Commit Graph

43376 Commits

Author SHA1 Message Date
Fabrice Fontaine
a1dfcff3f9 package/systemd: fix build with older kernels
Fixes:
 - http://autobuild.buildroot.org/results/699c078aa078240c6741da4dbd0871450ceeca92

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d62425599e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 21:54:27 +01:00
James Hilliard
326635afec package/systemd: fix build on toolchain without C++
This is a backport from upstream.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Acked-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ae9157af6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 21:54:18 +01:00
Adam Duskett
0813faf138 package/systemd: bump to v240
In addition:

 - Remove unused option -Dkill-path.
  (See commit 9a85778412fa3e3f8d4561064131ba69f3259b28)

 - Change option -Dmyhostname to -Dnss-myhostname.

 - Remove patches from upstream.

 - Update hash of README file. The changes are unrelated to licensing.

Signed-off-by: Adam Duskett <Aduskett@gmail.com>
Tested-by: Jérémy Rosen <jeremy.rosen@smile.fr>
[Thomas: update the hash of the README file.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 0b213d5a38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 21:54:01 +01:00
Vadim Kochan
64025318d2 package/dash: Create $(TARGET_DIR)/bin before install
The build fails because $(TARGET_DIR)/bin folder may not exist if for
example to use the following defconfig:

	BR2_x86_64=y
	BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_4_16=y
	BR2_SYSTEM_BIN_SH_DASH=y
	BR2_TARGET_GENERIC_GETTY_PORT="tty1"
	BR2_LINUX_KERNEL=y
	BR2_LINUX_KERNEL_CUSTOM_VERSION=y
	BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="4.16.7"
	BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
	BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/x86_64/linux.config"
	BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
	BR2_PACKAGE_S6_LINUX_INIT=y
	BR2_TARGET_ROOTFS_EXT2=y

Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
[Peter: use install -D]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 89fdf21d58)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 20:08:21 +01:00
Fabrice Fontaine
f9a583f7b8 sunxi-cedarx: needs -fPIC
Fixes:
 - http://autobuild.buildroot.org/results/c17062e1558f26c2db837883a0c33ef39dd031a2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 838b9b6979)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 20:04:23 +01:00
Baruch Siach
907c1d3d33 gnupg2: security bump to version 2.2.12
Fixes CVE-2018-1000858: Cross Site Request Forgery with arbitrary HTTPS
GET requests via HTTP redirect.

https://sektioneins.de/en/advisories/advisory-012018-gnupg-wkd.html

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d4dbcb036a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:49:45 +01:00
Baruch Siach
a535a6f593 package/libassuan: bump to version 2.5.2
Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b905370c09)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:49:12 +01:00
Baruch Siach
1efee05356 package/libgpg-error: bump to version 1.33
The syscfg header name is now based on the target triplet, with the
vendor part set to "unknown". The symlink approach no longer works since
we use "buildroot" for the vendor part. Override the target host
configure parameter to match the build system expectation.

The x86 header vendor part has been renamed to "unknown" as well.
Account for that in BR2_PACKAGE_LIBGPG_ERROR_SYSCFG.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e58b5b1b93)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 19:48:47 +01:00
Baruch Siach
0e418046b1 package/openssh: add upstream security fix
Fixes CVE-2018-20685: The scp client allows server to modify permissions
of the target directory by using empty ("D0777 0 \n") or dot ("D0777 0
.\n") directory name.

The bug reporter lists a number of related vulnerabilities that are not
fixed yet:

  https://sintonen.fi/advisories/scp-client-multiple-vulnerabilities.txt

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8233c66612)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:25:24 +01:00
Evgeniy Didin
0870375bcd package/python-numpy: fix fenv build failure on ARC with glibc
Building python-numpy on ARC with glibc fails due to missing FE_*
definitions in <fenv.h>. These exceptions are not supported by
ARC architecture. Let's add patch, which disables compilation
of a part of the code in which FE_* errors occur for ARC.

ARCompact toolchain issues are already fixed in the latest toolchain.
Also since commit "311af5e8c2db887800639bc803c8201b6b70e9ce"
("toolchain/toolchain-buildroot: enable glibc for all little-endian
ARCs with atomic ops") glibc is available for ARCompact.
That is why in Config.in we are leaving only "BR_arc" and
removing comments, which are not actual.

Signed-off-by: Evgeniy Didin <didin@synopsys.com>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: arc-buildroot@synopsys.com
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b1056f16f4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:21:46 +01:00
Fabrice Fontaine
63149e45eb package/fwts: add optional bash-completion dependency
fwts uses the completionsdir variable from bash-completion.pc to decide
where to install things.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7da56120a0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:20:25 +01:00
Fabrice Fontaine
0e15199398 package/cc-tool: drop BR2_PACKAGE_BOOST_SIGNALS select
cc-tool depends on signals2 not signals, indeed only signals2 is used
in src/data/progress_watcher.h and BOOST_SIGNALS defined in
m4/boost.m4 is never used in configure.ac.

There is no need to select any sort of BR2_PACKAGE_BOOST_SIGNALS2
option, as signals2 is a header-only boost library, and such
header-only boost libraries do not have any Config.in options, as they
are all always installed with the base boost library.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Thomas: tweak commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 024ed470ad)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:18:40 +01:00
Fabrice Fontaine
0ab0ca5e38 package/lxc: add optional dependency to bash-completion
lxc uses the completionsdir variable from bash-completions.pc to decide
where to install things.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 61a425590a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 17:17:35 +01:00
Asaf Kahlon
11079a8ff4 package/python-pyyaml: security bump to 4.2b4
Fixes CVE-2017-18342: In PyYAML before 4.1, the yaml.load() API
could execute arbitrary code.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1cf071726d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:56:07 +01:00
Peter Seiderer
e466b27674 boot/barebox: change download site to https
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2cf0688647)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:51:20 +01:00
Yann E. MORIN
a54a7e6bbb infra/pkg-cmake: use an obviously-invalid value for CMAKE_SYSTEM_VERSION
In 36568732e4, we expanded toolchain.cmake to also define the value for
CMAKE_SYSTEM_VERSION, as the cmake documentation states that it must be
manually defined when doing cross-compilation [0]:

    When the CMAKE_SYSTEM_NAME variable is set explicitly to enable
    cross compiling then the value of CMAKE_SYSTEM_VERSION must also
    be set explicitly to specify the target system version.

However, the fix in 36568732e4 uses the version of the kernel headers,
assuming that would be the oldest kernel we could run on. Yet, this is
not the case, because glibc (for example) has fallbacks to support
running on kernels older than the headers it was built against.

The cmake official wiki [1] additionally states:

  * CMAKE_SYSTEM_VERSION : optional, version of your target system, not
    used very much.

Folllowed a little bit below, by:

  * CMAKE_TOOLCHAIN_FILE : absolute or relative path to a cmake script
    which sets up all the toolchain related variables mentioned above

    For instance for crosscompiling from Linux to Embedded Linux on PowerPC
    this file could look like this:

        # this one is important
        SET(CMAKE_SYSTEM_NAME Linux)
        #this one not so much
        SET(CMAKE_SYSTEM_VERSION 1)

    [...]

Furthermore, using the kernel headers version can be a bit misleading (as
it really looks like is is the correct version to use when it is not),
while it is obvious that 1 is not really the output of `uname -r` and
thus is definitely not misleading.

Finally, random searches [2] about CMAKE_SYSTEM_VERSION, mostly only
turns up issues related with Windows, Mac-OS, and to a lesser extent,
Android (where it is forcibly set to 1), with issues realted to running
under just Linux (as opposed to Adnroid) mostly non-existent.

Consequently, we revert to using the value that is suggested in the
cmake WiKi, i.e. 1, and which is basically what we also used as a
workaround in the azure-iot-sdk-c paclkage up until d300b1d3b1.

A case were we will need to have a real kernel version, is if we one day
have a cmake-based pacakge that builds and installs a kernel module [3],
because it will need the _running_ kernel version to install it in
/lib/modules/VERSION/, but in that case it will anyway most probably
not be the headers version.

[0] https://cmake.org/cmake/help/v3.8/variable/CMAKE_SYSTEM_VERSION.html
[1] https://gitlab.kitware.com/cmake/community/wikis/doc/cmake/CrossCompiling
[2] https://duckduckgo.com/?q=CMAKE_SYSTEM_VERSION
[3] https://stackoverflow.com/questions/38205745/cmake-system-version-not-updated-for-new-kernel

Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Samuel Martin <s.martin49@gmail.com>
Acked-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fc8a5f56b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:48:02 +01:00
Arnout Vandecappelle (Essensium/Mind)
e5cde95606 package/pkg-cmake: add CMAKE_SYSTEM_VERSION to toolchainfile.cmake
Quoting the CMake documentation:

  When the CMAKE_SYSTEM_NAME variable is set explicitly to enable cross
  compiling then the value of CMAKE_SYSTEM_VERSION must also be set
  explicitly to specify the target system version.

Thus, we should also set CMAKE_SYSTEM_VERSION in toolchainfile.cmake. It
is supposed to be set to the value of `uname -r` on the target. We don't
have that exact value available (unless we build the kernel), but the
value of BR2_TOOLCHAIN_HEADERS_AT_LEAST contains the (minimum) version
of the kernel it will run on, so it should be OK for all practical
purposes.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Samuel Martin <s.martin49@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 36568732e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:47:53 +01:00
Thomas Petazzoni
896695e8ad package/libsquish: re-enable for BR2_STATIC_LIBS configuration
Since the bump to version 1.15, libsquish can conditionally
build/install its shared library, which makes it possible to re-enable
this package for BR2_STATIC_LIBS configurations.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ae4b9e4afb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:45:22 +01:00
Romain Naour
7758db51e6 package/libsquish: really install shared library
While testing the new supertuxkart 0.10-beta1 version, the build
failed due to missing libsquash shared library.

Indeed, by default (see config file) the shared library is not build
and all symlinks created by LIBSQUISH_INSTALL_{STAGING,TARGET}_CMDS
are curently broken.

To fix that, add USE_SHARED=1 to LIBSQUISH_MAKE_ENV.

Also add a patch to allow reinstall the package.

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b621273755)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:44:55 +01:00
Romain Naour
8001021a16 package/libsquish: add license file hash
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9b377e9dcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:44:44 +01:00
Fabrice Fontaine
e8a5bf8660 package/swupdate: disable lua in static build
Since version 2018.11 and
624904cc18,
bindings for LUA is a shared library so disable lua if BR2_STATIC_LIBS
is set

Fixes:
 - http://autobuild.buildroot.org/results/55767e58c211656558af7916a4e0975089a2785b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b898b67209)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:43:20 +01:00
Fabrice Fontaine
af993e0684 package/gnuchess: license is GPL-3.0+, not GPL-2.0+
gnuchess is licensed under GPL-3.0+ not GPL-2.0+, also add hash for
license file

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ef25d13fc7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:28:13 +01:00
Arnout Vandecappelle (Essensium/Mind)
8175f6e889 patchelf: update _SITE to new location
releases.nixos.org gives some weird XML pages. The upstream location is
nixos.org/releases.

This side uses HSTS, so switch to https to avoid a needless redirect.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e2fa462426)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:27:02 +01:00
Peter Korsgaard
fed0c666e6 package/lighttpd: adjust hash comment after 1.4.52 bump
Commit ec69d3820f (package/lighttpd: bump to version 1.4.52) bumped the
lighttpd version but forgot to adjust the upstream hash comment.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b99b09caee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:25:43 +01:00
Peter Korsgaard
1f14043c56 package/lighttpd: bump to version 1.4.52
Fixes location header parsing regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2918

Fixes header setting regression introduced in 1.4.51:
https://redmine.lighttpd.net/issues/2919

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ec69d3820f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:25:38 +01:00
Peter Korsgaard
1ca9600c96 {linux, linux-headers}: bump 4.{9, 14, 19, 20}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 78f0c1fe4a)
[Peter: drop 4.19.x/4.20.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 16:04:13 +01:00
Peter Korsgaard
7286fc1803 package/xenomai: drop consecutive empty lines
Commit 4219c58c (xenomai: remove unnecessary autoreconf) introduced a
check-package warning:

1 warnings generated
package/xenomai/xenomai.mk:27: consecutive empty lines

https://gitlab.com/buildroot.org/buildroot/-/jobs/143155797

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d2e1617ccc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:37:49 +01:00
Thomas De Schampheleire
f17bde9466 xenomai: remove unnecessary autoreconf
As xenomai release tarballs ship with a configure script, there is only a
need for autoreconfiguring when patches are applied.

The last patch was removed with git commit
de993bc23a but the AUTORECONF line remained.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4219c58c38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:36:37 +01:00
Baruch Siach
4c909a095c tcpreplay: security bump to version 4.3.1
Upstream CHANGELOG entry for 4.3.0 lists these fixes:

    - CVE-2018-18408 use-after-free in post_args (#489)
    - CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)
    - CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486)
    - CVE-2018-17580 heap-buffer-overflow fast_edit_packet (#485)
    - CVE-2018-17582 heap-buffer-overflow in get_next_packet (#484)
    - CVE-2018-13112 heap-buffer-overflow in get_l2len (#477 dup #408)

Drop tr_cv_libpcap_version and ac_cv_have_bpf; unused in current
configure script.

Make configure script use pcap-config to list library dependencies.
Unfortunately, pcap-config is not entirely correct, so we still need to
set the LIBS variable for static linking.

Use the smaller tar.xz archive.

Add license file hash.

Signed-off-by: Baruch Siach <baruch@tkos.co.il>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f5961ff56a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:29:55 +01:00
Carlos Santos
8ce6f86666 package/liburiparser: security bump to version 0.9.1
Fixes an out-of-bounds read, the parsing of some a malformed URIs and a
function that reported 1 more byte than actually needed for IPv4 address
URIs. For additional datails, see

    https://github.com/uriparser/uriparser/blob/uriparser-0.9.1/ChangeLog

Signed-off-by: Carlos Santos <casantos@datacom.com.br>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 518eb53ec5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:26:56 +01:00
Peter Korsgaard
bca62e0a01 Makefile, manual, website: Bump copyright year
Happy 2019!

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8e928a8389)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:26:19 +01:00
Asaf Kahlon
6f6f5e28f5 package/python-django: security bump to version 2.1.5
Fixes CVE-2019-3498: Content spoofing possibility in the default 404 page

For more details, see the announcement:
https://www.djangoproject.com/weblog/2019/jan/04/security-releases/

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
[Peter: mention that bump fixes security issues]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>

(cherry picked from commit 86d0ecf076)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:00:39 +01:00
Asaf Kahlon
d2beca10ee python-django: bump to version 2.1.4
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 89829c4f11)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 12:00:33 +01:00
Peter Korsgaard
dcb3cf3a66 utils/get-developers: really make it callable from elsewhere than the toplevel directory
Commit 62d5558f76 (utils/get-developers: make it callable from elsewhere
than the toplevel directory) tried to fix this by passing in the toplevel
directory when the DEVELOPERS file is parsed.

Unfortunately this is not enough, as E.G.  also the paths listed in the
patches are relative to the toplevel directory, causing it to not match the
entries in the DEVELOPERS file.

In concept this can be fixed by also passing the toplevel directory to the
Developers class, but the simplest solution is just to chdir to the toplevel
Buildroot directory before calling any of the getdeveloperlib functions.

This does require us to finish parsing command line arguments (which opens
the provided patch files) to not get into trouble with relative paths to
patches before chdir'ing / initializing getdeveloperlib.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 45aabcddc5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:30 +01:00
Peter Korsgaard
4402e082db Revert "utils/get-developers: make it callable from elsewhere than the toplevel directory"
This reverts commit 62d5558f76.

This actually does not work, as patches contain paths relative to the
toplevel directory as well.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 74fbc20504)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:58:24 +01:00
Peter Korsgaard
4baa5cb31b package/nodejs: bump version to v8.15.0
Fixes regressions introduced by the v8.14.0 security release.  From the
announcement:

The 8.14.0 security release introduced some unexpected breakages on the 8.x
release line.  This is a special release to fix a regression in the HTTP
binary upgrade response body and add a missing CLI flag to adjust the max
header size of the http parser.

https://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V8.md#8.15.0

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f68e5cf72)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:53:45 +01:00
Peter Korsgaard
e8b60ec4da package/libhttpparser: bump version to v2.9.0
Needed by nodejs v8.15.0+

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a02ce33aa5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:53:39 +01:00
Peter Korsgaard
c3935fe3c2 package/efivar: bump version to 35
Fixes:
http://autobuild.buildroot.net/results/545/545013d3977b3eddd27ca0fc21cc1248f3bb0dbb/
http://autobuild.buildroot.net/results/695/6952b99eb0b0e85b2f5408accdca2b4dd17d14c0/

Includes a workaround for -Werror=stringop-overflow= erroring out on strncpy
on some toolchains:

7461d47cdd

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5816a0a122)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:52:34 +01:00
Thomas De Schampheleire
f379011d1f docs/manual: fix typo get-developer (-> get-developers)
The script is utils/get-developers but the manual refers to get-developer in
several places.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 81aeab60cd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:48:57 +01:00
Mark Corbin
d61df00174 package/glibc: bump version for more post-2.28 fixes
This update includes two specific fixes that have been backported
to the glibc 2.28 release branch from the glibc master branch:

1) UAPI header file asm/syscalls.h has been merged into the UAPI
asm/unistd.h header file for the RISC-V architecture in the
4.20 kernel. This causes the glibc 2.28 build to break.

2) sysdeps/ieee754/soft-fp: ignore maybe-uninitialized with -O
[BZ #19444]. The current patch for this issue can now be dropped
from Buildroot.

Signed-off-by: Mark Corbin <mark.corbin@embecosm.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7ab6281075)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:48:17 +01:00
Thomas De Schampheleire
f331b23934 support/download: fix scp downloads
scp download is broken, because scp is called without filename argument and
only the server is specified. The call is:
    scp <server> <outputfile>

but should be:
    scp <server>/<filename> <outputfile>

Instead of assuming '-u' lists a full URL including filename (which it is
not), align with the wget helper where -u is the server URL and -f gives the
filename.

With this commit, an scp download can work if FOO_SITE_METHOD is explicitly
set to 'scp' and the server does not have a scheme prefix 'scp://'.
The next commit will handle the case where a scheme prefix is present.

Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
Reviewed-by: "Yann E. MORIN" <yann.morin.1998@free.fr>
[Thomas: s/URL/URI/, as noticed by Yann.]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

(cherry picked from commit 4d6e20ff46)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:47:35 +01:00
Peter Korsgaard
81eba6d012 package/linux-headers: bump 4.{4, 9, 14, 19}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5bbc472463)
[Peter: drop 4.19.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:27:23 +01:00
Thomas Petazzoni
446ba17e95 package/lua-msgpack-native: adjust Config.in comment
The Config.in comment of lua-msgpack-native only indicates that it
needs Lua 5.1, while the package can actually build with LuaJIT. This
commit adjusts the comment to match the reality.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6141506760)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-24 11:12:34 +01:00
Grégoire Delattre
a130f69330 board/pc: ensure grub.cfg is copied to target filesystem
Before this commit, the grub configuration file was copied to the
TARGET_DIR in a post-image hook, after the filesystem has been
generated. It was kinda working because the board/pc's grub
configuration and the default one are the same and the later was
copied during the build process of the grub2 package.

This commit ensures the custom board/pc grub configuration is copied at
the right time.

Signed-off-by: Grégoire Delattre <gregoire.delattre@gmail.com>
Reviewed-by: Matt Weber <matthew.weber@rockwellcollin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0b28397a9b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:17:38 +01:00
Vadim Kochan
4d4c5750d3 package/udisks: fix compilation issue with glibc 2.28+
It fixes a compilation failure with undefined "minor", "major" and
"makedev" objects which is caused by the missing include of
<sys/sysmacros.h>.

Fixes:

  http://autobuild.buildroot.net/results/74a8d8c247cfc9c0024e749e1f1ac423c9e90855/

Signed-off-by: Vadim Kochan <vadim4j@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit dbd80a2737)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 16:16:04 +01:00
Peter Korsgaard
1644fead67 package/wireshark: security bump to version 2.6.6
Fixes the following security vulnerabilities:

- wnpa-sec-2019-01 The 6LoWPAN dissector could crash. Bug 15217. CVE-2019-5716
  https://www.wireshark.org/security/wnpa-sec-2019-01

- wnpa-sec-2019-02 The P_MUL dissector could crash. Bug 15337. CVE-2019-5717
  https://www.wireshark.org/security/wnpa-sec-2019-02

- wnpa-sec-2019-03 The RTSE dissector and other dissectors could crash.  Bug
  15373.  CVE-2019-5718
  https://www.wireshark.org/security/wnpa-sec-2019-03

- wnpa-sec-2019-04 The ISAKMP dissector could crash. Bug 15374. CVE-2019-5719
  https://www.wireshark.org/security/wnpa-sec-2019-04

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cd232aefc9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:34:00 +01:00
Peter Korsgaard
32ee7f9a7f package/wireshark: security bump to version 2.6.5
The following vulnerabilities have been fixed:

- wnpa-sec-2018-51 The Wireshark dissection engine could crash. Bug 14466. CVE-2018-19625.
- wnpa-sec-2018-52 The DCOM dissector could crash. Bug 15130. CVE-2018-19626.
- wnpa-sec-2018-53 The LBMPDM dissector could crash. Bug 15132. CVE-2018-19623.
- wnpa-sec-2018-54 The MMSE dissector could go into an infinite loop. Bug 15250. CVE-2018-19622.
- wnpa-sec-2018-55 The IxVeriWave file parser could crash. Bug 15279. CVE-2018-19627.
- wnpa-sec-2018-56 The PVFS dissector could crash. Bug 15280. CVE-2018-19624.
- wnpa-sec-2018-57 The ZigBee ZCL dissector could crash. Bug 15281. CVE-2018-19628.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 2ec38321d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:33:49 +01:00
Trent Piepho
4d671f1f14 package/rauc: target rauc needs unsquashfs at runtime
In order to provide info about a bundle file, e.g. running "rauc info
bundle.raucb", rauc needs to use the unsquashfs progam from the squashfs
package.

This was not documented until upstream commit 10c501c12752 ("docs:
integration: document need for 'unsquashfs' tool for 'rauc info'"), but
is already present in rauc.

Signed-off-by: Trent Piepho <tpiepho@impinj.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4a4dba21b9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:31:45 +01:00
Peter Korsgaard
c129b06847 package/sqlite: security bump to version 3.25.3
Fixes CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is
enabled, encounters an integer overflow (and resultant buffer overflow) for
FTS3 queries that occur after crafted changes to FTS3 shadow tables,
allowing remote attackers to execute arbitrary code by leveraging the
ability to run arbitrary SQL statements (such as in certain WebSQL use
cases), aka Magellan.

For more details, see:
https://blade.tencent.com/magellan/index_en.html
https://www.sqlite.org/releaselog/3_25_3.html
https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c4475c0a57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 15:19:49 +01:00
Thomas Petazzoni
fa069b85b3 package/acpica: add missing dependencies for host variant
Just like the target acpica package needs host-flex and host-bison,
the host variant also needs the same dependencies. This allows to fix
the build of "make host-acpica", which was detected thanks to
per-package directory support.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8681430628)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-01-23 11:50:40 +01:00