mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-10 00:04:06 -09:00
Code Issues Packages Projects Releases Wiki Activity
56,168 Commits 6 Branches 483 Tags
a828ee89f00ef7f7337cbc8b8ec60cb8a3609d3f
Commit Graph

56168 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Adrian Perez de Castro
a828ee89f0 package/wpebackend-fdo: bump to version 1.8.2 
This minor release fixes an issue with its public API headers which
can cause third party packages (mainly wpewebkit) to show build errors.
Release notes:

  https://wpewebkit.org/release/wpebackend-fdo-1.8.2.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 1c72f8aa2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-29 21:46:23 +02:00
Adrian Perez de Castro
9788d38197 package/wpewebkit: security bump to 2.30.6 
This is a minor release which provides fixes for CVE-2020-27918,
CVE-2020-29623, CVE-2021-1765, CVE-2021-1789, CVE-2021-1799,
CVE-2021-1801, and CVE-2021-1870.

Full release notes can be found at:

  https://wpewebkit.org/release/wpewebkit-2.30.6.html

An accompanying security advisory has been published at:

  https://wpewebkit.org/security/WSA-2021-0002.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 26437a51e1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-29 21:45:03 +02:00
Adrian Perez de Castro
9c75413c6a package/webkitgtk: security bump to 2.30.6 
This is a minor release which provides fixes for CVE-2020-27918,
CVE-2020-29623, CVE-2021-1765, CVE-2021-1789, CVE-2021-1799,
CVE-2021-1801, and CVE-2021-1870.

Full release notes can be found at:

  https://webkitgtk.org/2021/03/18/webkitgtk2.30.6-released.html

An accompanying security advisory has been published at:

  https://webkitgtk.org/security/WSA-2021-0002.html

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 185e1c9c62)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-29 21:45:00 +02:00
Bernd Kuhls
d1b15668f6 package/kodi: honour the libusb option even when disabled 
Make sure libusb support is properly disabled even if the libusb
package is enabled, and in case it gets built before Kodi.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0e1acc6e36)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-29 21:41:56 +02:00
Waldemar Brodkorb
89d48452df package/uclibc: update to 1.0.38 
- fixes renameat2 issues on riscv64

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0cf28c2c5a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-29 21:15:50 +02:00
Bernd Kuhls
3ea19568aa package/libopenssl: security bump version to 1.1.1k 
Fixes CVE-2021-3449 & CVE-2021-3450:
https://www.openssl.org/news/vulnerabilities-1.1.1.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 198e20921f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-28 22:46:19 +02:00
Petr Vorel
02779001bb linux: bump CIP kernel 4.19 series 
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c670ab1e6c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-28 22:42:22 +02:00
Petr Vorel
f82ec65bca {linux, linux-headers}: bump 5.{4, 10, 11}.x 4.{4, 9, 14, 19} series 
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ddfac826ae)
[Peter: drop 5.11.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-28 22:01:15 +02:00
Ismael Luceno
65d018436e package/libressl: security bump to 3.2.5 
It includes the following bug fix:

 * A TLS client using session resumption may cause a use-after-free.

https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.2.5-relnotes.txt

Signed-off-by: Ismael Luceno <ismael@iodev.co.uk>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f3894ffce2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:43:19 +01:00
Fabrice Fontaine
0438a071b1 package/gvfs: add GVFS_CPE_ID_VENDOR 
cpe:2.3:a:gnome:gvfs is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnome%3Agvfs

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7062e183a2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:42:59 +01:00
Fabrice Fontaine
ea70d89250 package/gutenprint: add GUTENPRINT_CPE_ID_VENDOR 
cpe:2.3:a:gutenprint_project:gutenprint is a valid CPE identifier for
this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agutenprint_project%3Agutenprint

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 9462869f27)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:42:18 +01:00
Fabrice Fontaine
d83b753643 package/gpsd: add GPSD_CPE_ID_VENDOR 
cpe:2.3:a:gpsd_project:gpsd is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agpsd_project%3Agpsd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b72416bc6c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:41:53 +01:00
Fabrice Fontaine
11c566e306 package/gettext-gnu: add CPE variables 
cpe:2.3:a:gnu:gettext is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Agettext

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 15b6cae49a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:41:48 +01:00
Peter Seiderer
c48f769c7f boot/syslinux: fix gcc-10.x compile 
Add two patches ([1], [2]) taken from the fedora syslinux package ([3]) to fix
compile/linking with gcc-10.x compiler.

[1] https://src.fedoraproject.org/rpms/syslinux/raw/rawhide/f/0005-Workaround-multiple-definition-of-symbol-errors.patch
[2] https://src.fedoraproject.org/rpms/syslinux/raw/rawhide/f/0006-Replace-builtin-strlen-that-appears-to-get-optimized.patch
[3] https://src.fedoraproject.org/rpms/syslinux/tree/rawhide

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a9f94d7aba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:38:12 +01:00
Filip Skoneczny
3d0919a43f configs/bananapi_m1_plus_defconfig: select custom headers 
Board used custom Kernel but did not specify
custom headers. This broke the build when
Linux 5.11 was added in d2fe9c6.

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/1089053980

Signed-off-by: Filip Skoneczny <fskoneczny@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 76efcc2f54)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:36:13 +01:00
Alexander Dahl
e37429e8a9 package/squid: use external libltdl 
When enabling BR2_PACKAGE_LIBTOOL it depended on the build order if
squid used the external libltdl or built it from its internal copy. That
broke the build in fli4l where we have additional post build checks
analyzing runtime dependencies and a separate step for copying build
artefacts to target packages.

Depend on the external libltdl unconditionally like done with commit
3efc5a250c ("package/siproxd: new package") for package siproxd
recently as well. For reproducibility, size, and security.

Link: https://web.nettworks.org/ci/job/fli4l/job/buildroot/job/4.0/job/trunk-sunxi/672/
Suggested-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Alexander Dahl <post@lespocky.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f5eec0731d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 23:35:37 +01:00
Bernd Kuhls
9efd9bf0ed package/tor: security bump version to 0.4.5.7 
Updated license hash due to upstream commit:
https://gitweb.torproject.org/tor.git/commit/LICENSE?h=tor-0.4.5.7&id=02230575c4da6cd6342516e6682f95dad3e3e29e

Fixes CVE-2021-28089 & CVE-2021-28090.

Release notes: https://blog.torproject.org/node/2009

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit ed308a5cc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 20:09:13 +01:00
Bernd Kuhls
5d6a6563db package/tor: bump version to 0.4.5.6 
Rebased patch, part of it was committed upstream:
https://gitweb.torproject.org/tor.git/commit/?id=c5817a0dafc67882f15730ee818fbcdba1b7b915

Release notes: https://blog.torproject.org/node/2000

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 795fe88cf8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 20:09:04 +01:00
Fabrice Fontaine
716e151b00 package/haproxy: bump to version 2.2.10 
https://www.mail-archive.com/haproxy@formilux.org/msg39916.html

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 31f6fc2bde)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-26 20:05:40 +01:00
Peter Korsgaard
5ce4d99699 package/efivar: add upstream post-37 patches fixing efibootmgr -v 
Without this patch, efibootmgr -v errors out:

efibootmgr -v
BootCurrent: 0001
Timeout: 1 seconds
BootOrder: 0001,0002,0000
Boot0000* Diagnostic ProgramCould not parse device path: Invalid argument

vs:

efibootmgr -v
BootCurrent: 0001
Timeout: 1 seconds
BootOrder: 0001,0002,0000
Boot0000* Diagnostic Program    FvVol(5c60f367-a505-419a-859e-2a4ff6ca6fe5)/FvFile(085e8cc2-8ec9-4666-bd2a-49d481e95fa7)
Boot0001* containeros-a HD(1,GPT,1491d519-d9d7-7c4e-9110-4ab21271ac64,0x800,0x20000)/File(\efi\container\boot.efi)

For more details, see:

https://github.com/rhboot/efibootmgr/issues/133
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=963475

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 82f65e2c5f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-25 08:17:03 +01:00
Michael Vetter
5fb4ccb6f4 package/jasper: bump version to 2.0.27 
Changes:
  * Check for an image containing no samples in the PGX
    decoder. (#271, #272, #273, #274, #275, #276, #281)
  * Check for dimensions of zero in the JPC and JPEG decoders.
  * Fix an arguably incorrect type for an integer literal
    in the PGX decoder. (#270)
  * Check for an invalid component reference in the
    JP2 decoder. (#269)
  * Check on integer size in JP2 decoder. (#278)

Signed-off-by: Michael Vetter <jubalh@iodoru.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 34743fadba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:54:26 +01:00
Peter Seiderer
101f3d8ea1 package/git: bump version to 2.30.2 
Fix CVE-2021-21300:

  On case-insensitive file systems with support for symbolic links,
  if Git is configured globally to apply delay-capable clean/smudge
  filters (such as Git LFS), Git could be fooled into running
  remote code during a clone.

For details see [1] and [2].

[1] http://lkml.iu.edu/hypermail/linux/kernel/2102.1/01858.html
[2] http://lkml.iu.edu/hypermail/linux/kernel/2103.1/02533.html

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6e0771062c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:33:50 +01:00
Peter Seiderer
bc360ecd02 package/gst1-python: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b06a83e354)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:29:22 +01:00
Peter Seiderer
4b72b86d2e package/gst-omx: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 953ccbcc96)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:29:13 +01:00
Peter Seiderer
4e8043bf16 package/gstreamer1-editing-services: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ab33ebe4b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:28:59 +01:00
Peter Seiderer
5bdf660e44 package/gst1-rtsp-server: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 048f787235)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:28:05 +01:00
Peter Seiderer
0211be5e1c package/gst1-vaapi: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1070dbc158)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:27:35 +01:00
Peter Seiderer
1edd82f04f package/gst1-libav: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 75f3adff94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:27:26 +01:00
Peter Seiderer
12f91cf504 package/gst1-devtools: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 091cafd1ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:26:59 +01:00
Peter Seiderer
17f4432934 package/gst1-plugins-ugly: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 52d2a89bb4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:26:37 +01:00
Peter Seiderer
11482ef476 package/gst1-plugins-bad: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a1ff13b86f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:26:20 +01:00
Peter Seiderer
8d09e843a9 package/gst1-plugins-good: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f538705bc0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:26:03 +01:00
Peter Seiderer
60ee6a3e6c package/gst1-plugins-base: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 267ece7d64)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:25:56 +01:00
Peter Seiderer
9ea796d822 package/gstreamer1: bump version to 1.18.4 
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 40f46cb0ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 23:25:46 +01:00
Fabrice Fontaine
79629821e4 package/libwebsockets: needs dynamic library 
kismets fails to build statically with libwebsockets since commit
14522a8f9d because libwebsockets does not
specify any Libs.Private field in its pkg-config file resulting in the
following failure:

configure:10659: checking for lws_client_connect_via_info in -lwebsockets
configure:10684: /usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-1/output-1/host/bin/arm-linux-g++ -std=gnu++17 -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -O2   -static -static -O3 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 conftest.cpp -lwebsockets  -latomic -lz >&5
/usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /usr/lfs/hdd_v1/rc-buildroot-test/scripts/instance-1/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libwebsockets.a(tls.c.o): in function `alpn_cb':
tls.c:(.text+0x24): undefined reference to `SSL_select_next_proto'

As it is not trivial to specify Libs.Private with cmake buildsystem
(i.e. LIB_LIST contains the list of libraries but in the "cmake format"
with full paths and ';'), just disable static build with libwebsockets.

Fixes:
 - http://autobuild.buildroot.org/results/9fc7891b61b1c487b95f07c59b802dd98ef71e3a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 46a1e2847f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:43:09 +01:00
Michael Nosthoff
ecbec13168 configs/beaglebone_qt5: add overlay to defconfig 
commit 8efc5dce98 added an overlay but
forgot to add it to the related defconfig.

Fixes: missing overlay data in image

Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d08bb7491a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:11:22 +01:00
Fabrice Fontaine
c14d48bfdb package/ejabberd: add EJABBERD_CPE_ID_VENDOR 
cpe:2.3:a:process-one:ejabberd is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aprocess-one%3Aejabberd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 61aee0d75b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:08:52 +01:00
Fabrice Fontaine
8e04c37f0f package/dtc: add DTC_CPE_ID_VENDOR 
cpe:2.3:a:dtc_project:dtc is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Adtc_project%3Adtc

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 70d5a08dbe)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:08:42 +01:00
Fabrice Fontaine
9cc277222b package/doxygen: add DOXYGEN_CPE_ID_VENDOR 
cpe:2.3:a:doxygen:doxygen is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Adoxygen%3Adoxygen

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 44b76cc49f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:07:24 +01:00
Fabrice Fontaine
171211a38b package/dhcpcd: add DHCPCD_CPE_ID_VENDOR 
cpe:2.3:a:dhcpcd_project:dhcpcd is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Adhcpcd_project%3Adhcpcd

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b844bf46ba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:07:17 +01:00
Fabrice Fontaine
029ffafc61 package/davfs2: add DAVFS2_CPE_ID_VENDOR 
cpe:2.3:a:werner_baumann:davfs2 is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Awerner_baumann%3Adavfs2

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 58134c1570)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:07:07 +01:00
Fabrice Fontaine
c6d05bbd46 package/cracklib: add CRACKLIB_CPE_ID_VENDOR 
cpe:2.3:a:cracklib_project:cracklib is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Acracklib_project%3Acracklib

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5575aa6f51)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:06:27 +01:00
Fabrice Fontaine
f5155334cc package/cups-filters: add CUPS_FILTERS_CPE_ID_VENDOR 
cpe:2.3:a:linuxfoundation:cups-filters is a valid CPE identifier for
this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alinuxfoundation%3Acups-filters

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 268fbb730b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 14:06:22 +01:00
Jean-pierre Cartal
4cee5fc397 support/download: fix tarball generation with symlinks pointing to ./something 
When a --transform expression is provided, it is by default also applied
to the target of a symlink.

When we create tarballs (from git or svn checkouts), we use a --transform
expression to replace the leading ./ with the package name and version.

This causes issues when a package contains symlinks that points to
./something, as the leading './' is also replaced.

Fix that by using the 'S' transformation scope flag, as described in the
tar manual:
    https://www.gnu.org/software/tar/manual/html_node/transform.html#transform

    In addition, several transformation scope flags are supported, that
    control to what files transformations apply. These are:

    ‘r’ Apply transformation to regular archive members.
    ‘R’ Do not apply transformation to regular archive members.
    ‘s’ Apply transformation to symbolic link targets.
    ‘S’ Do not apply transformation to symbolic link targets.
    ‘h’ Apply transformation to hard link targets.
    ‘H’ Do not apply transformation to hard link targets.

    Default is ‘rsh’ [...].

Fixes: #13616

This has been checked to not change any of the existing hash for any of
our git-downloaded package (some are host-only, hence the few fixups):

    ---8<---
    $ m="$( git grep -l -E -- -br[[:digit:]]+.tar.gz boot package/ \
            |awk -F/ '{print $(NF-1)}' \
            |sed -r -e 's/(imx-mkimage|netsurf-buildsystem|prelink-cross|qoriq-rcw|vboot-utils)/host-\1/g' \
                    -e 's/$/-source/'
          )"
    $ make defconfig; make clean; BR2_DL_DIR=$(pwd)/trash-me make ${m}
    ---8<---

Note: it is unclear what the 'H' flag does nor how it works, because the
concept of "target of a hardlink" is not obvious; probably it has to do
with how tar internally detects and stores hardlinks. Since we do not
yet have any issue with hardlinks, just ignore the problem for now, and
postpone until we have an actual issue with a real test-case.

Signed-off-by: Jean-pierre Cartal <jpcartal@free.fr>
Cc: Vincent Fazio <vfazio@xes-inc.com>
[yann.morin.1998@free.fr:
  - re-indent commit log
  - add scriptlet to test existing hashes
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c9f27fdc1b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-24 10:42:04 +01:00
Fabrice Fontaine
6c04e6fb04 package/zstd: security bump to version 1.4.9 
Fix CVE-2021-24032: Beginning in v1.4.1 and prior to v1.4.9, due to an
incomplete fix for CVE-2021-24031, the Zstandard command-line utility
created output files with default permissions and restricted those
permissions immediately afterwards. Output files could therefore
momentarily be readable or writable to unintended parties.

https://github.com/facebook/zstd/releases/tag/v1.4.9

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 74ed1b5ca0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 23:11:57 +01:00
Nicolas Serafini
a34511eff7 DEVELOPERS: update Nicolas Serafini e-mail address 
Signed-off-by: Nicolas Serafini <nicolas.serafini@ik.me>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cd9ffd9473)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 23:07:08 +01:00
Fabrice Fontaine
7ad553446d package/proftpd: fix build with gcc 10 
Fixes:
 - http://autobuild.buildroot.org/results/d6ce64245c2724cbd94583490bf009c188182b1b

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f6428c072b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 22:44:35 +01:00
Titouan Christophe
46b53434c5 package/mosquitto: security bump to v2.0.9 
This is a bugfix release and include a minor security fix.
Read the announcement on https://mosquitto.org/blog/2021/03/version-2-0-9-released/

Signed-off-by: Titouan Christophe <titouanchristophe@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 521597d47f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 22:35:42 +01:00
Fabrice Fontaine
75997ef8e0 pcmanfm: add PCMANFM_CPE_ID_VENDOR 
cpe:2.3:a:pcmanfm_project:pcmanfm is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Apcmanfm_project%3Apcmanfm

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b85f8e2899)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 22:29:44 +01:00
Peter Seiderer
4a373ec8cd package/batman-adv: add note about linux mainline kernel module alternative 
Since version 2.6.38 batman-adv is integreated into the linux mainline
kernel ([1], [2]) so add a note about it in the Config.in help text.

[1] https://kernelnewbies.org/Linux_2_6_38
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c6c8fea29769d998d94fcec9b9f14d4b52b349d3

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8ec31f1bc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
 2021-03-23 18:20:07 +01:00