Commit Graph

77474 Commits

Author SHA1 Message Date
Thomas Petazzoni
dd4299e87a package/avrdude: disable Python support to fix build issues
The build of avrdude sometimes fails with:

avrdude: installs files in /home/autobuild/autobuild/instance-1/output-1/target//home/autobuild/autobuild/instance-1/output-1

This is due to an issue in the installation logic for the Python
code. However, our avrdude.mk doesn't explicitly support building
avrdude's Python support, so it's really only by luck (or lack
thereof) that sometimes host-swig and python3 end up built before
avrdude, causing avrdude to build its Python support, which installs
at the wrong location.

In order to address this, we add a small patch, submitted upstream,
that allows to explicitly disable Python support, which we then use in
avrdude.mk.

The actual Python issue can be investigated at a later point if
someone needs it. But in any case, being able to explicitly disable
Python support if not needed is useful.

Fixes:

  http://autobuild.buildroot.net/results/f18d47289d8b4dee768275a468c25b4f4399cf8c/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d3229d7fa0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:15:17 +02:00
Peter Korsgaard
2b21f3fb35 package/ecryptfs-utils: ssl support needs engines support in openssl
Fixes https://autobuild.buildroot.net/results/f32ae62961aac7e8344f4be109040e7de2eb415e/

The openssl logic in ecryptfs uses the openssl engines API, which is always
available in libressl, but only available in libopenssl when
BR2_PACKAGE_LIBOPENSSL_ENGINES is enabled, leading to build failures when it
is not:

ecryptfs_key_mod_openssl.c: In function 'ecryptfs_openssl_read_key':
ecryptfs_key_mod_openssl.c:305:9: error: implicit declaration of function 'ENGINE_load_builtin_engines' [-Wimplicit-function-declaration]
  305 |         ENGINE_load_builtin_engines();

Fix it by only passing --enable-openssl if libressl or (libopenssl + engines
support) is enabled.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2f309a6e0f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:15:03 +02:00
Peter Korsgaard
1c46bc69e8 package/jose: needs shared libraries
Fixes https://autobuild.buildroot.net/results/bf23e75461877a4ca3a189626f30cf8cde24de36/

Jose unconditionally builds a shared library since v11 with:

 commit b72f8cad002edc87286dd1f2331c359158c512e8
 Author: Rosen Penev <rosenp@gmail.com>
 Date:   Tue May 30 12:18:30 2023 +0300

   jose: build library only as shared (#119)

   Needed because of constructor usage in library.

So add a dependency on BR2_SHARED_LIBS.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f847653144)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:14:42 +02:00
Titouan Christophe
5a5259c640 package/python-flask-cors: security bump to v6.0.1
This is a major version bump, because it could break user code that depends
on the (wrong) previous logic fixed by the new release

See the release notes:
- https://github.com/corydolphin/flask-cors/releases/tag/6.0.0
- https://github.com/corydolphin/flask-cors/releases/tag/6.0.1

This fixes the following vulnerabilities:
- CVE-2024-6839:
    corydolphin/flask-cors version 4.0.1 contains an improper regex path
    matching vulnerability. The plugin prioritizes longer regex patterns
    over more specific ones when matching paths, which can lead to less
    restrictive CORS policies being applied to sensitive endpoints. This
    mismatch in regex pattern priority allows unauthorized cross-origin
    access to sensitive data or functionality, potentially exposing
    confidential information and increasing the risk of unauthorized
    actions by malicious actors.
    https://www.cve.org/CVERecord?id=CVE-2024-6839

- CVE-2024-6844:
    A vulnerability in corydolphin/flask-cors version 4.0.1 allows for
    inconsistent CORS matching due to the handling of the '+' character in
    URL paths. The request.path is passed through the unquote_plus
    function, which converts the '+' character to a space ' '. This
    behavior leads to incorrect path normalization, causing potential
    mismatches in CORS configuration. As a result, endpoints may not be
    matched correctly to their CORS settings, leading to unexpected CORS
    policy application. This can cause unauthorized cross-origin access or
    block valid requests, creating security vulnerabilities and usability
    issues.
    https://www.cve.org/CVERecord?id=CVE-2024-6844

- CVE-2024-6866:
    corydolphin/flask-cors version 4.01 contains a vulnerability where the
    request path matching is case-insensitive due to the use of the
    `try_match` function, which is originally intended for matching hosts.
    This results in a mismatch because paths in URLs are case-sensitive,
    but the regex matching treats them as case-insensitive. This
    misconfiguration can lead to significant security vulnerabilities,
    allowing unauthorized origins to access paths meant to be restricted,
    resulting in data exposure and potential data leaks.
    https://www.cve.org/CVERecord?id=CVE-2024-6866

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 04cd135b26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:14:21 +02:00
Titouan Christophe
25ff8de748 package/imagemagick: security bump to v7.1.2-3
This fixes the following vulnerabilities:
- CVE-2023-5341:
    A heap use-after-free flaw was found in coders/bmp.c in ImageMagick.
    https://www.cve.org/CVERecord?id=CVE-2023-5341

- CVE-2025-55004:
    ImageMagick is free and open-source software used for editing and
    manipulating digital images. Prior to version 7.1.2-1, ImageMagick is
    vulnerable to heap-buffer overflow read around the handling of images
    with separate alpha channels when performing image magnification in
    ReadOneMNGIMage. This can likely be used to leak subsequent memory
    contents into the output image. This issue has been patched in version
    7.1.2-1.
    https://www.cve.org/CVERecord?id=CVE-2025-55004

- CVE-2025-55005:
    ImageMagick is free and open-source software used for editing and
    manipulating digital images. Prior to version 7.1.2-1, when preparing
    to transform from Log to sRGB colorspaces, the logmap construction
    fails to handle cases where the reference-black or reference-white
    value is larger than 1024. This leads to corrupting memory beyond the
    end of the allocated logmap buffer. This issue has been patched in
    version 7.1.2-1.
    https://www.cve.org/CVERecord?id=CVE-2025-55005

- CVE-2025-55160:
    ImageMagick is free and open-source software used for editing and
    manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1,
    there is undefined behavior (function-type-mismatch) in splay tree
    cloning callback. This results in a deterministic abort under UBSan
    (DoS in sanitizer builds), with no crash in a non-sanitized build.
    This issue has been patched in versions 6.9.13-27 and 7.1.2-1.
    https://www.cve.org/CVERecord?id=CVE-2025-55160

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0eefa1095d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:14:11 +02:00
Titouan Christophe
3327d37a97 package/sqlite: add patch for CVE-2025-6965
This fixes the following vulnerability:
- CVE-2025-6965:
    There exists a vulnerability in SQLite versions before 3.50.2 where
    the number of aggregate terms could exceed the number of columns
    available. This could lead to a memory corruption issue. We recommend
    upgrading to version 3.50.2 or above.
    https://www.cve.org/CVERecord?id=CVE-2025-6965

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c4c282f8ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:13:39 +02:00
Titouan Christophe
ea2dad9c9d package/wireshark: security bump to v4.2.13
See the release notes:
- https://www.wireshark.org/docs/relnotes/wireshark-4.2.12.html
- https://www.wireshark.org/docs/relnotes/wireshark-4.2.13.html

This fixes the following vulnerability:
- CVE-2025-5601:
    Column handling crashes in Wireshark 4.4.0 to 4.4.6 and 4.2.0 to
    4.2.12 allows denial of service via packet injection or crafted
    capture file
    https://www.cve.org/CVERecord?id=CVE-2025-5601

Also update hash for COPYING because of Wireshark commit
614add27f29269e681e4d32138bea4951985fe0a that changes the FSF address

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 891ec88b6d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:13:25 +02:00
Giulio Benetti
21a6c98ac4 package/udisks: security bump to version 2.10.2
This fixes this security bug:
https://github.com/storaged-project/udisks/security/advisories/GHSA-742q-gggc-473g

Release notes:
https://github.com/storaged-project/udisks/releases/tag/udisks-2.10.2

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f55145837e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:07:43 +02:00
Titouan Christophe
4d0919498b package/mosquitto: fix build failure with recent glibc
Fix link-time build failures because glibc>=2.34 no longer ships libanl.so
as it has been consolidated into libc.

See the inner patch message for more details.

Fixes: https://autobuild.buildroot.org/results/16223cd838876abc9b6f941f7dc20d23afa32c3b/

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a49354e46f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:03:38 +02:00
Peter Korsgaard
3394bb0ff9 package/mbpfan: fix build on musl / uclibc-ng
Fixes https://autobuild.buildroot.net/results/9526503fe8e756bd4444f1fb1e9cf1391c461901/

mbpfan uses vsyslog(), which is not in POSIX so only exposed by <syslog.h>
on musl and uclibc-ng if we define _DEFAULT_SOURCE:

https://git.musl-libc.org/cgit/musl/tree/include/syslog.h#n64
https://cgit.uclibc-ng.org/cgi/cgit/uclibc-ng.git/tree/include/sys/syslog.h#n200

Add a patch submitted upstream to do this.

[Peter: add patch rather than passing _DEFAULT_SOURCE in mbpfan.mk]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 759a08633e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-11 17:03:37 +02:00
Arnout Vandecappelle
6360671c28 Makefile: update for 2025.02.6
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025.02.6
2025-09-09 21:27:43 +02:00
Thomas Perale
a1175b19ee CHANGES: update for 2025.02.6
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Arnout: reorder, summarize infrastructure updates]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-09-09 21:26:23 +02:00
Thomas Perale
2d5c298d5a package/iperf3: add patch to fix CVE-2025-54350
Fixes the following vulnerability:

    In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion
    failure and application exit upon a malformed authentication attempt.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-54350
  - 4eab661da0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-09-08 12:37:53 +02:00
Thomas Perale
7172f0642c package/iperf3: add patch to fix CVE-2025-54349
Fixes the following vulnerability:

- CVE-2025-54349

    In iperf before 3.19.1, iperf_auth.c has an off-by-one error and
    resultant heap-based buffer overflow.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-54349
  - 4e5313bab0

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-09-08 12:37:31 +02:00
Thomas Perale
633f0731e1 package/ipset: fix build w/ musl
When building ipset with musl libc the following error appeared on the
autobuilder in 2025.02.x:

```
ipset.c: In function 'main':
ipset.c:35:21: error: implicit declaration of function 'basename' [-Wimplicit-function-declaration]
   35 |         if (!strcmp(basename(argv[0]), "ipset-translate")) {
      |                     ^~~~~~~~
ipset.c:35:21: error: passing argument 1 of 'strcmp' makes pointer from integer without a cast [-Wint-conversion]
   35 |         if (!strcmp(basename(argv[0]), "ipset-translate")) {
      |                     ^~~~~~~~~~~~~~~~~
      |                     |
      |                     int
In file included from ipset.c:13:
```

This error can be reproduced with:

```
cat >.config <<EOF
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_MUSL_BLEEDING_EDGE=y
BR2_PACKAGE_IPSET=y
EOF
make olddefconfig
make ipset
```

This patch adds the upstream commit [1], that fixes this issue by
including explicitly `libgen.h`. This patch is part of the master
branch since commit [2].

[1] https://git.netfilter.org/ipset/commit/?id=316f592ddc547c28388da4e7cb7c5c8f89cd3591
[2] 8fdbbefa08 package/ipset: bump to version 7.23

Fixes: https://autobuild.buildroot.org/results/930/930802ecc324c4cfc697191aa6a68642a4188e7b
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2025-09-08 12:36:55 +02:00
Thomas Perale
cd32013c57 package/cpp-httplib: add patch for CVE-2025-46728
Fix the following vulnerability:

- CVE-2025-46728

    cpp-httplib is a C++ header-only HTTP/HTTPS server and client library.
    Prior to version 0.20.1, the library fails to enforce configured size
    limits on incoming request bodies when `Transfer-Encoding: chunked` is
    used or when no `Content-Length` header is provided. A remote attacker
    can send a chunked request without the terminating zero-length chunk,
    causing uncontrolled memory allocation on the server. This leads to
    potential exhaustion of system memory and results in a server crash or
    unresponsiveness. Version 0.20.1 fixes the issue by enforcing limits
    during parsing. If the limit is exceeded at any point during reading,
    the connection is terminated immediately. A short-term workaround
    through a Reverse Proxy is available. If updating the library
    immediately is not feasible, deploy a reverse proxy (e.g., Nginx,
    HAProxy) in front of the `cpp-httplib` application. Configure the
    proxy to enforce maximum request body size limits, thereby stopping
    excessively large requests before they reach the vulnerable library
    code.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-46728
  - 7b752106ac

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
(cherry picked from commit aea7c89396)
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fd313c4ceb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:20:13 +02:00
Thomas Petazzoni
3a5940bc46 support/testing: use again the default BR2_BACKUP_SITE
This reverts commit 559bb33ae7, which
was disabling BR2_BACKUP_SITE in our tests with the following
reasoning:

    support/testing: do not use s.b.o

    Currently, the runtime tests will use the sources.buildroot.org backup
    mirror, which is the default setup.

    However, in some cases we do not want to use the backup site, because we
    want to ensure that the download actually works.

    This is the case for vendored packages, like cargo or golang packages,
    for whbich we want to check that gthe download still works when we
    update the rust or go versions, or when our download helpers change.

    So, disable the use of the backup site in all runtime tests, and drop
    the no-longer needed special cases.

    Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
    Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>

However, not using the backup site is causing a LOT of random failures
in Gitlab CI, making the results barely usable. Since it's more
important to get real failures than random ones due to download
issues, let's re-enable BR2_BACKUP_SITE in our testing infrastructure.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit d26f371758)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:20:04 +02:00
Julien Olivain
f54e0595fb support/testing: test_systemd_selinux: fix test after bootlin toolchains update
Since Buildroot commit [1] "update to Bootlin toolchains 2025.08-1",
the tests.init.test_systemd_selinux fails when building its
Kernel 6.1.26 with gcc 15.1.0.

This commit fixes the issue by updating the test Kernel to the
latest 6.1.y version (6.1.148 at the time of this commit) which
includes several fixes for gcc-15 like this one [2].

Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/10984685949
https://gitlab.com/buildroot.org/buildroot/-/jobs/10984685950

[1] 947dbc92a2
[2] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=0f82f6f1556389d6489795f03ac3f68cde99d5ad

Signed-off-by: Julien Olivain <ju.o@free.fr>
[Romain: Add a link to one of the kernel commit related to gcc-15]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit 8d6f9393ec)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:19:46 +02:00
Thomas Petazzoni
81c94c0d93 package/weston: jpeg support needs jpeg-turbo
Since upstream commit 312efb2acba7dba80b6652ccf98339dcbbd47695, the
JPEG loading code is using jpeg_read_icc_profile(), which is only
available when the jpeg-turbo implementation is used, not the classic
libjpeg. When classic jpeg is used, the build fails with:

../shared/image-loader.c:163:14: error: implicit declaration of function 'jpeg_read_icc_profile' [-Wimplicit-function-declaration]
  163 |         if (!jpeg_read_icc_profile(cinfo, &profdata, &proflen)) {

This commit first appeared in development version 13.0.91 and stable
version 14.0.0, which means the problem exists in Buildroot since
commit 430b80cfc1, when weston was
bumped from 13.0.3 to 14.0.0.

So let's enable the JPEG logic only when jpeg-turbo is used.

Fixes:

  https://autobuild.buildroot.org/results/353e39902616bdbce40ac667e98cbaf51079f69e/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f74f7d4a03)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:19:31 +02:00
Thomas Petazzoni
39615bc272 package/weston: do not select JPEG, no longer needed
Since upstream commit 66e1614122c22d455cc3a28db08b3afac2b7be29, which
first appeared in version 1.11.0, back in 2016, jpeg is no longer a
mandatory dependency. And in fact, Buildroot no longer has it
unconditionally in WESTON_DEPENDENCIES since commit
f67a6e9b7a, but BR2_PACKAGE_WESTON is
still selecting in.

A build without libjpeg works just fine, so let's drop this select.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c8edd532c2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:19:20 +02:00
Henri Roosen
7e83660cae package/wpewebkit: needs host-cmake >= 3.20
Since commit-2882cf4ae649 ("package/wpewebkit: security bump to version
2.48.3") wpewebkit depends on cmake 3.20.
Fixes build on current Debian LTS (bullseye) which has only 3.18.4.

>>> wpewebkit 2.48.3 Configuring
...
CMake Error at CMakeLists.txt:9 (cmake_minimum_required):
  CMake 3.20 or higher is required.  You are running version 3.18.4
-- Configuring incomplete, errors occurred!
make: *** [package/pkg-generic.mk:263: /../buildroot/output/build/wpewebkit-2.48.3/.stamp_configured] Error 1

Fixes: 2882cf4ae6
Signed-off-by: Henri Roosen <henri.roosen@ginzinger.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ad75a5d478)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:17:16 +02:00
Thomas Petazzoni
5d35b11416 package/sdl: improve existing patches
- Replace patch 0001 by a properly Git-formatted patch, cherry-picked
  from the upstream Git repository at
  https://github.com/libsdl-org/SDL-1.2

- Add Upstream: tags on both patches, with the upstream Git
  commit. Updated .checkpackageignore accordingly.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit da3996a39d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:16:56 +02:00
Thomas Petazzoni
4bcb1ed67a package/liblog4c-localtime: fix build with GCC 15.x
Add simple patch, submitted upstream, to fix the build with GCC 15.x:

userloc_formatter.c: In function 'userloc_format':
userloc_formatter.c:30:5: error: implicit declaration of function 'sd_debug' [-Wimplicit-function-declaration]
   30 |     sd_debug("Formatter s13_userloc checking location info for userdata %X",a_event->evt_loc->loc_data);
      |     ^~~~~~~~
make[4]: *** [Makefile:519: userloc_formatter.lo] Error 1

Fixes:

  https://autobuild.buildroot.org/results/dab64025e6a1688d5fadc2b9bd3738a2c886aa9c/

Considering the level of upstream maintenance, we did hesitate with
dropping the package, but as the fix was quite simple, we did the fix
instead.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 41463deed4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:15:53 +02:00
Peter Korsgaard
879dcc6930 package/proftpd: bump to version 1.3.8d
Bugfix release, fixing the following issues:

1.3.8d - Released 14-Mar-2025
--------------------------------
- Issue 1855 - Use of HideNoAccess for SFTP sessions can lead to segfault
  and/or unexpected behavior.
- Issue 1876 - SFTP channel allocations can lead to high memory utilization
  over time.

1.3.8c - Released 11-Dec-2024
--------------------------------
- Issue 1770 - Using FTPS after upgrading from 1.3.8a to 1.3.8b leads to crash.
- Issue 1785 - Bad handling of lack of extended attributes leads to SFTP out of
  memory error.
- Issue 1529 - mod_sftp_sql logs "header value too long" due to unexpected key
  header text.
- Issue 1839 - SSH ECDSA host key algorithms not be used as expected despite
  configuring appropriate key.
- Issue 1840 - RADIUS Message-Authenticator verification failed with ProFTPD
  mod_radius.
- Issue 1830 - Supplemental group inheritance grants unintended access to
  GID 0 due to lack of supplemental groups from mod_sql.

https://github.com/proftpd/proftpd/blob/1.3.8/NEWS

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 90be04d4d3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:15:35 +02:00
Thomas Petazzoni
352e838ed9 configs/ci20: U-Boot needs host-openssl
Very likely since the bump of U-Boot from 2020.07 to 2024.01 in commit
dedb7dc6d6, U-Boot needs host-openssl,
so let's add the necessary dependency.

With this change ci20_defconfig builds again:

  https://gitlab.com/tpetazzoni/buildroot/-/jobs/11054480107

Fixes:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11012273114

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2c6a292b93)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:15:11 +02:00
Michael Trimarchi
fdb09610b7 configs/imx6ulz_bsh_smm_m2_defconfig: Fix processor VFP
imx6ull is compatible with VFPV4. Update it from VFPV3

Signed-off-by: Michael Trimarchi <michael@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a9d487ae5d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:14:46 +02:00
Thomas Petazzoni
1d9340709c configs/kontron_pitx_imx8m: remove defconfig, broken
This defconfig no longer builds:

  https://gitlab.com/buildroot.org/buildroot/-/jobs/11012273666

It has been broken for over 2 months:

  https://gitlab.com/buildroot.org/buildroot/-/jobs?name=T%3Dkontron_pitx_imx8m&kind=BUILD

Unless a fix is provided, this defconfig will be removed.

Cc: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-By: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a80b13fc63)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:10:00 +02:00
Thomas Petazzoni
4ad84775e8 configs/{canaan_kd233, sipeed*}: use BR2_LINUX_KENREL_IMAGE_TARGET_NAME
Since commit cb4f11a696 ("linux: handle
empty BR2_LINUX_KERNEL_IMAGE_TARGET_NAME situation"), we error out if
BR2_LINUX_KERNEL_IMAGE_TARGET_CUSTOM=y but
BR2_LINUX_KERNEL_IMAGE_TARGET_NAME is empty, which is exactly the case
of the RISC-V configurations being fixed by this commit.

They define the BR2_LINUX_KERNEL_IMAGE_NAME variable, but not
BR2_LINUX_KERNEL_IMAGE_TARGET_NAME, while BR2_LINUX_KERNEL_IMAGE_NAME
will automatically default to BR2_LINUX_KERNEL_IMAGE_TARGET_NAME if
BR2_LINUX_KERNEL_IMAGE_NAME is not provided.

It probably used to work because specifying an empty make target was
generating the right images, and they did have the name specified in
BR2_LINUX_KERNEL_IMAGE_TARGET_NAME. But with the additional check
added in cb4f11a696 this scenario is no
longer supported.

Fixes:

              canaan_kd233 | https://gitlab.com/buildroot.org/buildroot/-/jobs/11012273088
           sipeed_maix_bit | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771237
    sipeed_maix_bit_sdcard | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771342
          sipeed_maix_dock | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771387
   sipeed_maix_dock_sdcard | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771472
            sipeed_maix_go | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771505
     sipeed_maix_go_sdcard | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771581
          sipeed_maixduino | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771663
   sipeed_maixduino_sdcard | https://gitlab.com/buildroot.org/buildroot/-/jobs/11026771885

Cc: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 070d91ed04)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:09:47 +02:00
Thomas Petazzoni
b014d18e92 linux: enable BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL on a few more architectures
This commit is an extension of
5dae966a30 ("linux: select
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL when needed"), which solves
autobuilder issues by making sure that
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL is automatically enabled on some
architecture if the default architecture defconfig is used and the
latest kernel is built (which is what happens in the autobuilders).

This new commit adds BR2_or1k and BR2_riscv to the list to fix
autobuilder issues.

Fixes:

  https://autobuild.buildroot.org/results/1a739eee39bdef8986279a9e21f8637fbe263353/ (or1k)
  https://autobuild.buildroot.org/results/acb62b7a486f3f8e99c6cc2b52b0c259bfa18a0e/ (riscv)

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e002ec3773)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:09:17 +02:00
Peter Seiderer
8195355256 package/ell: bump version to 0.79
Changelog (see [1]):

  ver 0.79:
    Fix issue with D-Bus client and watch removal handling.
    Fix issue with D-Bus client and service name handling.
    Fix issue with D-Bus proxy and filter rule handling.

  ver 0.78:
    Fix issue with random ECC scalar generation.

  ver 0.77:
    Add support for precheck feature for unit tests.
    Add support for license variable for pkg-config.

  ver 0.76:
    Fix issue with random scalar generation.

  ver 0.75:
    Add support for converting OID octets to strings.
    Add support for NIST P-224 cuve usage with ECDH.
    Add support for NIST P-521 cuve usage with ECDH.
    Add support for SHA-3 series of hashing algorithms.

  ver 0.74:
    Add support for NIST P-192 curve usage with ECDH.
    Add support for SHA-224 based checksums and HMACs.

  ver 0.73:
    Fix issue with parsing hwdb.bin child structures.

  ver 0.72:
    Add support for the Test Anything Protocol.

  ver 0.71:
    Fix issue with GCC 15 and -std=c23 build errors.

  ver 0.70:
    Add support for helper function for safe memcpy.

[1] https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ChangeLog?h=0.79

Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e834d23cd7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2025-09-05 17:08:13 +02:00
Peter Korsgaard
9fe028b53d package/ipmitool: move to codeberg
The github repo was deleted and moved to codeberg, so use that instead:

https://lwn.net/Articles/926101/

It is unclear if the auto generated tarballs from codeberg are reproducible,
so instead fetch through git.

[Peter: set _CPE_ID_VERSION to the correct value]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c7af01f47a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Peter Korsgaard
b1be77a1e8 package/squid: bump to version 6.14
Bufix release fixing a number of issues:

- Bug 5352: Do not get stuck in RESPMOD after pausing peer read(2)
- Bug 5489: Fix "make check" linking on Solaris
- Fix SNMP cacheNumObjCount -- number of cached objects
- Do not duplicate received Surrogate-Capability in sent requests
- Fix Mem::Segment::open() stub to fix build without shm_open()
- ... and CI and documentation updates

https://github.com/squid-cache/squid/releases/tag/SQUID_6_14

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7c47e8b1b2)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Peter Korsgaard
65c245324d package/python-h2: security bump to version 4.3.0
Fixes the following security vulnerability:

- CVE-2025-57804: HTTP/2 request splitting via CRLF injection

  https://github.com/python-hyper/h2/security/advisories/GHSA-847f-9342-265h

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2389965eaf)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Vincent Stehlé
9ecc8d0abf configs/qemu_{arm,aarch64}_{ebbr,sbsa}*: linux needs host python3
Since Buildroot commit [1] updating qemu defconfigs from Kernel 6.6.32
to 6.12.9, qemu_aarch64_ebbr_defconfig, qemu_aarch64_sbsa_defconfig
and qemu_arm_ebbr_defconfig can fail to build with error:

    /bin/sh: 1: python3: not found
    make[7]: *** [drivers/gpu/drm/msm/Makefile:182: drivers/gpu/drm/msm/generated/a2xx.xml.h] Error 127

The issue can happen on build hosts without Python, and if the Linux
kernel is built before any package having host-python3 in its
dependencies (e.g. host-qemu, optee-os, ...).

Starting with Linux 6.10, the arm and arm64 architecture defconfigs need
python3 to build. [2]

This commit fixes this issue by adding
BR2_LINUX_KERNEL_NEEDS_HOST_PYTHON3=y in those defconfigs.

[1] 44075c1955
[2] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=0fddd045f88e34d6160785a3a5e506d374566454

Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Romain Naour <romain.naour@gmail.com>
[Julien:
 - reword commit log to add the commit introducing the issue
 - fix qemu_aarch64_sbsa_defconfig which has the same issue
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6001601544)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Perale
2ec463fa2f package/go: fix CPE id
This patch fixes the CPE ID for both go-bin and go-src packages.

The go-src package did had a CPE ID because GO_SRC_CPE_ID_VENDOR is
defined but the generated CPE ID would be the following:

cpe:2.3:a:golang:go-src:*:*:*:*:*:*:*:*

The CPE product go-src doesn't match to anything and should be 'go'
instead.

For go-bin no CPE_ID variable were defined so no CPE ID would be
generated if using a pre-build toolchain.

This patch duplicate the definition of the CPE_ID variables, I didn't
put the definition in the 'package/go/go.mk' file to avoid generate a
CPE for the go virtual package.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1869b4065c)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Peter Korsgaard
427fbd3af6 package/libcap-ng: disable pthread support on nommu
Fixes: https://autobuild.buildroot.net/results/9c40c86a42882a6d56eb6d6d1418781a980b6f8f/

The pthread support uses pthread_atfork(), which is not available on nommu:

cap-ng.c: In function 'init_lib':
cap-ng.c:225:9: error: implicit declaration of function 'pthread_atfork';
  did you mean 'pthread_join'?  [-Wimplicit-function-declaration]

So disable pthread support on nommu to fix that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 59fe7547a4)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Peter Korsgaard
9c5aeac0c4 package/vde2: fix build w/ gcc-15
Fixes: https://autobuild.buildroot.net/results/8d14173f31922a737c326be75aa24c9f9471342a/

The vde2 source code uses empty argument function pointer prototypes like:

typedef ssize_t (* ssize_fun)();
extern ssize_fun vdehist_vderead;

In C17 and earlier, such prototypes means unknown number of arguments,
whereas with C23 it means no arguments, leading to build failures:

libvdehist.c:39:27: error: initialization of 'ssize_fun' {aka 'long int
  (*)(void)'} from incompatible pointer type 'ssize_t (*)(int,  void *,
  size_t)' {aka 'long int (*)(int,  void *, long unsigned int)'}
  [-Wincompatible-pointer-types]

Workaround it using -std=gnu99.  Vde2 is provided both as a host and target
package, so do this unconditionally for both.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 2218f02155)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Waldemar Brodkorb
0f0fe331ff package/uclibc: fix grub2 compilation
Fixes:
 https://autobuild.buildroot.org/results/7a4/7a4d0f0571cd0cef1c87f3ef207618de72c1c78c/build-end.log

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 08a1e10fbe)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Devoogdt
13de70b4b4 package/lighttpd: security bump to 1.4.81
News:
- https://www.lighttpd.net/2025/8/13/1.4.80/
  - detect and issue error trace for HTTP/2 MadeYouReset VU#767506 CVE-2025-8671
- https://www.lighttpd.net/2025/8/17/1.4.81/
  - security: fix to reject disallowed trailers

See Changes from 1.4.79:

[build] remove references to libev; no longer used

So drop here as well.

Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit 0d643a8636)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Neal Frager
ba1b5c41ce board/zynqmp: increase vfat partition to 64M
Now that the qspi.bin file is included for zynqmp images, the 32M vfat
partition is getting dangerously close to being full.

In the process of bumping Linux kernel 6.12.10 to 6.12.40, the size of the
default Linux kernel Image file for zynqmp products is increasing from 23.4M
to 26.9M. This is leaving less than 1M of free space in the vfat partition
meaning users may unknowingly exceed the 32M size by just adding Linux kernel
configs.

To avoid potential problems, this patch doubles the size of the vfat partition
to 64M, which should be plenty of space for any configuration.

Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit c7a45b8302)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Gero Schwäricke
89f5bf0406 utils/bump-stable-kernel-versions: new tool
This tool helps to update Linux stable releases.

The script uses the versions found in linux/linux.hash. For each of the
versions it downloads the related hash list and tries to find an updated
stable release. If found it updates all related files and hashes.

Signed-off-by: Gero Schwäricke <gero.schwaericke@grandcentrix.net>
[Arnout: commonalize the sed expression for linux and linux-headers]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
(cherry picked from commit a87b1800b9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Peter Korsgaard
18809021cc package/unbound: mark CVE-2025-5994 as not applicable
Unbound is vulnerable to CVE-2025-5994: "Cache poisoning via the ECS-enabled
Rebirthday Attack" if built with --enable-subnet, which is not the case in
Buildroot, so mark it as not applicable.

https://nlnetlabs.nl/downloads/unbound/CVE-2025-5994.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c7721b0174)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
575465c786 package/ffmpeg: add optional support for libsoxr
Now that libsoxr no longer depends on ffmpeg, we can actually use
libsoxr in ffmpeg.

See:

  https://trac.ffmpeg.org/wiki/FFmpeg%20and%20the%20SoX%20Resampler

for some details.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c719a73a21)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
25cc2a6f5b Reapply "package/ffmpeg: add support for pulseaudio"
This reverts commit fecc337d21,
re-adding optional support for pulseuadio in ffmpeg.

This is possible now that the circular dependency:

  pulseaudio -> libsoxr -> ffmpeg -> pulseaudio

has been broken between libsoxr and ffmpeg.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8db836d292)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
8761f5ed7b package/libsoxr: drop ffmpeg support
Having support for ffmpeg in libsoxr causes several circular
dependencies:

- pulseaudio -> libsoxr -> ffmpeg -> pulseaudio

  (This one was worked around in
  fecc337d21 by dropping the ffmpeg ->
  pulseaudio dependency, but it's annoying as being able to output
  audio from ffmpeg into pulseaudio seems useful)

- libopenmpt -> pulseaudio -> libsoxr -> ffmpeg -> libopenmpt

  (This is one exists, and is fixed by this commit)

To fix both circular dependencies, we propose to drop the dependency
of libsoxr on ffmpeg, which is used to get some optimized FFT
implementation. While not being useless, this is the point where
breaking the dependency seems the most logical.

Neither Debian nor Fedora build libsoxr with ffmpeg support.

In order to achieve that, we add a new patch making the option
WITH_AVFFT actually effective. Since we no longer build against
ffmpeg, the previously added patch that was fixing the pkg-config file
is no longer needed.

Fixes:

  https://autobuild.buildroot.net/results/bbfce69f35cafd56245ebeae79086a8b64592a16/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4bf2a854f9)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
82ba9e3547 package/libsvgtiny: add patch to fix GCC 15.x build issue
Add a small, easily backportable patch to fix GCC 15.x build
issue. The issue is also fixed upstream in later releases, but this
patch is a minimal fix that can be backported to LTS independently
from a version bump.

Fixes:

  https://autobuild.buildroot.org/results/c3d703663faabe40448d908afbdbb351a016aece/

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6fdebc54b3)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Fiona Klute (WIWA)
66af5b9914 package/pkg-utils.mk: include package directory in show-info output
The new package_dir element contains the path of the package
directory. For Buildroot packages this is a path relative to the main
Buildroot directory, for packages from external trees an absolute
path.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Tested-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit b10f50399a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Titouan Christophe
d63f8ad6ad {linux, linux-headers}: bump 6.12.x, 6.6.x, 6.1.x, 5.15.x, 5.10.x, 5.4.x series
Update the latest kernel releases to:
 - 6.12.41 -> 6.12.44
 - 6.6.101 -> 6.6.103
 - 6.1.147 -> 6.1.149
 - 5.15.189 -> 5.15.190
 - 5.10.240 -> 5.10.241
 - 5.4.296 -> 5.4.297

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
4a2f2973e3 package/mariadb: explicitly disable the column store plugin
Building the column store plugin (which gets automatically enabled
when Boost with a bunch of submodules is found) currently fails as it
requires a number of runtime checks that obviously cannot work when
cross-compiling.

OpenEmbedded has defined them as such:

  -DLSTAT_FOLLOWS_SLASHED_SYMLINK_EXITCODE=0 \
  -DSTAT_EMPTY_STRING_BUG_EXITCODE=0 \
  -DMASK_LONGDOUBLE_EXITCODE=0 \

but it really isn't clear whether those values are completely correct
for all CPU architectures, especially the last one.

So instead, let's disable the column store plugin until someone
actually needs it and figures out how to set those variables properly.

The issue fixed by this commit can be reproduced using the following
defconfig:

BR2_aarch64=y
BR2_ARM_FPU_VFPV3D16=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_PACKAGE_MARIADB=y
BR2_PACKAGE_MARIADB_SERVER=y
BR2_PACKAGE_BOOST=y
BR2_PACKAGE_BOOST_DATE_TIME=y
BR2_PACKAGE_BOOST_FILESYSTEM=y
BR2_PACKAGE_BOOST_REGEX=y
BR2_PACKAGE_BOOST_THREAD=y

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 44bba49507)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00
Thomas Petazzoni
2fdc74add5 package/mariadb: fix sub-option indentation
The Config.in comment is between the main BR2_PACKAGE_MARIADB option
and its sub-options, causing the sub-options to not appear as nicely
indented in menuconfig.

Before:

[ ] mariadb
[ ] mariadb server
  [ ] mariadb embedded server

After:

[ ] mariadb
  [ ] mariadb server
    [ ] mariadb embedded server

which is what we want.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8964f0652c)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
2025-09-04 13:57:24 +02:00