Commit Graph

75729 Commits

Author SHA1 Message Date
Niklas Cassel
79494bba29 package/linux-tools: selftests: Add path containing BPF binary to _BIN_ARCH_EXCLUDE
Enabling BR2_PACKAGE_LINUX_TOOLS_SELFTESTS (on rock5b_defconfig,
which uses kernel 6.12 at the time of writing), results in:

make[1]: Leaving directory '/br/output/build/linux-endpoint-test/tools/testing/selftests'
ERROR: architecture for "/usr/lib/kselftests/tc-testing/action-ebpf" is "Linux BPF", should be "AArch64"
make: *** [package/pkg-generic.mk:402: /br/output/build/linux-tools/.stamp_installed] Error 1

To solve this, add /usr/lib/kselftests/tc-testing/ to
LINUX_TOOLS_BIN_ARCH_EXCLUDE.

Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3a03cb2ad6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:24 +02:00
Niklas Cassel
8cb5263d38 package/linux-tools: perf: Fix _BIN_ARCH_EXCLUDE
support/scripts/check-bin-arch has an option -i to exclude a path
(or many paths by using -i multiple times).

This was implemented in commit 01d90f0d09 ("spport/check-bin-arch:
accept arbitrary per-package ignore paths").

Looking at this feature (which hasn't changed since being added),
we can see that check-bin-arch automatically adds a trailing slash
to all entries specified using -i.

Thus, specifying a path to a file, e.g.
"/usr/libexec/perf-core/tests/pe-file.exe" will cause check-bin-arch
to add "/usr/libexec/perf-core/tests/pe-file.exe/" to the IGNORES array.

When running the main loop, the file
"/usr/libexec/perf-core/tests/pe-file.exe" will thus not be ignored,
since it will not trigger a match the pattern that was added to the
IGNORES array ("/usr/libexec/perf-core/tests/pe-file.exe/").

This means that the -i option in check-bin-arch only supports directories
and not files.

Fix the LINUX_TOOLS_BIN_ARCH_EXCLUDE in
package/linux-tools/linux-tool-perf.mk.in to specify a directory, as the
existing LINUX_TOOLS_BIN_ARCH_EXCLUDE can never have actually worked.

Fixes: a7ad781626 ("package/linux-tools: Exclude checking PE binaries from perf test")
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4d7292675a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:23 +02:00
Sébastien Szymanski
fee4b78429 support/kconfig: handle backspace (^H) key
This is in the mainline kernel since v5.1-rc3:
9c38f1f04408 ("kconfig/[mn]conf: handle backspace (^H) key")

Quoting the commit's log:

"
Backspace is not working on some terminal emulators which do not send the
key code defined by terminfo. Terminals either send '^H' (8) or '^?' (127).
But currently only '^?' is handled. Let's also handle '^H' for those
terminals.
"

Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d65c10c20a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:22 +02:00
Colin Evrard
6dd9b8c196 package/libmodsecurity: security bump to 3.0.14
The project has been updated, including
security fixes to issues present in version 3.0.13.

- Fixes:
  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27110

- For a full changelog, visit:
  https://github.com/owasp-modsecurity/ModSecurity/blob/v3.0.14/CHANGES

Signed-off-by: Colin Evrard <colin.evrard@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 29cf86b8d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:21 +02:00
Frank Vanbever
42a08ee3a5 package/libmodsecurity: bump to version 3.0.13
For release note, see:
https://github.com/owasp-modsecurity/ModSecurity/releases/tag/v3.0.13

- Drop 0001-configure.ac-drop-usage-of-git-at-configure-time.patch
  The package originally had to be reconfigured to patch in uclinux
  support. The fix has been merged upstream [1]. We no longer need to
  reconfigure the package so we can drop this patch.

[1] https://github.com/owasp-modsecurity/ModSecurity/pull/2235

Signed-off-by: Frank Vanbever <frank.vanbever@mind.be>
[Julien:
 - add link to release note
 - update .checkpackageignore to fix check-package errors
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0748e761e2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-04-11 12:42:20 +02:00
Peter Korsgaard
8fdf9ed8d2 Update for 2024.11.3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024.11.3
2025-03-24 17:43:27 +01:00
Yann E. MORIN
324856a3a4 package/libopenssl do not build in parallel
With highly parallel builds on a heavily loaded machine, the libopenssl
build often (about half of the time) fails with spurious missing rules
in its Makefile:

    >>> host-libopenssl 3.4.1 Installing to host directory
    [...] /usr/bin/make  -C [...]/build/host-libopenssl-3.4.1 install
    "/usr/bin/make" depend && "/usr/bin/make" _build_libs
    "/usr/bin/make" depend && "/usr/bin/make" _build_modules
    "/usr/bin/make" depend && "/usr/bin/make" _build_programs
    [...]
    make[3]: *** No rule to make target '_build_modules'.  Stop.
    make[2]: *** [Makefile:3159: build_modules] Error 2
    make[2]: *** Waiting for unfinished jobs....
    make[3]: Nothing to be done for '_build_programs'.
    make[3]: Nothing to be done for '_build_libs'.
    make[1]: *** [package/pkg-generic.mk:283: [...]/build/host-libopenssl-3.4.1/.stamp_host_installed] Error 2
    make[1]: *** Waiting for unfinished jobs....
    [...]
    make: *** [Makefile:23: _all] Error 2

Ideally, we'd like to fix the issue. However, the Nakefile is generated
by the Configure script, written in perl, from the template in
Configurations/unix-Makefile.tmpl, which also uses some kind of special
(perl-related, probably) templating language. That makes it pretty
difficult to see what is going on, though, and nigh impossible to fix
without a deep understanding of the openssl buildsystem.

So, we can only disable parallel builds until the issue is fixed
upstream [0]. Add a comment to both build commands (host and target) to
reference the upstream issue report.

Note that the issue has mostly been observed in the build of the host
variant so far, but there is no reason why it can't happen in the build
of the target variant.

[0] https://github.com/openssl/openssl/issues/27074

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 27ab880ebb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 13:13:26 +01:00
Waldemar Brodkorb
98a01c9aca package/expat: security update to 2.7.0
Fixes CVE-2024-8176.

For more details, see:
https://blog.hartwork.org/posts/expat-2-7-0-released/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dcd6bea6ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 13:12:35 +01:00
Peter Korsgaard
5b357927f0 package/rauc: needs libopenssl, not libressl
Fixes http://autobuild.buildroot.net/results/6efc1275d3aac9f0a4c000f3d0911b5a880e495d/

Rauc uses X509_PURPOSE_get_by_id() since rauc-1.3 with commit 375dbb16dd94
("src/signature: add support for codesigning certificate purpose"):

../src/signature.c: In function 'signature_init':
../src/signature.c:97:13: warning: implicit declaration of function 'X509_PURPOSE_get_by_id'; did you mean 'X509_PURPOSE_get_id'? [-Wimplicit-function-declaration]
   97 |         if (X509_PURPOSE_get_by_id(id) >= 0) {

Which is not provided by LibreSSL:

nm -D target/usr/lib/libcrypto.so | grep X509_PURPOSE_
00000000001377b0 T X509_PURPOSE_get0
0000000000137850 T X509_PURPOSE_get0_name
0000000000137860 T X509_PURPOSE_get0_sname
00000000001377d0 T X509_PURPOSE_get_by_sname
00000000001377a0 T X509_PURPOSE_get_count
0000000000137840 T X509_PURPOSE_get_id

So force the use of libopenssl.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9679ddbcd0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 11:25:28 +01:00
Alex Bennée
4085ca3069 package/fio: explicitly control libnfs dependency
The upstream uses pkg-config to detect and enable libnfs usage if it
is found [1]. This can get confused by the host configuration so at the
least we should disable detection if we are not planning to build with
it.

Note: the fio configure script accept both --enable-libnfs
and --disable-libnfs since upstream commit [2], first included
in fio v3.31. In Buildroot, this is supported since [3].

[1] https://github.com/axboe/fio/blob/fio-3.38/configure#L2360
[2] 98ab12629c
[3] 256395d8e5

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fc690631ca)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 11:05:28 +01:00
Bernd Kuhls
c1d85f148a {linux, linux-headers}: bump 5.{4, 10, 15}.x / 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a79c862fa1)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-24 10:59:03 +01:00
Bernd Kuhls
7379a1e451 package/php: security bump version to 8.3.19
Changelog: https://www.php.net/ChangeLog-8.php#PHP_8_3

Release notes: https://news-web.php.net/php.announce/455
"(The 8.3.18 release was skipped due to the erroneous omission of a
non-security related patch.)"

Fixes CVE-2024-11235, CVE-2025-1219, CVE-2025-1736, CVE-2025-1861,
CVE-2025-1734, and CVE-2025-1217.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit befd90b765)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 14:00:31 +01:00
Yevhen Babiichuk (DustDFG)
48505536f6 package/llvm-project/compiler-rt: remove duplicate parameter
The COMPILER_RT_STANDALONE_BUILD parameter was passed twice.  One time as
FALSE and immediately after as TRUE which overrides previous value, so drop
the first one.

Signed-off-by: Yevhen Babiichuk (DustDFG) <dfgdust@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit acc7ce7262)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 08:37:23 +01:00
Yevhen Babiichuk (DustDFG)
6dd33c2779 package/{odb,sdbusplus}: use "host <foo>" prompt
For consistency with the other host packages.

Signed-off-by: Yevhen Babiichuk (DustDFG) <dfgdust@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6979ee5db0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-22 08:37:07 +01:00
Thomas Devoogdt
d3c48508b2 package/webkitgtk: bump to 2.46.4
Stable release to the 2.46 series.

Release notes:

  https://webkitgtk.org/2024/09/17/webkitgtk2.46.0-released.html
  https://webkitgtk.org/2024/09/30/webkitgtk2.46.1-released.html
  https://webkitgtk.org/2024/10/21/webkitgtk2.46.2-released.html
  https://webkitgtk.org/2024/10/30/webkitgtk2.46.3-released.html
  https://webkitgtk.org/2024/11/27/webkitgtk2.46.4-released.html

Added BR2_PACKAGE_WEBP_MUX to fix this error:

-- The following WebP libraries were not found:
--  mux (required)

Added USE_SYSTEM_SYSPROF_CAPTURE=OFF to fix this error:

-- Checking for module 'sysprof-capture-4'
--   Package 'sysprof-capture-4', required by 'virtual:world', not found
-- Could NOT find SysProfCapture (missing: SysProfCapture_LIBRARY SysProfCapture_INCLUDE_DIR)

For now, use USE_SKIA=OFF which is the replacement for cairo.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a199751e5b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-21 22:20:58 +01:00
Daniel Palmer
3c1c7d5179 package/musl: Add upstream patch to fix building strace on m68k
Fixes:
http://autobuild.buildroot.net/results/ec3de790a66373f270f731519e2ef51c293ba683/

Currently it's not possible to build strace on m68k when using
musl because the version of musl in buildroot doesn't have the
m68k specific definitions of POLLWRNORM and POLLWRBAND.

This is already fixed upstream so manually apply the patch
until the next release.

Signed-off-by: Daniel Palmer <daniel@0x0f.com>
[Peter: add autobuilder ref and upstream link / s-o-b in patch description]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 3e88ba41a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-21 15:59:40 +01:00
Bernd Kuhls
fdd59f82c0 {linux, linux-headers}: bump 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a3c3c2cc3b)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:30:55 +01:00
Quentin Schulz
1dda0987a0 package/libcamera: force-disable qcam for now
Fixes:
http://autobuild.buildroot.net/results/5b0dc8acd491f1d7b20f5b5f065b28212b9d4912/
http://autobuild.buildroot.net/results/61e4bce00a2aff3f531de6c1896d4dc1f92ba5e3/

qcam is based on Qt6 since commit 71aa3ceec30b ("apps: qcam: Port to Qt
6") which is part of the v0.3.1 release.

qcam being enabled when BR2_PACKAGE_QT5BASE_WIDGETS symbol is defined
breaks the build as it's missing the qt6 dependencies.

The migration to Qt 6 for the Buildroot package isn't straightforward
though as we're hitting a meson bug[1].

For now, let's just always disable qcam until we can get everything
fixed and migrated properly.

[1] https://github.com/mesonbuild/meson/issues/13018

Fixes: 72757d111a ("package/libcamera: bump to version 0.3.2")
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1c653dd19f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:24:51 +01:00
Daniel Palmer
4d779a7d2d package/prboom: Fix big endian fix up
The hack to force big endian support when building
for a big endian machine doesn't work as there is
some whitespace between "#" and "undef" in config.h.

Add a wildcard between those two so that the target
line matches and the replacement is done.

Allows me to play DOOM on my LC475.

Signed-off-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcd82198f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:23:59 +01:00
Julien Olivain
e33e8a43a3 package/libjxl: security bump to version 0.11.1
For release notes since v0.11.0, see:
https://github.com/libjxl/libjxl/releases/tag/v0.11.1

Fixes:
https://www.cve.org/cverecord?id=CVE-2024-11403
https://www.cve.org/cverecord?id=CVE-2024-11498

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5dab98d721)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:10:38 +01:00
Vladimir Oltean
4ad66243dc package/util-linux: add uuidd user and group
When util-linux is compiled with the uuidd daemon and with systemd
init, the rootfs creation fails in fakeroot as follows:

    printf 'host/bin/systemctl --root=build/buildroot-fs/ext2/target preset-all\n' >> build/buildroot-fs/ext2/fakeroot
    [...]
    FAKEROOTDONTTRYCHOWN=1 host/bin/fakeroot -- build/buildroot-fs/ext2/fakeroot
    rootdir=build/buildroot-fs/ext2/target
    table='build/buildroot-fs/full_devices_table.txt'
    ignored spec: h /var/log/journal/%m - - - - +C
    ignored spec: x /var/tmp/systemd-private-%b-*
    ignored spec: X /var/tmp/systemd-private-%b-*/tmp
    ignored spec: x  /var/lib/systemd/coredump/.#core*.%b*
    ignored spec: z /var/log/journal/%m 2755 root systemd-journal - -
    ignored spec: z /var/log/journal/%m/system.journal 0640 root systemd-journal - -
    <stdin>:37: Failed to resolve user 'uuidd': No such process
    make[1]: *** [fs/ext2/ext2.mk:66: images/rootfs.ext2] Error 65
    make: *** [Makefile:83: _all] Error 2

This error can be reproduced with the commands:

    cat <<EOF >.config
    BR2_aarch64=y
    BR2_TOOLCHAIN_EXTERNAL=y
    BR2_PACKAGE_UTIL_LINUX=y
    BR2_PACKAGE_UTIL_LINUX_UUIDD=y
    BR2_INIT_SYSTEMD=y
    BR2_TARGET_ROOTFS_EXT2=y
    EOF
    make olddefconfig
    make

The error comes from systemctl, which cannot find the uuidd user in
the target rootfs, needed in the uuidd.service unit file [1].

This commit fixes the issue by adding the uuidd user and group in
support/scripts/mkusers syntax.

[1] https://web.git.kernel.org/pub/scm/utils/util-linux/util-linux.git/tree/misc-utils/uuidd.service.in?h=v2.40.2

Signed-off-by: Vladimir Oltean <olteanv@gmail.com>
[Julien: add commands to reproduce the issue in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4809690d42)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:08:23 +01:00
Cherniaev Andrei
1666a565e7 boot/grub2/readme.txt: typo
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3fbc4e583f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:06:26 +01:00
Daniel Lang
29acf56a7c boot/optee-os: add CPE identifier
cpe:2.3:o:linaro:op-tee:4.3.0:*:*:*:*:*:*:* is a valid CPE ID.

See:
https://nvd.nist.gov/products/cpe/detail/2754E8CF-9BD5-448D-9F32-CFAC92278CD9

Note: this commit needs to set _CPE_ID_PREFIX because optee-os CPE
"part" needs to be set to "o" (OS), while the default Buildroot prefix
is "a" (Application).

Signed-off-by: Daniel Lang <dalang@gmx.at>
[Julien:
 - add extra info in commit log (and fix CVE to CPE)
 - add a new line after OPTEE_OS_CPE_ID_PRODUCT for readability
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f2498258d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 21:04:53 +01:00
Adam Duskett
5746e5aa3c package/systemd: enable tmpfs kernel option
systemd automatically creates tmpfs mounts for /tmp, /run, /dev/shm, and
others. If tmpfs is not enabled in the kernel, systemd crashes with an
unknown filesystem error on boot. This hasn't manifested itself during
tests with defconfigs such as pc_x86_64_efi_defconfig for a few reasons:

  - No defconfig uses systemd as the init system by default
  - Even if a user does use pc_x86_64_efi_defconfig and changes to systemd,
    the board/pc/linux.config file enables CONFIG_PCI, which selects
    CONFIG_TMPFS.
  - The systemd init tests use a prebuilt kernel with tmpfs enabled.

Enable tmpfs unconditionally to ensure that systemd always boots, even with
a minimal kernel built.

Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b19976abc9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 20:57:14 +01:00
Peter Korsgaard
ac7632af83 package/go: security bump to version 1.23.7
go1.23.7 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, and the reflect,
runtime, and syscall package.

https://github.com/golang/go/issues?q=milestone%3AGo1.23.7+label%3ACherryPickApproved

Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-22870

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: add candidate CVE link]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 77674c6cfb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 20:54:16 +01:00
Bernd Kuhls
673a38db1c {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2ef5e56d1f)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-16 20:47:38 +01:00
Bernd Kuhls
4042019fda package/exim: security bump version to 4.98.1
Fixes CVE 2025-26794:
https://lists.exim.org/lurker/message/20250221.121401.a509f6c9.en.html
https://exim.org/static/doc/security/CVE-2025-26794.txt

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 97f8ba4ea2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-14 11:25:18 +01:00
Fiona Klute (WIWA)
b4e1bc7aa5 package/python-typing-extensions: update homepage link in help
Typing-extensions has moved to a separate repository, the previous
link now leads to a 404 page. The top level README in the previous
repository points at the new one, see:
fafcdeb724/README.md (repository-content)

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a40ea829ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-14 11:23:37 +01:00
Kory Maincent
cd407e89f8 board/octavo: Fix Linux compilation
Since commit dc0f7215c6 ("package/gcc: switch to 13.x as default"),
the Linux kernel is failing to build with this output:

In file included from ./include/linux/kernel.h:10,
                 from drivers/ata/libahci.c:35:
drivers/ata/libahci.c: In function ‘ahci_led_store’:
./include/linux/compiler.h:348:45: error: call to ‘__compiletime_assert_1154’ declared with attribute error: BUILD_BUG_ON failed: sizeof(_s) > sizeof(long)
   348 |         _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)

Fix it by importing Linux upstream patch.

Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 864cb7ea29)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-14 09:06:38 +01:00
Kory Maincent
bbb0d31406 board/octavo/osd32mp1: Fix TF-A build error
The Octavo defconfig currently uses TF-A version 2.4 from ST, which leads
to build errors due to missing patches. This update imports the necessary
TF-A 2.4 patches to ensure compatibility and resolve the build issues for
these boards.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/8751983324
https://gitlab.com/buildroot.org/buildroot/-/jobs/8751983326

Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 793b88a7ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-14 09:06:06 +01:00
Andreas Naumann
a6c50d8c8d DEVELOPERS: update email address for Andreas Naumann
Update my email address in the DEVELOPERS file.

Signed-off-by: Andreas Naumann <anaumann@ultratronik.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fee61e3d8d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 21:38:15 +01:00
Thomas Devoogdt
9b3d080b62 package/pkgconf: fix sysroot being prepended twice to the pkgdatadir path
When building webkit, I got this build error:

>>> webkitgtk 2.46.3 Building
GIT_DIR=. PATH="/home/thomas/br-test-pkg/bootlin-armv5-uclibc/host/bin:/home/thomas/br-test-pkg/bootlin-armv5-uclibc/host/sbin:/home/thomas/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin"
 /home/thomas/.local/bin/cmake --build
/home/thomas/br-test-pkg/bootlin-armv5-uclibc/build/webkitgtk-2.46.3/
-j25
ninja: error: '/home/thomas/br-test-pkg/bootlin-armv5-uclibc/host/arm-buildroot-linux-uclibcgnueabi/sysroot/home/thomas/br-test-pkg/bootlin-armv5-uclibc/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/share/wayland-protocols/unstable/pointer-constraints/pointer-constraints-unstable-v1.xml',
needed by 'WebKitGTK/DerivedSources/pointer-constraints-unstable-v1-protocol.c',
missing and no known rule to make it
make[1]: *** [package/pkg-generic.mk:289:
/home/thomas/br-test-pkg/bootlin-armv5-uclibc/build/webkitgtk-2.46.3/.stamp_built]
Error 1
make: *** [Makefile:83: _all] Error 2

The sysroot path is prepended twice to the path. This error persists
since a3b2bc8 "package/pkgconf: bump to version 2.3.0".

After digging into it, I found out that dropping "pkgdatadir" from the
patch does fix it. This is, in fact, the same, or similar problem that
was fixed in 3e74c13 "package/pkgconf: variable pkgdatadir also needs
sysroot prefixing, wayland patch III" years ago.

I was not able to find out which pkgconf commit caused the behavior
change. Commit a3b2bc8 bumped it from 1.6.3 to 2.3.0, which is a
considerable big change.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 139b580ca4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 21:36:52 +01:00
Yann E. MORIN
f95260e2dc package/mokutil: fix dependencies of comment
Since the package was introduced in 2e6e121496 (package/mokutil: new
package), the dependencies for the comment about missing dependencies
are not all inverted compared to the actual dependencies.

Notably, gcc and headers versions should be negative, not positive,
dependencies. This makes the comment visible even when said dependencies
are met.

Fix that.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c73fb46fea)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 21:28:34 +01:00
Thomas Bonnefille
9ddb20f8dc package/foot: support soft-float architecture
Architecture using soft float don't support the math FE_* exceptions.
This commit adds a patch to conditionnally build the FE_* exception
handling.

Fixes:
    https://autobuild.buildroot.org/results/88d/88d764dd12bdbdbe633ebc703c461ebe95b75693/

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ac83fdcb29)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 21:17:42 +01:00
Raphaël Mélotte
9c0891190a package/jbig2dec: add upstream security fix for CVE-2023-46361
Fixes the following security issue:
CVE-2023-46361: Artifex Software jbig2dec v0.20 was discovered to
contain a SEGV vulnerability via jbig2_error at /jbig2dec/jbig2.c.

https://www.cve.org/CVERecord?id=CVE-2023-46361

Note that jbig2dec version 0.19 (used in Buildroot 2024.02.11) is not
officially listed as affected, but it actually has the same bug.

Also note that this CVE is about a crash in the CLI tool only.

Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
[Julien: add JBIG2DEC_IGNORE_CVES]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 63c2dd2d40)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-13 21:08:56 +01:00
Scott Fan
155038635f package/postgresql: bump version to 16.8
Release notes:
https://www.postgresql.org/docs/release/16.8/
https://www.postgresql.org/about/news/postgresql-174-168-1512-1417-and-1320-released-3018/

Updated license hash due to copyright year bump:
https://git.postgresql.org/gitweb/?p=postgresql.git;a=commitdiff;h=759620716adb347c1d8c8b2e6f7d88b947a54c98

Signed-off-by: Scott Fan <fancp2007@gmail.com>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-03-12 19:55:23 +01:00
Fiona Klute (WIWA)
197a1bd331 package/watchdogd: fix sysv init script
PIDFILE was set incorrectly, watchdogd writes its PID file to
/var/run/watchdogd/pid (note the slash), which is not configurable
without patching.

Restructure the rest of the script to match current style while at it.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 51b848b534)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-25 21:02:28 +01:00
Fiona Klute (WIWA)
1891b45694 package/watchdogd: fix use of uninitialized exit status
The bug could lead to incorrect "critical error" reports if that
uninitialized memory happened to contain a value that interpreted as
an int was above the critical threshold. It affected primarily scripts
running approximately one second or longer, because access happens by
timer.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bfb87bafdb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-25 20:56:07 +01:00
Bernd Kuhls
1fc6877fd0 {linux, linux-headers}: bump 6.{1, 6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1bcd3d6bc5)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-25 20:44:08 +01:00
Peter Korsgaard
6db0e9620f package/libxml2: security bump to version 2.13.6
Fixes the following security vulnerabilities:

[CVE-2024-56171] Use-after-free in xmlSchemaIDCFillNodeTables
https://gitlab.gnome.org/GNOME/libxml2/-/issues/828

[CVE-2025-24928] Stack-buffer-overflow in xmlSnprintfElements
https://gitlab.gnome.org/GNOME/libxml2/-/issues/847

Null-deref in xmlPatMatch
https://gitlab.gnome.org/GNOME/libxml2/-/issues/861

https://www.openwall.com/lists/oss-security/2025/02/18/2

Drop now upstreamed patches:
fc72e0833a
539663626b

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 843a4faa6d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-24 22:24:40 +01:00
Peter Korsgaard
2287e900c4 Update for 2024.11.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2024.11.2
2025-02-21 15:31:53 +01:00
Peter Korsgaard
4ed78586e8 package/gnutls: security bump to version 3.8.9
Fixes the following vulnerability:

** libgnutls: Fix potential DoS in handling certificates with numerous name
   constraints, as a follow-up of CVE-2024-12133 in libtasn1. The
   bundled copy of libtasn1 has also been updated to the latest 4.20.0
   release to complete the fix.  Reported by Bing Shi (#1553).
   [GNUTLS-SA-2025-02-07, CVSS: medium] [CVE-2024-12243]

For more details, see the release announcement:
https://lists.gnupg.org/pipermail/gnutls-help/2025-February/004875.html

Update the license info for a move/rename of license files and a slight
rewording.  The license clarification is now in README.md so also add that:

a8727cdb07
75f5ea8073

Drop now upstreamed
0001-groups-represent-hybrid-groups-with-an-array-of-IDs.patch:

9cc9d5556d

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2461b34077)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-21 14:06:41 +01:00
Michael Fischer
651e8731a7 package/openssh: security bump version to 9.9p2
Release note: https://www.openssh.com/txt/release-9.9p2

Fixes: CVE-2025-26465 (ssh) , CVE-2025-26466 (sshd)

Drop upstream patch: 0001-build-construct_utmp-when-USE_BTMP-is-set.patch

Signed-off-by: Michael Fischer <mf@go-sys.de>
Tested-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 002931cc3a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-20 21:08:07 +01:00
Bernd Kuhls
d843e65028 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4d6e3ea7a5)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-20 20:58:13 +01:00
Yann E. MORIN
4013ba6a42 package/kodi: don't uselessly select libdisplay-info
Commit c619346111 (package/kodi: bump version to 21.0-Omega) added a
select onto libdisplay-info from a blind option that only represents
whether a specific subset of Kodi is available, not whether Kodi itself
is enabled.

This causes useless builds of libdisplay-info for a lot of builds where
Kodi is not enabled.

Move the select to the main Kodi symbol itself, guarded with the proper
condition, like a few existing dependencies for GBM.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 64b2f03f5a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-19 20:54:56 +01:00
Peter Korsgaard
e28f3ba80d package/assimp: add upstream security fix for CVE-2024-48423
Fixes the following security issue:

CVE-2024-48423: An issue in assimp v.5.4.3 allows a local attacker to
execute arbitrary code via the CallbackToLogRedirector function within the
Assimp library

https://github.com/assimp/assimp/issues/5788
https://www.cve.org/CVERecord?id=CVE-2024-48423

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ad82b28427)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-19 20:39:54 +01:00
Bernd Kuhls
89767d4a36 {linux, linux-headers}: bump 6.{6, 12}.x series
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b8638648d6)
[Peter: drop 6.12.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-18 17:40:15 +01:00
Bernd Kuhls
3e1679f5b6 package/intel-microcode: security bump version to 20250211
Release notes:
https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250211

CVE-2024-31068:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01166.html

CVE-2024-36293
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01213.html

CVE-2023-43758, CVE-2023-34440, CVE-2024-24582, CVE-2024-29214,
CVE-2024-28127, CVE-2024-39279, CVE-2024-31157 & CVE-2024-28047:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01139.html

CVE-2024-39355:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01228.html

CVE-2024-37020:
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01194.html

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 67a0f96b88)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-18 13:10:16 +01:00
Vincent Fazio
be469ec0cc support/testing: test_python_{gnupg, spake2}: increase timeout value
Previously, these tests had the potential for timing out with the
default 5 second timeout value if initializing /dev/urandom took too
long.

Now the tests use a 10 second timeout value.

Signed-off-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 9bc3bbce38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-18 10:50:27 +01:00
Vincent Fazio
ab5f8362bd support/testing: test_python_txaio: include twisted sample
Prior to b7d251293a, txaio would test both asyncio and twisted.

Add back the twisted sample and include the twisted package in the
config so both modes of the package are tested.

Fixes: b7d251293a ("package/python-txaio: drop python 2 support")
Signed-off-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 41b08a779b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-02-18 10:50:20 +01:00