The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
in [1]. The IGNORE_CVES entry was removed while the patch is still
present in [2].
Re-introduce this IGNORE_CVES entry.
[1] 75c594d446 package/busybox: fix pending CVEs
[2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix patch number in comment (s/0008/0007/)]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 092abbe035)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
When adding the libldns and python_scp, the corresponding tests were not
added to DEVELOPERS, preventing correct notifications in case of tests
failures.
Add the missing entries to enable proper author notifications in case of
failing tests.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1209f3f7a1)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Fixes following CVE's:
CVE-2026-70368: Fixed an out-of-bounds memory
access triggered by logging attacker-controlled protocol messages longer
than 1,024 bytes (thanks to AISLE Research and Clemens Lang).
CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
destination filter using alternate local-address encodings and
interface-scoped IPv6 destinations (thanks to AISLE Research and Clemens
Lang).
Complete Changelog is here:
https://www.stunnel.org/NEWS.html
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8b6eea299b)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Upstream removed configure option INSTALL_EXAMPLE_CODE with commit
8434de3cbc
which was first released with version 2.11.0.
Upstream re-added a similar configure option named INSTALL_EXAMPLE_CODE
with commits
f8d989160e7c803c8538
which were first released with version 2.15.0.
Buildroot bumped the package to 2.15.0 with
8e713dcc88 and forgot to rename the
configure option.
Remove libva/x11/wayland-related configure option due to upstream commit
8434de3cbc
which was first released with version 2.11.0. Remove the selection of
optional packages for these dependencies as well.
Removed unneeded libatomic handling.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 53c29cf046)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- Update BOTAN_VERSION to 3.11.1
- Remove 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
as it is already integrated upstream in this version.
Fixed in 3.11.1:
- CVE-2026-34580: Resolve certificate verification bypass bug introduced
in 3.11.0 (GH #5500)
- CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)
Fixed in 3.11.0:
- CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)
- CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)
- CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)
- Remove the --disable-altivec configuration option as it has been removed
from the Botan build system in version 3.x
- Optimize the --disable-neon logic using the yx pattern.
In Botan 3.x, the --disable-neon flag is specifically targeted at the
arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON
variable is only defined for 32-bit ARM, which previously caused a
false-positive --disable-neon flag to be passed on AArch64 builds
- Update license.txt hash in botan.hash due to the copyright year update
to 2026
https://botan.randombit.net/news.html#version-3-11-1-2026-03-31
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: fix CVE numbers in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 402c94c2d7)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
- botan dropped the usage of Boost.Filesystem in 2.10.0 [0]
- botan never actively searched for Boost.System, as it is header-only
the dependecy can be dropped too
The only part of boost botan currently uses is asio. So use --with-boost option
when boost is selected.
[0] aff8cc8a7a
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8ff577bb35)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Changes made in this release:
Ben Wolsieffer (1):
nptl: fix getting main stack size on no-MMU
Max Filippov (4):
stdio: fix %a formatting of inf and nan
stdio: fix radix point output for %a
stdio: output sign with NaNs
stdio: restrict first digit of %a output to 0 or 1
Ramin Moussavi (19):
libintl.h: route stubs through format_arg inlines; fix gettext_noop
build: scope .NOTPARALLEL to locale targets only, restore parallel build
limits.h: define PAGE_SIZE/PAGESIZE like musl, fixing the gdb build
wait4: fall back to waitid(2) at runtime when wait4 returns ENOSYS
pagesize: restore PAGE_SHIFT fallback for binfmt_flat (no auxv)
buildsys: build locale headers in-tree, not via a recursive sub-make
extra/locale: skip locales the build host cannot provide
csky: fix struct semid_ds layout for TIME64
csky: make __kernel_uid_t/__kernel_gid_t 32-bit
hppa: fix inotify/signalfd/timerfd flag values
hppa: do not set IPC_64 for the SysV IPC *ctl commands
x86: fix struct semid_ds layout for TIME64
i386: add CFI to __libc_i386_syscall6 for cancellation unwinding
i386: do not set IPC_64 for the SysV IPC *ctl commands on 5.1+ kernels
buildsys: terminate .eh_frame in shared objects
m68k: make the __jmp_buf layout match what setjmp.S actually saves
inet: use the direct accept4 syscall when __NR_accept is missing
m68k: implement atomic operations with the CAS instruction
libc: fix struct shmid_ds layout for TIME64
Waldemar Brodkorb (10):
netinet/in.h: sync with glibc
bits/fcntl-linux.h: sync with glibc
add copy_file_range syscall wrapper
sys/fanotify.h: drop include to fix c-sky compilation
adjtimex: fix for architectures lacking __NR_clock_adjtime, f.e. frv
sys/user.h: restore required macros
netinet/tcp.h: sync with glibc
loongarch: add basic static only support
riscv: setcontext: fix linking error
bump version for 1.0.59 release
ramin (16):
ldso: harden _dl_tls_get_addr_soft against an unusable DTV
microblaze: implement atomic operations with lwx/swx
ldso: microblaze: add missing addend to R_MICROBLAZE_TLSDTPREL32
ldso: make the _dl_tls_get_addr_soft DTV check microblaze-specific
microblaze: fix struct semid_ds layout for TIME64
m68k: fix struct semid_ds layout for TIME64
mips: fix fallocate() 64-bit argument passing on n32
mips: fix mmap64() for large offsets on n32
mips: fix setjmp() on n32/n64 (.cpreturn, not .cprestore)
mips: always set IPC_64 for the SysV IPC *ctl commands
libc: fix struct msqid_ds layout for TIME64 on all common-header arches
linuxthreads: fix SIGSEGV in MIPS cancellable wrappers (waitpid, nanosleep)
ldso: serialize dl_iterate_phdr to fix concurrent unwind hang on SMP
nptl: cancel the current thread directly instead of via SIGCANCEL
mips: only n32/n64 always need IPC_64, not o32
m68k: use the kernel cmpxchg helper for atomics on ColdFire
Patch 0001 is applied upstream and is removed here.
Fixes:
- https://autobuild.buildroot.net/results/2bd/2bd73b0060cad4f44649ffe4ea60c4775160d86e
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b94d3eb728)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
New release with following changes:
Adam Lackorzynski (1):
termios.h: Add IBSHIFT
Charles Mirabile (11):
riscv: add defconfigs
riscv: add support for static pie binaries
riscv: add support for ucontext functions
pipe: directly invoke pipe2 from kernel when !UCLIBC_LINUX_SPECIFIC
Fix {g,s}ettimeofday when !UCLIBC_HAS_REALTIME
Fix build with static-pie but without nptl threads
do not remove bits/uClibc_ctype.h when !UCLIBC_HAS_CTYPE_TABLES
getopt-susv3: remove call to gettext `_` macro
readdir{,_r}: remove loop to skip files with d_ino == 0
spawn: allow file actions on no-mmu targets
getopt-susv3: add support for reseting the scan by setting optind to zero
Marcus Haehnel (1):
aarch64/fpu_control.h: Don't use gcc-internal types
Jan Klötzke (1):
elf/dl-support.c: remove unnecessary memset
Ramin Moussavi (9):
libsanitizer: arm/ucontext: fix VFP save/restore to use uc_regspace area
libsanitizer: arm/ucontext.h: add glibc-style REG_R0..REG_R15 aliases
libsanitizer: link.h/dl-iterate-phdr: expose dl_phdr_info TLS fields
libsanitizer: ldso: track _dl_load_adds/_dl_load_subs counters
libsanitizer: ldso: implement _dl_tls_get_addr_soft for dl_phdr_info::dlpi_tls_data
libsanitizer: drop __pagesize, make _dl_pagesize the single source of truth
libsanitizer: sys/user.h: remove obsolete BFD trad-core NBPG/UPAGES defines
libsanitizer: features.h: hard-wire _FILE_OFFSET_BITS=64 to match library's 64-bit off_t/ino_t
libsanitizer: fts.h: drop the bogus _FILE_OFFSET_BITS==64 #error
Waldemar Brodkorb (7):
bits/statx.h: add some missing defines
bits/statx.h: sync struct with glibc
sys/fanotify.h: sync with musl
libiconv: fix typedef of iconv_t
misc: add unicode character functions (c11)
netinet/tcp.h: sync with glibc
bump version for 1.0.58 release
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c7fef3704c)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
It has been good practice for a while to describe the kind of change
in the commit message of any patch that changes license file
hashes. This is important so any substantial changes don't go
unnoticed. However it wasn't explicitly stated in the manual, fix
that.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ef655b53dd)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Localedef is built from the glibc source code, so license information
is the same.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 187d329d1d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
The COPYINGv3 license file was added with upstream commit
e067e53080386e93dcf8b07e25fb6656f2c8941e, it applies to scripts used
during build.
LGPL-3.0+ applies to sysdeps/htl/raise.c, which is used for the Hurd
platform. Buildroot builds only Linux, so the file should not be
compiled, but it is part of the downloaded (and possibly shared, if
"make legal-info" is used) archive. The same applies to the manual.
Checked against the copyright file of the Debian "libc6" package (as
of 2.42-17 and 2.43-2), note that Debian excludes the manual.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45b24c43a0)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This fixes the following vulnerability:
- CVE-2026-6368
(alternative to commit a4d4c7527a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
This configuration for the s6lx9 microboard was added back in March 2012
(commit 49084a1982), and has not been
updated in any significant way since then.
This defconfig still use a 4.4.7 (no longer maintained) and out of tree
devicetree (lx9_mmu.dts).
Remove its support.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728914045 (s6lx9_microboard_defconfig)
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 81490b9592)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
librsvg project on gitlab.gnome.org instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c01426fe96)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
A start script has been missing since the package was added, so the
daemon was not started automatically on sysv/busybox systems.
This also fixes a regression in systemd builds introduced in fccdc6bd,
when the package switched from local unit file to upstream.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 54485e075d)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
libgtk4 passes -Dintrospection=disabled unconditionally, so Gtk-4.0.gir is
never installed. webkitgtk depends on gobject-introspection and generates
WebKit-6.0.gir, which includes Gtk-4.0.gir, so building both fails:
FAILED: WebKit-6.0.gir
Couldn't find include 'Gtk-4.0.gir' (search path:
'['.../usr/share/gir-1.0', ...]')
Tie the option to BR2_PACKAGE_GOBJECT_INTROSPECTION and add the dependency,
the way package/libgtk3 already does. Systems without introspection keep the
previous behaviour.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 8c5f774172)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Whether the host libglib2 picks up sysprof support depends on whether
libsysprof-capture happens to be installed on the build machine, which
makes the host build depend on the host environment. Disable sysprof
explicitly for the host build so the result is deterministic.
Keep sysprof enabled for the target build: it is useful to profile and
measure the performance of applications running on the target.
Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
[Fiona: also apply to package/libglib2/libglib2-bootstrap]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c92dc611e5)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Since NetworkManager 1.54, packaged since commit 24827ae398
(package/network-manager: bump to 1.56.0), new services related to
running in an initrd are now installed, which prevents proper startup,
with systemd reporting that two units declare the same BusName.
When systemd is configured without initrd support, drop the
NetworkManager initrd-related services.
Fixes: 24827ae398
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Marcus Hoffmann <buildroot@bubu1.eu>
Acked-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 32bdc4710a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Running TestUsbIp may fail when checking if two QEMU USB Keyboards are
reported by lsusb. On fast host, the second QEMU USB keyboard may not
aleady detected when lsusb is executed. So wait a bit, to let the new
keyboard be detected.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 933a591d8a)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
