The patch bumps the Linux kernel to version 5.15.222 and U-Boot to
version 2026.10.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.1.189. The size of
xipImage has increased by 9286 bytes (1706592 bytes compared to
1696766 in version 6.1.177).
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BR2_DOWNLOAD_FORCE_CHECK_HASHES=y is supposed to make the build fail
if any download cannot be successfully verified against a known
hash. However, support/download/check-hash would only warn if there
was no hash file at all for the package in question, and allow the
build to continue.
This is a security fix and should be backported to all stable
branches.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The patch bumps the Linux kernel to version 6.12.112 and U-Boot to
version 2026.10.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Adds support for injecting structured data when forwarding to remote syslog
servers:
*.* @[ff02::1%eth0] ;RFC5424,sd=[device@32473 name="kilroy"]
Also, a bunch of fixes for, e.g., UTF-8. For the full release notes, see:
https://github.com/troglobit/sysklogd/releases/tag/v2.8.0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: fix hash source link in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Adapt the code added to the host test with
928cc5dc5c ("package/uboot-tools: fix
host FIT signature support") to run on the target.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 928cc5dc5c ("package/uboot-tools:
fix host FIT signature support") fixed building host-uboot-tools with
FIT signature support after upstream changes to the config included
since v2026.04, added to Buildroot with commit
e049f6fef1 ("package/uboot-tools: bump
to version 2026.04"). This commit applies the same fixes to
configuration for target uboot-tools.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Patch 0003-Add-support-for-OpenSSL-Provider-API.patch makes
package/uboot-tools build without the OpenSSL engine API, but it fails
at runtime if pkcs11-provider [1] is not available. That provider is
not packaged in Buildroot, and should not be required when not
actually using PKCS#11 keys.
The problem has been discussed on the U-Boot mailing list [2], and
part of the reason this patch has not been merged into U-Boot yet. It
causes tests.package.test_uboot_tools.TestHostUbootTools to fail with:
=== STDOUT/STDERR ===
At main.c:259:
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_dlfcn.c:115
- SSL error:12800067:DSO support routines::could not load the shared library: crypto/dso/dso_lib.c:147
- SSL error:07880025:common libcrypto routines::reason(37): crypto/provider_core.c:1026
mkimage: OSSL_PROVIDER_try_load(pkcs11)
This commit adjust the patch as suggested in [2] to continue if the
PKCS#11 provider fails to load, making the test work. However,
actually using PKCS#11 keys will not work until pkcs11-provider [1] is
packaged.
[1] https://github.com/openssl-projects/pkcs11-provider
[2] https://lists.u-boot-project.org/pipermail/u-boot/2026-August/629348.html
Fixes: f87cf2d623 ("package/uboot-tools: Fix build with OpenSSL 4.0.0")
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
P11-kit has been offering a meson build since 0.23.17 (see upstream
NEWS [1]), and it is the build system described in the upstream
README.
Changes in the switch to meson:
* Explicitly enable/disable NLS.
* Explicitly enable/disable bash-completion.
* The meson build has no explicit option for libtasn1, it is required
if trust_module is enabled.
* Add patch for meson configuration to avoid depending on systemd to
discover install location for units, which would create a dependency
loop.
* Check for BR2_INIT_SYSTEMD instead of BR2_PACKAGE_SYSTEMD to decide
whether to install systemd units.
[1] https://github.com/p11-glue/p11-kit/blob/0.26.5/NEWS#L164
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The aarch64 defconfig has grown, so bump the ext4 size to make it fit.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Running a modern kernel with old A-TF/U-Boot leads to various issues. Add a
note about updating the bootloader in the SPI flash.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
The lafrite board exposes the console UART on the GPIO header. Document the
pinout for ease of use.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Swtpm builds manpages using pod2man, and fails if it is not
available. The patch adds support for --disable-docs, which Buildroot
passes by default. Found while building in a container with minimal
dependencies.
Fixes: 87b9b126d2 ("package/swtpm: add host package")
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Release notes:
https://github.com/mikebrady/shairport-sync/releases/tag/5.6
This version adds support for Mbed TLS 4.x.
Classic AirPlay now needs an ALAC decoder to be selected. FFmpeg is
enabled by default, and the bundled Hammerton decoder, which older
versions always used, is now optional. Use FFmpeg if it is available
and fall back to the Hammerton decoder otherwise, so that existing
configurations keep building.
AirPlay 2 support now needs plistutil on the host, so depend on
host-libplist.
The LICENSES file now also lists the bundled FFTConvolver (MIT) and
pair_ap (MIT, BSD-3-Clause) code, and other copyright notices were
updated.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
shairport-sync 5.6 needs plistutil on the host to build with AirPlay 2
support. libplist builds its tools by default.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes the following vulnerability:
CVE-2026-58016: A flaw was found in GLib. A state confusion issue exists in
g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when
processing malformed D-Bus introspection XML, specifically with a `node`
element nested within other elements like `method`, `signal`, `property` or
`arg`. This issue can cause an unsigned integer overflow and lead to an
out-of-bounds read, resulting in a denial of service.
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5156
Backport the upstream patch (included in 2.89.0), but drop the test addition
for easier backport:
c9da977c17
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
The patch bumps the Linux kernel to version 5.15.222 and, for the SD
configuration, also updates U-Boot to version 2026.10.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
No CVEs specified, but NEWS states:
!5394 Backport various security fixes to glib-2-88
https://gitlab.gnome.org/GNOME/glib/-/merge_requests/5394
And a number of other bugfixes:
* Bugs fixed:
- #4011 gio/tests/services: Installed service file contains build path after
!5259 (Jaipaul Cheernam)
- #4020 ‘TLS callback not invoked’ error on msys2-clang64 CI job (Luca Bacci)
- !5262 Backport !5261 “gio/tests/services: Fix installed service file
containing build path” to glib-2-88
- !5273 Backport !5266 “docs: Fix gio gi-docgen docs_url” to glib-2-88
- !5285 Backport !5283 “gconstructor: Reference _tls_used also on GCC, CLang”
to glib-2-88
- !5323 Backport !5311 “fix: handle long filenames in trash by truncating from
front” to glib-2-88
- !5379 Update Norwegian Nynorsk translation
- !5394 Backport various security fixes to glib-2-88
* Translation updates:
- Norwegian Nynorsk (Roy-Magne Mo)
https://gitlab.gnome.org/GNOME/glib/-/blob/2.88.4/NEWS?ref_type=tags
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Fiona: fix typo in upstream NEWS link]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This fixes the following vulnerability:
- CVE-2026-85091:
zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow
vulnerability in the gz_vacate() function when processing non-blocking
gzwrite() operations with stale external buffer pointers. Attackers
can trigger the overflow by calling gzprintf() or gzvprintf() after a
write stall, causing an unchecked memmove() to write beyond the
internal input buffer boundary.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-85091
- https://security-tracker.debian.org/tracker/CVE-2026-85091
- df84af25dc.patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Drop the obsolete six dependency and keep the remaining Python
dependencies as runtime selections.
Update the license hash for the removal of a trailing blank line:
f9d97a8bde
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Restore the compatibility symlink omitted from the PyPI archive so the
wheel continues to provide the rtslib_fb module.
Replace the six runtime dependency with pyudev and propagate its
libudev requirement to targetcli-fb.
Update the license hash for the removal of a trailing blank line:
c44657500a
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Switch to hatchling with hatch-vcs and use the PyPI source distribution,
which includes the version metadata needed by hatch-vcs.
Restore the compatibility symlink omitted from the PyPI archive so the
wheel continues to provide the configshell_fb module.
Drop the obsolete six and urwid runtime dependencies. Select curses
explicitly, since it was previously pulled in by urwid.
Update the license hash for the removal of a trailing blank line:
36306fd6f8
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Since kernel v7.0, perf uses `rustc --version` to know whether or not
rust is available. If rust is installed on the host, this `rustc
--version` works fine but then the perf build fails with following error
(on aarch64) if host-rust isn't selected:
rustc /home/bastien/embedded-linux-imx93-frdm-labs/integration/buildroot/output/build/linux-7.1.3/tools/perf/tests/workloads/code_with_type.a
error[E0463]: can't find crate for `std`
|
= note: the `aarch64-unknown-linux-gnu` target may not be installed
= help: consider downloading the target with `rustup target add aarch64-unknown-linux-gnu`
error: aborting due to 1 previous error
In perf, rust is only used by one file of the test suite
(tools/perf/tests/workloads/code_with_type.rs) so we can safely disable
it.
Always use the NO_RUST flag to build perf.
Signed-off-by: Bastien Curutchet <bastien.curutchet@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
nettest depends, through rustls, quinn and rcgen, on the ring crate,
which refuses to build for 32-bit x86 targets without SSE and SSE2:
error[E0080]: evaluation panicked: assertion failed: cfg!(target_feature = "sse") && cfg!(target_feature = "sse2")
--> .../VENDOR/ring/src/cpu/intel.rs:26:9
This affects i586 and i686-class CPUs that lack SSE2
Make nettest depend on SSE2 support when building for i386.
Fixes: https://autobuild.buildroot.org/results/d04f770538412bee77851142ee007f2ff107e0ec
Fixes: 36fa003547 ("package/nettest: new package")
Signed-off-by: Bogdan Radulescu <bogdan@nimblex.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Drop --skip-dependency-check now that upstream restricts the
setuptools-rust build requirement to Windows and macOS.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Refresh the libudev loading workaround for the removal of an upstream
import-sorting comment.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add the mypy-extensions runtime dependency for both target and host
packages. The vecs module now imports mypy_extensions unconditionally,
rather than only when the experimental vector support is enabled.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
