk:283: [...]/build/host-libopenssl-3.4.1/.stamp_host_installed] Error 2
    make[1]: *** Waiting for unfinished jobs....
    [...]
    make: *** [Makefile:23: _all] Error 2

Ideally, we'd like to fix the issue. However, the Nakefile is generated
by the Configure script, written in perl, from the template in
Configurations/unix-Makefile.tmpl, which also uses some kind of special
(perl-related, probably) templating language. That makes it pretty
difficult to see what is going on, though, and nigh impossible to fix
without a deep understanding of the openssl buildsystem.

So, we can only disable parallel builds until the issue is fixed
upstream [0]. Add a comment to both build commands (host and target) to
reference the upstream issue report.

Note that the issue has mostly been observed in the build of the host
variant so far, but there is no reason why it can't happen in the build
of the target variant.

[0] https://github.com/openssl/openssl/issues/27074

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-17 18:32:11 +01:00
Waldemar Brodkorb
dcd6bea6ae package/expat: security update to 2.7.0
Fixes CVE-2024-8176.

For more details, see:
https://blog.hartwork.org/posts/expat-2-7-0-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-17 18:23:29 +01:00
Peter Korsgaard
9679ddbcd0 package/rauc: needs libopenssl, not libressl
Fixes http://autobuild.buildroot.net/results/6efc1275d3aac9f0a4c000f3d0911b5a880e495d/

Rauc uses X509_PURPOSE_get_by_id() since rauc-1.3 with commit 375dbb16dd94
("src/signature: add support for codesigning certificate purpose"):

../src/signature.c: In function 'signature_init':
../src/signature.c:97:13: warning: implicit declaration of function 'X509_PURPOSE_get_by_id'; did you mean 'X509_PURPOSE_get_id'? [-Wimplicit-function-declaration]
   97 |         if (X509_PURPOSE_get_by_id(id) >= 0) {

Which is not provided by LibreSSL:

nm -D target/usr/lib/libcrypto.so | grep X509_PURPOSE_
00000000001377b0 T X509_PURPOSE_get0
0000000000137850 T X509_PURPOSE_get0_name
0000000000137860 T X509_PURPOSE_get0_sname
00000000001377d0 T X509_PURPOSE_get_by_sname
00000000001377a0 T X509_PURPOSE_get_count
0000000000137840 T X509_PURPOSE_get_id

So force the use of libopenssl.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 20:44:34 +01:00
Yann E. MORIN
3a2baca4b7 system/skeleton: move target of /etc/resolv.conf symlink
In commit ba70f94e62 (subversion makes it so we do not need a separate
tarball to store empty directories and symlinks for the target_skeleton.)
/etc/resolv.conf was made a symlink to ../tmp/resolv.conf. There was no
rationale behind this change, but back at the time (2006!), the only
location that Buildroot guaranteed to be writable was /tmp, and we
needed a writable location to create resolv.conf from a DHCP reply for
example, so the change made sense.

Commits 2f67d9e2fe (preparation for BR2_PACKAGE_BUSYBOX_SKELETON), in
2007, then d9119c0bc5 (move default skeleton to fs/ and drop busybox
skeleton), in 2010, and finally 6c3e3ad419 (New top-level directory:
system), in 2012, propagated that /etc/resolv.conf without any change in
the target of the symlink.

However, since commit d380dde1d2 (skeleton: make /run a proper
directory/filesystem), in 2015, a tmpfs has been mounted on /run, so it
is now guaranteed to be writable as well for SYS-V-based systems. That
has also been the case for openrc since commit a840e485d1
(package/skeleton-init-openrc: new package), in 2019. This has also
always been the case for systemd as well.

resolv.conf is not a temporary file [0]; it is really more of a runtime
data; its location in /tmp is just a historical artefact of a long-wrong
assertion.

Nowadays, distributions either have an actual file as /etc/resolv.conf
(when /etc is writable), or it is a symlink to a location below /run.

Although resolv.conf is used by the C library resolver, a lot of
applications now will directly use it; this is the case for some
container management tools, such as podman (and its helpers, like
netavark), that expect /etc/resolv.conf to either be a file or a symlink
to somewhere in /run, and fail to provide DNS services if that is not
the case.

So, we move the target of /etc/resolv.conf to ../run/resolv.conf.

As a consequence, we can drop the workaround in podman's runtime test.

To be noted: there are tow custom fstab files in Buildroot that do not
explicitly mount a tmpfs on /run:
  - one for a systemd runtime test, so /run would also be a tmpfs there
    anyway, as systemd does mount one;
  - one for the mender_x86_64_efi_defconfig; that's a not a problem:
    / is an ext4 that is mounted r/w (and /tmp is not a tmpfs either, so
    the symlink to /tmp would not not have worked if / was not r/w
    anyway).

This leaves people with their own fstab, to adapt. Cater to them by
adding a little blurb in the documentation.

Note: the following 43 tests all built and ran successfully:
    tests.init
    tests.package.test_apache
    tests.package.test_docker_compose
    tests.package.test_dropbear
    tests.package.test_iputils
    tests.package.test_podman
    tests.package.test_skopeo
    tests.package.test_wget

(no other runtime test were attempted)

[0] temporary, as in relatively short-lived.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:23:59 +01:00
Yann E. MORIN
54f79d804f package/podman: add option to use passt as network backend
passt/pasta is the officially supported network backend, with slirp4netns
only considered a legacy solution. However, some people have experienced
corner cases when using passt/pasta (as it still is a young stack), so we
do not want to do a blanket replace of slirp4netns just yet. Still, we
make passt/pasta the default option.

As a consequence, the existing runtime tests will now test passt/pasta,
so we introduce two new tests for slirp4netns as a network backend.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:23:23 +01:00
Yann E. MORIN
d038cc47cd package/passt: new package
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:22:10 +01:00
Yann E. MORIN
b36475315b package/aardvark-dns: new package
aardvark-dns is needed by netavark to provide cross-container DNS
resolving with Podman.

It is to be noted that netavark and aardvark-dns have to be updated in
lock-step [0].

Update the podman runtime test to validate this is working.

[0] https://github.com/containers/podman/blob/main/DISTRO_PACKAGE.md#networking-tools-netavark-aardvark-dns-passt

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:21:58 +01:00
Yann E. MORIN
ebbaac08e3 package/podman: new package
Podman is a container manager not unlike Docker, but is daemon-less.

Similarly to docker-engine, quite a few kernel config options are
required; as they are very similar in goals and features, the options
from docker-engine have been duplicated for podman. As that was not
enough, a few additional options have been added after trial-and-error
testing (they are not explicitly listed in the documentation).

The documentation [0] states that seccomp can be disabled (i.e. not
enabled). However, without seccomp support, starting containers requires
--security-opt=seccomp=unconfined to be specified; it does not look
trivial to make that the default, though [1]. Furthermore, containers
are about security, so disabling a security measure does not sound too
good. So we make seccomp support mandatory.

Podman needs netavark as a the network backend (it missing is a hard
error at runtime). It is supposed to also require aardvark-dns, an
authoritative DNS resolver, but it missing does not look to adversely
affect networking, so it is not used (as not even packaged in Buildroot
yet).

Podman can run either as the root user, or it can run rootless, i.e. by
a non-root user, which requires a bit of setup (see below, in the
runtime test) and a few other dependencies: slirp4netns [2] (to provide
network connectivity in userland), and support for subordinate UIDs and
GIDs with the shadow library. Rootless mode is one of the main selling
point for podman, so we decided that this would not be configurable in
Buildroot.

Similar to Docker, podman can inject a minimalist init as PID1 in
containers, and like Docker, this is optional; podman however by default
uses catatonit as such an init [3]. As for Docker-engine, we offer a
choice of which init package to use to provide podman-init.

Podman requires at least three config files; they can be either per-user
or system-wide:
  - containers.conf [4]: defines various settings for the container
    runtimes;
  - policy.json [5]: defines what signature to accept to validate
    images; without one such file, podman just refuses to pull images;
  - registries.conf [6]: defines where to pull images from; without it,
    podman does not know how to pull un-qualified images (i.e. images
    where the registry is not specified in the path, and which Docker
    would fetch from the Docker Hub, e.g. "busybox:latest").

For those three files, we provide a very minimal default that (in the
same order as above):
  - uses the slirp4netns network backend for rootless operation (the
    default in podman is to use pasta [1], so we need to explicitly
    configure it to use slirp4netns);
  - allows pulling images which signature can't be verified;
  - pulls unqualified images from the Docker Hub, as is traditional.

Providing actual files is going to be use-case dependent, and interested
parties will have to provide their own config files, e.g. in a rootfs
overlay.

Finally, we add a runtime test for podman. Podman is a huge binary, and
may call other huge binaries (netavark...); this can be quite slow in
the emulated machine (even when running on a very fast host machine), so
we use a huge timeout for all commands involving podman, even those that
exit the containers, as that may need to tear down podman setup.

The default kernel used in runtime tests is missing a lot of features,
so we need to build our own; we use the same version as the bundled
kernel. We can't use cpio either, because we need a filesystem that can
be used as a lower and upper of overlayfs, which is not possible with
the filesystem the cpio is extracted into; ext2 fits the bill, so we use
that. We need a bit of space to store images and stuff, so let's be
generous and allocate 256M.

To test rootless operation, we need a non-root user that has some
special setup [7]; it is easier to run the commands from the infra
rather than carry a user-definition table and a rootfs overlay. We need
that user to have the same prompts (main and continuation) so that the
REPLWrapper still detects those; it has the unfortunate side effect that
it is not immediately obvious whether a command was run as root or not,
and one has to look back up in the run-log to see whether there was a
transition to another user earlier.

Still for rootless containers, podman/netavark expect /etc/resolv.conf
to be either a plain file, or a symlink that points either deeper in
/etc or anywhere in /run; if resolv.conf resolves to any other location,
DNS in rootless containers does not work. This is reasonable, and is
what already happens on a systemd-based system (and thus all major
distributions nowadays. However, in Buildroot, we put the actual file in
/tmp; this is historical, and dates back to the days where Buildroot did
not have a guaranteed-writable /run. So, we work around this limitation
in the test (for now).

The official busybox image on the Docker Hub supports a lot of
architectures, of which armv7 which we use for this runtime test.
Finding a small image that also supports armv7 on other registries was
a bit of a challenge; we eventually found one busybox image on quay.io,
but it is not an official busybox image; still, it fits the bill, so we
use it.

There is no runtime test with systemd, as this requires quite some
additional setup that does not look very trivial to do; when it detects
it is running under systemd in rootless mode, podman expects that a full
user session exists, or it whines about it every time it is started,
reverting to non-systemd behaviour; getting a full user session does not
look to be that trivial (PAM?), so this would not exercise the actual
integration with systemd, so the test would not be meaningful, so it is
not provided. This is left as an exercise to an interested party to
extend the tests.

PS: Hat-tip to Raphael, who provided some pointers and hints on this
change, especially for rootless mode. Thanks! 👍

[0] https://podman.io/docs/installation#get-source-code
[1] it looks like we can provide a custom seccomp profile, by specifying
seccomp_profile="PATH" in containers.conf; that would still require
seccomp support to use that file, though, so that does not change the
outcome.
[2] it is possible to use another backend, but it is not packaged in
in Buildroot yet: https://passt.top/passt/about/#pasta-pack-a-subtle-tap-abstraction
[3] podman expects a 'catatonit' helper in /usr/libexec/podman, so even
if tini would be usable instead, it would not feel right to use it to
impersonate catatonit. So let's assume that only catatonit is supported.
[4] https://github.com/containers/common/blob/main/docs/containers.conf.5.md
[5] https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md
[6] https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
[7] https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Cc: Christian Stewart <christian@aperture.us>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:19:29 +01:00
Yann E. MORIN
7289731adf package/netavark: new package
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:16:51 +01:00
Yann E. MORIN
2795fecc50 package/nftables: add an option to force JSON support
Currently, nftables JSON support is implicit: if jansson is enabled,
JSON support is enabled, otherwise it is not.

Some packages will require that nftables be built with JSON support;
that's the case of netavarks, for example (to come in a later patch).
So, in the current state, it would mean a package would have to select
jansson, although it does not itself use it, so that nftables has JSON
support. This does not feel right.

Instead, introduce an option to nftables, to explicitly enabled JSON
support. Packages such as netavark would then just have to require JSON
support in nftables.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:16:22 +01:00
Yann E. MORIN
5ae4c36dfe package/cgroupfs-v2-mount: new package
Currently, the cgroupfs-mount package only mounts a cgroup v1 hierarchy,
but v1 is considered legacy and obsolete, while v2 has been around for a
while now, and is required by some packages (e.g. podman whines about
v1).

cgroupfs-mount has not had a release in almost 8 years now, and only the
occasional commit since then and until more than 3 years ago. It's not
going to evolve...

Add a new package with a simple-enough sysv startup script, that mounts
the cgroup v2 hierarchy filesystem. For systemd, there's nothing to do,
as systemd handles the mount by itself.

Since both cgroup v1 and v2 use the same mountpoint, we can't have both
enabled at the same time, and thus we restrict the v2 to be hidden when
v1 is enabled (quite a few packages select the v1; changing those would
require that they be validated against v2 first...)

Note that, due to limitations in Kconfig, cgroupfs-v2-mount will appear
indented below cgroupfs-mount, because it has a (negative) dependency on
it. This spurious indentation is unfortunate and annoying, but benign;
fixing that would require breaking the dependency with a random Kconfig
symbol, which we don't have, and which we decided not to introduce just
for this one use-case (well, there's host-gnupg and host-gnupg2 that
have the exact same issue, but meh...)

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:13:25 +01:00
Yann E. MORIN
2c7a817dc5 package/cgroupfs-mount: tweak the kernel config
When it was introduced in 2016 with commit 0e1547a87c (cgroupfs-mount:
new package), we did not yet have the infrastructure for package to set
kernel config options, which only came 4 years later with commit
0aed4c2dae (linux: allow packages to set kernel config options).

So at that time, the requirements for cgroupfs-mount were documented in
the help for the Kconfig symbol.

But now that we do have the infrastructure in place, actually use it to
set the required options, and drop the list from the Kconfig entry (that
would be duplication, prone to bit-rot with time, and other packages do
not document their requirements in Kconfig, they just use the infra to
set the options).

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:11:01 +01:00
Yann E. MORIN
5c77357c58 package/skopeo: add target variant
Skopeo can be used to manipulate container images, and so can be useful
on target devices that are going to be used as a host to run containers.

So, add a target variant for skopeo.

... with a runtime test while at it.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 22:09:10 +01:00
Yann E. MORIN
c1add22462 package/slirp4netns: needs TUN support in the kernel
slirp4netns needs a kernel with TUN support, so enable that and the few
options it depends on.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Reviewed-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:59:46 +01:00
Yann E. MORIN
8edab92178 package/conmon: depends on systemd when enabled
When it detects it runs under systemd, conmon will want to log to the
journal. However, it needs to be linked with libsystemd to do so and if
not, will error out:

    Feb 22 11:10:03 buildroot conmon[199]: conmon 3b462ce6f2cc64f75c42 <error>: Include journald in compilation path to log to systemd journal

This prevents starting any container.

Add a dependency to systemd when it is enabled.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:59:06 +01:00
Yann E. MORIN
4554ab9815 package/shadow: install to staging for subids
When the subids feature is enabled, shadow will install a library and a
header:

    $ sort output/build/shadow-4.16.0/.files-list.txt
    [...]
    shadow,./lib/libsubid.la
    shadow,./lib/libsubid.so
    shadow,./lib/libsubid.so.5
    shadow,./lib/libsubid.so.5.0.0
    [...]
    shadow,./usr/include/shadow/subid.h
    [...]

Install to staging in that case.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Reviewed-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:58:27 +01:00
Yann E. MORIN
cf8641b73e support/testing: set date in emulated machine
When time comes to check certificates, the date and time in the emulated
machine should be close enough to the actual values, so that certificate
validity can be checked.

Some Qemu machines have an RTC (e.g. arm vexpress-a9 has a pl031), and
the kernel needs a driver for those RTC. It is not guaranteed that the
machine used for a test meets those two conditions; in such a case, the
time in the machine starts way back in the past (1970-01-01T00:00:00Z on
sysv, or the release date of systemd). This is the case with the default
kernel, so such tests do not have the proper time.

Set the date to the date of the host system. This is going to be accurate
to the second, which is, by far, enough for our purpose.

To avoid having to consider what combination of emulated machine and kernel
configuration are being used, we always set the date, as this is a
generic step that should be done by the infra (like login in as root is).

The Emulator() class doesn't inherit from unittest.TestCase, so we can't
call any of the usual self.assertXXX() methods; instead, we just raise
a standard exception, like is done a few lines above to detect the login
prompt.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Ricardo Martincoski <ricardo.martincoski@datacom.com.br>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:57:45 +01:00
Yann E. MORIN
6dc177bee8 system: add catatonit as init system
Like the existing tini, catatonit can be used as minimal init to be
used as PID-1.

Add it to the list of init systems, like was done for tini in
24cac9c4e6 (system: add tini as init system) and tinyinit in
c1daa35cd9 (package/tinyinit: new package).

Unlike the "main" init systems, there is no historical preference for
those minimalist init systems, so just keep them alphabetically
ordered.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:45:36 +01:00
Yann E. MORIN
1b81b594a9 package/catatonit: update to version 0.2.1
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:45:36 +01:00
Yann E. MORIN
022f49618c package/docker-engine: add option to support catatonit as init
currently, docker-engine can only use tini as injected init. catatonit
as a package exists, but it does not create the symlink that would be
needed at runtime [0].

Add a choice at the docker-engine level, for which injected init to use,
bringing catatonit to the integration level of tini.

[0] that could be done in a post-build script, but that's not practical.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
[Julien: move the legacy option to a new 2025.05 section]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 21:45:31 +01:00
Yann E. MORIN
cb97f6a9b3 package/docker-engine: carry the tini init symlink
tini can be used standalone, not just as an init injected by docker.
As such, creating the docker-engine's init symlink does not belong to
tini itself, but to docker-engine.

This will also help later, when we allow docker-engine to use another
init alternative, catatonit (already paclkaged in Buildroot, but not
integrated with docker).

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Christian Stewart <christian@aperture.us>
Cc: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 20:45:57 +01:00
Akhilesh Nema
ce3dae7a83 configs/ls1046a-frwy_defconfig: bump BSP components to lf-6.6.52-2.2.0
- Updated Linux, U-Boot, and TF-A to lf-6.6.52-2.2.0 tag.
- Updated readme.txt

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
[Julien: remove fmc and fmlib in readme.txt to reflect
  comment from Brandon Maier]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 16:36:33 +01:00
Akhilesh Nema
ba8a8359e9 package/fmc: bump version to lf-6.6.52-2.2.0
- The license file was renamed from COPYING to LICENSE.

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 15:07:23 +01:00
Akhilesh Nema
a3412adb2a package/fmlib: bump version to lf-6.6.52-2.2.0
- The license file was renamed from COPYING to LICENSE.
- Added a patch to fix build errors with gcc-14.

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 15:06:42 +01:00
Akhilesh Nema
2522130175 package/qoriq-fm-ucode: bump version to lf-6.6.52-2.2.0
The package is unchanged; a new tag was added to match other NXP QorIQ package versions.

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 15:06:14 +01:00
Akhilesh Nema
13a8275c2a package/qoriq-rcw: bump version to lf-6.6.52-2.2.0
Changelog:
https://github.com/nxp-qoriq/rcw/compare/lf-6.6.23-2.0.0...lf-6.6.52-2.2.0

Signed-off-by: Akhilesh Nema <nemaakhilesh@gmail.com>
Reviewed-by: Brandon Maier <brandon.maier@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-15 15:05:34 +01:00
Fiona Klute (WIWA)
e7cbf89798 package/libglib2: bump version to 2.84.0
Upstream changelog:
https://gitlab.gnome.org/GNOME/glib/-/blob/main/NEWS?ref_type=heads

Note that upstream is planning to require C11 starting with 2.85.x,
and encourages people who would have problems with that to file
issues: https://gitlab.gnome.org/GNOME/glib/-/merge_requests/4473

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 22:41:55 +01:00
Marcus Hoffmann
291a3263e0 package/can-utils: bump to v2025.01
Remove patches that are now included in upstream release.
Package switched from autotools to cmake based build.
Backport two build fixes that are already merged upstream.

* 0001-Include-time.h-for-timespec-struct-definition.patch fixes a musl
  build issue
* 0002-CMakeLists.txt-add-an-option-to-control-shared-libra.patch fixes
  static only builds

Release Notes: https://github.com/linux-can/can-utils/releases/tag/v2025.01

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 22:25:35 +01:00
Marcus Hoffmann
e1cbe13462 package/libedit: bump to 20250104-3.1
Changelog:

2025-01-04 Jess Thrysoee

   * all: sync with upstream source

2024-08-08 Jess Thrysoee

   * all: sync with upstream source

   * doc/Makefile.am: fix regression. Name all manpage links as el_*
	(e.g. el_history.3) to avoid conflicts.
	Reported by Zopolis4

2024-05-17 Jess Thrysoee

   * all: sync with upstream source

Upstream changes are theoretically viewable at [1] but not
in a very readable form.

[1] http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libedit

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 22:06:51 +01:00
Alex Bennée
fc690631ca package/fio: explicitly control libnfs dependency
The upstream uses pkg-config to detect and enable libnfs usage if it
is found [1]. This can get confused by the host configuration so at the
least we should disable detection if we are not planning to build with
it.

Note: the fio configure script accept both --enable-libnfs
and --disable-libnfs since upstream commit [2], first included
in fio v3.31. In Buildroot, this is supported since [3].

[1] https://github.com/axboe/fio/blob/fio-3.38/configure#L2360
[2] 98ab12629c
[3] 256395d8e5

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 20:58:04 +01:00
Bernd Kuhls
a79c862fa1 {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 19:15:42 +01:00
Brandon Lumbra
9f60aa973d package/rt-tests: fix build with glibc 2.41+
Since glibc bump to 2.41 in Buildroot commit [1], rt-tests is failing
to build with error:

    In file included from src/lib/rt-utils.c:28:
    src/include/rt-sched.h:45:8: error: redefinition of 'struct sched_attr'
       45 | struct sched_attr {
          |        ^~~~~~~~~~

glibc 2.41 adds sched_*attr, conflicting with rt-sched.h in the rt-tests
package. This commit resolves the conflict by applying a patch from
upstream which excludes the conflicting code when using glibc >= 2.41.

Fixes:
https://autobuild.buildroot.org/results/30308c74291004c328d6c3603ce68d600c5ef281/

[1] 6ecab31fad

Signed-off-by: Brandon Lumbra <brandon.lumbra@sense.com>
[Julien:
 - add extra info in commit log
 - add missing Signed-off-by line in commit log
 - add missing Signed-off-by in patch
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 19:01:50 +01:00
Bernd Kuhls
befd90b765 package/php: security bump version to 8.3.19
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_3

Release notes: https://news-web.php.net/php.announce/455
"(The 8.3.18 release was skipped due to the erroneous omission of a
non-security related patch.)"

Fixes CVE-2024-11235, CVE-2025-1219, CVE-2025-1736, CVE-2025-1861,
CVE-2025-1734, and CVE-2025-1217.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-03-14 18:47:25 +01:00
Peter Korsgaard
873407b46c docs/website/news.html: refer to gitlab bug tracker
We moved the issue tracking to gitlab some time ago.  Adjust the bug tracker
references in news.html to point to there instead of bugzilla for clarity.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 11:40:10 +01:00
Peter Korsgaard
53f74f49c0 Update for 2025.02-rc2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025.02-rc2
2025-03-13 11:09:27 +01:00
Gero Schwäricke
ac300757f6 board/stmicroelectronics/stm32mp135f-dk: fix boot steps in readme
The instructions in the readme use incorrect connector names.

See also the official devkit documentation:
https://wiki.st.com/stm32mpu/wiki/Getting_started/STM32MP1_boards/STM32MP135x-DK/Let%27s_start/Unpack_the_STM32MP135x-DK_board#Out-of-the-box_kit

Also the board does not show the console on the screen.

This may have been a copy & paste oversight from the STM32MP157 readme.

Signed-off-by: Gero Schwäricke <gero.schwaericke@sevenlab.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 10:42:23 +01:00