Commit Graph

47131 Commits

Author SHA1 Message Date
Pierre-Jean Texier
ae2a108326 package/mongoose: security bump to version 6.16
Fixes the following security vulnerability:

CVE-2019-13503: mq_parse_http in mongoose.c in Mongoose 6.15
has a heap-based buffer over-read.

See https://github.com/cesanta/mongoose/releases/tag/6.16

Signed-off-by: Pierre-Jean Texier <pjtexier@koncepto.io>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit aeee0b9bd7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 11:38:14 +01:00
Bernd Kuhls
244e9055c0 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{2, 3}.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 32042f42cb)
[Peter: drop 5.3.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 09:51:17 +01:00
Charlie Turner
5719bf4bf5 package/gstreamer1: gl enabled when either GL or GLES2 is present
When building gst1-plugins-base with GL support on the rpi3 (which
supports only GLES2, not full desktop GL), GStreamer was being asked to
disable its GL support completely. This isn't correct since it can be
used with either GL or GLES2. There is already a Config.in symbol to
indicate that either of them is enabled:
BR2_PACKAGE_GST1_PLUGINS_BASE_LIB_OPENGL_HAS_API. So use that to
determine if gl should be enabled or disabled.

While we're at it, also move the GL/GLES handling under the same API
condition. This makes it clearer that they belong together.

Signed-off-by: Charlie Turner <cturner@igalia.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
[Arnout: refactor using
BR2_PACKAGE_GST1_PLUGINS_BASE_LIB_OPENGL_HAS_API]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4164d31e05)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-29 09:02:53 +01:00
Thomas Petazzoni
08c7ad11b8 docs/manual: fix Config.in option that cargo packages must depend on
Back in commit 025b863e6f, the option
BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS was introduced, to
separate the option that host packages needing Rust should depend on
(BR2_PACKAGE_HOST_RUSTC_ARCH_SUPPORTS) from the option that target
packages needing Rust should depend on
(BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS).

Since the example in the manual is showing a target package, we must
use BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Sam Voss <sam.voss@gmail.com>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit edee45b843)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 17:38:04 +01:00
Heiko Thiery
cf61da4748 utils/test-pkg: ensure to exit with an error upon failure
This commit modifies the main() function so that it returns the sum of
build and legal errors, making sure the overall test-pkg script exists
with a non-zero error code upon failure.

Signed-off-by: Heiko Thiery <heiko.thiery@kontron.com>
[Thomas: improved commit log]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5093435f66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 17:33:23 +01:00
Fabio Estevam
a7bca3f0f7 board/freescale/imx6-sabresd: improve Qt5 Cinematic Demo instructions
QT_QPA_EGLFS_ALWAYS_SET_MODE=1 needs to be exported, otherwise the Qt5
Cinematic demo throws a storm of the following messages:

Could not queue DRM page flip on screen LVDS1 (Invalid argument)

Improve the instructions by mentioning such requirement.

Signed-off-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d9ccd8f0fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:24:45 +01:00
Fabrice Fontaine
43a79b9643 package/sdl_mixer: disable parallel build
Build sometimes fails on:
Fatal error: can't create build/load_aiff.o: No such file or directory

Fixes:
 - http://autobuild.buildroot.org/results/c800ef60d8af0cd76f2f1de9aff573120ebd8ada

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit fcc22749e8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:21:25 +01:00
Fabrice Fontaine
216c668a36 package/vtun: fix static linking with atomic
Fixes:
 - http://autobuild.buildroot.org/results/908707cdd16c5b89197c226a3e259f8943a5474e

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit cff14017f9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:13:53 +01:00
Bernd Kuhls
2c0f064ff7 package/wireshark: security bump to version 3.0.5
Fixes the following security vulnerabilities (3.0.4):
- CVE-2019-16319: Gryphon dissector infinite loop
  https://www.wireshark.org/security/wnpa-sec-2019-21

Added upstream sha1 hash.

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1218a2be41)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:06:22 +01:00
Bernd Kuhls
2750b41e4e package/libva: fix mesa3d glx support
https://git.buildroot.net/buildroot/commit/package/mesa3d?id=5cb821d5635626b7327d5d704555c412e5ed5a1f

added a new option to enable GLX support.

This patch adjusts libva to use the new logic.

Fixes:
http://autobuild.buildroot.net/results/797/79776104e681402c24160be15789fe67bb69f833/

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Reviewed-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 196e3d2b33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 14:02:53 +01:00
Fabrice Fontaine
0689e268e7 package/nbd: add host-pkgconf to dependencies
pkg-config is used to find libglib2 since version 3.17 and
ef86bbd9da

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Acked-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d630ed2dcf)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:59:04 +01:00
Asaf Kahlon
55c0c09fe4 package/python-pysnmp-apps: update license to BSD-2-Clause
The license file for this application is BSD-2-Clause and not
BSD-3-Clause as we currently state in the _LICENSE variable.

Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 1eb8252cce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:57:31 +01:00
Vivien Didelot
0df86310f8 DEVELOPERS: change Ash Charles' email address
Ash is no longer working at Savoir-faire Linux. Update his email
address in the DEVELOPERS file.

Signed-off-by: Vivien Didelot <vivien.didelot@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e32e92233f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 13:50:14 +01:00
Francois Perrad
444135d7c0 package/lua-sdl2: fix install path
WITH_LUAVER must be set with a value depending of Lua interpreter,
by this way, the module is installed in the correct location

Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Tested-by: Ricardo Martincoski <ricardo.martincoski@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f2d1ec39e4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:56:30 +01:00
Thomas Petazzoni
982a350aaa DEVELOPERS: remove Morgan Delestre
Morgan's e-mail is bouncing:

"""
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  m.delestre@sinters.fr
    retry timeout exceeded
"""

And I was confirmed by CORJON Julien <CORJON.J@ecagroup.com> that
Morgan is no longer at ECA/Sinters.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6015b46865)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:55:31 +01:00
Thomas Petazzoni
96db73f054 DEVELOPERS: remove Jonathan Liu
In a private e-mail answering one of our notifications about packages
being outdated, Jonathan replied:

"""
I switched from Buildroot to OpenEmbedded in 2013 so am no longer actively
involved with Buildroot.
Please unsubscribe me from outdated package notifications.
"""

So let's remove him from the DEVELOPERS file.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 175c3f8b2d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:54:17 +01:00
Arnout Vandecappelle (Essensium/Mind)
47649b2a1c package/python-tornado: only available for Python 3
Since the bump to 6.0.1, python-tornado has dropped support for Python 2
and now needs Python >= 3.5 (cfr. setup.cfg).

Apparently this is not checked by setuptools, and apparently
byte-compile is not done in the autobuilders, so there's not autobuild
failure.

Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Cc: Asaf Kahlon <asafka7@gmail.com>
Cc: Ryan Barnett <ryan.barnett@rockwellcollins.com>
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 69c787de04)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:49:22 +01:00
Bernd Kuhls
b6733ae2ad package/libpcap: security bump version to 1.9.1
Removed patch applied upstream.

Changelog: https://www.tcpdump.org/libpcap-changes.txt

Quoting changelog:
"Five CVE-2019-15161, CVE-2019-15162, CVE-2019-15163, CVE-2019-15164,
 CVE-2019-15165
 Fixes for CVE-2018-16301, errors in pcapng reading."

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7df3dfee55)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:43:13 +01:00
James Hilliard
e91b9bb66a package/nfs-utils: fix nfs-utils_env.sh path
Per upstream commit bf12e1fa9f48e8ee91a2869e69484c70595b5160
https://cdn.kernel.org/pub/linux/utils/nfs-utils/1.3.4/1.3.4-Changelog

Currently nfs-utils_env.sh is installed in a
directory that is own by systemd. They requested
via https://bugzilla.redhat.com/show_bug.cgi?id=1303113
to move the script into /usr/libexec/nfs-utils

As such we must update the installation path for nfs-utils_env.sh.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Tested-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 74aab4ae06)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:38:08 +01:00
Peter Seiderer
770680cd92 package/icu: fix double conversion compile for microblaze
Fixes [1]:

  In file included from double-conversion.h:42:0,
                   from number_decimalquantity.cpp:19:
  double-conversion-utils.h:120:2: error: #error Target architecture was not detected as supported by Double-Conversion.
   #error Target architecture was not detected as supported by Double-Conversion.

Apply the same fix as previously for qt5base ([2], already sent upstream [3],
but seems to be lost while merging [4]).

[1] http://autobuild.buildroot.net/results/24005bc54cbc742decee221fb09bca19ee70502c
[2] https://git.buildroot.net/buildroot/commit/?id=530668ddb709cf27aa6694e00f44cf58af858b0b
[3] https://github.com/google/double-conversion/issues/73
[4] 768a445f0c

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0e9eaf7d57)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:31:00 +01:00
Romain Naour
f975b39baf DEVELOPERS: add Romain Naour for clang, clinfo, libclc and llvm packages
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7fe2e9e48b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 10:28:32 +01:00
Bernd Kuhls
b4fffad781 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{2, 3}.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Peter: drop 5.3.x bump]
(cherry picked from commit 17ec040ff5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 09:41:47 +01:00
Fabrice Fontaine
b1d3234ff9 package/suricata: fix build without geoip
Fixes:
 - http://autobuild.buildroot.org/results/a7a34f760ae5fe0922fdb720b8234dbcd85ed222

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9bab165ccb)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 00:16:45 +01:00
Fabrice Fontaine
edc680caaa package/suricata: security bump to version 4.1.5
- Drop second patch (already in version)
- Add libmaxminddb optional dependency and use --disable-libgeoip to prefer
  maxminddb over geoip, see:
  d29072647f
  c55226b712
- Disable sphinx-build (to avoid a build failure)
- This release fixes a number of issues found in the 4.1 branch. Some of
  the issues are security issues, so upgrading is highly recommended.
  See https://suricata-ids.org/2019/09/24/suricata-4-1-5-released

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 37be55a5db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-28 00:16:29 +01:00
Peter Korsgaard
c5d3437e84 package/ruby: security bump to version 2.4.9
Fixes the following security vulnerability:

(Bundled jquery)
- CVE-2012-6708: jQuery before 1.9.0 is vulnerable to Cross-site Scripting
  (XSS) attacks.  The jQuery(strInput) function does not differentiate
  selectors from HTML in a reliable fashion.  In vulnerable versions, jQuery
  determined whether the input was HTML by looking for the '<' character
  anywhere in the string, giving attackers more flexibility when attempting
  to construct a malicious payload.  In fixed versions, jQuery only deems
  the input to be HTML if it explicitly starts with the '<' character,
  limiting exploitability only to attackers who can control the beginning of
  a string, which is far less common.

- CVE-2015-9251: jQuery before 3.0.0 is vulnerable to Cross-site Scripting
  (XSS) attacks when a cross-domain Ajax request is performed without the
  dataType option, causing text/javascript responses to be executed.

https://www.ruby-lang.org/en/news/2019/08/28/multiple-jquery-vulnerabilities-in-rdoc/

- CVE-2019-16255: A code injection vulnerability of Shell#[] and Shell#test

https://www.ruby-lang.org/en/news/2019/10/01/code-injection-shell-test-cve-2019-16255/

- CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)

https://www.ruby-lang.org/en/news/2019/10/01/http-response-splitting-in-webrick-cve-2019-16254/

- CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and File.fnmatch?

https://www.ruby-lang.org/en/news/2019/10/01/nul-injection-file-fnmatch-cve-2019-15845/

- CVE-2019-16201: Regular Expression Denial of Service vulnerability of
  WEBrick's Digest access authentication

https://www.ruby-lang.org/en/news/2019/10/01/webrick-regexp-digestauth-dos-cve-2019-16201/

2.4.9 fixes a packaging bug in 2.4.8:

https://www.ruby-lang.org/en/news/2019/10/02/ruby-2-4-9-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit dc487302b6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-25 23:46:17 +02:00
Carlos Santos
fe0f841794 package/cups-filters: fix ln -r workaround for older patch versions
0001-install-support-old-ln-versions-without-the-r-option.patch adds a
ln-srf script for older distributions to emulate 'ln -r', but GNU patch <
2.7 does not handle the git patch permission extensions - So ensure it is
executable.

https://savannah.gnu.org/forum/forum.php?forum_id=7361

Fixes:
    http://autobuild.buildroot.net/results/5c88115b92abc1360a979cd46e00332f61c41cb4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-18 20:54:26 +02:00
Peter Korsgaard
d77f6c1712 Update for 2019.08.1
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019.08.1
2019-10-03 09:12:47 +02:00
Peter Korsgaard
73dad61740 package/mongodb: security bump to version 4.0.12
Fixes the following (low severity) security vulnerabilities:

4.0.9:

- CVE-2019-2386: After user deletion in MongoDB Server the improper
  invalidation of authorization sessions allows an authenticated user's
  session to persist and become conflated with new accounts, if those
  accounts reuse the names of deleted ones
  https://jira.mongodb.org/browse/SERVER-38984

4.0.11:

- CVE-2019-2389: Incorrect scoping of kill operations in MongoDB Server's
  packaged SysV init scripts allow users with write access to the PID file
  to insert arbitrary PIDs to be killed when the root user stops the MongoDB
  process via SysV init
  https://jira.mongodb.org/browse/SERVER-40563

- CVE-2019-2390: An unprivileged user or program on Microsoft Windows which
  can create OpenSSL configuration files in a fixed location may cause
  utility programs shipped with MongoDB server versions less than 4.0.11
  https://jira.mongodb.org/browse/SERVER-42233

Plus a number of other bugfixes. For details, see the release notes:
https://docs.mongodb.com/manual/release-notes/4.0/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 165e9c163c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 21:31:46 +02:00
Bernd Kuhls
b718ed9fab package/putty: security bump version to 0.73
Added upstream-provided sha1 hash.

Changelog:
https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 71d2911e26)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 18:02:39 +02:00
Peter Korsgaard
668fe091f8 {linux, linux-headers}: bump 4.19.x / 5.{2, 3}.x series
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 04e9fdb1c6)
[Peter: drop 5.3.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:58:46 +02:00
André Hentschel
efe9840c2a DEVELOPERS: remove myself from azure-iot-sdk-c
Signed-off-by: André Hentschel <nerv@dawncrow.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit fbc54866a3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:48:53 +02:00
Peter Korsgaard
2610ab44be package/go: security bump to version 1.12.10
Fixes the following security vulnerabilities:

- CVE-2019-16276: Go before 1.12.10 and 1.13.x before 1.13.1 allow HTTP
  Request Smuggling.
  https://github.com/golang/go/issues/34540

>From the release notes:

go1.12.10 (released 2019/09/25) includes security fixes to the net/http and
net/textproto packages

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bd574c445c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-02 17:13:54 +02:00
Jagan Teki
30433bc252 package/swupdate: fix typo in BR2_PACKAGE_LIBCURL in the help text
Config.in documented BR2_LIBCURL for swupdate but the actual
package name is BR2_PACKAGE_LIBCURL

Fix by updating the same in Config.in

Cc: Jörg Krause <joerg.krause@embedded.rocks>
Signed-off-by: Jagan Teki <jagan@amarulasolutions.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5abe6f2bf7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:45:01 +02:00
Yegor Yefremov
5381d693ef configs/beaglebone_defconfig: use default console device
OMAP kernels use 8250 driver by default. Hence the name of
the console device is not /dev/ttyO0 but /dev/ttyS0.
Use /dev/console in order to handle the console independently
of the selected driver.

Tested in BeagleBone Black board.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 68b5b79b2f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:44:53 +02:00
Bernd Kuhls
3eadf3ccbd {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.2.x series
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 80d32c942a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:36:06 +02:00
Carlos Santos
b952431bf3 package/cups-filters: disable Braille embosing filters
Otherwise they are installed even though the Braille support is not
built because it requires liblouis, which is not available.

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3da92264c6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:29:34 +02:00
Julien Floret
e818d80f4d DEVELOPERS: remove myself from lldpd developers
Signed-off-by: Julien Floret <julien.floret@6wind.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 686f40c0b4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 11:27:52 +02:00
Bernd Kuhls
e82df41169 package/exim: add upstream security fix
Fixes CVE-2019-16928:
https://lists.exim.org/lurker/message/20190928.003428.2b4c81a7.en.html

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6c73ef37bd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:25:57 +02:00
Bernd Kuhls
6271eabb12 package/e2fsprogs: security bump version to 1.45.4
Fixes CVE-2019-5094:
http://e2fsprogs.sourceforge.net/e2fsprogs-release.html#1.45.4

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5ff8106a08)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:19:41 +02:00
Shyam Saini
b1a2ad290a DEVELOPERS: Add Jagan Teki as maintainer for olimex A33 olinuxino
I no longer work at Amarula Solutions and neither do I have access to
olimex A33 olinuxino board. So, add Jagan as maintainer of this board.

Signed-off-by: Shyam Saini <mayhs11saini@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 31fb2ac781)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:15:22 +02:00
Max Filippov
c6bf0d01e7 package/gcc: backport fix for xtensa PR 91880
Xtensa hwloop_optimize segfaults when zero overhead loop is about to be
inserted as the first instruction of the function.
Insert zero overhead loop instruction into new basic block before the
loop when basic block that precedes the loop is empty.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a88e87eee0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:13:12 +02:00
Bernd Kuhls
8294642b7a package/php: security bump version to 7.3.10
Release notes: https://www.php.net/archive/2019.php#2019-09-26-1

No CVE IDs can be found in the bug reports mentioned in the Changelog:
https://www.php.net/ChangeLog-7.php#7.3.10

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7169beb3fc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:09:11 +02:00
Yegor Yefremov
675b5f3439 DEVELOPERS: add Yegor Yefremov as contact for BeagleBone defconfigs
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit e34b323161)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:08:24 +02:00
Max Filippov
e047354d09 package/gcc: backport fix for xtensa PR 90922
Stack pointer adjustment code in xtensa call0 ABI prologue missed a case
of no callee-saved registers and a stack frame size bigger than 128 bytes.
Handle that case.

Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9fd7ad8e71)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-10-01 08:05:26 +02:00
Peter Korsgaard
550c5d67ab package/mosquitto: bump version to 1.6.7
Fixes a number of issues after 1.6.6:
https://mosquitto.org/blog/2019/09/version-1-6-7-released/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7b65663a47)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 18:37:11 +02:00
Carlos Santos
8607d7f7e0 toolchain: generate check-headers program under $(BUILD_DIR)
Some installations mount /tmp with the 'noexec' option, which prevents
running the program generated there to check the kernel headers.

Avoid the problem by generating the program under $(BUILD_DIR), passed
as the first argument to check-kernel-headers.sh.

We could globally export a TMPDIR environment variable with some path
under $(BUILD_DIR) but such solution would be too intrusive, depriving
the user from the freedom to set TMPDIR at his will (or needs).

Fixes: https://bugs.busybox.net/show_bug.cgi?id=12241

Signed-off-by: Carlos Santos <unixmania@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6136765b23)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 18:02:24 +02:00
Fabrice Fontaine
82796c2770 package/libgcrypt: security bump to version 1.8.5
- Drop second and third patches (alredy in version)
- Add mitigation against an ECDSA timing attack. [T4626,CVE-2019-13627]

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 26daf383f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 16:09:43 +02:00
Thomas Huth
64f83694c1 package/ncurses: use COPYING as license file instead of README
The recent versions of ncurses now have the license information in a
separate file called COPYING.

Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 40de427a63)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 15:58:30 +02:00
Asaf Kahlon
83d4a70fd2 DEVELOPERS: add Asaf Kahlon for collectd
Signed-off-by: Asaf Kahlon <asafka7@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ec00c88d5a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 15:53:18 +02:00
Peter Korsgaard
6bab977dc7 package/joe: license is GPL-2.0+
Joe changed the COPYING file from GPL-1.0 to GPL-2.0 in the development
leading up to 3.8:

d731f9b379/

So change the license to GPL-2.0+

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 0d26068b38)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2019-09-30 15:50:57 +02:00