Commit Graph

57352 Commits

Author SHA1 Message Date
Fabrice Fontaine
eb8a37154b package/speex: add SPEEX_CPE_ID_VENDOR
cpe:2.3:a:xiph:speex is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Axiph%3Aspeex

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c84cd8b1d1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:20:29 +01:00
Joachim Wiberg
fb8409fb83 DEVELOPERS: add Joachim Wiberg as maintainer for inadyn
Upstream maintainer, now also maintainer in Buildroot.

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit afdd3b2afc)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:19:46 +01:00
Fabrice Fontaine
1bee81455b package/unixodbc: add UNIXODBC_CPE_ID_VENDOR
cpe:2.3:a:unixodbc:unixodbc is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aunixodbc%3Aunixodbc

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 764176324e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:19:25 +01:00
Fabrice Fontaine
74426950e5 package/unrar: add UNRAR_CPE_ID_VENDOR
cpe:2.3:a:rarlab:unrar is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Ararlab%3Aunrar

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ba9ca16b33)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:19:23 +01:00
Fabrice Fontaine
d68fbd7314 package/util-linux/util-linux-libs: add CPE variables
cpe:2.3:a:kernel:util-linux is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Akernel%3Autil-linux

Inherit the values from util-linux; they really are, and have to be,
the same.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: inherit values from util-linux]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bfe518b068)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:18:39 +01:00
Yann E. MORIN
2b92adc6d6 core/show-info: 'name' only applies to packages
Commit 0cfa165948 (package/pkg-utils.mk: introduce "name" field in
show-info output) did what it said, but did so in the generic show-info
part, thus it was also added to filesystems (rootfs), the other kind of
entity that show-info reports on.

Only packages have a "name"; filesystems do not. Instead, they already
have an 'image_name'.

Move the 'name' field to the package-related part of show-info.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 471ecea5ee)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:15:47 +01:00
Yann E. MORIN
82db9f487f Makefile: really comment syntax colouring
The unmatched escaped single-quote lies in the middle of a few
function calls, so they too must be fake-closed to properly fix
colour highlighting in some editors.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit cba51c7f5a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:14:31 +01:00
Yann E. MORIN
cd815834d7 core/pkg-generic: also list files installed in images/
Some packages install nothing in target nor staging, but install images
(like the kernel vmlinux, or a bootloader boot blob...)

If we want to appropriately account for the files installed by each
package, we also need to take images/ into account.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Cc: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5d00fecb7d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:13:36 +01:00
Yann E. MORIN
138328309d support/dependencies: avoid spurious warning on print-vars
When calling 'printvars', the 'suitable-host-package' macro is printed
(a macro is just a variable like the others, after all, just with some
parameters). Because it is printed as a variable, it is missing its
parameters, but it still tries to evaluate the $(shell) construct.

This causes spurious warning:

    make[1]: support/dependencies/check-host-.sh: Command not found

Only try and call the script if there is actually a tool to check for.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 77304e5143)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:12:38 +01:00
Yann E. MORIN
abf7c453d8 core/show-info: report build_dir relative to CONFIG_DIR
Currently, the build_dir field is reported relative to $(BASE_DIR), to
avoid leaking local paths.

However, BASE_DIR is not a directory that is very convenient: for
in-tree builds, it is $(CONFIG_DIR)/output/, while for out-of-tree
builds, it is $(CONFIG_DIR). This difference is purely an idiosyncracy
of how out-of-tree builds have been implemented in Buildroot, and is
not under the control of the user.

What the user is in control of, however, is where the .config file is
located. This, really, is the directory we should base relative paths
on.

Reported-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 76c4df324d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:08:27 +01:00
Fabrice Fontaine
2436f0d75c package/janus-gateway: fix CVE-2021-4020
Fix CVE-2021-4020: janus-gateway is vulnerable to Improper
Neutralization of Input During Web Page Generation ('Cross-site
Scripting')

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 99d2826e03)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:06:12 +01:00
Fabrice Fontaine
36509594f4 package/janus-gateway: bump to version 0.10.10
https://github.com/meetecho/janus-gateway/blob/v0.10.10/CHANGELOG.md

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ed6e6ebdf3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 23:05:50 +01:00
Fabrice Fontaine
64dcd86ccf Revert "package/coreutils: ignore CVE-2013-0221, CVE-2013-0222, CVE-2013-0223"
This reverts commit 8ae9156d8b as those
CVEs are not tagged as affecting gnu:coreutils in NVD NIST database but
opensuse:opensuse and redhat:entreprise_linux:
- https://nvd.nist.gov/vuln/detail/CVE-2013-0221
- https://nvd.nist.gov/vuln/detail/CVE-2013-0222
- https://nvd.nist.gov/vuln/detail/CVE-2013-0223

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7d569f5191)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:34:04 +01:00
Fabrice Fontaine
12f767975f package/netdata: add NETDATA_CPE_ID_VENDOR
cpe:2.3:a:netdata:netdata is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Anetdata%3Anetdata

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 349159c439)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:32:21 +01:00
Fabrice Fontaine
d0f503d510 package/mxml: add CPE variables
cpe:2.3:a:mini-xml_project:mini-xml is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amini-xml_project%3Amini-xml

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2d2888c7c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:32:11 +01:00
Fabrice Fontaine
2ecd44f615 package/motion: add MOTION_CPE_ID_VENDOR
cpe:2.3:a:motion_project:motion is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amotion_project%3Amotion

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit d5d5d55933)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:31:49 +01:00
Fabrice Fontaine
457f0f20b2 package/libnspr: add CPE variables
cpe:2.3:a:mozilla:netscape_portable_runtime is a valid CPE identifier
for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amozilla%3Anetscape_portable_runtime

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit fffd2aade6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:31:34 +01:00
Fabrice Fontaine
28bcbbbc21 package/libhtp: add LIBHTP_CPE_ID_VENDOR
cpe:2.3:a:oisf:libhtp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Aoisf%3Alibhtp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 44048a09c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:30:06 +01:00
Fabrice Fontaine
ed743d1f4a package/libgdiplus: add LIBGDIPLUS_CPE_ID_VENDOR
cpe:2.3:a:mono-project:libgdiplus is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amono-project%3Alibgdiplus

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 68e1a88ab9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:29:58 +01:00
Fabrice Fontaine
2cc1ee34fe package/libffi: add LIBFFI_CPE_ID_VENDOR
cpe:2.3:a:libffi_project:libffi is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alibffi_project%3Alibffi

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 72125334ba)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:29:30 +01:00
Fabrice Fontaine
d02928594e package/libbson: add LIBBSON_CPE_ID_VENDOR
cpe:2.3:a:mongodb:libbson is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amongodb%3Alibbson

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 8d23efce28)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:29:28 +01:00
Fabrice Fontaine
9f8061560e package/guile: add GUILE_CPE_ID_VENDOR
cpe:2.3:a:gnu:guile is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnu%3Aguile

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 7e649e705a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:28:24 +01:00
Fabrice Fontaine
3db9cf6e0e package/gupnp: add GUPNP_CPE_ID_VENDOR
cpe:2.3:a:gnome:gupnp is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Agnome%3Agupnp

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6c3122b85a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:28:10 +01:00
Fabrice Fontaine
6fdd72cb89 package/freeswitch: add FREESWITCH_CPE_ID_VENDOR
cpe:2.3:a:freeswitch:freeswitch is a valid CPE identifier for this
package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Afreeswitch%3Afreeswitch

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[yann.morin.1998@free.fr: move after license files]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6739071d31)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:27:40 +01:00
Fabrice Fontaine
9dae6718f2 package/lynx: add LYNX_CPE_ID_VENDOR
cpe:2.3:a:lynx_project:lynx is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Alynx_project%3Alynx

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit e259d0d8b2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:27:38 +01:00
Fabrice Fontaine
636fa58b72 package/libnss: add CPE variables
cpe:2.3:a:mozilla:nss is a valid CPE identifier for this package:

  https://nvd.nist.gov/products/cpe/search/results?namingFormat=2.3&keyword=cpe%3A2.3%3Aa%3Amozilla%3Anss

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 47f3f8a1c8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:26:40 +01:00
Fabrice Fontaine
a77f4e255c package/gstreamer1/gstreamer1: fix girdir
As already done for libglib2 in commit
b094f88a4d, fix girdir to avoid the
following build failure with gst1-plugins-base and introspection:

/home/giuliobenetti/autobuild/run/instance-3/output-1/host/riscv32-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler gst-libs/gst/tag/GstTag-1.0.gir --output gst-libs/gst/tag/GstTag-1.0.typelib --includedir=/usr/share/gir-1.0
Could not find GIR file 'Gst-1.0.gir'; check XDG_DATA_DIRS or use --includedir

Fixes:
 - http://autobuild.buildroot.org/results/d1e2bdde97777ff61c185d375ba412a93e7ca467

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ff420a3195)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:26:17 +01:00
Peter Korsgaard
509aa94c57 package/icu: backport upstream security fix for CVE-2021-30535
Fixes CVE-2021-30535: Double free in ICU in Google Chrome prior to
91.0.4472.77 allowed a remote attacker to potentially exploit heap
corruption via a crafted HTML page.

https://nvd.nist.gov/vuln/detail/CVE-2021-30535

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f4483f1aab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:20:36 +01:00
Bernd Kuhls
8466fdb4e4 package/icu: bump version to 69-1
Release notes: http://site.icu-project.org/download/69

Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d6fefd4f21)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 18:17:33 +01:00
Peter Korsgaard
7bc5438ff3 {linux, linux-headers}: bump 4.{4, 9, 14, 19}.x / 5.{4, 10, 15}.x series
5.14.x is EOL, so no more updates for that.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 64cb922db7)
[Peter: drop 5.15.x bump]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:56:22 +01:00
Peter Korsgaard
0d280a461d package/libnss: security bump to version 3.68.1
Fixes the following security issue:

- CVE-2021-43527: Heap overflow in NSS when verifying DSA/RSA-PSS
  DER-encoded signatures

For more details, see the advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2021-51/

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit bad5728c98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:28:20 +01:00
Fabrice Fontaine
49989c8724 package/pkcs11-helper: fix build with libnss
Build is broken since bump of libnss to version 3.68 in commit
0a73b9b962

Fixes:
 - http://autobuild.buildroot.org/results/1e8113d638fcb73538329511eeac9f5e7cb04d6a

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 6b78d02085)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:28:20 +01:00
Fabrice Fontaine
1005fcfc59 package/libnss: fix build on ARM big endian
Fix the follownig build failure on ARM big endian raised since bump to
version 3.68 in commit 0a73b9b962:

Linux2.6_aarch64_aarch64_be-linux-gnu-gcc_glibc_PTH_64_DBG.OBJ/Linux_SINGLE_SHLIB/sha256-armv8.o: In function `SHA256_Compress_Native':
sha256-armv8.c:(.text.SHA256_Compress_Native+0x0): multiple definition of `SHA256_Compress_Native'
Linux2.6_aarch64_aarch64_be-linux-gnu-gcc_glibc_PTH_64_DBG.OBJ/Linux_SINGLE_SHLIB/sha512.o:sha512.c:(.text.SHA256_Compress_Native+0x0): first defined here
Linux2.6_aarch64_aarch64_be-linux-gnu-gcc_glibc_PTH_64_DBG.OBJ/Linux_SINGLE_SHLIB/sha256-armv8.o: In function `SHA256_Update_Native':
sha256-armv8.c:(.text.SHA256_Update_Native+0x0): multiple definition of `SHA256_Update_Native'
Linux2.6_aarch64_aarch64_be-linux-gnu-gcc_glibc_PTH_64_DBG.OBJ/Linux_SINGLE_SHLIB/sha512.o:sha512.c:(.text.SHA256_Update_Native+0x0): first defined here

Fixes:
 - http://autobuild.buildroot.org/results/237aba0c16a34fec1b0fe50fe08cace438eda1bf

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3e524755a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:26:30 +01:00
Giulio Benetti
61758f3ed3 package/libnss: bump to version 3.68
libnss 3.68 requires libnspr 4.32.

Release Notes (not yet available, but should eventually land):
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.68_release_notes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0a73b9b962)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:26:15 +01:00
Giulio Benetti
537bbfe54b package/libnspr: bump to version 4.32
Bump to version 4.32

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 811305e38f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 14:25:57 +01:00
Giulio Benetti
5336bd122a package/libnss: bump version to 3.65
Release Notes (not yet available, but should eventually land):
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.65_release_notes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[yann.morin.1998@free.fr: release notes not yet available]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 4eadbfeb94)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:29:46 +01:00
Giulio Benetti
f613d04151 package/libnss: bump version to 3.64
Release Notes:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.64_release_notes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 59fedf02df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:29:39 +01:00
Giulio Benetti
b8dac8c6cb package/libnss: bump version to 3.63
Note: NSS 3.63 requires NSPR 4.30.
Release Notes:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.63_release_notes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a0f020f7ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:29:12 +01:00
Giulio Benetti
76b62c102b package/libnspr: bump version to 4.30
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2022de6469)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:28:55 +01:00
Giulio Benetti
5d8b83334d package/libnss: bump version to 3.62
Release Notes:
https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_3.62_release_notes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 06d695cd70)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 13:28:35 +01:00
Fabrice Fontaine
8348f36e94 package/samba4: drop third patch
Drop third patch as it is not needed when using compile_et from heimdal
instead of compile_et from e2fprogs as spotted by upstream in:
https://bugzilla.samba.org/show_bug.cgi?id=13856#c20

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5847208213)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:50:30 +01:00
Fabrice Fontaine
8e52d096dd package/heimdal: install compile_et
compile_et is not installed anymore by heimdal since version 7.0.1 and
e40ef47b57

So remove the broken symlink and install it manually as it is needed for
samba4 because compile_et provided by e2fsprogs raises a build failure

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 30107f026e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:50:25 +01:00
Fabrice Fontaine
ebc6277adf package/e2fsprogs: don't install compile_et
Don't install compile_et as it raises the following build failure with
samba4 since, at least, bump to version 4.14.7 in commit
630e85f8f5:

source4/heimdal/lib/asn1/asn1_err.c:47:23: error: 'link' redeclared as different kind of symbol
   47 | static struct et_list link = { 0, 0 };
      |                       ^~~~
In file included from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/bits/sigstksz.h:24,
                 from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/signal.h:328,
                 from /home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/sys/param.h:28,
                 from ../../lib/replace/../replace/replace.h:659,
                 from ../../source4/heimdal_build/config.h:10,
                 from source4/heimdal/lib/asn1/asn1_err.c:1:
/home/giuliobenetti/autobuild/run/instance-1/output-1/host/s390x-buildroot-linux-gnu/sysroot/usr/include/unistd.h:819:12: note: previous declaration of 'link' was here
  819 | extern int link (const char *__from, const char *__to)
      |            ^~~~

Fixes:
 - http://autobuild.buildroot.org/results/d6de6ed59c553f6f413d280f3c65184945bb3850

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit dd89074e83)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 11:50:21 +01:00
Fabrice Fontaine
5997470110 package/wireshark: fix build failure with -latomic
Fix the following build failure raised since bump to version 3.4.10 in
commit 0ce776942d:

/usr/bin/ld: cannot find /usr/lib64/libatomic.so.1.0.0
collect2: error: ld returned 1 exit status
make[3]: *** [run/lemon] Error 1

Fixes:
 - http://autobuild.buildroot.org/results/02ea7d76a683b039fb37e005578644108bd1e3b7

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 76e66240da)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 00:07:00 +01:00
Urja Rannikko
010868e1ca boot/syslinux: define OBJCOPY and AS
This fixes build on an ARM64 host (and I assume also
other non-x86).

Signed-off-by: Urja Rannikko <urjaman@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e938419bd9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-12 00:05:55 +01:00
Fabrice Fontaine
3bf9cd4d4e package/vim: security bump to version 8.2.3690
- Fix CVE-2021-3973: vim is vulnerable to Heap-based Buffer Overflow
- Fix CVE-2021-3974: vim is vulnerable to Use After Free
- Fix CVE-2021-3968: vim is vulnerable to Heap-based Buffer Overflow

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 5377ff1933)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:59:33 +01:00
Romain Naour
f4ffe6a721 .gitlab-ci.yml: use the Docker image from gitlab registry
From [1]:
"In November 2020, Docker introduced rate limits on pull requests from
Docker Hub [2]. If your GitLab CI/CD configuration uses an image from
Docker Hub, each time a job runs, it may count as a pull request."

Since then, some jobs in our gitlab-ci fail when this rate limits is
reached [3].

To avoid this rate limit, move our Docker image from dockerhub to the
registry provided by gitlab. Keeping the image from dockerhub would be
possible by using dependency proxy [4] but the gitlab registry is good
enough.

Tested on gitlab:
https://gitlab.com/kubu93/buildroot/-/jobs/1694863584

[1] https://docs.gitlab.com/ee/user/packages/container_registry/index.html
[2] https://docs.docker.com/docker-hub/download-rate-limit/
[3] https://gitlab.com/buildroot.org/buildroot/-/jobs/1687590417
[4] https://docs.gitlab.com/ee/user/packages/dependency_proxy

Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b3b4e270d1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:58:55 +01:00
Yann E. MORIN
80d10e40e1 support/docker: drop use of Docker hub, use Gitlab registry
Now that our pipelines are using the Docker image from the Gitlab
registry, there is no longer any reason to push the image to the
Docker hub.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 37004bde66)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:55:39 +01:00
Yann E. MORIN
bda562d509 support/docker: don't use sudo to build
On a properly setup machine, it is totally useless to use sudo to run
docker; it is very bad practice. Instead, users really should add
themselves to the docker group.

Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Reviewed-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9f6a2dbe03)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:42:12 +01:00
Fabrice Fontaine
69fa2d879c package/pure-ftpd: fix CVE-2021-40524
In Pure-FTPd 1.0.49, an incorrect max_filesize quota mechanism in the
server allows attackers to upload files of unbounded size, which may
lead to denial of service or a server hang. This occurs because a
certain greater-than-zero test does not anticipate an initial -1 value.

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 4fd5d8df2a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2021-12-11 23:40:35 +01:00