Updating the hash of the WHENCE file, due to firmware additions and
firmware changes, but no changes to the redistribution/licensing
conditions.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://curl.se/ch/8.19.0.htmlhttps://curl.se/docs/security.html
Fixes the following CVEs:
CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection
Switch to sha256 tarball hash provided by upstream.
Updated license hash due to copyright year bump:
e83c82f05f
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.
To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.
Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.
The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.
Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.
Fixes the following security vulnerabilities:
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root
For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit switches the aarch64_efi_defconfig to an external glibc
stable Bootlin toolchain, to follow recommendation from [1].
Since an external toolchain is used, the linux-headers.hash custom
hash file is no longer needed and is removed.
[1] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- updates the Kernel from 6.10 to 6.18.16
- updates U-Boot from 2024.07 to 2026.01
- updates arm-trusted-firmware from v2.11 to v2.12 LTS
- switches to Bootlin external glibc stable toolchain
Replace OP-TEE TEE binary file tee-pager_v2.bin by tee-raw.bin using
the new option BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN.
Remove unsued linux-headers.hash since we now use a prebuilt toolchain.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Replace OP-TEE TEE binary file tee-pager_v2.bin by tee-raw.bin using
the new option BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN.
Remove unsued linux-headers.hash since we use a prebuilt toolchain.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
There was a previous attempt in commit [1] to bump the kernel to 6.18
but the SD card failed at boot. It seems the actual issue is related to
the "cheap" (or fake?) SD card with SD UHS SDR50 speed.
This offending SD card come from a lot recently purchased in order to
fix my “Too many boards, not enough SD cards” issue.
[1] 4abb8a98b2
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The commit [1] update arm-trusted-firmware to v2.12 LTS without
removing the custom file hash.
While at it, remove unused linux-headers.hash since we already use a
prebuilt toolchain.
[1] 4abb8a98b2
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This defconfig use BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS to provide the path
to the TEE in raw binary format but use the legacy file name
"tee-pager_v2.bin" rather than the recommended "tee-raw.bin" [1][2].
Instead of just replacing the file name, use the newly introduced
BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN option. Since this option
needs BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE, we now have an explicit
dependency between u-boot and optee-os package.
Previously we had an indirect dependency: optee-os <- ATF <- u-boot
with both BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL32_OPTEE and
BR2_TARGET_UBOOT_NEEDS_ATF_BL31 options enabled at the same time.
[1] 376cb124dd
[2] 4e0b8238ee
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
OP-TEE generates a few binaries that can be used by u-boot on some
platforms (Rockchip, Texas Instruments K3) using TEE variable.
Add a link to the OP-TEE documentation were we can find easily the
desciption for each TEE format that can be used by u-boot.
For convenience, copy tee.elf and tee.bin description in each option
choice help text.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Remove myself from packages that I'm no longer personally interested in.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Subproject tarballs are not provided anymore:
https://discourse.llvm.org/t/llvm-22-1-0-released/89950
"Please note since the last release the subproject tarballs have been
removed"
https://discourse.llvm.org/t/rfc-do-something-with-the-subproject-tarballs-in-the-release-page/75024/14
Used upstream tarball llvm-project-22.1.0.src.tar.xz for all packages
and linked subproject hash files to ../llvm-project.hash.
Removed patches which fix build errors caused by subproject tarballs.
Removed handling of third-party-21.1.8.src.tar.xz which is included in
the monolithic tarball.
Added _SUBDIR variable or updated _INSTALL_CMDS when needed.
For compiler-rt:
Removed both patches, they are not needed anymore.
Added patch to fix aarch64 build.
Added dependency on gcc >= 15.x because libcxx now depends on gcc >=
15.x: https://github.com/llvm/llvm-project/pull/165684
warning "Libc++ only supports GCC 15 and later"
Building with gcc 14.x causes many build errors like
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/is_array.h:43:68:
error: expected primary-expression before ')' token
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/is_array.h:43:44:
error: there are no arguments to '__is_unbounded_array' that depend on
a template parameter, so a declaration of '__is_unbounded_array' must
be available [-fpermissive]
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/decay.h:22:32:
error: expected type-specifier before '__decay'
A corresponding bug report sent upstream
https://github.com/llvm/llvm-project/issues/174203
was answered:
https://github.com/llvm/llvm-project/issues/174203#issuecomment-3711113919
"Our policy is rather clear: Only the latest GCC is supported."
and an update to supported compiler versions was committed:
d1146b1ddd
Updated TestClangCompilerRT to use a gcc 15-based toolchain.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit will also switch to the Bootlin glibc stable toolchain.
Switch to Bootlin glibc stable toolchain as requested by the 2024
Buildroot meeting report:
https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
Signed-off-by: Scott Fan <fancp2007@gmail.com>
[Julien:
- remove no longer needed linux-headers.hash
- change comment in linux.hash to take hash from upstream
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
FTXUI is a simple cross-platform C++ library for terminal
based user interfaces.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
[Julien: remove FTXUI_SOURCE to use the default archive name]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Replaced install_prefix with DESTDIR in _INSTALL_TARGET_OPTS following
changes in upstream Makefiles, for example:
acb9dd88dc (diff-d56275146b88014f5017f78d3eb4ccdb545c8b82d94877b09ef33bac8f228414L13)
Build-tested using this defconfig
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XSCREENSAVER=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: SKIPPED
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: SKIPPED
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: SKIPPED
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: SKIPPED
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: SKIPPED
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: SKIPPED
br-arm-full-nothread [31/32]: SKIPPED
br-arm-full-static [32/32]: SKIPPED
32 builds, 8 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error with gcc 9.x:
output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
'bool nclx_profile::operator==(const nclx_profile&)
const' cannot be defaulted
using this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_STATIC_LIBS=y
BR2_PACKAGE_LIBHEIF=y
According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.
The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.
Also removed -std=c++11 from CXXFLAGS.
The build error was not yet recorded by the autobuilders.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
