Commit Graph

77327 Commits

Author SHA1 Message Date
Thomas Petazzoni
b0a62a9654 docs/migrating.adoc: document the tarball suffix update for Cargo-fetch packages
We changed the suffix of tarballs for Cargo-fetched packages, which
affects out-of-tree packages, so it makes sense to document that in
the migration guide.

Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 20:00:38 +02:00
Thomas Petazzoni
e0beecec56 package: update cargo suffix to -cargo4 and fix hashes
Following the "support/download: replace deprecated .cargo/config"
change, the hashes of all Cargo-fetched packages need to be
updated. This commit therefore changes the suffix of Cargo packages
from -cargo3 to -cargo4, and updates all hashes.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 20:00:37 +02:00
Fiona Klute (WIWA)
3776f7c11f support/download: replace deprecated .cargo/config
With the current vendoring process, any Cargo build emits the
following warning:

warning: `.../.cargo/config` is deprecated in favor of `config.toml`

.cargo/config.toml was introduced in 1.39 [1], so there shouldn't be
backwards compatibility issues in Buildroot. However, because the
generated config file becomes part of the vendored archive, this
changes the hashes of all Cargo-based packages.

[1] https://doc.rust-lang.org/cargo/reference/config.html#hierarchical-structure

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 20:00:36 +02:00
Adrian Perez de Castro
e743759a52 package/sysprof: bump to version 48.0
This new release includes a number of improvements. Release notes:

  https://gitlab.gnome.org/GNOME/sysprof/-/blob/48.0/NEWS

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 19:57:59 +02:00
Adrian Perez de Castro
10720c036e package/libdex: bump to version 0.10.0
On top of a few small features, this release has a few build system
improvements, and in particular improves checking for libatomic and
libucontext.

https://gitlab.gnome.org/GNOME/libdex/-/blob/0.10.0/NEWS

Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 19:57:59 +02:00
Thomas Perale
6541717ef9 package/python-h11: security bump to version 0.16.0
Fixes the following security issue:

- CVE-2025-43859: A leniency in h11's parsing of line terminators in
    chunked-coding message bodies can lead to request smuggling
    vulnerabilities under certain conditions.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-43859
  - 114803a29c

For more details on the version bump, see:
  - https://github.com/python-hyper/h11/compare/v0.14.0...v0.16.0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 19:54:54 +02:00
Yann E. MORIN
5009fd2436 Makefile: include defconfigs in sub-directories in list-defconfigs
Currently, list-defconfigs only lists the defconfigs that live
 live in the top-level configs/ directory. For the in-tree defconfigs
this is indeed the case, but it is possible to manage the configs in a
br2-external tree with sub-directories.

A few examples:
  - for a given board, a first defconfig is the full system, and a
    second is the rescue system;
  - for a given board, two defconfigs implement an A/B feature set;
  - a set of configurations targetting various famillies of systems each
    running on different hardware, sorted per familly.

Extend list-defconfigs to look for and report defconfigs in
sub-directories of the top-level configs/.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 19:45:35 +02:00
James Hilliard
3481a9643f package/mbedtls: bump to version 3.6.3.1
As specified in the 2.28.10 release notes:
https://github.com/Mbed-TLS/mbedtls/releases/tag/mbedtls-2.28.10

Mbed TLS 2.28.10 is the last release of the 2.28 LTS and won't receive bug
fixes or security fixes anymore.  Users are advised to upgrade to a
maintained version.

So move to 3.6.x, which is the new LTS version:

Mbed TLS 3.6 is a long-term support (LTS) branch.  It will be supported with
bug-fixes and security fixes until at least March 2027.

Drop BR2_PACKAGE_MBEDTLS_COMPRESSION and all related references
as native zlib support has been entirely removed from mbedtls.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Peter: add note about 2.28.x / 3.6.x, add Config.in.legacy]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 18:49:54 +02:00
Thomas Petazzoni
432aef053e package/{rust,rust-bin}: fix license
The bump of rust and rust-bin from 1.82 to 1.86 in commit
072f3bc8c6 forgot to update the hash of
the license files. The LICENSE-MIT file has changed with the following
diff:

+Copyright (c) The Rust Project Contributors
+

So no change to the license terms.

Fixes:

  https://autobuild.buildroot.net/results/382489b3f5c931451bead7e232af07b70c3e29bb/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 18:46:24 +02:00
Julien Olivain
e9498b4faa support/testing: new dieharder runtime test
Note: this test was not working in Buildroot test infrastructure
before commit [1] was merged, because dieharder has the string "# "
in its output.

[1] 0cad947b96

Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 18:44:56 +02:00
Juan Pablo MONTERO CASTRO
a0b51dd088 board/freescale: imx9-bootloader-prepare.sh: fix cpu name
This commit replaces "a35" occurrences with "a55" in imx9 bootloader
preparation script. i.MX9 families have Cortex-A55 processors. See [1].

This change is purely cosmetic and only for correctness, as the
mkimage_imx8 tool currently uses internally the "a55" identifier as
an alias for "a35". See [2].

[1] https://www.nxp.com/products/processors-and-microcontrollers/arm-processors/i-mx-applications-processors/i-mx-9-processors:IMX9-PROCESSORS
[2] https://github.com/nxp-imx/imx-mkimage/blob/lf-6.6.23-2.0.0/src/mkimage_imx8.c#L773

Signed-off-by: Juan Pablo MONTERO CASTRO <juanpablo.monterocastro@nxp.com>
[Julien: reword a bit and add info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 18:40:22 +02:00
Nikita Kiryushin
f777c79912 package/dbus: set session-socket-dir to /tmp
dbus has a session socket directory configuration setting,
that, if not set, will be autodeducted based on env vars
like TMPDIR during configuration time.

Becuse of that, the builder's environment variables will
lead to an image with a broken session bus while
leaking builder's details to the image.

Add an explicit setting of session-socket-dir to /tmp dir.

Fixes: https://gitlab.com/buildroot.org/buildroot/-/issues/67

Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 18:33:11 +02:00
Peter Korsgaard
82575b3e52 package/sdl2: allow wayland support to be enabled without X11
Commit 4662553088 ("package/sdl2: add wayland support") added an option to
enable wayland support but accidentally put the .mk logic inside the
BR2_PACKAGE_SDL2_X11, so it would only trigger if the X11 driver was
enabled.

Fix that by moving it outside the conditional.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 18:00:58 +02:00
Thomas Devoogdt
4662553088 package/sdl2: add wayland support
This adds a configuration option to enable the Wayland
video driver support in SDL2.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Peter: move after KMS/DRM]
Tested-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 17:17:56 +02:00
Giulio Benetti
b0a703a974 package/rtl8188eu: fix building with Linux 6.14
Add local patch pending upstream to fix build failure with Linux 6.14.

Fixes:
https://autobuild.buildroot.org/results/065b9afc1c6f9f5561547b12171269adc8c12275

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 17:15:08 +02:00
James Hilliard
d0841c007b package/python-charset-normalizer: bump to version 3.4.1
Add new host-python-mypy and host-python-setuptools-scm build
dependencies.

Set --skip-dependency-check due to unnecessarily strict mypy
version limit.

Set CHARSET_NORMALIZER_USE_MYPYC=1 in env so that mypyc optimizations
are enabled.

License hash changed due to year update:
deed20577b

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:56:37 +02:00
James Hilliard
218a17dbc4 package/python-mypy: new package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:55:03 +02:00
James Hilliard
c6924b2331 package/python-mypy-extensions: enable host package
This will be required for the upcoming python-mypy package.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:54:43 +02:00
James Hilliard
253f53a155 package/python-types-setuptools: new host package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:51:09 +02:00
James Hilliard
69ac2100c6 package/python-types-psutil: new host package
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:48:48 +02:00
Thomas Bonnefille
fc827edb65 package/musepack: fix incompatible pointer types
As of GCC14, GCC no longer allows implicitly casting all pointer types
to all other pointer types.

We can fix this error, by adding the appropriate cast.
This patch is a port of a Gentoo patch.

Link: https://gitweb.gentoo.org/repo/gentoo.git/tree/media-sound/musepack-tools/files/musepack-tools-495-incompatible-pointers.patch

Fixes:

    https://autobuild.buildroot.org/results/6412fc37d533dff27f18b09c668870bebff2bec5/

Signed-off-by: Thomas Bonnefille <thomas.bonnefille@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:47:14 +02:00
Marcus Hoffmann
b15cd1d8fe docs/manual/adding-packages-python.adoc: clarify how _BUILD_OPTS work
PYTHON_FOO_BUILD_OPTS are passed to the build module call of the package
build, this allows passing options to the python build *backend* by
using the --config-setting= option. setup.py is no longer involved since
even the setuptools backend now used the pep517 build method.

The note about the options being passed to
support/scripts/pyinstaller.py seems to be no longer accurate.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Arnout: also mention -C (suggested by James)]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:46:57 +02:00
Mika Westerberg
70d5bac305 package/tbtools: bump to version 0.6.0
Update to the latest release of tbtools. For change log, see:
https://github.com/intel/tbtools/compare/v0.5.0...v0.6.0

Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
[Julien: update .hash file to use -cargo3 format]
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 16:43:13 +02:00
Waldemar Brodkorb
f11b9db0b5 package/asterisk: bump to 22.3.0
For a changelog see here:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22.3.0.md

Changes made by the package maintainer:
- add systemd service file
- run asterisk as non-root user asterisk
- build pjsip as bundled source code, but download it like
  sound files
- remove unused configure options
- chan_alsa was removed upstream in commit
  de3ce178ab0282445cf25161b49f3737ac2d20ff

See here for the reason behind using the bundled pjsip:
https://github.com/asterisk/asterisk/issues/671

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 16:42:22 +02:00
Thomas Petazzoni
8a25ff3f89 package/android-tools: add patch to fix GCC 15.x build issue
host-android-tools fails to build when the host gcc version is >=
15.x. A simple patch allows to fix the issue by adjusting how
allocate_inode() gets called.

Fixes:

  https://autobuild.buildroot.org/results/e8152490540ee1968182f4eb7813e5e940f3e9b3/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 16:22:53 +02:00
Marcus Hoffmann
5eb46878bd support/testing: new python-pydantic-settings runtime test
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:53 +02:00
Marcus Hoffmann
45321879e1 support/testing: new python-pydantic runtime test
While in theory, the fastapi tests finds problems with the pydantic
package, it's not obvious that this test should be run when the pydantic
package is updated.

Add a new test that just covers pydantic.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:52 +02:00
Marcus Hoffmann
c100f6a2fe DEVELOPERS: add Marcus Hoffmann for python-pydantic packages
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:51 +02:00
Marcus Hoffmann
3648cec128 package/python-typing-extensions: bump to 4.13.2
Release notes:
https://github.com/python/typing_extensions/blob/main/CHANGELOG.md#release-4132-april-10-2025

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:50 +02:00
Marcus Hoffmann
1126be8fdf package/python-dotenv: bump to 1.1.0
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:50 +02:00
Marcus Hoffmann
cde5e50b73 package/python-pydantic-settings: bump to 2.9.1
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:49 +02:00
Marcus Hoffmann
e1c939e426 package/python-pydantic: bump 2.11.4
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:48 +02:00
Marcus Hoffmann
e42de820cd package/python-pydantic-core: bump to 2.34.1
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Arnout: update hash for cargo3]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:47 +02:00
Marcus Hoffmann
9b6e7bf7ee package/python-typing-inspection: new package
Add python-typing-inspection as a newly introduced dependency of
pydantic.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:46 +02:00
Marcus Hoffmann
0468aae90a package/python-anyio: bump to 4.9.0
Release notes: https://github.com/agronholm/anyio/releases/tag/4.9.0

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:45 +02:00
Marcus Hoffmann
c912dc1d27 package/python-starlette: bump to 0.46.2
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:44 +02:00
Marcus Hoffmann
873e1d658a package/python-fastapi: bump to 0.115.12
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-05-16 16:19:43 +02:00
Thomas Perale
0814b614c2 package/micropython: fix build with GCC 15
A set of `unterminated-string-initialization` errors appeared when
building the micropython package with GCC15 on the host.
The autobuilder failed to build the package micropython with the
following error:

```
CC ../py/emitinlinethumb.c
../py/emitinlinethumb.c:153:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (4 chars into 3 available) [-Werror=unterminated-string-initialization]
  153 |     {0, "r0\0"},
      |         ^~~~~~
../py/emitinlinethumb.c:154:9: error: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (4 chars into 3 available) [-Werror=unterminated-string-initialization]
  154 |     {1, "r1\0"},
      |         ^~~~~~
...
```

This patch adds the set of upstream commits to fix the compatbility with
GCC15 (see [1]).
The patches were backported to micropython v1.22.2. The main difference
with the upstream version is that since the v1.23, the project removed the
use of the `STATIC` macro (see [2]).

Also, in the codebase of v1.22.2 the 'unterminated-string-initialization'
error occured in another file that was reworked in the patch [3] and
included in v1.25. This patch is included as well to remove the error in
v1.22.2.

[1] package/micropython/0003-Fixes-for-GCC-15-1-unterminated-string-literal-warning.patch
[2] decf8e6a8b
[3] package/micropython/0002-py-emitinlinextensa-Simplify-register-name-lookup.patch

Fixes: https://autobuild.buildroot.org/results/fdf/fdf1d7c3e3a51e6fc7fa5abea57de6c9ce792015

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 16:14:32 +02:00
Kadambini Nema
9868ca6ec9 package/libopenssl: bump version to 3.5.0
Release notes:
https://github.com/openssl/openssl/releases/tag/openssl-3.5.0

Changelog:
https://github.com/openssl/openssl/blob/master/CHANGES.md#openssl-35

Rebased patches for the new version.

Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 15:45:33 +02:00
James Hilliard
22cd2e0bc4 package/unifdef: fix build with gcc 15
Add a patch fixing compilation on hosts with gcc 15.

Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:36:13 +02:00
Olivier Benjamin
f5d4ed04ac package/psplash: bump to revision 53ae74a
This includes the following changes:

53ae74a configure.ac: fix autoconf code for img_fullscreen
ec1ed35 configure.ac: standardize default-enabled options
1f64c65 README: Update mailing list to point to yocto-patches ml
b1a75fd psplash: Only define bool if using C standard older than C23
5a32cf6 psplash.c: fix crash from length becoming negative
ecc1913 SECURITY.md: Add file

Signed-off-by: Olivier Benjamin <olivier.benjamin@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:31:48 +02:00
Julien Olivain
2e05f22ff8 configs/freescale_imx93frdm: new defconfig
This commit adds support for the i.MX 93 FRDM (Freedom) board.

The i.MX93 FRDM development board is a low-cost and compact
development board featuring the i.MX93 applications processor.

See: https://nxp.com/FRDM-IMX93

This defconfig is based on freescale_imx93evk_defconfig introduced
by Sébastien, in Cc.

Note: the Linux and U-Boot repositories are forks. This is because
the NXP software team did not included all the necessary i.MX93 FRDM
patches in the standard NXP i.MX BSP at the time of this commit.
Instead, patches were published in a dedicated Yocto Layer from [1].
The forks used in this defconfig are simply the repositories [2]
and [3] with patches from [1] applied on them. This is only to make this
defconfig simpler in the meantime the BSP patches are included in the
NXP BSP repositories.

Thanks to Martin Chabot for lending a board!

[1] https://github.com/nxp-imx-support/meta-imx-frdm
[2] https://github.com/nxp-imx/uboot-imx
[3] https://github.com/nxp-imx/linux-imx

Cc: Martin Chabot <martin.chabot@gmail.com>
Cc: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Tested-by: Julien Olivain <ju.o@free.fr>
[Julien: Tested on board 700-94611 Rev B1]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 15:26:06 +02:00
Thomas Petazzoni
b473d99416 package/libcap: backport upstream patch to fix build on Xtensa
Following the bump of libcap to version 2.76 in commit
e2eb2ee58b, the build started failing on
Xtensa. The bug was reported upstream at
https://bugzilla.kernel.org/show_bug.cgi?id=219915 and was
subsequently fixed by upstream commit:

  https://git.kernel.org/pub/scm/libs/libcap/libcap.git/commit/?id=6cdd8cd72ebcedd6b1b6c989a7e5722d5d87f35c

Which we backport in this commit.

Fixes:

  https://autobuild.buildroot.org/results/b9ff9258f407898eeee80dd8cc4dd1d777f44c06

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 15:12:22 +02:00
Thomas Perale
45439ae262 package/python-flask: security bump to version 3.1.1
Fixes the following security issues:

- CVE-2025-47278: In Flask 3.1.0, the way fallback key configuration was
    handled resulted in the last fallback key being used for signing,
    rather than the current signing key.

For more information, see:
  - https://nvd.nist.gov/vuln/detail/CVE-2025-47278
  - 73d6504063

For more details on the version bump, see the release notes:
  - https://github.com/pallets/flask/releases/tag/3.1.1

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:55:09 +02:00
Marcus Hoffmann
fa5771d975 package/libiio: bump to 0.26
Drop patch that is now merged upstream.

Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:54:02 +02:00
Brandon Maier
0c230eef90 package/mtd: update to 2.3.0
Changelog: https://git.infradead.org/?p=mtd-utils.git;a=blob;f=CHANGELOG.md

The TestMtd build fails with the following error

  checking pkg-config is at least version 0.9.0... ./configure: line
  5375: .../output/TestMtd/host/bin/pkg-config: No such file or
  directory

So we promote host-pkgconf to be a required dependency for the build.

Signed-off-by: Brandon Maier <brandon.maier@collins.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2025-05-16 13:53:18 +02:00
Peter Korsgaard
9a1aaec3f3 package/screen: security bump to version 5.0.1
Fixes the following security issues:

CVE-2025-46805: do NOT send signals with root privileges
CVE-2025-46804: avoid file existence test information leaks
CVE-2025-46803: apply safe PTY default mode of 0620
CVE-2025-46802: prevent temporary 0666 mode on PTYs in attacher
CVE-2025-23395: reintroduce lf_secreopen() for logfile

https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00002.html

For more details, see:
https://security.opensuse.org/2025/05/12/screen-security-issues.html

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
2025-05-16 13:40:17 +02:00
El Mehdi YOUNES
3615b2cd04 package: update all hashes after cargo3 switch
This updates all SHA256 hashes for Rust packages that previously used
cargo2.tar.gz archives, following the switch to cargo3 naming in my last
patch.

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:33 +02:00
El Mehdi YOUNES
b80278613e package/pkg-download: switch from cargo2 to cargo3
Starting from rust 1.84.0 (cargo 1.84.0), published crates now always
include a Cargo.lock file. Originally it was only included for packages
that have executables or examples for use with cargo install. see [1]

This behaviour change alters the contents of the .tar.gz archives,
which causes SHA256 hash mistmatches when trying to build Rust packages.

Example build failure with bat-0.24.0:

ERROR: while checking hashes from package/bat/bat.hash
ERROR: bat-0.24.0-cargo2.tar.gz has wrong sha256 hash:
ERROR: expected: 45fcdd6076dc1b45698a7b6c0f4d1f5d9ae676f3ca3b155402ad24680d5b4df6
ERROR: got     : 28b302b1aa325221796d4ebb25bacab19a8927ef32f4d56a965b32a7b1c102fc

After using the ne hash to download the new archive tar.gz, we have the
difference between the old archive and the new one using diffoscope:
│ │ --rw-r--r--   0        0        0     1529 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/.cargo-checksum.json
│ │ +-rw-r--r--   0        0        0     1609 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/.cargo-checksum.json
│ │ +-rw-r--r--   0        0        0     1766 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/Cargo.lock
│ │  -rw-r--r--   0        0        0     1388 2023-10-11 17:14:12.000000 bat-0.24.0/VENDOR/bincode/Cargo.toml

We can see that Cargo.lock has been added.

To avoid hash mismatch issues and to clearly mark archives generated
with the new Cargo behavior, we migrate the naming from 'cargo2.tar.gz'
to 'cargo3.tar.gz'.

We did not find any alternative to disable this new cargo-publish
behavior, so this change is necessary to allow updating the hashes of
Cargo-fetched packages.

[1] https://github.com/rust-lang/cargo/pull/14815
https://doc.rust-lang.org/nightly/cargo/CHANGELOG.html

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:32 +02:00
El Mehdi YOUNES
072f3bc8c6 package/rust: bump to version 1.86.0
bump rust from version 1.82.0 to 1.86.0
releases:
https://github.com/rust-lang/rust/releases

Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
2025-05-16 13:26:32 +02:00