Buildroot commit 7f48325de6 bumped the
asterisk package from 22.9.0 to 22.10.1.
This bump includes upstream commit
5d543ad80c
which bumped the bundled pjsip package to 2.17.
To allow offline builds we download the pjsip tarball so we need to keep
the version numbers in sync.
The autobuilders logs show a download process:
https://autobuild.buildroot.net/results/400/400e53158f11926446c11d22681eb8a9430caf1d/build-end.log
checking for embedded pjproject (may have to download)... configuring
[pjproject] Downloading https://raw.githubusercontent.com/asterisk/third-party/master/pjproject/2.17/pjproject-2.17.tar.bz2 to
/home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2
[pjproject] Verifying /home/autobuild/autobuild/instance-3/dl/asterisk/pjproject-2.17.tar.bz2
where the tarball was once stored in the configured download directory:
--with-download-cache=$(ASTERISK_DL_DIR)
to be used during later autobuilder runs.
Fixes: 7f48325de6 ("package/asterisk: security bump to 22.10.1")
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: add comment in .mk file]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 96a2337bd4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes: CVE-2026-18321:
https://nvd.nist.gov/vuln/detail/cve-2026-18321
- bump version to 1.2.5 (for details see [1])
- rebased 0001-wscript-remove-checks-for-bsd-string.h-fixes-host-co.patch
- rebased 0002-disable-PIE-support.patch
- removed 0003-ntpd-refclock_gpsd.c-Add-missing-time.h-for-strptim.patch
(from upstream [2])
- moved 0004-refclock_gpsd-add-build-fix-for-gcc-14.x.patch to
0003-refclock_gpsd-add-build-fix-for-gcc-14.x.patch, rebased and enhanced
as the original conflicts with upstream commit 5505260c ("Fix redefined
_XOPEN_SOURCE warning in refclock_gpsd.c") [3] and leads to the following
compile failure:
../../ntpd/refclock_gpsd.c:113:21: error: operator ‘<’ has no left operand
113 | #if _XOPEN_SOURCE < 700
| ^
[1] https://lists.ntpsec.org/pipermail/devel/2026-July/011029.html
[2] 5137c155d8
[3] 5505260cd1
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[Julien: mark commit as "security bump"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1caeb632a6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit [1] (package/mrouted: fix invalid daemon path in
S41mrouted) removed script execution permission but forgot to remove
the corresponding .checkpackage entry.
check-package is reporting the error:
package/mrouted/S41mrouted:0: NotExecutable was expected to fail, did you fix the file and forget to update /builds/buildroot.org/buildroot/.checkpackageignore?
This commit fixes the issue by removing the entry.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16661195972
[1] d8f408b1f1
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e2b81003a4)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
S41mrouted hard-coded /sbin/mrouted, but mrouted has always installed
to /usr/sbin/mrouted. This went unnoticed with BR2_ROOTFS_MERGED_USR=y,
but the daemon fails to start without it.
Also drop the script's executable bit to match other sysv init
scripts that do not set it.
Introduced in c25115daf2
(package/mrouted: add sysv init script).
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d8f408b1f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
stunnel's configure unconditionally probes -fstack-clash-protection
using AX_APPEND_COMPILE_FLAGS. The probe compiles a trivial conftest.c,
which succeeds, so the flag ends up in CFLAGS. However, on ARM Thumb-1
gcc implements stack clash protection through -fstack-check=specific,
which it refuses for any real function body, so every source file fails
to build:
stunnel.c:1003:1: sorry, unimplemented: '-fstack-check=specific' for Thumb-1
Force the corresponding autoconf cache variable to "no" on Thumb-1, in
the same way cmocka already works around this gcc limitation, and
consistently with the existing -fstack-protector-strong override.
Fixes:
https://autobuild.buildroot.org/results/3d691184ba83ba4d881632f2b2bb4da5aa50f491/
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 15ccf339c9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Remove -Werror from CFLAGS to prevent build errors due to warnings of
deprecated functions:
futility/cmd_create.c: In function ‘vb1_make_keypair’:
futility/cmd_create.c:96:9: error: ‘PEM_read_RSAPrivateKey’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
96 | rsa_key = PEM_read_RSAPrivateKey(fp, NULL, NULL, NULL);
futility/cmd_create.c:155:9: error: ‘RSA_free’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
155 | RSA_free(rsa_key);
futility/cmd_create.c:191:17: error: ‘PEM_read_RSA_PUBKEY’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
191 | rsa_key = PEM_read_RSA_PUBKEY(fp, NULL, NULL, NULL);
futility/cmd_create.c:199:9: error: ‘RSA_get0_key’ is deprecated:
Since OpenSSL 3.0 [-Werror=deprecated-declarations]
199 | RSA_get0_key(rsa_key, NULL, NULL, &rsa_d);
cc1: all warnings being treated as errors
The oldest build error dates back to 2024 so a backport to LTS branches
should be considered.
Fixes:
https://autobuild.buildroot.net/results/375/37554c5ce784835a36f0068d9a0c1cd931212b44/https://autobuild.buildroot.net/results/1fa/1fabca11c7839d2d7ed809f30482595719a29c92/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 4463009364)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Boost.DateTime is header-only since 1.77.0
The Boost Release Notes[0] didn't mention it but it was introduced in
the documentation of DateTime in this commit: [1]
This was bumped in buildroot in d39d8f7cee
So analog to the "header-only" move of Boost.System we have now to
gradually phase out the dependencies on this library. Ideally before
the stub is removed as it now happened for Boost.System in 1.89.0.
[0] https://www.boost.org/releases/1.77.0/
[1] 33dc6136f1
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a235a33cfe)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
pkg-stats columns are sorted either alphabetically or numerically. This
does not make much sense for the "Latest version" column.
This commit orders the column by whether the package is up-to-date or
not.
Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 95b1e8676c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Add basic tests for openscap, ensuring that it builds and runs a minimal
command with different cryptographic backends:
- libgcrypt
- libnss
- no crypto backend
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a304c7bf12)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
When enabling the openscap package and the libnss library _but not_
libgcrypt, the build can fail on the following error:
../src/libopenscap.so.33.1.3: undefined reference to `crapi_init'
The issue is due to the fact that the corresponding Makefile
systematically forces -DWITH_CRYPTO=gcrypt: openscap CMake
instrumentation then searches only this backend, fails to find it,
assumes that no crypto backend is available, and so does not include the
crapi_object in the final link step.
Commit 7c85f3adf4 ("package/openscap: new package") took into account
the fact that openscap isn't currently able to build if no crypto backend
is provided (see [0]), and so made sure to force libgcrypt inclusion if
libnss is not included. Since then, two fixes ([1] and [2]) have been
integrated upstream to allow building openscap with any backend.
Do not systematically enforce libgcrypt anymore through WITH_CRYPTO:
rather than testing nss presence, and falling back to libgcrypt, allow
both to be absent, and so relax the libgcrypt dependency to make it
optional as well. Bring the two upstream patches allowing openscap build
without any crypto backend. Those patches can be dropped once openscap
v1.4.5 is released.
[0] https://github.com/OpenSCAP/openscap/issues/2310
[1] d12d820a94
[2] 5b858d1786
Fixes: https://autobuild.buildroot.org/results/4c905c1b0ee384149c3d85e8f2ebf0af3a12c2ad/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c24ae7f2f1)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The comment about the toolchain requirements to have Python support in
gnuradio is always displayed, even if architecture requirements are
not met and if Python is not enabled. For the latter: the option
BR2_PACKAGE_GNURADIO_PYTHON also depends on python, so it makes sense
for the Config.in comment to also depend on it.
Fixes: 7a546b87d5 ("package/python-numpy: add reverse dependency on packages using python-numpy")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fbb9739dd8)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_GNURADIO_PYTHON selects BR2_PACKAGE_PYTHON_NUMPY, so it
should inherit its dependencies, but BR2_TOOLCHAIN_GCC_AT_LEAST_9 was
forgotten in commit 8b3993178d, when
python-numpy got this gcc >= 9 dependency added.
Note that the existing BR2_HOST_GCC_AT_LEAST_9 dependency is correct:
it is there because gnuradio needs host-python-numpy at build time.
Fixes: 8b3993178d ("package/python-numpy: needs gcc >= 9")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c6986e6d2e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
This commit fixes 3 issues in the Config.in comment:
- It is displayed even on unsupported CPU architectures, so we add a
"depends on BR2_PACKAGE_TENSORFLOW_LITE_ARCH_SUPPORTS"
- It doesn't mention the need for a glibc toolchain even though that's
part of the dependencies
- The requirement for dynamic lib support should be part of the same
comment as the other dependencies
Fixes: fd29fee3a3 ("package/tensorflow-lite: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 101d543e38)
[raphael: resolve conflicts]
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_TENSORFLOW_LITE selects BR2_PACKAGE_LIBABSEIL_CPP without
propagating its depends on BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS,
which this commit fixes.
Note that this doesn't create any functional change: tensorflow-lite
is anyway limited to ARM, ARM64, x86 32-bit and x86 64-bit, all of
which are supported by libabseil-cpp.
Fixes: fd29fee3a3 ("package/tensorflow-lite: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f5a2b35531)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_RPI_RGB_LED_MATRIX_VIDEO_VIEWER selects
BR2_PACKAGE_FFMPEG, but without propagating its depends on, and most
notably BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS.
Fixes: e821078031 ("package/rpi-rgb-led-matrix: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 0fbbe6b681)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
libgtk3 selects at-spi2-core, so it should inherit its
!BR2_STATIC_LIBS, which this commit does.
This has been an issue since libgtk3 started using at-spi2-core
instead of atk in commit 2c3ca7bea1.
Fixes: 2c3ca7bea1 ("package/atk: remove package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 93282f76a5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Commit 0b9efc991f ("linux: use BR2_MAKE", 2023-04-10) replaced $(MAKE)
with $(BR2_MAKE) in a number of recipes. As a consequence, the child
make is unable to discover the job server, in some cases. In those
cases, we get a warning such as:
> warning: jobserver unavailable: using -j1. Add `+' to parent make rule.
See [1] and [2].
Falling back to single job can make build considerably longer.
This longer build time issue can be reproduced in specific
conditions. This situation happens when:
1. The top GNU Make is using a "pipe" jobserver.
This is the default when GNU Make <= 4.3 is used (and v4.3 is the
version inside the current Buildroot Docker reference image).
Make > 4.3 changed the default jobserver style to "fifo".
See [3][4]. With Make > 4.3, the issue can be reproduced by
calling "make --jobserver-style=pipe ...".
2. The root filesystem is an initramfs linked into the Kernel
(i.e. using the config BR2_TARGET_ROOTFS_INITRAMFS=y)
3. Buildroot per-package directories is used
(i.e. using the config BR2_PER_PACKAGE_DIRECTORIES=y)
4. The build is made in parallel, with 2 or more jobs. For example:
make -j$(nproc)
Overall, the issue can be reproduced with the commands:
utils/docker-run
cat >.config <<EOF
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
BR2_TARGET_ROOTFS_INITRAMFS=y
EOF
make olddefconfig
make -j$(nproc)
The Linux Kernel is built once (with a fake empty initramfs cpio
image), when build log is showing ">>> linux 7.2.6 Building". Then,
at the end of the Buildroot build, once the CPIO filesystem is
complete, it is integrated inside the Kernel with an extra "make"
invocation when the build log shows
">>> Rebuilding kernel with initramfs".
This second kernel "make" is not expected to rebuild the whole
kernel, since compiled objects from the first compilation are still
here. However, in the described conditions, the second kernel is
fully rebuilt. This is an undesired behaviour. The Make jobserver
issue adds up to that: this second full kernel is rebuilt with only
one job, which can significantly increase the build time.
Running the previous example on a host with 128 CPUs:
without this change, build takes 1h5m,
with this change, build takes 7m.
Note: using GNU Make >= 4.4 (with a fifo jobserver style by default)
or removing per-package directories no longer produces the issue.
For reference, running the example, without this change and without
per-package directories on the same host, the build takes 10 mins.
This commit improves the situation by prefixing the recipe with "+",
to inform the parent Make that $(BR2_MAKE) can deal with the job
server. This will give a chance to do jobs in parallel, in general.
Note: the pkg-generic.mk infra already has '+' for _BUILD_CMDS, which is
why other $(BR2_MAKE) invocations in linux.mk does not need this '+'.
See [5].
[1] https://www.gnu.org/software/make/manual/html_node/Error-Messages.html
[2] https://www.gnu.org/software/make/manual/html_node/MAKE-Variable.html
[3] https://www.gnu.org/software/make/manual/html_node/Options-Summary.html#index-_002d_002djobserver_002dstyle
[4] https://cgit.git.savannah.gnu.org/cgit/make.git/commit/?id=7ad2593b2d2bb5b9332f4444d8bf93ac6f958bc6
[5] 069b33a30e
Cc: Arnout Vandecappelle <arnout@mind.be>
Cc: Oleg Lyovin <ovlevin@sberdevices.ru>
Cc: buildroot@buildroot.org
Signed-off-by: Laszlo Ersek <laszlo.ersek@arm.com>
[Julien: extend commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 86a56dcc17)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
python-grpcio builds its own bundled copy of abseil-cpp, which only
implements DirectMmap() with mmap2 for the o32 ABI on MIPS:
#if ... (defined(__mips__) && _MIPS_SIM == _MIPS_SIM_ABI32) || ...
With the n32 ABI, the "remaining 64-bit architectures" fallback is
selected instead, which fails to build because long is 32-bit there:
third_party/abseil-cpp/absl/base/internal/direct_mmap.h:130:39:
error: static assertion failed: Platform is not 64-bit
130 | static_assert(sizeof(unsigned long) == 8, "Platform is not 64-bit");
| ~~~~~~~~~~~~~~~~~~~~~~^~~~
third_party/abseil-cpp/absl/base/internal/direct_mmap.h:130:39:
note: the comparison reduces to '(4 == 8)'
This is the same defect fixed for libabseil-cpp in the previous patch,
but the dependency added there does not help here: python-grpcio does
not use the Buildroot abseil, it compiles the copy bundled in the
tarball.
Using the Buildroot-provided abseil instead is not an option today.
setup.py does have a GRPC_PYTHON_BUILD_SYSTEM_ABSL knob, but it is
hardcoded to the build machine paths:
if BUILD_WITH_SYSTEM_ABSL:
CORE_C_FILES = filter(
lambda x: "third_party/abseil-cpp" not in x, CORE_C_FILES
)
ABSL_INCLUDE = (os.path.join("/usr", "include"),)
[...]
if BUILD_WITH_SYSTEM_ABSL:
EXTENSION_LIBRARIES += tuple(
lib.stem[3:]
for lib in sorted(pathlib.Path("/usr").glob("lib*/libabsl_*.so"))
)
i.e. it would pick up the host headers and host libraries, so it cannot
be used when cross-compiling without patching setup.py. And even with
such a patch it would not fix this build failure, since Buildroot's
abseil has the very same limitation.
So just disable the package for the n32 ABI. The o32 and n64 ABIs are
unaffected. Note that n32 is the default ABI for BR2_mips64/BR2_mips64el,
so this affects every mips64 build that does not explicitly select n64.
For the LTS maintainers: python-grpcio gained MIPS support in commit
2bfad952c3, released in 2024.02, and the autobuilders have been hitting
this ever since, already with grpcio 1.60.0, the version shipped in
2024.02:
https://autobuild.buildroot.net/results/e6cb7f473a28af8b53e7cbb8d8a582adffdeb66e/
It is still reproduced on 2025.02.x:
https://autobuild.buildroot.net/results/9cf98bff7ce05262d6ff4221953901ae5543880e/
so a backport is needed there.
Fixes: 2bfad952c3 ("package/python-grpcio: add BR2_PACKAGE_PYTHON_GRPCIO_ARCH_SUPPORTS")
Fixes:
https://autobuild.buildroot.net/results/90405c0a3d0b2e929d5074305906e6fe3679298c/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit d4c13e96cf)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
absl::base_internal::DirectMmap() only implements mmap() via mmap2 for
the o32 ABI on MIPS:
#if ... (defined(__mips__) && _MIPS_SIM == _MIPS_SIM_ABI32) || ...
With the n32 ABI, the "remaining 64-bit architectures" fallback is
selected instead, which fails to build because long is 32-bit there:
absl/base/internal/direct_mmap.h: In function 'void* absl::lts_20260107::base_internal::DirectMmap(void*, size_t, int, int, int, off_t)':
absl/base/internal/direct_mmap.h:130:39: error: static assertion failed: Platform is not 64-bit
130 | static_assert(sizeof(unsigned long) == 8, "Platform is not 64-bit");
| ~~~~~~~~~~~~~~~~~~~~~~^~~~
absl/base/internal/direct_mmap.h:130:39: note: the comparison reduces to '(4 == 8)'
direct_mmap.h is included by absl/base/internal/low_level_alloc.cc and
absl/base/internal/poison.cc, which are always built, so the failure is
unconditional. Upstream abseil has no support for the n32 ABI, so
disable the package for that ABI.
Since n32 is the default ABI for BR2_mips64/BR2_mips64el, this affects
every mips64 build that does not explicitly select n64. The o32
(BR2_MIPS_OABI32) and n64 (BR2_MIPS_NABI64) ABIs are unaffected, and all
in-tree mips64 defconfigs use n64.
For the LTS maintainers: the ABI list in direct_mmap.h is identical in
abseil 20200225 (the version in tree when the arch dependencies were
introduced) and in the current 20260817.0, so the failure has existed
ever since mips64 was allowed. It is still reproduced on all maintained
branches, e.g.:
2026.02.x https://autobuild.buildroot.net/results/5818407a73cfd3371cd1f726a24df6ceb9afa42d/
2025.02.x https://autobuild.buildroot.net/results/5065bda3b91bdbee53559dd97af8ab5a63a1e112/
so a backport is needed there.
Fixes: ae0557403a ("package/libabseil-cpp: add BR2_PACKAGE_LIBABSEIL_CPP_ARCH_SUPPORTS")
Fixes:
https://autobuild.buildroot.net/results/f375584f3721d61238b9e43d9926e037802f6141/
Assisted-by: Claude:claude-opus-5
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 263cfb165e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Commit 1f7efaf89f ("package/qemu: do not support x86_steamroller or
x86_core_avx2") excluded BR2_x86_steamroller from
BR2_PACKAGE_HOST_QEMU_ARCH_SUPPORTS. This is still needed, but for a
different reason than AVX, and the exclusion is incomplete.
steamroller is bdver3, and what the Qemu TCG engine cannot emulate
there is not AVX, but the Bulldozer-specific XOP, FMA4, TBM and LWP
extensions. In Qemu 11.0.0 (the version we currently package) and
11.1.1, target/i386/cpu.c has:
#define TCG_EXT3_FEATURES (CPUID_EXT3_LAHF_LM | CPUID_EXT3_SVM | \
CPUID_EXT3_CR8LEG | CPUID_EXT3_ABM | CPUID_EXT3_SSE4A | \
CPUID_EXT3_3DNOWPREFETCH | CPUID_EXT3_KERNEL_FEATURES | \
CPUID_EXT3_CMP_LEG)
CPUID_EXT3_XOP, CPUID_EXT3_FMA4, CPUID_EXT3_TBM and CPUID_EXT3_LWP are
defined in target/i386/cpu.h, but are not part of that mask, i.e. TCG
does not implement them. Binaries using those instructions therefore
die with:
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
This affects the whole Bulldozer family, not only steamroller:
bulldozer (bdver1), piledriver (bdver2) and excavator (bdver4) are
equally unsupported, but were never excluded.
Use the newly introduced BR2_X86_CPU_HAS_XOP symbol, which covers all
four variants, instead of listing BR2_x86_steamroller alone. As for
AVX512, this disables gobject-introspection and nodejs, which are the
two packages needing host-qemu in user mode.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 22c0ec4fcf)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The AMD Bulldozer family (bdver1 to bdver4, i.e. bulldozer, piledriver,
steamroller and excavator) is the only x86 family implementing the XOP
instruction set, together with the equally Bulldozer-specific FMA4 and
LWP extensions, and TBM starting with bdver2. All of them were dropped
again with Zen.
This can be verified with:
$ gcc -march=bdver1 -Q --help=target | grep -E '\-m(xop|fma4|tbm|lwp)'
-mfma4 [enabled]
-mlwp [enabled]
-mtbm [disabled]
-mxop [enabled]
$ gcc -march=bdver2 -Q --help=target | grep -E '\-m(xop|fma4|tbm|lwp)'
-mfma4 [enabled]
-mlwp [enabled]
-mtbm [enabled]
-mxop [enabled]
with bdver3 and bdver4 behaving like bdver2.
Add a hidden BR2_X86_CPU_HAS_XOP capability symbol and select it from
those four CPU variants, so that packages which cannot cope with this
instruction set can depend on it, instead of listing the CPU variants
one by one. The first user is host-qemu, whose TCG engine does not
implement XOP.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit f91407f012)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Commit 1f7efaf89f ("package/qemu: do not support x86_steamroller or
x86_core_avx2") excluded BR2_x86_core_avx2 from
BR2_PACKAGE_HOST_QEMU_ARCH_SUPPORTS because binaries built for that CPU
variant crashed under qemu-user. This was done at the time of Qemu 4.2,
whose TCG engine did not implement AVX at all.
Since Qemu 7.2, the TCG engine implements AVX, AVX2, F16C, FMA3 and
VAES. In Qemu 11.0.0 (the version we currently package) and 11.1.1,
target/i386/cpu.c has:
#define TCG_EXT_FEATURES (... | CPUID_EXT_AVX | CPUID_EXT_F16C | \
CPUID_EXT_FMA | ...)
#define TCG_7_0_EBX_FEATURES (... | CPUID_7_0_EBX_BMI1 | \
CPUID_7_0_EBX_BMI2 | CPUID_7_0_EBX_AVX2 | ...)
which covers everything gcc generates for -march=core-avx2.
In addition, the exclusion was inconsistent: gcc's core-avx2 is a
deprecated alias for haswell, both variants select exactly the same
BR2_X86_CPU_HAS_* symbols in arch/Config.in.x86, and haswell was never
excluded. The same goes for broadwell, skylake, zen*, x86-64-v3, ...,
which all enable AVX2 and build fine on the autobuilders.
So drop the BR2_x86_core_avx2 exclusion.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8d80efe017)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes:
https://autobuild.buildroot.net/results/d43/d4364f6e3636c696471bf8cba6d308439130e53a/
In function 'MakeIv',
inlined from 'TestSymmetricAlgorithm' at AlgorithmTests.c:197:25:
AlgorithmTests.c:181:23: error: writing 32 bytes into a region of size
16 [-Werror=stringop-overflow=]
The build error occurs with gcc 15.x on some platforms, gcc 14.x is not
affected.
These defconfigs build without this patch:
BR2_x86_64=y
BR2_GCC_VERSION_14_X=y
BR2_PACKAGE_IBM_SW_TPM2=y
BR2_x86_64=y
BR2_x86_x86_64_v4=y
BR2_GCC_VERSION_14_X=y
BR2_PACKAGE_IBM_SW_TPM2=y
BR2_x86_64=y
BR2_PACKAGE_IBM_SW_TPM2=y
This gcc-15 based defconfig is broken:
BR2_x86_64=y
BR2_x86_x86_64_v4=y
BR2_PACKAGE_IBM_SW_TPM2=y
The build error is not related to the recent bump of the package from
rev183-2024-03-27 to rev183-2026-08-26 because no changes were committed
upstream to AlgorithmTests.c since rev183-2024-03-27:
https://github.com/kgoldman/ibmswtpm2/commits/master/src/AlgorithmTests.c
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b016989c61)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Fixes build error:
In file included from client.c:14:
client.c: In function 'JNI_OnLoad':
./../../src/est/est.h:834:10: error: implicit declaration of function 'ERR_load_crypto_strings'; did you mean 'ERR_load_CRYPTO_strings'? [-Wimplicit-function-declaration]
834 | do { ERR_load_crypto_strings(); \
| ^~~~~~~~~~~~~~~~~~~~~~~
client.c:88:9: note: in expansion of macro 'est_apps_startup'
88 | est_apps_startup();
| ^~~~~~~~~~~~~~~~
./../../src/est/est.h:836:10: error: implicit declaration of function 'ENGINE_load_builtin_engines' [-Wimplicit-function-declaration]
836 | ENGINE_load_builtin_engines(); \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
client.c:88:9: note: in expansion of macro 'est_apps_startup'
88 | est_apps_startup();
| ^~~~~~~~~~~~~~~~
client.c: In function 'JNI_OnUnload':
./../../src/est/est.h:860:40: error: implicit declaration of function 'ENGINE_cleanup'; did you mean 'EVP_PBE_cleanup'? [-Wimplicit-function-declaration]
860 | OBJ_cleanup(); EVP_cleanup(); ENGINE_cleanup(); \
| ^~~~~~~~~~~~~~
client.c:101:9: note: in expansion of macro 'est_apps_shutdown'
101 | est_apps_shutdown();
| ^~~~~~~~~~~~~~~~~
./../../src/est/est.h:862:10: error: implicit declaration of function 'ERR_free_strings'; did you mean 'ERR_load_EC_strings'? [-Wimplicit-function-declaration]
862 | ERR_free_strings(); } while (0)
| ^~~~~~~~~~~~~~~~
client.c:101:9: note: in expansion of macro 'est_apps_shutdown'
101 | est_apps_shutdown();
| ^~~~~~~~~~~~~~~~~
client.c: In function 'est_client_raise_exception':
client.c:122:17: error: implicit declaration of function 'ERR_print_errors_fp' [-Wimplicit-function-declaration]
122 | ERR_print_errors_fp(stderr);
| ^~~~~~~~~~~~~~~~~~~
seen with this defconfig
BR2_PACKAGE_OPENJDK=y
BR2_PACKAGE_LIBEST=y
The failing code was added upstream on Jul, 6th, 2020:
ab998c0918
and included in version 3.2.0.
Buildroot commit 5bbb1834a4 bumped the
package to a tree including the aforementioned upstream commit on Jul
24th, 2022 so a backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 7e34cd7c7e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://lists.exim.org/lurker/message/20260820.154633.91995f73.en.html
Rebased patch 0001.
Updated patch 0005, the previous version was applied upstream with
commit 497e9eb7e77ad27ae1d45281e23eefadfaa7a3bc but it did not fix all
linker errors so we sent a new patch upstream which replaces the
previous patch.
Updated hash of GPL-2.0 license file (address, name of president and
typos), a commit can not be provided from the source tree.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 8b009489f5)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Add an infrastructure test case to verify that the per-package
<PKG>_FLAT_STACKSIZE variable correctly configures the stack size in the
generated FLAT binary header.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 0bf4525045)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The comment should be shown when !BR2_INSTALL_LIBSTDCPP is true, also
treat BR2_PACKAGE_LIBURCU_ARCH_SUPPORTS as arch dependency.
Fixes: 54f96add94 ("package/bind: security bump version to 9.20.24")
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 96ac57460f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
No autobuilder errors were recorded, the build error can be reproduced
with this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_QT5=y
BR2_PACKAGE_QT5WEBENGINE=y
BR2_PACKAGE_XORG7=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 60dc97fcee)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Building gobject-introspection for an x86 CPU variant with AVX512 fails
when g-ir-scanner runs the freshly built target binaries under
qemu-user:
qemu: uncaught target signal 4 (Illegal instruction) - core dumped
The Qemu TCG engine implements AVX, AVX2, F16C, FMA3 and VAES since Qemu
7.2, but it does not implement the AVX512 instruction set at all [0].
Therefore no -cpu value passed through
BR2_PACKAGE_HOST_QEMU_USER_MODE_ARGS can make such binaries run, and
user-mode emulation is simply not possible for these CPU variants.
Mark those CPUs as unsupported by host-qemu, the same way it is already
done for x86_steamroller and x86_core_avx2. This relies on the existing
BR2_X86_CPU_HAS_AVX512 symbol, so all AVX512 capable variants are
covered, and it disables gobject-introspection and nodejs, which are the
two packages needing host-qemu in user mode.
[0] https://gitlab.com/qemu-project/qemu/-/issues/2878
Fixes:
https://autobuild.buildroot.org/results/7ed7f9c36dae1ddb965a0f0021db6cd319927b47/
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Assisted-by: Claude:claude-opus-5
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit c2bd6148c6)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA selects BR2_PACKAGE_GST1_LIBAV, which
depends on BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS, but doesn't propagate
this dependency. In practice, there is no issue, as webkitgtk is only
available on a subset of CPU architectures, while
BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS makes ffmpeg available on pretty much
all CPU architectures, except Cortex-M, m68k coldfire, and some
specific cases of OpenRISC, which are not supported by webkitgtk.
But for the sake of having correct dependency propagation, let's fix
this.
The other packages selected by BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA have
dependencies that are already handled at the top-level
BR2_PACKAGE_WPEWEBKIT option.
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
CC: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 251a80dd9d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit
0e2c958e05 ("package/libseccomp: bump to
version 2.5.3"), the kernel headers dependency of seccomp was bumped
from 3.12 to 3.17, but BR2_PACKAGE_WEBKITGTK_SANDBOX, which is a
reverse dependency of BR2_PACKAGE_LIBSECCOMP was forgotten.
This commit fixes this inconsistency.
Fixes: 0e2c958e05 ("package/libseccomp: bump to version 2.5.3")
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
CC: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 5279b2303c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The 0002-Update-linker-flags.patch assumes that the qemu-xen files are included
in the xen source tree. However, if BR2_PACKAGE_XEN_TOOLS is not enabled, the
qemu-xen dependency will not be handled and the patch will fail to apply with
the following error.
Fixes: build error below
Applying 0002-Update-linker-flags.patch using patch:
patching file tools/Makefile
Hunk #1 succeeded at 36 (offset -1 lines).
Hunk #2 succeeded at 185 (offset -8 lines).
can't find file to patch at input line 76
Perhaps you used the wrong -p or --strip option?
The text leading up to this was:
--------------------------
|diff --git a/tools/qemu-xen/include/hw/xen/xen_native.h b/tools/qemu-xen/include/hw/xen/xen_native.h
|index 6bcc83ba..2590904e 100644
|--- a/tools/qemu-xen/include/hw/xen/xen_native.h
|+++ b/tools/qemu-xen/include/hw/xen/xen_native.h
--------------------------
No file to patch. Skipping patch.
1 out of 1 hunk ignored
make: *** [package/pkg-generic.mk:239: output/build/xen-4.21.1/.stamp_patched] Error 1
To avoid making BR2_PACKAGE_XEN_TOOLS a required option, fix the
0002-Update-linker-flags.patch so that modifying source from the qemu-xen
package is no longer included.
Instead of patching qemu-xen, a better solution is undefining the
__XEN_INTERFACE_VERSION__ from the qemu-xen package.
To test:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_XEN=y
# BR2_PACKAGE_XEN_TOOLS is not set
Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Matt Weber <matt@thewebers.ws>
Reviewed-by: Stewart Hildebrand <stewart.hildebrand@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f63e572432)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_GLSLSANDBOX_PLAYER_SCRIPTS needs the full blown version of
bash and coreutils, so it selects BR2_PACKAGE_BUSYBOX_SHOW_OTHERS, but
it does so only if BR2_PACKAGE_BUSYBOX=y. Which kind of makes sense,
but is not aligned with the vast majority of other places where
BR2_PACKAGE_BUSYBOX_SHOW_OTHERS is selected, where
BR2_PACKAGE_BUSYBOX_SHOW_OTHERS is selected unconditionally. Harmonize
this with other packages.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 22540e0d41)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_XEN_TOOLS needs the full blown version of bash and
coreutils, so it selects BR2_PACKAGE_BUSYBOX_SHOW_OTHERS, but it does
so only if BR2_PACKAGE_BUSYBOX=y. Which kind of makes sense, but is
not aligned with the vast majority of other places where
BR2_PACKAGE_BUSYBOX_SHOW_OTHERS is selected, where
BR2_PACKAGE_BUSYBOX_SHOW_OTHERS is selected unconditionally. Harmonize
this with other packages.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e62e06b19d)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
ndctl selects kmod and keyutils, both of which depend on
!BR2_STATIC_LIBS, but this dependency was not propagated into ndctl
when the package was introduced. This commit fixes this issue.
Fixes: 039c1ae13e ("package/ndctl: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6dad789282)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The Config.in comment has the correct dependency on
!BR2_TOOLCHAIN_HAS_THREADS, but that was not reflected in the comment
text itself.
Fixes: 039c1ae13e ("package/ndctl: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3472fd59af)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_STRONGSWAN_BOTAN selects BR2_PACKAGE_BOTAN, but since
commit 10a70b1af6, botan needs gcc 11,
which was not propagated to strongswan's botan option. This commit
fixes this issue.
Fixes: 10a70b1af6 ("package/botan: needs gcc >= 11")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b56072c126)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
gerbera selects BR2_PACKAGE_ICU, which depends on !BR2_BINFMT_FLAT,
but this dependency was not propagated to gerbera. In practice this is
not an issue because gerbera depends on BR2_USE_MMU, and only noMMU
platforms can use BR2_BINFMT_FLAT. But for the sake of completeness,
let's propagate this dependency.
Note: in the Config.in comment, we handle it like an architecture
dependency, like is done in package/icu/Config.in.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6b716763e9)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Since the bump of libabseil-cpp in commit
76241e89e1, it requires gcc 10. As part
of this commit, the protobuf package was updated, but not its reverse
dependency netdata. This commit fixes this issue.
Fixes: 76241e89e1 ("package/libabseil-cpp: bump to version 20260817.0")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e91ffb1afb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_SYSPROF selects BR2_PACKAGE_LIBDEX but did not propagate:
depends on BR2_TOOLCHAIN_HAS_UCONTEXT || \
BR2_PACKAGE_LIBUCONTEXT_ARCH_SUPPORTS
from libdex. This commit fixes this missing dependency. In terms of
Config.in comment, we do the same as what libdex is doing: handle it
as a toolchain dependency (rather than an architecture dependency).
This was missed in commit a73ef093f7,
which added the ucontext related dependency to libdex, without
propagating it to sysprof.
Fixes: a73ef093f7 ("package/libdex: needs ucontext")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit cd5eab10fe)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
BR2_PACKAGE_RPI_RGB_LED_MATRIX_IMAGE_VIEWER selects
BR2_PACKAGE_GRAPHICSMAGICK, but did not propagate its BR2_USE_MMU
dependency. This issue exists since the package was introduced in
commit e821078031.
It fixes the following Kconfig warning:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_GRAPHICSMAGICK
Depends on [n]: BR2_USE_MMU [=n] && BR2_TOOLCHAIN_HAS_THREADS [=y]
Selected by [y]:
- BR2_PACKAGE_RPI_RGB_LED_MATRIX_IMAGE_VIEWER [=y] && BR2_PACKAGE_RPI_RGB_LED_MATRIX [=y]
which occurs when you configure an ARM noMMU FDPIC toolchain (because
we have noMMU, but shared libraries, so rpi-rgb-led-matrix can be
enabled).
Fixes: e821078031 ("package/rpi-rgb-led-matrix: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e67b301f53)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
There's recently been autobuilder failures on
toolchain-external-bootlin, but I wasn't getting notified in the daily
autobuilder e-mail for those failures, which sounded odd as DEVELOPERS
contains:
N: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[...]
F: toolchain/
And indeed, testing:
$ ./utils/get-developers -p toolchain-external-bootlin
returned nothing.
Turns out that the regexp FIND_INFRA_IN_PATCH and FIND_INFRA_IN_MK
used to find the package infrastructure, and ultimately decide if a
given .mk file contains a package, was a bit too strict:
"^\+\$\(eval \$\((host-)?([^-]*)-package\)\)$"
This would only allow packages named <something>-package or
host-<something>-package, but the <something> should not contain any
dash ("-"). So this works fine for cmake-package,
host-autotools-package, but not for toolchain-external-package where
<something> is toolchain-external and it contains a dash.
We fix this by relaxing the regexp a bit and allowing any character in
<something>. Consider the rest of the regexp that expects $(eval
$(<host>-<something>-package)), it seems highly unlikely to match
anything else but the line we're interested in.
With this fix:
$ ./utils/get-developers -p toolchain-external-bootlin
Giulio Benetti <giulio.benetti@benettiengineering.com>
Romain Naour <romain.naour@gmail.com>
Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This issue has existed since the toolchain-external-package
infrastructure had been added.
Fixes: 1c99d70e52 ("toolchain-external: introduce toolchain-external-package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 592d5c517e)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Building zabbix without libcurl enabled would lead to the following
error:
/usr/bin/ld: .../src/libs/zbxxml/xml.c:515:(.text+0x1c64): undefined reference to `zbx_vector_str_append'
This issue has been addressed in the upstream commit [1] and backported
as a patch in Buildroot.
For more information see the upstream issue [2].
This error is reproducible with the following defconfig:
cat >.config <<EOF
BR2_arm=y
BR2_cortex_a7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_PACKAGE_PHP=y
BR2_PACKAGE_ZABBIX=y
BR2_PACKAGE_ZABBIX_SERVER=y
BR2_PACKAGE_ZABBIX_SERVER_COPY_FRONTEND=y
EOF
make oldefconfig
make zabbix
[1] https://git.zabbix.com/projects/ZBX/repos/zabbix/commits/e8333ca2128
[2] https://support.zabbix.com/browse/ZBX-27635
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 489aefc22a)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Zabbix 7.2 is EOL since December 2025 [1]
For more info on the version bump, see:
- https://www.zabbix.com/rn/rn7.2.14
- https://www.zabbix.com/rn/rn7.2.15
This fixes the following vulnerabilties:
- CVE-2026-23920:
Host and event action script input is validated with a regex (set by
the administrator), but the validation runs in multiline mode. If ^
and $ anchors are used in user input validation, an injected newline
lets authenticated users bypass the check and inject shell commands.
https://www.cve.org/CVERecord?id=CVE-2026-23920
- CVE-2026-23921:
A low privilege Zabbix user with API access can exploit a blind SQL
injection vulnerability in include/classes/api/CApiService.php to
execute arbitrary SQL selects via the sortfield parameter. Although
query results are not returned directly, an attacker can exfiltrate
arbitrary database data through time-based techniques, potentially
leading to session identifier disclosure and administrator account
compromise.
https://www.cve.org/CVERecord?id=CVE-2026-23921
[1] https://endoflife.date/zabbix
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 055a1e249c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
check-package reports six warnings on S60lldpd: indentation with
spaces, no DAEMON variable, and shellcheck complaints.
The script also masks failures, the exit status of
"[ $? = 0 ] && echo OK || echo FAIL" is the one of echo, so start and
stop always return success. Stopping does not wait for the daemon to
exit either, so a restart can race the instance on its way out.
Rewrite it after package/busybox/S01syslogd, as the manual asks. lldpd
daemonizes and writes the PID file itself, but does not remove it on
exit, so pass the PID file to both start-stop-daemon and the daemon and
drop the stale file once the process is gone. Also pick up arguments
from /etc/default/lldpd and add the customary reload alias.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: remove .checkpackageignore entry to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 2fd1f6b629)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
In commit 203725a46b ("package/clamav:
bump version to 1.0.1"), select BR2_PACKAGE_JSON_C was added to
BR2_PACKAGE_CLAMAV without propagating the BR2_TOOLCHAIN_HAS_SYNC_4
dependency from BR2_PACKAGE_JSON_C.
Since at the same time a dependency on
BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS was added to clamav and
Rust is not supported on the few architectures that don't have 4-byte
sync intrinsics, this has basically no effect, but ensure a correct
propagation of dependencies.
Fixes: 203725a46b ("package/clamav: bump version to 1.0.1")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 39b840beef)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_FALCOSECURITY_LIBS selects BR2_PACKAGE_HOST_GRPC and
BR2_PACKAGE_HOST_PROTOBUF, neither of which exists. These selects are
anyway not needed, so drop them.
Fixes: a15e35c4eb ("falcosecurity-libs: add new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7f5bb493e2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_WEBKITGTK_MULTIMEDIA selects BR2_PACKAGE_GST1_LIBAV, which
depends on BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS, but doesn't propagate
this dependency. In practice, there is no issue, as webkitgtk is only
available on a subset of CPU architectures, while
BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS makes ffmpeg available on pretty much
all CPU architectures, except Cortex-M, m68k coldfire, and some
specific cases of OpenRISC, which are not supported by webkitgtk.
But for the sake of having correct dependency propagation, let's fix
this.
The other packages selected by BR2_PACKAGE_WEBKITGTK_MULTIMEDIA have
dependencies that are already handled at the top-level
BR2_PACKAGE_WEBKITGTK option.
Fixes: e6e549b9e4 ("ffmpeg: add BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit da90655637)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In commit
0e2c958e05 ("package/libseccomp: bump to
version 2.5.3"), the kernel headers dependency of seccomp was bumped
from 3.12 to 3.17, but BR2_PACKAGE_WEBKITGTK_SANDBOX, which is a
reverse dependency of BR2_PACKAGE_LIBSECCOMP was forgotten.
This commit fixes this inconsistency.
Fixes: 0e2c958e05 ("package/libseccomp: bump to version 2.5.3")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit ef92929504)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_LIBSSH_OPENSSL unconditionnally selects
BR2_PACKAGE_LIBOPENSSL_ENGINES even though libressl is also supported
as an OpenSSL provider (and BR2_PACKAGE_LIBOPENSSL_ENGINES doesn't
make sense for libressl).
This causes the following Kconfig warning:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LIBOPENSSL_ENGINES
Depends on [n]: <choice> && BR2_PACKAGE_LIBOPENSSL [=n]
Selected by [y]:
- BR2_PACKAGE_LIBSSH_OPENSSL [=y] && <choice> && BR2_PACKAGE_OPENSSL [=y]
We checked that libssh, with OpenSSL support and libressl selected as
an OpenSSL provider works fine, using the following defconfig:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_LIBSSH=y
BR2_PACKAGE_LIBSSH_SERVER=y
BR2_PACKAGE_LIBRESSL=y
Fixes: 62103be918 ("package/libssh: select BR2_PACKAGE_LIBOPENSSL_ENGINES")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f7fe354ada)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_QT5CINEX selects BR2_PACKAGE_QT5BASE_PNG,
BR2_PACKAGE_QT5BASE_WIDGETS and BR2_PACKAGE_QT5BASE_EGLFS, which are
all sub-options of BR2_PACKAGE_QT5BASE_GUI, but we don't explicitly
selects BR2_PACKAGE_QT5BASE_GUI.
It turns out that things work because the package selects
BR2_PACKAGE_QT5GRAPHICALEFFECTS, which selects
BR2_PACKAGE_QT5DECLARATIVE_QUICK, which selects
BR2_PACKAGE_QT5BASE_GUI, but that is rather non-obvious, and it makes
more sense for BR2_PACKAGE_QT5CINEX to directly select
BR2_PACKAGE_QT5BASE_GUI if it also selects sub-options of it.
No functional change.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit f077ba9e67)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
- BR2_PACKAGE_IVI_HOMESCREEN_AUDIO_PLAYERS selects gstreamer1, which
has a depends on BR2_USE_MMU, but does not propagate it
- BR2_PACKAGE_IVI_HOMESCREEN_FLUTTER_SECURE_STORAGE_PLUGIN selects
libsecret, which has a depends on BR2_USE_MMU, but does not propagate
it
In practice there is no problem since ivi-homescreen depends on glibc,
and glibc doesn't support any noMMU architecture. But just by walking
the chain of option dependencies, this is not something that is
theoretically guaranteed (making automated verification of
dependencies difficult).
The other "depends on" from gstreamer1 and libsecret, BR2_USE_WCHAR
and BR2_TOOLCHAIN_HAS_THREADS are on the other hand already handled by
the top-level BR2_PACKAGE_IVI_HOMESCREEN option, so there is no
ambiguity.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 90aeea08bb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_PULSEVIEW selects BR2_PACKAGE_QT5BASE_PNG and
BR2_PACKAGE_QT5BASE_WIDGETS, which both depend on
BR2_PACKAGE_QT5BASE_GUI. It ends working because we also select
BR2_PACKAGE_QT5SVG, which selects BR2_PACKAGE_QT5BASE_GUI, so there is
no bug, but it's bit inconsistent to select sub-options that have a
"depends on" without selecting the option they depend on.
This not a bug fix, it has no functional implication.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit aff091c39d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
pocketpy enables thread support by default (PK_ENABLE_THREADS=ON) and
then requires Threads from cmake, which fails on toolchains without
thread support:
CMake Error at /usr/share/cmake-3.28/Modules/FindPackageHandleStandardArgs.cmake:230 (message):
Could NOT find Threads (missing: Threads_FOUND)
Thread support is optional, so enable it only when the toolchain
provides threads.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 376daf3dd0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The definition of BR2_PACKAGE_KODI_ARCH_SUPPORTS is incorrect, it
goes like this:
bool
default y if BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS
default y if BR2_PACKAGE_HOST_OPENJDK_BIN_ARCH_SUPPORTS
so it means it would be "y" if either
BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS *OR*
BR2_PACKAGE_HOST_OPENJDK_BIN_ARCH_SUPPORTS is true. While clearly what
we need is for both to be true: ffmpeg should be available for the
target architecture, and openjdk should be available for the host
architecture.
One option was to change to:
bool
default y if BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS && BR2_PACKAGE_HOST_OPENJDK_BIN_ARCH_SUPPORTS
Or:
bool
default y if BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS
depends on BR2_PACKAGE_HOST_OPENJDK_BIN_ARCH_SUPPORTS
But we preferred:
bool
default y
depends on BR2_PACKAGE_FFMPEG_ARCH_SUPPORTS
depends on BR2_PACKAGE_HOST_OPENJDK_BIN_ARCH_SUPPORTS
Fixes: b6a2f49429 ("package/kodi: depend on host-openjdk-bin instead of selecting BR2_NEEDS_HOST_JAVA")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00e83bc24d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Even though kodi itself has architecture dependencies (expressed
through BR2_PACKAGE_KODI_ARCH_SUPPORTS, the option
BR2_PACKAGE_KODI_MYSQL selects BR2_PACKAGE_MARIADB, which has its own
architecture dependencies as well. Make sure to propagate those to
BR2_PACKAGE_KODI_MYSQL, which doesn't require adding a Config.in
comment as these are purely architecture dependencies.
We haven't replicate all dependencies of BR2_PACKAGE_MARIADB because
all the others are covered by the top-level BR2_PACKAGE_KODI, and
propagating them would require adding a Config.in comment for
BR2_PACKAGE_KODI_MYSQL.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 16e3d628bd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Since hidapi was introduced in commit
6267f34afd, it forgot to propagate some
dependencies of libgudev (which existed back then). Initially libgudev
was only needed when BR2_INIT_SYSTEMD=y, but still the dependencies
were not propagated for the systemd case.
Anyway, since e739dd5a11, libgudev is a
mandatory dependency of hidapi, independently from the selected init
system.
We make sure to propagate all dependencies of libgudev to hidapi, and
propagate them to the reverse dependencies of hidapi.
Fixes: 6267f34afd ("hidapi: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 74def2cdd4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_ARGP_STANDALONE is defined as follows:
config BR2_PACKAGE_ARGP_STANDALONE
depends on !BR2_TOOLCHAIN_USES_GLIBC
Some packages did:
select BR2_PACKAGE_ARGP_STANDALONE if !BR2_TOOLCHAIN_USES_GLIBC
while a number of others did:
select BR2_PACKAGE_ARGP_STANDALONE if BR2_TOOLCHAIN_USES_UCLIBC || BR2_TOOLCHAIN_USES_MUSL
This commit harmonizes the situation, by settling on the first
solution ("if !BR2_TOOLCHAIN_USES_GLIBC") as it matches how
BR2_PACKAGE_ARGP_STANDALONE is defined in the first place.
No functional change.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 1799bf3680)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_INTEL_VPL_GPU_RT selects BR2_PACKAGE_INTEL_MEDIADRIVER but
did not propagate "depends on BR2_TOOLCHAIN_GCC_AT_LEAST_8". This
commit fixes this issue, which was introduced in commit
ac65841def, when onevpl-intel-gpu was
introduced (it was later renamed to intel-vpl-gpu-rt).
Fixes: ac65841def ("package/onevpl-intel-gpu: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 876023bc5a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_INTEL_MEDIASDK selects BR2_PACKAGE_INTEL_MEDIADRIVER but
forgets to propagate the "depends on BR2_TOOLCHAIN_GCC_AT_LEAST_8".
This issue was introduced in commit
51b60c8acf, when "depends on
BR2_TOOLCHAIN_GCC_AT_LEAST_8" was added to mesa3d, propagated to
intel-mediadriver, but not intel-mediasdk.
Fixes: 51b60c8acf ("package/mesa3d: needs gcc >= 8")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit fa38fea91c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_PYTHON_MEMRAY selects BR2_PACKAGE_LIBUNWIND but forgot to
propagate "depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9".
Fixes: c2df8bab97 ("package/python-memray: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e36370624d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_PYTHON_GRPCIO_REFLECTION selects
BR2_PACKAGE_PYTHON_PROTOBUF, but forgot to replicate "depends on
BR2_PACKAGE_HOST_PROTOBUF_ARCH_SUPPORTS".
Fixes: 3217fedcb8 ("package/python-grpcio-reflection: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 74dab03495)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_PYTHON_GOOGLEAPIS_COMMON_PROTOS selects
BR2_PACKAGE_PYTHON_PROTOBUF but did not propagate
BR2_PACKAGE_HOST_PROTOBUF_ARCH_SUPPORTS.
Fixes: d37766a886 ("package/python-googleapis-common-protos: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 548904619c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Commit 66ddec89e8 ("package/udisks: bump
to version 2.92") mistakenly removed the BR2_USE_MMU dependency of
udisks when dropping "select BR2_PACKAGE_LVM2". Indeed, BR2_USE_MMU is
a dependency of many other packages selected by udisks.
Interestingly, the Config.in comments in the same file still had the
"depends on BR2_USE_MMU" dependencies.
Fixes: 66ddec89e8 ("package/udisks: bump to version 2.92")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4b8259bad9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Since bcc was introduced in commit
146498d13c, it lacked a dependency
propagation from clang for BR2_TOOLCHAIN_HAS_GCC_BUG_64735, this
commit fixes this mistake.
Fixes: 146498d13c ("package/bcc: new package")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit c305370f36)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS redefines the conditions to
determine if a host go compiler is available for the current host
architecture. Instead, make it explicit that those conditions are the
same by re-using BR2_PACKAGE_HOST_GO_HOST_ARCH_SUPPORTS.
No functional change.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 71d3ffd372)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
In commit
fef9cad1fe ("package/libxmlsec1: bump
version to 1.3.12"), libxmlsec1 was bumped, and alongside some
additional "depends on" were added.
However, these new "depends on" were not propagated to reverse
dependencies of libxmlsec1, i.e. openscap, causing Kconfig warnings:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LIBXMLSEC1
Depends on [n]: BR2_TOOLCHAIN_GCC_AT_LEAST_7 [=n] && BR2_TOOLCHAIN_HAS_ATOMIC [=n]
Selected by [y]:
- BR2_PACKAGE_OPENSCAP [=y] && BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_HAS_THREADS_NPTL [=y]
and potentially some build issues, even though we didn't check in the
autobuilders for potential failures.
This commit fixes that by properly propagating the new dependencies.
Cc: Alexis Lothoré <alexis.lothore@bootlin.com>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Acked-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 36b2b3f561)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
The demo programs, which have always been built and are still enabled by
default, gained a zlib dependency in imlib2 1.12.3: upstream commit
f8a451043871 ("imlib2_load: Add crc32 printout") started using zlib's
crc32() in imlib2_load, and 31006b425e11 ("imlib2_view: Optionally show
crc32 of image data") did the same for imlib2_view. Both hardcoded -lz.
Upstream commit b9555030dace ("autofoo: don't hardcode zlib flags"),
first released in 1.12.4, replaced -lz with $(ZLIB_LIBS) and added an
unconditional PKG_CHECK_MODULES(ZLIB, zlib) to the demo programs branch
of configure, turning the previously silent link-time requirement into a
configure failure:
checking for zlib... no
configure: error: Package requirements (zlib) were not met:
Package 'zlib' not found
As Buildroot went straight from 1.7.3 to 1.12.5 the intermediate state
was never packaged, but the dependency has in fact been missing since the
crc32 support landed.
Fixes: https://autobuild.buildroot.org/results/4e05404c353ef985d74757d0b1ec3eda2cdff523/
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 051e5ab13b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/tukaani-project/xz/releases/tag/v5.8.4
- lzma_alone_decoder(), lzma_lzip_decoder(),
lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
invalid memory access after memory allocation has failed and
the application reinitializes the existing decoder to decode
a different file. This bug could at least result in a crash.
This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
(Also in v5.2, v5.4, and v5.6.)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f125a6530)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Fixes a sandbox escape through symlink traversal tracked in
CVE-2026-87766, which affects all previous versions.
Using the bwrap binary with the setuid bit set is no longer supported
and user namespaces are now always required, so a kernel config fixup
is applied.
A new build option allows indicating the minimum kernel version that
will be used, which removes code used for backwards compatibility with
kernels older than 5.6.0 when a newer version is specified. Passing
$(LINUX_VERSION_PROBED) seems reasonable here.
This version also changed the license from LGPL-2.0+ to LGPL-2.1+,
hence the updated hash.
Release notes:
https://github.com/containers/bubblewrap/releases/tag/v0.12.0
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
[Julien: fix _LINUX_CONFIG_FIXUPS by adding the missing "_LINUX"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4cb6193d2e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
To indicate that a patch fixes a vulnerability in Buildroot, the convention is:
1. In the patch file, add a tag 'CVE: <cve id>'
2. In <pkg>.mk, and an entry to <PKG>_IGNORE_CVES, and add a comment above
that new entry to reference the patch file(s)
However, as packages get bumped and their patches are added, removed or
rebased; it happens that IGNORE_CVES get outdated. One important issue is
marking a CVE as ignored, while the corresponding patch is not in Buildroot.
To detect such cases, add a new checker to checkpackagelib that finds
occurences of:
# 000x-some-patch.patch
PKG_IGNORE_CVES += CVE-XXXX-YYYY
For each one of them, ensure that the mentioned patch files actually exist
and contain the `CVE: ...` tag.
Assisted-by: Claude:claude-opus-4.8
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit b00ac4e346)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Prior to improving check-package to verify that the comment preceding
a <pkg>_IGNORE_CVES entry mentions an existing patch, and that the
patch itself contains a CVE: tag, we fix all problematic cases that
currently exist in Buildroot:
- In the case of binutils: the CVE was only applicable to binutils
2.43/2.44, and the oldest version now supported is 2.45, so the
patch doesn't exist anymore in Buildroot
- For x11vnc, fix a typo in the patch name
- For gpsd the patches were dropped in [1] as they are included in the
version bump
- Similarly for micropython, the patches were dropped in [2] along with
the version bump
- For util-linux, strip the prefix "package/util-linux/", so that the patch
is relative to the .mk file and can be found by the new check
- Add missing 'CVE:' tag to net-tools patch 0001
[1] 37ef4f862f package/gpsd: bump version to 3.27.2
[2] 28eeca9a98 package/micropython: bump to version 1.28.0
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 636f69ab45)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48
Fixes the following security issues:
(Security fix for specific API usage, GHSA-2p8c-ff85-vh9x)
If pcre2_jit_compile() is called with options for some match modes, and
then pcre2_match() is used to perform a match for a different match
mode, an out-of-bounds read can occur if the match is attempted against
invalid UTF input.
(Security fix for pattern conversion, GHSA-q8g2-wprr-34m9)
If pcre2_convert() is called on untrusted input on platforms with
32-bit size_t, an out-of-bounds heap write can occur.
(Security fix, GHSA-3r4p-g7gg-ppmf) Fixed an out-of-bounds write in DFA
matching when using a heap limit; also fixed possible integer overflows
which could cause under-allocation of the workspace.
(Security fix, GHSA-fmgr-6ggq-9859) Added bounds checks for several
integer overflows while compiling patterns on 32-bit CPUs, which could
cause under-allocation followed by out-of-bounds writes.
(Security fix, GHSA-9qww-pwc4-77qq) Applied lower buffer bound to
prevent two out-of-bounds reads while scanning backwards through
invalid UTF data with PCRE2_MATCH_INVALID_UTF.
(Security fix for specific API usage, #937) Fixed a leak and later
invalid free when calling the fast-path pcre2_jit_match() function with
a match data object previously used with pcre2_match() and
PCRE2_COPY_MATCHED_SUBJECT.
(Low-severity security fix, GHSA-q7rw-r7qq-2hx6) Fixed exposure of two
uninitialised bytes from malloc() via pcre2_serialize_encode().
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 664db5d62c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/kernelsauce/turbo/releases/tag/v2.1.5https://github.com/kernelsauce/turbo/releases/tag/v2.1.4
Security fixes:
HTTP header injection: header values were only checked for a literal
\r\n, so a lone \r or \n could still split a header. Now rejected on
either character.
Transfer-Encoding requests are now rejected with 501 instead of silently
mishandled, closing a request smuggling avenue.
A real default request body size cap (128 MB) with a 413 response,
previously unbounded.
Secure cookie signature now binds the cookie name, so a value signed for
one cookie can no longer be replayed under a different name.
Verification failures return the default value instead of raising.
Constant-time comparison for the secure cookie HMAC, previously a
timing-leaky ==.
util.secure_random_bytes reads real OS entropy (/dev/urandom,
BCryptGenRandom on Windows) for WebSocket masks and util.rand_str,
previously math.random.
WebSocket: unmasked client frames are rejected per RFC 6455, and
fragmented message reassembly is capped to max_buffer_size to close a
memory exhaustion path.
StaticFileHandler decodes the request path before the traversal check,
closing a bypass.
Fixed a 32-byte-per-malformed-request memory leak in the C header parser
wrapper (found via libFuzzer).
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 15a422cee1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Upstream started using std::string_view
https://github.com/search?q=repo%3APurpleI2P%2Fi2pd+string_view&type=commits&s=committer-date&o=asc
with commit
a3e0b3710c
first released in version 2.54.0 which was added to buildroot with
commit dea4f02bbb.
Building the package with the gcc6-based defconfig
bootlin-aarch64-glibc-old is broken:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/i2pd-2.61.0/libi2pd/Base.h:14:23:
fatal error: string_view: No such file or directory
BR2_TOOLCHAIN_HAS_GCC_BUG_64735 can be removed as well now as it depends
on gcc < 7.
A backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit a6bb4d52c0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
https://github.com/the-tcpdump-group/libpcap/blob/libpcap-1.10.7/CHANGES
Fixes the following CVEs:
CVE-2026-0799: Access M[] safely in the BPF interpreter.
CVE-2026-31912: Mind the program bounds in pcap_offline_filter().
CVE-2026-31911: Fail opcodes safely in the BPF interpreter.
CVE-2026-6244: Avoid division by zero via pcap_offline_filter().
CVE-2026-6554: Limit "ja L" looping in pcap_offline_filter().
CVE-2026-18313: Fix a memory leak in rpcapd.
CVE-2026-18238: Fix RPCAP_MSG_PACKET validation.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 446c0f85b8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
igh-ethercat is failing while attempting to apply patches,
with error:
Applying 0002-Linux-6.19.0-support.patch using patch:
patching file devices/generic.c
Reversed (or previously applied) patch detected! Skipping patch.
1 out of 1 hunk ignored -- saving rejects to file devices/generic.c.rej
The package patch 0002 was added in [1] in branch "master" while it
was in release client cycle. It was cherry-picked in [2] in branch
"next" to apply the bump [3] (which removes the package patches 0001
and 0002). When the branch "next" was merged in "master" in commit [4],
the patch 0002 was kept.
This commit removes this stale patch.
[1] e4cf512c39
[2] 8a5fc970b4
[3] 0a91e760f4
[4] 5f26877955
Fixes:
- https://autobuild.buildroot.org/results/4f509f1f788c1b8dc5a840ffa2e435c5ed7b6eea/
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d071817969)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libde265/releases/tag/v1.1.2
Security fixes:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-xp3h-6f5r-8cxp) Heap use-after-free and double free
in multi-threaded (WPP) decoding. A crafted stream whose slice segments
repeat or rewind their slice_segment_address within a picture re-ran
CTB rows that were already marked finished, so the CABAC context handoff
between rows was no longer ordered and the shared context table was
released twice. Slice segments that do not follow the previous one in
tile-scan order are now rejected with the new warning
DE265_WARNING_SLICE_SEGMENT_ADDRESS_NOT_INCREASING, and the WPP row
progress is reset for each slice segment. (medium)
CVE-2026-XXXXX (GHSA-mm7m-v26f-wf8x) Heap use-after-free after
de265_reset(): the pointer to the previous slice header was left
dangling when the DPB was cleared, and a dependent slice pushed after
the reset copied from freed memory. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e55cb31085)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
https://github.com/strukturag/libheif/releases/tag/v1.23.3
Fixes the following CVEs:
(CVE numbers will be added when assigned.)
CVE-2026-XXXXX (GHSA-x8r2-mggj-j6wr) Heap buffer overflow (write) in the
uncompressed (unci) mixed-interleave decoder when the two chroma
components declare different bit depths. Both the written bytes and the
overflow length are controlled by the file. (critical)
CVE-2026-XXXXX (GHSA-8fmq-r4pf-7m57) Permanent decoder deadlock through
a reference cycle between an image and its alpha auxiliary image. The
alpha edge was not covered by the cycle guard and re-entered a held
mutex. (high)
CVE-2026-XXXXX (GHSA-w7mc-p8jc-p853) Heap out-of-bounds read in the
YCbCr 4:2:0 to 16-bit interleaved RGB conversion when the chroma
planes have a lower bit depth than luma. Heap memory could end up in
the decoded image. YCbCr conversions with mismatched luma and chroma
bit depths are now rejected. (high)
CVE-2026-XXXXX (GHSA-4jqm-2x34-6f6r) Heap buffer overflow in the SVT-AV1
encoder plugin when encoding a high-bit-depth alpha channel, and a
double free on its send-picture error path. (high)
CVE-2026-84451 (GHSA-hh47-fhqr-cj2r) Incomplete fix for
GHSA-73p7-m7gg-w2jv: the tile range check of the unci decoder (without
icef) could still overflow, allowing an out-of-bounds read. (medium)
CVE-2026-XXXXX (GHSA-4h82-g446-83fm) Heap out-of-bounds read when
converting odd-height 4:2:0 frames of an uncompressed (uncv) image
sequence to RGB. (medium)
CVE-2026-XXXXX (GHSA-9rj8-5mp5-26c9) Out-of-bounds read in the RGB to
YCbCr identity-matrix color conversion when the R, G, and B planes
have different bit depths. (medium)
CVE-2026-84450 (GHSA-gh5q-69gg-c964) A clap property combined with an
oversized ispe reached an assert() in the Fraction arithmetic and
aborted the process (incomplete fix for GHSA-jc8f-p23p-5hjg). An error
is returned instead. (medium)
(GHSA-mw6f-29j3-76f4) Several smaller findings:
heif_image_handle_get_depth_image_handle() and
heif_image_handle_get_depth_image_representation_info() dereferenced a
null pointer on files without a depth image; the TIFF input decoder of
the example tools had an unbounded EXIF tag allocation and a division
by zero on zero YCbCr subsampling; assert()s in the PNG input decoder
are now error returns; integer overflow in the Go binding's
ImageAccess.GetPlane(); heif-view now verifies the decoded frame size
before display. (medium)
(GHSA-8857-r8x5-7499) Undefined behavior (negative shift) in the HDR
bit-depth up-conversion for target bit depths above 16. Such
conversions are now rejected. (low)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d148168e20)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot commit 9a43bf6593 bumped the gcc
dependency from 9 to 10 but forgot to propagate this change to the
libcamera-apps package.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 64ed9e6c43)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Buildroot 262a7f6d2f added the package but
forgot to provide the hash for LICENSE.GPL3-EXCEPT, instead a hash for
a non-existing file was added to qt5knx.hash.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit d2b7199dea)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig and test configurations using
support/scripts/gen-bootlin-toolchains.
This adds BR2_USE_MMU to the affected uClibc entries and to the
architecture support conditions, and updates the generated tests.
The glibc and musl changes only reorder their existing BR2_USE_MMU
dependencies.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9c6eed9ec0)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
The Bootlin uClibc toolchains for m68k-68xxx, riscv32-ilp32d, and
xtensa-lx60 require an MMU. However, their generated Kconfig entries
lack a BR2_USE_MMU dependency, allowing them to be selected for noMMU
configurations. External toolchain validation then fails with:
MMU support available in C library, please enable BR2_USE_MMU
Add the missing BR2_USE_MMU dependencies for these architectures to
prevent them from being selected for noMMU targets.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3469c6793c)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Regenerate the Bootlin toolchain Kconfig file with
support/scripts/gen-bootlin-toolchains to remove duplicate
BR2_TOOLCHAIN_HAS_THREADS selections.
Commit 184d47a7ad ("support/scripts/gen-bootlin-toolchains: add new
script to support Bootlin toolchains") initially introduced this issue.
Although commit a33e1af4a0 ("support/scripts/gen-bootlin-toolchains:
avoid selecting _HAS_THREADS multiple times") fixed the generator script,
the Config.in.options file was not regenerated accordingly.
This is a non-functional cleanup, as repeated Kconfig select statements
are harmless.
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 9556895e78)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
dtui depends on tui-textarea which unconditionally imports AtomicU64 in
src/widget.rs to pack a viewport rectangle into a single atomic word:
use std::sync::atomic::{AtomicU64, Ordering};
pub struct Viewport(AtomicU64);
As there is no cfg(target_has_atomic) guard in tui-textarea, its
build fails on any target for which rustc does not provide 64-bit
atomics with:
Compiling tui-textarea v0.7.0
error[E0432]: unresolved import `std::sync::atomic::AtomicU64`
--> .../dtui-3.0.0/VENDOR/tui-textarea/src/widget.rs:10:25
|
10 | use std::sync::atomic::{AtomicU64, Ordering};
| ^^^^^^^^^ no `AtomicU64` in `sync::atomic`
|
help: a similar name exists in the module
|
10 - use std::sync::atomic::{AtomicU64, Ordering};
10 + use std::sync::atomic::{AtomicU32, Ordering};
This has been reported to tui-textarea upstream, but unfortunately the
project seems to be unmaintained (issue linked below). A sane workaround
is to disable the package on targets which lack 64-bit atomic support,
which is exactly what BR2_PACKAGE_HOST_RUSTC_TARGET_HAS_ATOMIC_U64
describes: it is n for armv5te-unknown-linux-{gnu,musl}eabi and
powerpc-unknown-linux-gnu, the only rust targets Buildroot can generate
which lack 64-bit atomics, and y everywhere else.
The same problem was hit by package/dust and worked around in commit
3abc3b97ba ("package/dust: bump to version 1.1.2") by bumping to a
version in which upstream had added the missing guard. That is not an
option here as tui-textarea 0.7.0 is the latest release.
Note that a runtime test for dtui cannot use the default
infra.basetest.BASIC_TOOLCHAIN_CONFIG, since that builds with
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_GLIBC_STABLE, where dtui is now
disabled; such a test would need an armv7 or aarch64 toolchain instead.
Build tested with utils/test-pkg against:
- BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_GLIBC_STABLE
- BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_MUSL_STABLE
- BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_POWERPC_E500MC_GLIBC_STABLE
all three fail with the above error before this change and are skipped
after it, while armv7 (glibc and musl), aarch64, powerpc64le and x86-64
still select and build the package.
Link: https://github.com/rhysd/tui-textarea/issues/66
Fixes: https://autobuild.buildroot.org/results/188f6442371500731453f75983590c922eab6d57
Fixes: https://autobuild.buildroot.org/results/e254db2654f18f1d2110eb8b1a32b43ad0f2a3d6
Signed-off-by: Christopher Obbard <chris.obbard@oss.qualcomm.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 99529edaef)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Rust does not provide 64-bit atomics on every target Buildroot can
generate. rustc sets max_atomic_width = 32 for three of the 25 targets
listed in RUST_TARGETS in utils/update-rust, so
core::sync::atomic::AtomicU64 and AtomicI64 simply do not exist there:
$ rustc --print cfg --target <target> | grep target_has_atomic
armv5te-unknown-linux-gnueabi "16" "32" "8" "ptr"
armv5te-unknown-linux-musleabi "16" "32" "8" "ptr"
powerpc-unknown-linux-gnu "16" "32" "8" "ptr"
Every other supported target, including armv6, armv7, aarch64, all the
x86 variants, riscv64, s390x, sparc64 and both 64-bit powerpcs, has
them, e.g.:
arm-unknown-linux-gnueabi "16" "32" "64" "8" "ptr"
armv7-unknown-linux-gnueabihf "16" "32" "64" "8" "ptr"
A crate that uses 64-bit atomics without a cfg(target_has_atomic = "64")
guard therefore fails to build on those three targets with:
error[E0432]: unresolved import `std::sync::atomic::AtomicU64`
|
| atomic::{AtomicU64, AtomicU8, AtomicUsize, Ordering},
| ^^^^^^^^^ no `AtomicU64` in `sync::atomic`
This has been hit at least twice already: by package/dust, worked around
in commit 3abc3b97ba ("package/dust: bump to version 1.1.2") by moving
to a release in which upstream had added the guard and by package/dtui,
which has no such release available and had to open-code the affected
architectures instead.
It is likely to keep recurring: infra.basetest.BASIC_TOOLCHAIN_CONFIG
builds with BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_GLIBC_STABLE, so
every runtime test that does not override the toolchain compiles for
armv5te, one of the three affected targets. That is exactly how the two
failures above were found.
Add a hidden symbol so packages can express this constraint once, rather
than each open-coding BR2_ARM_CPU_ARMV5 and BR2_powerpc and needing to
update whenever rust gains or changes a target.
Note that armv5te and 32-bit powerpc are only supported by rust for
glibc and musl, so the uclibc variants of those architectures are
already excluded by BR2_PACKAGE_HOST_RUSTC_TARGET_ARCH_SUPPORTS.
Signed-off-by: Christopher Obbard <chris.obbard@oss.qualcomm.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 698535473f)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
DEJAVU_LICENSE is primarily BitstreamVera. The license file also
specifies that DejaVu-specific changes and certain math extensions are
in the Public Domain. This matches the licensing logic used by
OpenEmbedded/Yocto.
Signed-off-by: Martin Bachmann <martin.bachmann@designwerk.com>
[Fiona: wrap lines in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit df61b7e9bb)
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Was missed when the download page was updated for 2026.08-rc3 in commit
e6b06b8d9c ("Update for 2026.08-rc3").
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See the changelogs:
- https://www.erlang.org/patches/OTP-26.2.5.16
- https://www.erlang.org/patches/OTP-26.2.5.17
- https://www.erlang.org/patches/OTP-26.2.5.18
- https://www.erlang.org/patches/OTP-26.2.5.19
- https://www.erlang.org/patches/OTP-26.2.5.20
- https://www.erlang.org/patches/OTP-26.2.5.21
This fixes the following vulnerabilities:
- CVE-2026-21620:
Relative Path Traversal, Improper Isolation or Compartmentalization
vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp
inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows
Relative Path Traversal. This vulnerability is associated with program
files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-21620
- CVE-2026-23941:
Inconsistent Interpretation of HTTP Requests ('HTTP Request
Smuggling') vulnerability in Erlang OTP (inets httpd module) allows
HTTP Request Smuggling. This vulnerability is associated with program
files lib/inets/src/http_server/httpd_request.erl and program routines
httpd_request:parse_headers/7. The server does not reject or
normalize duplicate Content-Length headers. The earliest Content-
Length in the request is used for body parsing while common reverse
proxies (nginx, Apache httpd, Envoy) honor the last Content-Length
value. This violates RFC 9112 Section 6.3 and allows front-end/back-
end desynchronization, leaving attacker-controlled bytes queued as the
start of the next request.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23941
- CVE-2026-23942:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path
Traversal. This vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines
ssh_sftpd:is_within_root/2. The SFTP server uses string prefix
matching via lists:prefix/2 rather than proper path component
validation when checking if a path is within the configured root
directory. This allows authenticated users to access sibling
directories that share a common name prefix with the configured root
directory. For example, if root is set to /home/user1, paths like
/home/user10 or /home/user1_backup would incorrectly be considered
within the root.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23942
- CVE-2026-23943:
Improper Handling of Highly Compressed Data (Compression Bomb)
vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial
of Service via Resource Depletion. The SSH transport layer advertises
legacy zlib compression by default and inflates attacker-controlled
payloads pre-authentication without any size limit, enabling reliable
memory exhaustion DoS. Two compression algorithms are affected: *
zlib: Activates immediately after key exchange, enabling
unauthenticated attacks * zlib@openssh.com: Activates post-
authentication, enabling authenticated attacks Each SSH packet can
decompress ~255 MB from 256 KB of wire data (1029:1 amplification
ratio). Multiple packets can rapidly exhaust available memory, causing
OOM kills in memory-constrained environments. This vulnerability is
associated with program files lib/ssh/src/ssh_transport.erl and
program routines ssh_transport:decompress/2,
ssh_transport:handle_packet_part/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23943
- CVE-2026-28810:
Generation of Predictable Numbers or Identifiers vulnerability in
Erlang/OTP kernel (inet_res, inet_db modules) allows DNS Cache
Poisoning. The built-in DNS resolver (inet_res) uses a sequential,
process-global 16-bit transaction ID for UDP queries and does not
implement source port randomization. Response validation relies almost
entirely on this ID, making DNS cache poisoning practical for an
attacker who can observe one query or predict the next ID. This
conflicts with RFC 5452 recommendations for mitigating forged DNS
answers. inet_res is intended for use in trusted network environments
and with trusted recursive resolvers. Earlier documentation did not
clearly state this deployment assumption, which could lead users to
deploy the resolver in environments where spoofed DNS responses are
possible. This vulnerability is associated with program files
lib/kernel/src/inet_db.erl and lib/kernel/src/inet_res.erl.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-28810
- CVE-2026-32147:
Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability in Erlang OTP ssh (ssh_sftpd module) allows
an authenticated SFTP user to modify file attributes outside the
configured chroot directory. The SFTP daemon (ssh_sftpd) stores the
raw, user-supplied path in file handles instead of the chroot-resolved
path. When SSH_FXP_FSETSTAT is issued on such a handle, file
attributes (permissions, ownership, timestamps) are modified on the
real filesystem path, bypassing the root directory boundary entirely.
Any authenticated SFTP user on a server configured with the root
option can modify file attributes of files outside the intended chroot
boundary. The prerequisite is that a target file must exist on the
real filesystem at the same relative path. Note that this
vulnerability only allows modification of file attributes; file
contents cannot be read or altered through this attack vector. If the
SSH daemon runs as root, this enables direct privilege escalation: an
attacker can set the setuid bit on any binary, change ownership of
sensitive files, or make system configuration world-writable. This
vulnerability is associated with program files
lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:do_open/4 and
ssh_sftpd:handle_op/4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32147
- CVE-2026-42789:
Improper Following of a Certificate's Chain of Trust vulnerability in
Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate
to be accepted as an intermediate issuer, enabling certificate chain
forgery. In lib/public_key/src/pubkey_cert.erl,
pubkey_cert:validate_extensions/7 contains two flaws that together
allow a certificate with basicConstraints cA:false and no keyUsage
extension to be used as an intermediate issuer in a chain passed to
public_key:pkix_path_validation/3: the cA:false clause recurses into
the remaining extensions without rejecting the certificate when it is
in issuer position, and the keyUsage check only fires when the
extension is present, so a certificate lacking keyUsage entirely
bypasses the keyCertSign enforcement. Any party holding an end-entity
certificate with basicConstraints cA:false and no keyUsage extension,
issued by any CA in the victim's trust store, can use that
certificate's private key to sign forged leaf certificates for
arbitrary identities. public_key:pkix_path_validation/3 accepts the
resulting chain, and by extension every TLS or mTLS endpoint built on
the OTP ssl application that relies on the default verifier is
affected, including server identity verification on the client side
and client certificate verification on mTLS servers.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42789
- CVE-2026-42790:
Improper Certificate Validation vulnerability in Erlang OTP public_key
(pubkey_cert and public_key modules) allows a DNS nameConstraints
bypass via subject CommonName fallback in TLS hostname verification.
Two flaws combine to allow a subordinate CA whose DNS nameConstraints
are restricted (e.g. permitted;DNS:allowed.example.com) to issue a
leaf certificate that an OTP TLS client accepts as a valid identity
for an out-of-scope hostname (e.g. victim.example.com): First,
pubkey_cert:validate_names/6 in lib/public_key/src/pubkey_cert.erl
only checks SAN DNS entries against nameConstraints. Per RFC 5280, a
permitted DNS subtree only restricts certificates that contain a DNS-
typed name. A leaf with no subjectAltName therefore trivially
satisfies any permitted;DNS:... constraint regardless of its subject
commonName. Second, public_key:pkix_verify_hostname/3 in
lib/public_key/src/public_key.erl falls back to the subject commonName
when no subjectAltName is present, extracting id-at-commonName
attributes as presented IDs and matching them against the reference
hostname. The strict pkix_verify_hostname_match_fun(https) matcher
does not suppress this fallback. The result is that path validation
accepts a CN-only leaf under a DNS-constrained intermediate (no SAN
means the nameConstraints are not triggered), and hostname
verification then accepts it via the CN fallback. The bypass is
reachable from stock ssl:connect with verify_peer, a trusted CA, SNI,
and the canonical strict https hostname matcher.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-42790
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch fixes a build error with OpenSSL-enabled libcurl which was
detected by the Gitlab pipelines:
checking for openssl options with pkg-config... found
configure: pkg-config: SSL_LIBS: "-lssl -lcrypto -pthread"
configure: pkg-config: SSL_LDFLAGS: "-L/builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib"
configure: pkg-config: SSL_CPPFLAGS: ""
checking for HMAC_Update in -lcrypto... no
checking for HMAC_Init_ex in -lcrypto... no
checking OpenSSL linking with -ldl... no
checking OpenSSL linking with -ldl and -lpthread... no
checking for SSL_set_quic_use_legacy_codepoint... no
checking for SSL_set_quic_tls_cbs... no
configure: OpenSSL version does not speak any known QUIC API
configure: OPT_OPENSSL: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/host/m68k-buildroot-uclinux-uclibc/sysroot/usr
configure: OPENSSL_ENABLED:
configure: error: --with-openssl was given but OpenSSL could not be detected
make[1]: *** [package/pkg-generic.mk:263: /builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-5208-uclibc/build/libcurl-8.21.0/.stamp_configured] Error 1
Although OpenSSL was found using pkg-config the build tests fail.
A local build shows the concrete error in config.log, for example:
configure:27577: checking for HMAC_Update in -lcrypto
configure:27599: /home/bernd/buildroot/output/host/bin/m68k-linux-gcc
-o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE
-D_FILE_OFFSET_BITS=64 -O2 -g0 -fno-dwarf2-cfi-asm -Wl,-elf2flt=-r
-static -Werror-implicit-function-declaration -Wno-system-headers
-D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64
-D_GNU_SOURCE -Wl,-elf2flt=-r -static
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
-L/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib
conftest.c -lcrypto -lssl -lcrypto -lz -pthread -lz >&5
/home/bernd/buildroot/output/host/opt/ext-toolchain/m68k-buildroot-uclinux-uclibc/bin/ld.real:
/home/bernd/buildroot/output/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib/libcrypto.a(libcrypto-lib-threads_pthread.o):
in function `ossl_rcu_read_lock':
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
This error occurs many times for various atomic operations:
$ grep "undefined reference to \`__atomic" output/build/libcurl-8.20.0/config.log | sort -u | grep -v real
threads_pthread.c:(.text+0x28a): undefined reference to `__atomic_fetch_sub_8'
threads_pthread.c:(.text+0x3b4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0x9c8): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xa4): undefined reference to `__atomic_fetch_add_8'
threads_pthread.c:(.text+0xa9c): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xb66): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xc30): undefined reference to `__atomic_is_lock_free'
threads_pthread.c:(.text+0xcdc): undefined reference to `__atomic_is_lock_free'
The build error can be reproduced with the current buildroot tree using
this defconfig:
BR2_m68k=y
BR2_m68k_cf5208=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_M68K_COLDFIRE_UCLIBC_STABLE=y
BR2_PACKAGE_OPENSSL=y
BR2_PACKAGE_LIBCURL=y
Although the toolchain lacks atomics support
$ grep ATOMIC .config
$
it emits atomic-related defines, for example:
$ echo | output/host/bin/m68k-linux-gcc -dM -E - | grep __ATOMIC_ACQ_REL
#define __ATOMIC_ACQ_REL 4
$
This specific define __ATOMIC_ACQ_REL is used in OpenSSL to enable
atomic support at various places:
https://github.com/openssl/openssl/blob/openssl-3.6.3/crypto/threads_pthread.c
causing the build errors we see with the mentioned defconfig.
To fix the problem we use an OpenSSL-provided define to forcefully
disable the usage of atomic intrinsics.
The misdetection of atomic intrinsics for m68k coldfire is not a new
problem:
https://lists.buildroot.org/pipermail/buildroot/2017-May/180841.htmlhttps://lists.buildroot.org/pipermail/buildroot/2026-May/803110.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Version 0.24.15 change log:
* protocol
fix crash on "sticker delete" and "sticker find"
* database
upnp: fix crash bug
* input
alsa, curl, nfs: fix stalled transfers
* playlist
asx, pls, rss, xspf: limit to 16 MB
cue: fix problem playing CUE tracks in music directory root
* player
fix noise with replay gain and cross-fade
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Floating-point type _Float16 added in gcc-16 on s390 now requires
decimal floating-point support enabled in the toolchain [1][2].
Without decimal floating-point, gcc 16.2.0 fails to build with:
../../../libgcc/config/s390/_dpd_sd_to_hf.c:27:25: error: decimal floating-point not supported for this target
27 | HFtype __dpd_truncsdhf (_Decimal32);
| ^~~~~~~~~~
../../../libgcc/config/s390/_dpd_sd_to_hf.c:31:16: error: decimal floating-point not supported for this target
31 | force_convert (_Decimal32 x)
| ^~~~~~~~~~
../../../libgcc/config/s390/_dpd_hf_to_td.c:34:1: error: decimal floating-point not supported for this target
34 | _Decimal128
| ^~~~~~~~~~~
../../../libgcc/config/s390/_dpd_sd_to_hf.c:35:18: error: decimal floating-point not supported for this target
35 | __dpd_truncsdhf (_Decimal32 x)
Enable decimal floating-point support as suggested by Alexander
Egorenkov.
Fixes:
https://lore.kernel.org/buildroot/ansJ5dXXblvYeMLB@windsurf/
[1] https://gcc.gnu.org/gcc-16/changes.html#s390
[2] https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=5d6d56d837c3dbeabd382c1fb4f7d21d9891f4b9
Cc: Alexander Egorenkov <egorenar@linux.ibm.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The mdnsd runtime test can randomly fail on slow runners.
It's hard to reproduce locally (only one failure after a few attempts)
but we can reproduce it easily by removing the while loop entirely.
It turns out that mdnsd is started by S50mdnsd before the
emulator.login() change the system date:
[BRTEST# date -s @1788032864
Sat Aug 29 19:47:44 UTC 2026
Since the minimal rootfs.cpio generated for TestMdnsd doesn't have any
ntp client installed, it start with "January 1, 1970".
The date change may cause some issue to the mdnsd daemon which blocks
any response from mquery command.
When the problem occurs, "mquery -T _http._tcp" reply is empty:
# mquery -T _http._tcp
Querying _http._tcp.local. for PTR (12) ... press Ctrl-C to stop
To workaround the issue, restart mdnsd manually.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948555
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Dracut-internal executables were linked against system libraries,
instead of Buildroot host packages. For example:
$ ldd host/lib/dracut/dracut-install
linux-vdso.so.1 (0x00007f578cf06000)
libc.so.6 => /usr/lib/x86_64-linux-gnu/libc.so.6 (0x00007f578cccd000)
libkmod.so.2 => /usr/lib/x86_64-linux-gnu/libkmod.so.2 (0x00007f578ccb1000)
/lib64/ld-linux-x86-64.so.2 (0x00007f578cf08000)
libcrypto.so.3 => /usr/lib/x86_64-linux-gnu/libcrypto.so.3 (0x00007f578c600000)
libz.so.1 => /usr/lib/x86_64-linux-gnu/libz.so.1 (0x00007f578cc92000)
libzstd.so.1 => /usr/lib/x86_64-linux-gnu/libzstd.so.1 (0x00007f578c536000)
The reason is that Dracut is not a "real" autoconf package, and the
hand-written ./configure script does not preserve LDFLAGS for
make. Pass the environment variables directly to fix this.
Signed-off-by: Fiona Klute (othermo GmbH) <fiona.klute@gmx.de>
[Julien: add comment in dracut.mk]
Signed-off-by: Julien Olivain <ju.o@free.fr>
examples/vm_power_manager/meson.build in DPDK detects the presence of
libvirt:
opt_dep = cc.find_library('virt', required : false)
and then builds some examples or not depending on the availability of
libvirt. Let's make this optional dependency explicit in dpdk.mk, even
if there's no explicit enable/disable option for it.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When libvirt is present before DPDK is built, some additional examples
are compiled. One of them fails to build due to a missing <stdlib.h>
include. Let's import a patch from OpenSuse, that we have submitted
upstream, to fix this issue.
We couldn't find any autobuilder failure for this issue, but the
following defconfig allows to reproduce the failure:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_DPDK=y
BR2_PACKAGE_DPDK_EXAMPLES=y
BR2_PACKAGE_LIBVIRT=y
The problem exists since DPDK v19.11, so it has been in Buildroot
since DPDK was introduced in commit
d17d1b6bde.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit [1] (package/perl: fix build issue with musl)
introduced a patch that is meant to be applied on top of perl-cross,
which is extracted on top of perl only in the target variant.
Since the patch was introduced as a normal package patch, the Buildroot
infra is trying to always apply it, even for the host package variant.
Since perl-cross is not extracted for the host variant, some patched
files are missing. In that case, the host-perl is failing with error:
>>> host-perl 5.42.3 Patching
Applying 0001-configure-keep-_GNU_SOURCE-in-build-flags.patch using patch:
can't find file to patch at input line 46
This commit fixes the issue by moving the package patch in a dedicated
"perl-cross" subdirectory, to make sure it will no longer be applied by
the infra. We apply the patch only for the target package variant using
a _POST_PATCH_HOOKS hook.
Fixes:
- [1]
- https://gitlab.com/buildroot.org/buildroot/-/jobs/16185948610 (TestPerlXMLLibXML)
- ...and few other tests requiring host-perl
[1] d950fff290
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When OpenSSL is enabled, if DES support is enabled, OpenSSH uses
DES_crypt. However, without OpenSSL or its DES support, there is no
available crypt() implementation for OpenSSH libopenbsd-compat xcrypt()
function, resulting in the following error:
.../host/bin/i686-buildroot-linux-gnu-gcc -o sshd-auth sshd-auth.o
auth2-methods.o auth-rhosts.o auth-passwd.o sshpty.o sshlogin.o
servconf.o serverloop.o auth.o auth2.o auth-options.o session.o
auth2-chall.o groupaccess.o auth-bsdauth.o auth2-hostbased.o
auth2-kbdint.o auth2-none.o auth2-passwd.o auth2-pubkey.o
auth2-pubkeyfile.o auth2-gss.o gss-serv.o gss-serv-krb5.o
monitor_wrap.o auth-krb5.o audit.o audit-bsm.o audit-linux.o
platform.o loginrec.o auth-pam.o auth-shadow.o auth-sia.o
sandbox-null.o sandbox-rlimit.o sandbox-darwin.o
sandbox-seccomp-filter.o sandbox-capsicum.o sandbox-solaris.o
sftp-server.o sftp-common.o uidswap.o ssh-pkcs11-client.o
ssh-sk-client.o -L. -Lopenbsd-compat/ -D_LARGEFILE_SOURCE
-D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0
-D_FORTIFY_SOURCE=1 -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack
-fstack-protector-strong -pie -lssh -lopenbsd-compat
-L.../host/bin/../i686-buildroot-linux-gnu/sysroot/usr/lib
-lssl -lcrypto -lcrypto -lz
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt'
.../host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../
i686-buildroot-linux-gnu/bin/ld:
openbsd-compat//libopenbsd-compat.a(xcrypt.o): in function `xcrypt':
xcrypt.c:(.text+0x51): undefined reference to `crypt' collect2: error:
ld returned 1 exit status make[2]: *** [Makefile:233: sshd-auth] Error
1 make[2]: *** Waiting for unfinished jobs.... collect2: error: ld
returned 1 exit status make[2]: *** [Makefile:230: sshd-session] Error
1 make[1]: *** [package/pkg-generic.mk:273:
.../build/openssh-10.4p1/.stamp_built]
Error 2 make: *** [Makefile:83: _all] Error 2
This commit enables BR2_PACKAGE_LIBXCRYPT with OpenSSH as long as
glibc is used. Since "sshd-auth" is compiled regardless of
BR2_PACKAGE_OPENSSH_SERVER, we need to enable it with BR2_PACKAGE_OPENSSH.
Signed-off-by: Jimmy Durand Wesolowski <jimmy.wesolowski@mobileye.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 297f6f1921 updated vim.
However README.txt (used as part of the license hash check) has been updated
upstream in [1], without any corresponding hash change in Buildroot, leading
to build failure.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/work_items/189
NB: This also affects 2025.02.x & 2026.05.x, so this patch
should be applied there too.
[1] e7e21018fc
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the website accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
patchwork.buildroot.org used to be a redirect to patchwork.ozlabs.org,
but we are now running our own instance, so let's adjust the links in
the manual accordingly.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following CVEs:
CVE-2026-19499:
63b53df549
CVE-2026-77117:
6f9b2bfa50
CVE-2026-80489:
cb61572ea3
Added GLIBC_IGNORE_CVES for CVE-2026-19542 which was forgotten in
buildroot commit 58f3137738.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When BR2_PACKAGE_OPENCV4_WITH_WEBP=y we need to enable mux and demux
support in webp, otherwise the build of OpenCV fails as follows:
CMake Error: The following variables are used in this project,
but they are set to NOTFOUND.
Please set them or make sure they are set and tested correctly
in the CMake files:
WEBP_DEMUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
WEBP_MUX_LIBRARY
linked by target "opencv_imgcodecs"
in directory [...]/build/opencv4-4.13.0/modules/imgcodecs
The issue already exists in 2025.02.x.
Fixes:
https://autobuild.buildroot.net/results/d3e0446a87d32469267e241866c4224143170f31/
Signed-off-by: Alessandro Rubini <rubini@gnudd.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Even though it's only documentation, the form of the names of the
post-image.sh and post-build.sh scripts should be consistent with the
names of those scripts used in the code base, using hyphen, not
underscore.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Besides just updating a little terminology, remove the awkward
reference to "his" when referring to developers.
Signed-off-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The openscap build can fail with the following error:
In file included from [...]/src/OVAL/probes/unix/linux/systemdunitproperty_probe.c:38:
[...]/src/OVAL/probes/unix/linux/systemdshared.h: In function ‘get_all_systemd_units’:
[...]/src/OVAL/probes/unix/linux/systemdshared.h:188:50: error: implicit declaration of function ‘basename’; did you mean ‘rename’? [-Wimplicit-function-declaration]
188 | char *unit_name_s = oscap_strdup(basename(value.str));
| ^~~~~~~~
| rename
In file included from [...]/src/OVAL/probes/unix/linux/systemdunitdependency_probe.c:37:
[...]/src/OVAL/probes/unix/linux/systemdshared.h: In function ‘get_all_systemd_units’:
[...]/src/OVAL/probes/unix/linux/systemdshared.h:188:50: error: implicit declaration of function ‘basename’; did you mean ‘rename’? [-Wimplicit-function-declaration]
188 | char *unit_name_s = oscap_strdup(basename(value.str));
| ^~~~~~~~
| rename
This error happens when:
- dbus is enabled in the configuration, making openscap build probes
code
- the toolchain uses musl, which does not declare basename() in string.h
the way glibc does
The build error can be reproduced with the following minimal defconfig:
BR2_arm=y
BR2_cortex_a9=y
BR2_ARM_ENABLE_NEON=y
BR2_ARM_ENABLE_VFP=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_MUSL_BLEEDING_EDGE=y
BR2_PACKAGE_DBUS=y
BR2_PACKAGE_OPENSCAP=y
Backport the upstream fix to allow openscap to build with such
configuration. The custom patch can be removed once openscap is
re-released on its branch 1.3.x.
The issue affects master, 2026.05.x and 2025.02.x
Fixes: https://autobuild.buildroot.org/results/a874d4f34d36fa9f8566be90ad2d5facb99aec24/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
host-erlang build can fail with the following error:
make[5]: Nothing to be done for 'opt'.
MAKE opt
CC ../priv/bin/x86_64-pc-linux-gnu/odbcserver
/usr/bin/ld: ../priv/obj/x86_64-pc-linux-gnu/odbcserver.o: in function `encode_column_dyn':
odbcserver.c:(.text+0x6b4): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6c2): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x6d4): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6e7): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x6fa): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x708): undefined reference to `ei_x_encode_tuple_header'
/usr/bin/ld: odbcserver.c:(.text+0x71b): undefined reference to `ei_x_encode_ulong'
/usr/bin/ld: odbcserver.c:(.text+0x72e): undefined reference to `ei_x_encode_ulong'
[...]
This can be reproduced with the following minimal defconfig (and
libei.so present on host, see details below):
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_ERLANG=y
Those missing symbols are part of the erl_interface, exposed by libei.a.
host-erlang builds correctly libei.a _before_ odbcserver.c (it can be
found in lib/erl_interface/obj/x86_64-pc-linux-gnu/libei.a), but the
failure is actually due to the build command generated and used for
odbcserver.c, especially the link arguments:
/usr/bin/gcc \
[...]
-o ../priv/bin/x86_64-pc-linux-gnu/odbcserver \
../priv/obj/x86_64-pc-linux-gnu/odbcserver.o \
-L/usr/lib64 \
-lodbc \
-L/home/alexis/src/buildroot/erlang-master/build/host-erlang-custom/lib/erl_interface/obj/x86_64-pc-linux-gnu \
-lpthread -lei
/usr/lib64 is searched before the path where libei.a has been built, so
if whether a valid libei.a or libei.so is found there, it shadows the
expected libei.a. In the build from which the logs above come, the
notable point is that the host system indeed have a valid libei.so, but
is completely unrelated to erl_interface; it rather exposes the Emulated
Input protocol aimed at Wayland stack; and so it obviously contains none
of the expected ei_* symbols.
Upstream has already identified and fixed the issue, the fix is already
released in versions >= 27.x.y. Erlang 26 (the version currently
packaged in buildroot), isn't supported anymore (only the three latest
releases are supported, see
https://github.com/erlang/otp/blob/master/SECURITY.md), so there won't
be any new minor update that will release this fix.
Pick and backport the fixing patch so that the current version packaged
in buildroot can still build.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The VERSAL2_CONSOLE variable does not actually exist when building the atf
with plat=versal2. So the current VERSAL2_CONSOLE=cadence1 is not actually
doing anything. For this reason, the atf will print on its default console
which is UART0 or pl011_0.
The correct definition would be CONSOLE=pl011_1 in order to build the atf to
print on UART1 or pl011_1.
However, the git repo xparameters.h of the versal2_plm is not currently
enabling UART1 because the XPAR_XUARTPSV_NUM_INSTANCES is set to 1 including
the address defines only for UART0.
97f2baf7f6/lib/sw_apps/versal_plm/misc/versal_2ve_2vm/xparameters.h (L1519)
The problem with this is that the plm is not configuring UART1, so the atf
will crash at boot time, if it is built with CONSOLE=pl011_1 and the plm has
not already enabled UART1.
For now, we will remove the unnecessary config that is doing nothing. The
versal2_vek385_defconfig is working, but users need to currently open two
console windows to see the boot log because the current config is the
following.
plm - console uart0
asufw - console uart0
atf - console uart0
optee-os - console uart1
u-boot - console uart1
Linux - console uart1
A patch has been submitted to the embeddedsw repo to fix the xparameters.h
file such that the plm will correctly enable UART1. Once this is applied, we
will configure the plm and atf to use UART1 with the versal2_vek385_defconfig.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
https://github.com/strukturag/libheif/releases/tag/v1.23.2
Fixes the following CVEs:
(CVE numbers will be added upstream when assigned.)
CVE-2026-XXXXX (GHSA-g89c-p67h-r497)
Heap buffer overflow in scale_nearest_neighbor() via duplicate alpha
planes from nested iden/auxl items. (critical)
(GHSA-2jg2-4ch7-h545)
Out-of-bounds read and write in derived-item and pixel-plane handling.
Through iden and auxl item chains, a crafted file could attach pixel
planes whose size differs from the image geometry; crop, scale, and
plane-extraction code then indexed those planes with the wrong size.
A working code-execution exploit was confirmed. Plane sizes are now
validated wherever they are consumed. (critical)
CVE-2026-XXXXX (GHSA-24wx-9w62-c96w)
brotli/zlib decompression of mime metadata and unci image data had no
effective output-size limit, so a decompression bomb could exhaust
memory. Decompressed output is now bounded by the security limits.
(high)
CVE-2026-XXXXX (GHSA-x8xm-cm2c-cfc8)
Chains of derived-image references (grid, iovl, iden) bypassed decode
caching and memory limits, causing CPU and memory amplification. (high)
CVE-2026-XXXXX (GHSA-xw34-mjcp-jqh8)
Sequence sample-timing initialization could produce non-terminating
decode loops and unbounded memory, bypassing max_sequence_frames.
(high)
CVE-2026-XXXXX (GHSA-j264-xvrp-5v7q)
Out-of-bounds write in the unci encoder when
heif_context_add_image_tile() is given a tile whose planes do not match
its declared size. (high)
CVE-2026-XXXXX (GHSA-p58j-h3vm-3fp5)
Heap out-of-bounds read in the inline-mask region API when
mask_data_len does not match the region geometry. (medium)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since the bump of libxml2 from 2.13.8 to 2.15.0 in Buildroot commit
d81922c1ef, the "virt" plugin of
collectd no longer builds:
src/virt.c:2208:49: error: expected ';', ',' or ')' before 'ATTRIBUTE_UNUSED'
2208 | static void virt_eventloop_timeout_cb(int timer ATTRIBUTE_UNUSED,
| ^~~~~~~~~~~~~~~~
src/virt.c: In function 'register_event_impl':
src/virt.c:2221:26: error: 'virt_eventloop_timeout_cb' undeclared (first use in this function)
2221 | virt_eventloop_timeout_cb, NULL, NULL) < 0) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~
src/virt.c:2221:26: note: each undeclared identifier is reported only once for each function it appears in
This is due to the fact that the virt plugin code was incorrectly
using the ATTRIBUTE_UNUSED define, which was supposed to be an
internal define of libxml2. But it turns out that up to libxml2 2.14.0
and its commit 208f27f9641a59863ce1f7d4992df77f7eb0ea9d, this define
had been made publicly available. It could therefore mistakenly be
used by collectd's virt plugin... until libxml2 was upgraded.
We backport an upstream patch from collectd that fixes the issue.
Fixes:
https://autobuild.buildroot.net/results/4c8463f0372560f4c3a20b0f67854460f0d1c400/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit adds a simple bpftrace test that ensures that not only it
builds fine, but it also runs properly on a minimal test scenario.
Assisted-by: GPT-5.6
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien:
- reindent emulator.boot() options
- add a call to "bpftrace --version"
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since Buildroot commit 25cb3813e7 which
bumped LLVM from 21.x to 22.x, the build of bpftrace is broken as
bpftrace 0.24.2 only supports LLVM up to 21.
We tried backporting the bpftrace patch that allows using LLVM up to
version 22 but the patch didn't apply cleanly but more importantly it
wasn't clear if this patch was sufficient. Therefore, we opt for
bumping bpftrace entirely to fix the issue.
Packaging changes:
- The new version of bpftrace no longer needs host-bison/host-flex,
because bpftrace is now using a handwritten parser.
- Pass -DUSE_SYSTEM_LIBBPF:BOOL=ON to ensure the system libbpf version
is used, and not the bundled version
- Now depends on kernel headers >= 5.10 because it needs CAP_BPF and
CAP_PERFMON
Upstream changelog:
https://github.com/bpftrace/bpftrace/blob/v0.26.1/CHANGELOG.md
Fixes:
https://autobuild.buildroot.net/results/a3e3fd696685864977c688aa11c2653357cf6207/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: add link to upstream changelog]
Signed-off-by: Julien Olivain <ju.o@free.fr>
bpftrace often needs very recent kernel headers, more recent than the
runtime version actually needed. We already had a workaround in
libbpf making sure that if the kernel headers are older than 6.1, we
would install the libbpf provided headers instead.
As we are about to update bpftrace to a newer version that uses
BPF_TRACE_KPROBE_SESSION, which was introduced in Linux 6.10, we need
to update this workaround accordingly and ensure that the libbpf
header is installed if the kernel headers are older than 6.10.
This is necessary for the update of bpftrace to 0.26.1.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since commit
566bdcb97f ("package/fluidsynth:
security bump to version 2.5.7"), fluidsynth tries to download some
"gcem" code during its configure step, which not only violates
Buildroot's policies, but also breaks the build if network is not
available during the build.
To fix this, we add an EXTRA_DOWNLOADS to grab gcem and extract it at
the right place. Some minor fix (submitted upstream) is needed to
ensure the FindGCEM.cmake logic properly finds that gcem is already in
the source tree.
Fixes:
https://autobuild.buildroot.net/results/048df28f6ab97a16731e62d7f56c6eba565cda63/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Based on the lighttpd test case. Verify that we can download index.html
from haproxy in front of lighttpd.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
haproxy has a runtime test to verify that it is built with -fwrapv:
haproxy
FATAL ERROR: invalid code detected -- cannot go further, please recompile!
The source code was miscompiled by the compiler, which usually indicates that
some of the CFLAGS needed to work around overzealous compiler optimizations
were overwritten at build time. Please do not force CFLAGS, and read Makefile
and INSTALL files to decide on the best way to pass your local build options.
Build options :
TARGET = custom
CPU = generic
CC = /home/peko/source/buildroot/output-haproxy/host/bin/arm-linux-gcc
CFLAGS = -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1 -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -g0 -D_FORTIFY_SOURCE=1
OPTIONS = USE_THREAD=1 USE_DL=1
DEBUG = -DDEBUG_STRICT -DDEBUG_MEMORY_POOLS
Which comes from:
https://github.com/haproxy/haproxy/blob/v2.6.0/src/haproxy.c#L3008-L3037
So build it with -fwrapv to fix that.
Notice that this message also embeds the build path (through CC), breaking
reproducible builds.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit
e42e3193137d1b21e84b499336e7a8887b8a8689 ("intel: add Jay"), a C23
construct is used in the intel driver code:
enum jay_predication : uint8_t
This causes a build issue with GCC < 13:
In file included from ../src/intel/compiler/jay/jay_builder.h:12,
from ../src/intel/compiler/jay/jay_from_nir.c:23:
../src/intel/compiler/jay/jay_ir.h:582:22: error: expected identifier or ‘(’ before ‘:’ token
582 | enum jay_predication : uint8_t {
| ^
../src/intel/compiler/jay/jay_ir.h:637:25: error: field ‘predication’ has incomplete type
637 | enum jay_predication predication;
| ^~~~~~~~~~~
We fix that by integrating a patch already available in
OpenEmbedded. It changes the code to not use the C23 construct.
This build issue was encountered on host-mesa3d while building an
allyespackageconfig configuration inside our standard Docker
container.
Buildroot commit
c073c97617 ("package/{mesa3d,
mesa3d-headers}: bump version to 26.1.0") that switched to mesa3d
26.1.0, which contains the problematic commit. Therefore 2026.05 is
affected, but not earlier Buildroot versions.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
perl does not build with musl due to memrchr() being unavailable. This
is caused by a perl-cross bug, which does function availability
detection with _GNU_SOURCE defined, but then does the build without
_GNU_SOURCE defined. At least OpenEmbedded and NixOS have faced the
same issue, and worked it around in slightly different ways.
On our side, we create a patch, which was submitted upstream, to solve
the issue.
This issue has been introduced in perl-cross commit b40c560f5d5e,
which was first merged in perl-cross release 1.4.1. From a Buildroot
perspective, we bumped from perl-cross 1.4 to 1.4.1 in commit
8a289667f5, which was merged
2023.05. And indeed the build failure can be reproduced even on our
LTS 2025.02.x, so the fix needs to be backported there.
It should be noted that even if the patch is against perl-cross, we
add it to package/perl/ directly, as patches in perl are applied after
perl has been extracted *and* perl-cross has been extracted on top.
Fixes:
https://autobuild.buildroot.net/results/3e47ade0963642988fd8e1be9a6e8042700619ec/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the bump of autoconf to version 2.73 in Buildroot commit, the
build of target bind fails if the host compiler is too old, because
the bind build system tries to use -std=gnu23 when building host tools
which isn't supported by older GCC releases, causing:
checking whether the C compiler works... no
configure: error: in '/home/thomas/autobuild/instance-2/output-1/build/bind-9.20.26':
configure: error: C compiler cannot create executables
See 'config.log' for more details
make: *** [package/pkg-generic.mk:263: /home/thomas/autobuild/instance-2/output-1/build/bind-9.20.26/.stamp_configured] Error 77
To fix this, we backport a number of patches from autoconf-archive, to
fix the m4/ax_prog_cc_for_build.m4 macro file, so that it works with
autoconf 2.73.
OpenEmbedded has a similar fix:
https://git.openembedded.org/openembedded-core/tree/meta/recipes-connectivity/bind/bind/0001-m4-Backport-ax_prog_cc_for_build.m4-macros.patch
but did not backport as carefully the autoconf-archive commits (and
their commit message reverts to sudo).
The patches can be dropped when we update to a newer version of bind
that itself has an updated copy of the m4/ax_prog_cc_for_build.m4
file.
Fixes:
https://autobuild.buildroot.net/results/13e07755101b7cae2f84eef173ef752f92842e71/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The BR2_PACKAGE_QT6DECLARATIVE_QUICK option has some logic to select
network support in host-qt6base if network support is enabled in
qt6base. However, it turns out that this is actually required at the
top level BR2_PACKAGE_QT6DECLARATIVE option: as soon as network
support is available in qt6base, the qt6declarative build will assume
that qmlprofiler is available... but that requires network support in
host-qt6base.
This fixes the following build failure:
CMake Error at /home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:784 (message):
Failed to find the host tool "Qt6::qmlprofiler". It is part of the
Qt6QmlTools package, but the package did not contain the tool. Make sure
that the host module Qml was built with all features enabled (no explicitly
disabled tools).
Call Stack (most recent call first):
/home/thomas/autobuild/instance-2/output-1/build/qt6base-6.9.1/cmake/QtToolHelpers.cmake:83 (qt_internal_find_tool)
tools/qmlprofiler/CMakeLists.txt:11 (qt_internal_add_tool)
Fixes:
https://autobuild.buildroot.net/results/72c956fdf982382d2981c649c456d1edc2c9d6b2/
We did not trace back exactly since when the problem exists, but we
verified that the problem exists in 2025.02.x. It can be reproduced
with the following defconfig:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_QT6BASE_NETWORK=y
BR2_PACKAGE_QT6DECLARATIVE=y
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The commit "Enable host test module to ensure that qmltestrunner is
built" in qt6declarative's Config.in feels lonely under
BR2_PACKAGE_QT6DECLARATIVE. It's because it's actually related to a
select done in the sub-option BR2_PACKAGE_QT6DECLARATIVE_QUICK, so
move it there.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since Firewalld v2.4.3 [1] firewall-cmd added a new log line while
waiting for dbus connection [2].
[BRTEST# firewall-cmd --state
Waiting on dbus connection...
running
The line "Waiting on dbus connection..." is not always printed by
firewall-cmd, so we have to search explicitely for the expected
string to get a reproducible test result.
Update both TestFirewalld accordingly.
This change is required to fix:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152329 (TestFirewalldSysVInit)
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152332 (TestFirewalldSystemd)
[1] 380dd8a348
[2] 5e1c37c966
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In Glib >= 2.88, GLib.unix_signal_add has been moved to a separate
platform-specific library. This break backward compatibility from
GLib-2.0. A workaround has been applied to pygobject >= 3.55.3
74e4e0f40a
This issue currently break TestFirewalldSysVInit and
TestFirewalldSystemd runtime tests since the bump to glib 2.88.3 [1]:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152329 (TestFirewalldSysVInit)
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152332 (TestFirewalldSystemd)
Break the test TestPythonPy3Gobject now in order to reproduce the same
issue than for Firewalld test.
[1] e313a2d259
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The mdnsd runtime test can randomly fail on slow runners.
It's hard to reproduce locally (only one failure after a few attempts)
but we can reproduce it easily by removing the while loop entirely.
It means that the "sleep 1" is not used on the Gitlab runner.
The timestamp of the failed job seems to confirm that [1].
07:06:55 [BRTEST# while ! ifconfig eth0 | grep -q 'inet addr'; do sleep 1; done
07:06:55 [BRTEST# echo $?
07:06:55 0
07:06:55 [BRTEST# mquery -T _http._tcp |grep -F buildroot._http._tcp.local
07:06:55 [BRTEST# echo $?
07:06:55 1
So wait a bit for mdnsd to be ready.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152862
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit [1] (package/apache: use "Debian" filesystem
layout to fix read-only rootfs) changed the filesystem layout.
This had the effect of installing files to different locations
and breaking the test_php runtime test.
This commit fixes the issue by updating the file paths to their
right locations. The "httpd.conf" was updated by following the
same recipe described in the comment (starting from a config
file as installed by the apache Buildroot package).
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/16060152979
[1] 1006666f67
Signed-off-by: Julien Olivain <ju.o@free.fr>
Tested-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the bump of autoconf to version 2.73 in Buildroot commit [1], the
build of target flex fails if the host compiler is too old, because
the flex build system tries to use -std=gnu23 which isn't supported by
older GCC releases, causing:
gcc: error: unrecognized command-line option '-std=gnu23'; did you mean '-std=gnu2x'?
gcc: error: unrecognized command-line option '-std=gnu23'; did you mean '-std=gnu2x'?
make[3]: *** [Makefile:1162: stage1flex-buf.o] Error 1
(Indeed the *target* flex package does build some host tools using the
host GCC compiler.)
To fix this issue, we backport an upstream commit that isn't yet in
any flex release.
Fixes:
https://autobuild.buildroot.net/results/aac730b57adb5b54964f1054de781750952ef7d4/
[1] a6e8c07a33
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: add link to commit]
Signed-off-by: Julien Olivain <ju.o@free.fr>
In commit 54f96add94 ("package/bind:
security bump version to 9.20.24") the depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL was incorrectly downgraded to
BR2_TOOLCHAIN_HAS_THREADS:
- depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # libuv
+ depends on BR2_TOOLCHAIN_HAS_THREADS # liburcu, libuv
This is wrong because libuv depends on
BR2_TOOLCHAIN_HAS_THREADS_NPTL. This causes unmet dependencies:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_LIBUV
Depends on [n]: BR2_TOOLCHAIN_HAS_THREADS_NPTL [=n] && BR2_USE_MMU [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y]
Selected by [y]:
- BR2_PACKAGE_BIND [=y] && BR2_USE_MMU [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && BR2_TOOLCHAIN_HAS_THREADS [=y] && BR2_INSTALL_LIBSTDCPP [=y] && !BR2_STATIC_LIBS [=n] && BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 [=y] && BR2_PACKAGE_LIBURCU_ARCH_SUPPORTS [=y]
Fix that by switching back to the BR2_TOOLCHAIN_HAS_THREADS_NPTL
dependency.
Fixes: 54f96add94 ("package/bind: security bump version to 9.20.24")
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- CVE-2026-19654:
A unauthenticated remote peer may lead rsyslogd to crash due to a flaw
in the optional imptcp module. A crafted input sequence during
oversize-frame recovery can cause an invalid internal message length
and terminate rsyslogd. No confidentiality or integrity impact,
privilege escalation, or code execution has been identified. imtcp and
the default imptcp framing modes are not affected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-19654
- 07b3c40a5a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See the changelog:
- https://nlnetlabs.nl/projects/unbound/download/#unbound-1-25-2
It fixes the following vulnerabilities:
- CVE-2026-14586: Assertion in libngtcp2 when under pressure in high
concurrency DNS-over-QUIC environments.
- CVE-2026-32665: Remote DNS-over-QUIC denial of service due to
`quic-size` budget bypass.
- CVE-2026-40691: Packet of death for DNSCrypt over TCP.
- CVE-2026-41637 Degradation of resolution service from improperly
accounted client-terminated DNS-over-QUIC queries.
- CVE-2026-42955: Extra fix for CVE-2026-40622 to also clamp the TTL of
A/AAAA records disallowing a one-time 'ghost domain' delegation
renewal via glue records.
- CVE-2026-44621: Libunbound applications configured with
'unwanted-reply-threshold' could eventually be abruptly terminated.
- CVE-2026-44687: Off-by-one error in 'harden-below-nxdomain' logic can
shadow a stub/forward zone by a legitimate parent's NXDOMAIN.
- CVE-2026-44690: Cross-zone wildcard cache poisoning via RRSIG.labels
manipulation.
- CVE-2026-46582: A wildcard replay, as another piece of data, triggers
poisoning in the serve expired reply path.
- CVE-2026-50045: 'max-global-quota' reset by DNSSEC validation
restarts.
- CVE-2026-50046: Possible heap use-after-free in an error path when a
DoT forwarded query is jostled out.
- CVE-2026-50243: 'response-ip'/'rpz' can rewrite BOGUS answers instead
of returning SERVFAIL.
- CVE-2026-50248: BOGUS configured primary hostname accepted for XFR in
auth/rpz zones.
- CVE-2026-50251: Attacker supplied `0.0.0.0`/`::` glue triggers
defensive full-cache flush.
- CVE-2026-50252: Possible cache poisoning attack by mapping source port
population per thread.
- CVE-2026-52863: Memory corruption could lead to crash and denial of
service.
- CVE-2026-54478: DNS Cookie bypass when combined with proxy-protocol
use.
- CVE-2026-55708: Privacy/configuration issue when adding local data in
views through 'unbound-control'.
- CVE-2026-55717: 'serve-expired-client-timeout' and 'response-ip' CNAME
redirect could lead to a crash.
- CVE-2026-55973: 'dns-error-reporting: yes' leads to stack buffer
overflow.
- CVE-2026-55990: Packet of death for a DNSCrypt misconfigured Unbound.
- CVE-2026-55991: Remote DNS-over-QUIC (DoQ) flow-control assertion
failure in libngtcp2.
- CVE-2026-56416: Possible heap buffer overflow when validator
canonicalizes RDATA that contains domain name.
- CVE-2026-56444: Degradation of resolution service when
'discard-timeout' and 'serve-expired-client-timeout' are combined in
unusual configuration.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This release includes a broad round of hardening against malformed and
adversarial input across the Python SDK (bounding allocations and enforcing
decompression limits before trusting size fields read from the input).
See the release notes https://avro.apache.org/blog/2026/08/12/avro-1.12.2/
Also update the download url, because www-eu.apache.org/dist/...
is a redirection to downloads.apache.org/...
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/openssl/openssl/releases/tag/openssl-3.6.4
This release incorporates the following bug fixes and mitigations:
Fixed QUIC server being able to trigger double free when processing
INITIAL packet.
(CVE-2026-18798)
Fixed heap buffer overflow in CMS key unwrapping.
(CVE-2026-63072)
Fixed invalid pointer dereference in CMP server via crafted protectionAlg.
(CVE-2026-63076)
Fixed unbounded memory growth in QUIC server incoming channel queue.
(CVE-2026-14456)
Fixed RPK server signature algorithm selection being able to dereference
a missing certificate.
(CVE-2026-14457)
Fixed excessive memory use buffering DTLS records for a future epoch.
(CVE-2026-54874)
Fixed client-side memory leak in OCSP response checking.
(CVE-2026-54876)
Fixed untrusted Sender DN being used as a format string in CMP response
validation.
(CVE-2026-63073)
Fixed CMP indefinite cache growth of extraCerts.
(CVE-2026-63074)
Fixed QUIC ACK-only packet retention being able to cause memory exhaustion.
(CVE-2026-63075)
Fixed possibility of AEAD forgeries with empty ciphertext when using
EVP_Cipher().
(CVE-2026-75803)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In some situations (old Linux <3.17 or glibc <2.25), expat fail at
compilation time with the error:
xmlparse.c:150:4: error: #error You do not have support for any sources of high quality entropy enabled.
For end user security, that is probably not what you want. Your options include:
* Linux >=3.17 + glibc >=2.25 (getrandom): HAVE_GETRANDOM,
* Linux >=3.17 + glibc (including <2.25) (syscall SYS_getrandom): HAVE_SYSCALL_GETRANDOM,
* BSD / macOS >=10.7 / glibc >=2.36 (arc4random_buf): HAVE_ARC4RANDOM_BUF,
* BSD / macOS (including <10.7) / glibc >=2.36 (arc4random): HAVE_ARC4RANDOM,
* BSD / macOS >=10.12 / glibc >=2.25 (getentropy): HAVE_GETENTROPY,
* Linux (including <3.17) / BSD / macOS (including <10.7) / Solaris >=8 (/dev/urandom): XML_DEV_URANDOM,
* Windows >=Vista (rand_s): _WIN32.
If you insist on not using any of these, bypass this error by defining XML_POOR_ENTROPY and be vulnerable to hash flooding;
you have been warned. If you have reasons to patch this detection code away or need changes to the build system, please open a bug. Thank you!
This is caused by the upstream commit [1] "Autotools: Stop using
/dev/urandom by default", first included in expat 2.8.2. The
Buildroot expat package was bumped to that version in commit [2].
But since all Linux systems have /dev/urandom, we can just enable
it by default.
Note: this commit does not globally switch the entropy source to
/dev/urandom. It is rather enabling it in the list of available
sources. On more recent Linux systems (linux >= 3.17, glibc >= 2.25),
other sources will be chosen. The entropy source preference order
amongst the enabled sources is defined in [3].
This commit also changes the _CONF_OPTS to multiline layout to fit
within the 80 characters.
[1] d30eca113a
[2] 6b1f6f7a48
[3] https://github.com/libexpat/libexpat/blob/R_2_8_3/expat/lib/xmlparse.c#L1115-L1142
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add extra info in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since gdb 9.x, gdb can optionally use the xxhash library. Since we
currently don't do anything about it, it's a potential "silent"
dependency.
In particular, for host-gdb, this means host-gdb might end up being
linked with the system-provided xxhash library if available.
This patch handles this dependency:
- For the target package, by looking at the value of
BR2_PACKAGE_XXHASH
- For the host package, by looking at the value of a newly introduced
BR2_PACKAGE_HOST_GDB_XXHASH
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For target gdb, we properly enable/disable lzma support depending on
BR2_PACKAGE_XZ.
However, for host-gdb we don't do anything, which can lead the gdb
configure script to detect and use a system-provided xz library, which
is not desired.
Instead, add an explicit option BR2_PACKAGE_HOST_GDB_LZMA, which when
enabled pulls in host-xz, but also when disabled ensures gdb doesn't
try to use a system-provided xz library.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add the option to configure the atf to load the optee-os binary:
BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL32_OPTEE=y
Without this, everything was still booting, and even though the versal2_plm
was loading the optee-os to its runtime location, it was never actually
loaded by the atf.
With this option enabled, atf is now properly loading optee with the boot log
below.
NOTICE: BL31: Executing from 0xbbf00000
NOTICE: BL31: Secure code at 0x1800000
NOTICE: BL31: Non secure code at 0x40000000
NOTICE: BL31: v2.14.0(release):custom
NOTICE: BL31: Built : 08:41:36, Aug 25 2026
KATs execution completed.
In task dispatch loop
I/TC:
I/TC: Non-secure external DT found
I/TC: pl011: device parameters ignored (115200n8)
I/TC: Switching console to device: /axi/serial@f1930000
I/TC: OP-TEE version: Unknown_4.9 (gcc version 14.3.0 (Buildroot 2021.11-18033-g83947c7bb6)) #1 Mon Aug 24 08:45:53 UTC 2026 aarch64
I/TC: WARNING: This OP-TEE configuration might be insecure!
I/TC: WARNING: Please check https://optee.readthedocs.io/en/latest/architecture/porting_guidelines.html
I/TC: Primary CPU initializing
I/TC: Cluster shift early-configured: 1 (cores per cluster: 2)
I/TC: ASU initialization complete
I/TC: OP-TEE OS Running on Platform AMD Versal Gen 2
I/TC: ASU ECC: NIST_P192=SW NIST_P224=SW NIST_P256=HW
I/TC: ASU ECC: NIST_P384=SW NIST_P521=SW
I/TC: ASU RSA driver successfully initialized
I/TC: Primary CPU switching to normal world boot
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
In commit a2380157f6 ("toolchain: enable
libquadmath for PowerPC with VSX"), the definition of
BR2_TOOLCHAIN_HAS_LIBQUADMATH has been extended to also be true when
BR2_POWERPC_CPU_HAS_VSX.
However, practical experiments show that when 64-bit VSX-capable cores
are used in 32-bit mode, libquadmath is not built by GCC, causing
build failures:
cp: cannot stat '/home/autobuild/autobuild/instance-3/output-1/host/powerpc-buildroot-linux-musl/lib*/libquadmath*': No such file or directory
We did an extensive testing, building the 27 combinations of:
- GCC versions: 14, 15, 16
- C library: glibc, uclibc, musl
- PowerPC 32-bit, PowerPC 64-bit, PowerPC 64-bit little endian
This testing provides the following results:
| gcc14 | powerpc64 | glibc | OK |
| gcc14 | powerpc64le | glibc | OK |
| gcc14 | powerpc64le | musl | OK |
| gcc14 | powerpc64le | uclibc | SKIPPED |
| gcc14 | powerpc64 | musl | OK |
| gcc14 | powerpc64 | uclibc | SKIPPED |
| gcc14 | powerpc | glibc | FAILED |
| gcc14 | powerpc | musl | FAILED |
| gcc14 | powerpc | uclibc | FAILED |
| gcc15 | powerpc64 | glibc | OK |
| gcc15 | powerpc64le | glibc | OK |
| gcc15 | powerpc64le | musl | OK |
| gcc15 | powerpc64le | uclibc | SKIPPED |
| gcc15 | powerpc64 | musl | OK |
| gcc15 | powerpc64 | uclibc | SKIPPED |
| gcc15 | powerpc | glibc | FAILED |
| gcc15 | powerpc | musl | FAILED |
| gcc15 | powerpc | uclibc | FAILED |
| gcc16 | powerpc64 | glibc | OK |
| gcc16 | powerpc64le | glibc | OK |
| gcc16 | powerpc64le | musl | OK |
| gcc16 | powerpc64le | uclibc | SKIPPED |
| gcc16 | powerpc64 | musl | OK |
| gcc16 | powerpc64 | uclibc | SKIPPED |
| gcc16 | powerpc | glibc | FAILED |
| gcc16 | powerpc | musl | FAILED |
| gcc16 | powerpc | uclibc | FAILED |
The "SKIPPED" are when the configuration is not possible: uClibc
doesn't support powerpc64 or powerpc64le.
Then, as we can see, the build fails for all "powerpc"
configuration. Our conclusion is therefore that libquadmath is not
supported on PowerPC 32-bit. While we were not able to find direct
evidence in the gcc code base, this practical experiment shows that is
simply doesn't work on PowerPC 32-bit.
So, we take the logical action of adjusting
BR2_TOOLCHAIN_HAS_LIBQUADMATH so that it is true only on
powerpc64/powerpc64le.
Fixes:
https://autobuild.buildroot.org/results/46d435c9f5086a8695f4f6cd4026bb0d194de13c/
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes a build error caught by the Gitlab pipelines:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-aarch64-glibc-old/build/taglib-2.3/taglib/mpeg/mpegfile.cpp:113:10:
error: expected primary-expression before ‘const’
if(const Header header(&file, headerOffset + i, true); header.isValid()) {
which was introduced by code format changes in upstream commit
dfe2aa5253
which was first released with taglib 2.0, added to buildroot with commit
9cd3464afa.
This "init-statement" C++17 language feature was described in proposal
P0305R1, and according to
https://en.cppreference.com/cpp/compiler_support/17, this feature was
only supported in gcc starting from gcc 7.x.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Buildroot commit 1c5730ebb5 bumped the
package from version 2.2.1 to version 2.3 which includes upstream commit
5d63187a8b
that uses std::call_once and is only available with threads support.
Inspired by buildroot commit f9a2d65cae
which fixed a similar error.
This patch fixes a build error
/builds/bkuhls/buildroot/br-test-pkg/br-arm-full-nothread/build/taglib-2.3/taglib/mp4/mp4itemfactory.cpp:51:16:
error: ‘once_flag’ in namespace ‘std’ does not name a type
caught by the Gitlab pipelines. To reproduce use this defconfig:
BR2_arm=y
BR2_arm1176jzf_s=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm11-full-nothread-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_5_9=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_TAGLIB=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
host-libxml-parser-perl compiles XS modules against the system perl
headers, which #include <crypt.h>. On build hosts without libcrypt-dev
installed, the build fails:
.../CORE/reentr.h:126:16: fatal error: crypt.h: No such file or directory
Declaring host-libxcrypt ensures crypt.h is present in the per-package
host sysroot before the build.
This can for example be reproduced on a minimal Debian Forky system,
where libc6-dev no longer pulls libxcrypt-dev.
Signed-off-by: Adam Ford <aford173@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Buildroot commit bb38f6f720 bumped the
package to 3.2.0. This version first included upstream commit
ed00e0f4b3
which removed the dependency to libm causing build errors detected by
the autobuilders.
Disabling the build of tests by the previous patch of this series is not
enough because the build will fail on other tools like
[ 98%] Linking C executable djpeg-static
/home/bernd/buildroot/output/per-package/jpeg-turbo/host/bin/../lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
src/spng/CMakeFiles/spng-static.dir/spng.c.o: in function
`spng_decode_image':
spng.c:(.text+0x4c62): undefined reference to `__fpclassifyf'
Add upstream commit to fix the problem.
Fixes:
https://autobuild.buildroot.net/results/981/98114d4ea7afe62bb4cef934a06bf289d863ad3f/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit c531fe6520 bumped the
package to 3.1.2. This version first included upstream commit
942ac87e47
which added configure options to disable the build of command-line
tools and tests.
This patch replaces the current _POST_INSTALL_TARGET_HOOK with the new
configure option and disables the build of tests.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This major fakeroot bump is introducing xattr issues on hosts with
SELinux enabled (for example a Fedora 44 default installation).
Trying to build defconfigs such as:
make qemu_aarch64_virt_defconfig
make
produces error when building the filesystem image:
>>> Generating filesystem image rootfs.ext2
...
mke2fs 1.47.4 (6-Mar-2025)
...
Copying files into the device: set_inode_xattr: No data available while reading attribute "security.selinux" of /buildroot/output/build/buildroot-fs/ext2/target"
populate_fs3: No data available while copying xattrs on root directory
mkfs.ext4: No data available while populating file system
This reverts commit 344d64f385.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
We need to revert the fakeroot update which is introducing
filesystem build issue.
Since btrfs-progs needed this new fakeroot version, it needs to be
reverted too.
This commit reverts to the previous btrfs-progs version, which is not
using the nftw() libc function.
This reverts commit 7aba8ecc6a.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since Buildroot commit [1] (boot/grub2: bump to version 2.14), the
qemu_x86_64_efi_defconfig fails at boot time with the error:
!!!! X64 Exception Type - 0E(#PF - Page-Fault) CPU Apic ID - 00000000 !!!!
ExceptionData - 0000000000000003 I:0 R:0 U:0 W:1 P:1 PK:0 SS:0 SGX:0
This issue happens because EDK2 and Grub 2.14 are enabling NX and the
kernel lacks the CONFIG_EFI_STUB configuration. For the full explanation
see the commit log of [2] (board/pc/linux.config: enable CONFIG_EFI_STUB).
This commit enables CONFIG_EFI_STUB=y.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/15969219375
[1] da278ba1da
[2] 1c1fa6ce67
Reported-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 8b1d8dd25d bumped the
package from 1.4.3 to 1.5.1 which includes upstream commit
8d485b9bfd
that adds the usage of the OpenSSL crate from rust.
This crate depends on DES and causes build errors when missing:
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb8'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cbc'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_cfb64'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ecb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_ede3_ofb'
/home/autobuild/autobuild/instance-11/output-1/host/lib/gcc/i686-buildroot-linux-gnu/15.3.0/../../../../i686-buildroot-linux-gnu/bin/ld:
../libclamav/libclamav.so.12.1.0: undefined reference to `EVP_des_cbc'
Fixes:
https://autobuild.buildroot.net/results/b93/b9359c5c177f3e4bcef991cde3c2dcf412dee5de/https://autobuild.buildroot.net/results/300/300721a882f3410528878db730aaff1aa6822986/https://autobuild.buildroot.net/results/a16/a163a9229c04f638a46e6250dc135c475e5d1576/https://autobuild.buildroot.net/results/7e8/7e88cba9974f6f5acd125b69b95b7269d8128886/
A backport to LTS branches should be considered.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Users asked where the notes are available and if the information are
publicly available.
Those changes clearly explain the location and convention of the staging
branches and also link to more documentation on how to read the
annotations.
Also update the timing of the different steps to be less specific.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 713d63b "package/webkitgtk: add option to enable MiniBrowser",
added support to select BR2_PACKAGE_WEBKITGTK_MINIBROWSER, but forgot
to drop the default -DENABLE_MINIBROWSER=ON entry.
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Acked-By: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since v2.4.7, see:
https://github.com/FluidSynth/fluidsynth/releases
According to:
https://github.com/FluidSynth/fluidsynth/blob/master/doc/wiki/ChangeLog.md
FluidSynth 2.5.6 fixes:
CVE-2026-58264 - a heap-based buffer overrun in command handler (GHSA-mqmq-w63q-cj94)
CVE-2026-61714 - a heap-based buffer overflow in MIDI player (GHSA-976m-35rw-h3m6)
CVE-2026-61721 - a heap-based buffer overrun for DLS samples (GHSA-59ph-rx8r-8p4j)
CVE-2026-61723 - a DLS ptbl chunk integer overflow (GHSA-r4mc-v3p8-pv47)
CVE-2026-61722 - a DLS articulation chunk integer overflow (GHSA-hp72-35pr-6h6r)
CVE-2026-61720 - a SF2 DMOD chunk integer underflow (GHSA-rmc4-c8hw-455w)
FluidSynth 2.5.2 fixes:
CVE-2025-68617 - a heap-based use-after-free involving DLS files (GHSA-ffw2-xvvp-39ch)
SDL2 audio support was removed upstream in commit:
89145b004a
It was replaced by the newer SDL3. This commit reflects that change
(update option name and comments, add legacy option entry).
Also, dynamic library dependency was added in Buildroot commit:
111a1c7091
This commot removes the duplicate dependency for SDL3.
FluidSynth also added a native DLS soundfont support in:
c959f8d208
It is enabled by default and uses C++17. This commit adds a new
option with a dependency on gcc >= 7.
The license option hash is also updated, after the FSF address
update in:
db42fa333b
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
In both start() and stop(), ret is only assigned on failure. When
hypervkvpd starts or stops successfully, return "$ret" expands to an
empty string and causes:
/etc/init.d/S10hyperv: return: line 31: Illegal number:
Those double quotes were added in Buildroot commit [1], to fix a
new ShellCheck warning at that time. This was not a complete fix.
Only removing the double quote would reintroduce the ShellCheck
warning. This would also reintroduce a check-package error.
Since a bare return is equivalent to a "return 0", this commit
also initializes with ret=0. Doing so will tell ShellCheck "ret" is
an integer. Therefore, the ShellCheck warning will no longer be
reported.
This commit fixes the invalid return value by removing the double
quotes and initialzing "ret=0".
[1] c4173d8b08
Signed-off-by: Benjamin DeCamp <benjamin8532@protonmail.com>
[Julien:
- add "ret=0" initialization in script to fix check-package error
- add extra info in the commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
enscript currently fails to build with musl with gcc >= 15. In order
to fix this, we need to bring a number of patches from upstream, and
add 2 others that were submitted upstream.
From upstream, we bring
0002-Add-CFLAG-std-c89-so-it-compiles-with-the-old-standa.patch, which
switches to -std=c89 to get the compiler back to "old" behavior.
However, as this commit patches configure.ac, we need to autoreconf,
but autoreconf is broken, so we also take
0003-Automake-1.12-and-up-no-longer-supports-pre-ANSI.patch from
upstream, which drops a problematic autoconf macro.
However, once you drop this problematic autoconf macro, the PROTOTYPES
define is never set by anything, causing the __P macro to no longer be
defined properly. This is fixed by
0004-Fix-prototype-detection-when-__STDC__-is-defined-but.patch that
we have submitted upstream.
Once you're there, you realize that switching to -std=c89 has the side
effect that musl's <limits.h> no longer defines PATH_MAX, because it
needs one of:
#if defined(_POSIX_SOURCE) || defined(_POSIX_C_SOURCE) \
|| defined(_XOPEN_SOURCE) || defined(_GNU_SOURCE) || defined(_BSD_SOURCE)
and a side effect of -std=c89 is that none of these is defined
anymore. So we introduce 0005-Use-std-gnu89-instead-of-std-c89.patch,
which switches to -std=gnu89. This patch has also been submitted
upstream.
With all of these efforts, we get a successful build on musl with gcc
>= 15.
This commit needs to be backported to Buildroot versions that support
gcc 15.x, so that means the currently maintained 2026.x branches, but
not 2025.02 as only up to gcc 14.x was supported then.
Fixes:
https://autobuild.buildroot.org/results/d39d14bbbb3a51d67fe962b877c7f66ff1204ecf/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the fix for CVE-2026-66035.
The ETM decrypt path does not validate the received packet length before
calculating the decrypt buffer size. A malformed packet can therefore
lead to a heap overflow.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the fix for CVE-2026-66034.
The publickey subsystem does not sufficiently validate the length of a
server-controlled comment field. A malformed response can therefore
cause an out-of-bounds read.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the fix for CVE-2026-66033.
The OpenSSL AES-GCM cipher path lacks runtime bounds checks around the
input block size. A malformed packet can therefore lead to an
out-of-bounds read or write.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the fix for CVE-2026-66032.
A SFTP error path can leave a dangling pointer after freeing the
response buffer, which may result in a double free on subsequent error
handling.
Use Debian's libssh2 1.11.1 backport of the upstream fix.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the SFTP symlink bounds checking fix for CVE-2025-15661.
The initial fix requires the LIBSSH2_UNCONST compatibility backport on
libssh2 1.11.1. Also include the upstream follow-up fixing
SSH_FXP_STATUS handling introduced by the initial security fix.
The patches are based on the upstream fixes and Debian's libssh2 1.11.1
backports.
Signed-off-by: Stefan Müller <stefan.mueller@rey-technology.com>
[Julien: add links to Debian patches]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit 89a86dcb0a3248606824de50f5c63f61cfe0369c (first
release: 106) if cargo exists on PATH the Dracut configure script
enables building dracut-cpio by default, and calls "cargo --version"
to check if cargo works. This fails on the autobuilders:
error: rustup could not choose a version of cargo to run, because one wasn't specified explicitly, and no default is configured.
help: run 'rustup default stable' to download the latest stable release of Rust and set it as your default toolchain.
dracut couldn't find cargo for dracut-cpio build
The affected configs either don't have BR2_PACKAGE_HOST_RUSTC enabled,
or build-time.log.gz shows host-rustc was not installed before the
host-dracut build, so presumably the "cargo" that produces the rustup
error is an external one already installed on the autobuilders.
To fix this, enable dracut-cpio only if BR2_PACKAGE_HOST_RUSTC=y, and
add a dependency on host-rustc in that case. According to the
documentation [1, see "enhanced_cpio"] dracut-cpio is supposed to
optimize archive creation for copy-on-write filesystems, so it should
not matter much for Buildroot. The --disable-dracut-cpio option was
added in upstream commit 4a4ab928a49e81e02104ec5466160664e59c3965
(same release).
Fixes: https://autobuild.buildroot.org/results/5f557d708cce997e7f039f17e30640b02ba9180a/
Fixes: https://autobuild.buildroot.org/results/f04ca3c4598f62a7e87d84bc111eb8b161b34a70/
(and more)
[1] https://dracut-ng.github.io/dracut/man/dracut.conf.5.html#_configuration_options
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the upstream fix for a heap buffer overflow in
convert_fname() when growing the iconv output buffer.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the upstream fix for integer overflows while parsing
Content-Range headers, together with the follow-up fix using
strtoll() for wgint values.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport the upstream fix for a buffer underflow in
clean_metalink_string(), together with the two required follow-up
fixes for the inverted whitespace check and missing ctype.h include.
Backport to: 2025.02.x
Signed-off-by: Stefan Müller <stemu86@gmx.ch>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The xilpm_runtime_lib is not enabled by default in the versal2_plm Makefile:
97f2baf7f6/lib/sw_apps/versal_plm/src/versal_2ve_2vm/Makefile (L13)
Without it, there is a silent runtime failure.
Add config XILPM_RUNTIME_LIB=SUBSYS to make sure the xilpm_runtime_lib is
correctly configured and included to fix the problem.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
distribution-registry calls pthread_getattr_np() which is only available
with NPTL; i.e. always available with glibc (where it originates from,
since 2.2.3), always available with musl (which has had it since 0.9.10
in 2013), and only available when uClibc has NPTL (since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/9395500a8baee6c6142f96d7bc97e81725c2e754/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Arc specific gdb version was removed by commit [1]
but we still have the TestGdbArc that was testing this
version of gdb.
We can now safely remove TestGdbArc.
[1] 0b3d526226
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Some examples embed CSP views, whose C++ sources are generated at build
time by drogon_ctl. When cross-compiling, CMake looks the tool up in
PATH, so the build fails with:
[ 77%] Generating HelloView.h, HelloView.cc
/bin/sh: 1: drogon_ctl: not found
make[3]: *** [examples/CMakeFiles/helloworld.dir/build.make:74: examples/HelloView.h] Error 127
Add host-drogon to the dependencies, as it installs drogon_ctl in
$(HOST_DIR)/bin.
Fixes:
- https://autobuild.buildroot.org/results/b8f38b0645932cb5506515d6d313b64d824c8ce0
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Build errors were found by the Gitlab pipelines with these defconfigs:
- bootlin-m68k-68040-uclibc
CMake Error at cmake/scripts/linux/ArchSetup.cmake:50 (message):
Unknown CPU: m68k
- bootlin-s390x-z13-glibc
CMake Error at cmake/scripts/linux/ArchSetup.cmake:50 (message):
Unknown CPU: s390x
Backport an upstream commit from the upcoming Piers branch to fix the
restriction in ArchSetup.cmake.
This caused a different build error on m68k later on:
/builds/bkuhls/buildroot/br-test-pkg/bootlin-m68k-68040-uclibc/build/kodi-21.3-Omega/xbmc/utils/MathUtils.h:142:5:
error: unknown register name ‘st’ in ‘asm’
142 | __asm__ __volatile__ (
because m68k is not part of the list of archs to disable asm code:
https://github.com/xbmc/xbmc/blob/Omega/xbmc/utils/MathUtils.h#L26
Upstream rejected to add m68k there:
https://github.com/xbmc/xbmc/pull/22519https://github.com/xbmc/xbmc/pull/22357#issuecomment-1368358471
so we disable m68k in BR2_PACKAGE_KODI_ARCH_SUPPORTS.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
When a package defines $(PKG)_FLAT_STACKSIZE, ELF2FLT_FLAGS contains
-Wl,-elf2flt="-r -s<stack-size>". The embedded quotes are needed to
keep both elf2flt options in single linker argument.
However, many package Makefiles wrap $(TARGET_CFLAGS) in double quotes,
for example:
CFLAGS="$(TARGET_CFLAGS)"
After expansion, the embedded quote terminates the outer CFLAGS quote.
As a result, the shell interprets "-s<stack-size> ..." as a command
instead of passing it to the compiler.
Pass -r and -s<stack-size> in separate -Wl arguments instead. This
avoids embedded quotes; GCC forwards both -elf2flt options to
ld-elf2flt, which collects them before invoking elf2flt.
This got broken by commit
04d7ea4720 ("package: Makefile.in: fix
elf2flt invocation options"), which by adding -r as an elf2flt
argument, did not correctly handle -s$($(PKG)_FLAT_STACKSIZE).
Signed-off-by: Fengwei Tan <tfx2001@outlook.com>
[Thomas: improve commit message]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
wine.mk passes --with-wayland whenever BR2_PACKAGE_WAYLAND is enabled,
but nothing guarantees the rest of what wine's Wayland test needs is in
the configuration. That test is:
WINE_NOTICE_WITH(wayland, [test -z "$WAYLAND_CLIENT_LIBS" \
-o -z "$WAYLAND_SCANNER" -o -z "$XKBCOMMON_LIBS" \
-o -z "$XKBREGISTRY_LIBS" -o "$ac_cv_header_linux_input_h" = "no"], ...)
and because --with-wayland is passed explicitly, WINE_NOTICE_WITH turns
into AC_MSG_ERROR rather than a notice.
So wine needs libxkbcommon, and it needs the libxkbregistry part of it,
which is only built when libxml2 is available. Select both when Wayland
support is enabled, and add libxkbcommon to the build dependencies.
Note that libxml2 is not a direct dependency of wine, it only has to be
in the configuration so that libxkbcommon builds libxkbregistry; the
build ordering is handled by libxkbcommon's own dependency on libxml2.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
libxkbregistry is the keyboard layout catalogue half of the library. It
parses the XML layout registry and so needs libxml2, which is presumably
why it was disabled unconditionally rather than wired to a dependency.
wine needs it. Its configure.ac requires XKBREGISTRY_LIBS alongside
wayland-client, wayland-scanner, xkbcommon and linux/input.h before it
will build the Wayland driver, and wine.mk passes --with-wayland for any
build with BR2_PACKAGE_WAYLAND - which turns that notice into a hard
error:
checking for wayland-client.h... yes
checking for wl_display_connect in -lwayland-client... yes
checking for wayland-scanner... .../host/bin/wayland-scanner
checking for xkb_context_new in -lxkbcommon... yes
checking for wayland-egl.h... yes
checking for wl_egl_window_create in -lwayland-egl... yes
configure: error: Wayland development files not found, the Wayland
driver won't be supported.
This is an error since --with-wayland was requested.
Every other term of that test passes; only XKBREGISTRY_LIBS is empty, so
wine and wayland together could not be built on any architecture.
Gated on BR2_PACKAGE_LIBXML2 rather than turned on outright, because
meson.build takes dependency('libxml-2.0') unconditionally once
enable-xkbregistry is set, so a target without libxml2 would fail to
configure.
Regarding since when this is broken, three pieces had to come together:
- libxkbcommon has passed -Denable-xkbregistry=false since commit
1791bc30a5 ("package/libxkbcommon: bump version to 1.0.1", Sep 2020),
i.e. Buildroot 2020.11. libxkbregistry has therefore never been built
in Buildroot.
- wine's configure gained the XKBREGISTRY_LIBS term in its Wayland
test in wine 9.0, with upstream commit d64ea8e4a6c9
("winewayland.drv: Enumerate Xkb layouts and create matching HKL.",
Nov 2023).
- wine.mk started passing --with-wayland in commit 7cb49e7712
("package/wine: bump to version 9.19", Oct 2024), which is what turns
the missing XKBREGISTRY_LIBS from a notice into a hard error.
The breakage therefore dates from Buildroot 2024.11, and every branch
since is affected, including the LTS one: 2025.02.x carries wine 10.0,
whose configure has the XKBREGISTRY_LIBS check, together with
libxkbcommon 1.9.2 built with -Denable-xkbregistry=false, and its wine.mk
passes --with-wayland. 2025.05.x and 2025.08.x are in the same state.
A backport to 2025.02.x is thus needed.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes the following security issues:
- x/mod/sumdb/tlog: fix transparency log tile verification bypass
A malicious GOPROXY was previously capable of forging up to two sumdb
tiles that allow for a requested module to bypass the GOSUMDB check and
persist attacker-controlled module content to a local Go module cache.
This attack allows for a malicious GOPROXY to serve malicious module
content that cannot be detected by evaluating the transparency log.
All tiles are now correctly verified against their parents.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to Filippo Valsorda (Geomys) for reporting this issue.
This is CVE-2026-56865 and Go issue https://go.dev/issue/80744.
- x/mod/sumdb: ignore unrelated, unauthenticated hashes in Lookup
A malicious GOSUMDB was capable of serving arbitrary module content not
contained within the transparency log.
This attack allows for a coordinating GOPROXY and GOSUMDB to serve a
client malicious module content that cannot be detected by evaluating
the transparency log.
In order to determine if you have been affected:
rm -r go.sum go.work.sum vendor/ && go mod tidy
Thanks to mundur for reporting this issue.
This is CVE-2026-56864 and Go issue https://go.dev/issue/80745.
- encoding/xml: add recursion depth guard during decode
Previously, DecodeElement would reset the depth counter causing it to
never fire; this could lead to stack exhaustion.
This is CVE-2026-56859 and Go issue https://go.dev/issue/80481.
- net/http: apply ReadHeaderTimeout when doing unencrypted HTTP/2 check
When a server is configured to support unencrypted HTTP/2, it reads a few
bytes from each new connection to see if they contain the HTTP/2 client
preface. Previously, this was being done with no timeout applied.
ReadHeaderTimeout is now applied for this.
This is CVE-2026-56853 and Go issue https://go.dev/issue/80205.
- net/url: avoid quadratic complexity in resolvePath
Previously, resolving relative paths containing parent directory (..)
segments performed string conversions and buffer rewrites on each step,
resulting in quadratic time complexity and high memory allocation
overhead.
Now, path resolution operates on a byte buffer using index-based
backtracking for .. segments, eliminating the quadratic time complexity
and significantly reducing memory allocations.
This is CVE-2026-56860 and Go issue https://go.dev/issue/80494.
- golang.org/x/net/dns/dnsmessage: panic when parsing invalid SVCB record
Parsing an invalid SVCB or HTTPS RR can panic when the size of a
parameter value overflows the message buffer.
Thanks to Mundur (https://github.com/M0nd0R) for reporting this issue.
This is CVE-2026-46600 and Go issue https://go.dev/issue/79795.
- crypto/tls: limit handshake messages we are willing to accept post-handshake
Previously, we always counted handshake messages, such as KeyUpdate, as
state-advancing, regardless of whether a handshake has been completed or
not. As a result, a malicious client can keep sending KeyUpdate messages
to force the server to keep performing key derivation operations
indefinitely.
Thanks to Qi Deng of Aurascape.ai for reporting this issue.
This is CVE-2026-56862 and Go issue https://go.dev/issue/80528.
- html/template: fix Javascript regexp context tracking
Previously, pathological inputs could close an unescaped / early,
allowing for attack-controlled data to inject arbitrary content,
potentially leading to XSS.
Thanks to Ali Sherif for reporting this issue.
This is CVE-2026-56858 and Go issue https://go.dev/issue/80435.
- x/net/idna: failure to reject ASCII-only Punycode-encoded labels
The ToASCII and ToUnicode functions incorrectly accepted Punycode-encoded
labels that decode to an ASCII-only label. For example,
ToUnicode("xn--example-.com") incorrectly returned the name "example.com"
rather than an error.
The idna package implements the processing algorithm from UTS 46. Older
versions of UTS 46 included a specification bug which permitted multiple
ASCII labels to decode to the same Unicode label. UTS 46 revision 33
fixed the specification bug. The idna package now implements the updated
specification.
This behavior can lead to privilege escalation in programs using the idna
package. For example, a program which performs privilege checks on the
ASCII hostname may reject "example.com" but permit "xn--example-.com".
If that program subsequently converts the ASCII hostname to Unicode, it
will inadvertently permits access to the Unicode name "example.com".
Thanks to KC1zs4 (https://github.com/KC1zs4) for reporting this issue.
This is CVE-2026-39821 and Go issue https://go.dev/issue/78760.
- encoding/asn1: enforce maximum recursion depth
Enforce a recursion limit in Unmarshal to prevent stack exhaustion when
parsing deeply-nested, recursive structures.
Thanks to Marwan Atia (marwansamir688@gmail.com) for reporting this issue.
This is CVE-2026-33818 and Go issue https://go.dev/issue/80405.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 0f2e9cc878 bumped the
package from 3.11.0 to 3.12.0. This bump includes upstream commit
9f8945251d
which added the usage of enums not present in older kernel versions.
The Gitlab pipelines caught the build errors with the defconfig
bootlin-aarch64-glibc-old:
lib/route/nh_encap_ila.c:50:19: error: ‘ILA_ATTR_IDENT_TYPE’ undeclared
(first use in this function)
lib/route/nh_encap_ila.c:53:19: error: ‘ILA_ATTR_HOOK_TYPE’ undeclared
(first use in this function)
Both enums were added to the Linux kernel in version 4.15:
fddb231ebe70d5aef48a
Add upstream commit to fix the problem.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bugfix release with large number of (security) fixes.
HAProxy 2.6.32 was released on 2026/07/29. It added 33 new commits
after version 2.6.31.
As for the 2.8.27, the announce is an expurgated copy-paste of the 3.4.3
announce:
* stats: Two issues about the stats page, reported by Red Hat/AISLE
Research, were fixed.
Proxies updated through the stats page while in "stats admin" mode were
not subject to the "stats scope" filtering, meaning a scope meant to
restrict which proxies are visible/actionable could be silently bypassed
on POST requests.
Separately, POST requests to the stats interface did not validate that the
Origin (or Referer) header matched the Host, which is now checked to
mitigate CSRF attacks.
* ssl-gencert: A memory leak on every certificate generation was fixed.
Two temporary buffers were not freed after generating a certificate on the
fly, leaking memory each time a new SNI triggered certificate
generation. This issue was reported by Red Hat/AISLE Research.
* sample/protobuf: buffer overflows after pointer-shift converters, reported
by Red Hat/AISLE Research and Charles Vosburgh, were fixed.
Several converters (protobuf/ungrpc field extraction, ltrim())
move the sample's data pointer forward on success but did not shrink the
sample's recorded buffer capacity accordingly. A converter chained
afterwards that relies on that capacity (e.g. padding via memset()) could
then write past the end of the buffer, leading to heap corruption or a
worker crash. All the affected converters now adjust the capacity
together with the pointer.
* protobuf: A nested-path validation bypass reported by Red Hat/AISLE
Research was fixed.
The protobuf field lookup used for the protobuf()/ungrpc() converters did
not strictly enforce hierarchical boundaries, so a flat sibling field
could incorrectly satisfy a nested-path lookup (e.g. matching a root-level
field as if it were nested under a parent). The lookup was rewritten as a
strict, non-recursive path walker that correctly bounds each nesting
level.
Separately, a crash because of deprecated protobuf group wire types was
fixed. These wire types are now explicitly rejected.
* http-fetch: Two crashes reachable from health-check configurations were
fixed.
"res.body"/"res.hdr"/... and similar response fetches assumed the
health-check receive buffer always held an HTX message, which is only true
for actual HTTP checks; on a plain TCP check, a hostile/misbehaving server
could craft the first bytes of its reply to be misinterpreted as HTX
internal fields, causing a wild read and worker crash (or leaking
arbitrary process memory).
Separately, "capture.req.hdr"/"capture.res.hdr" only validated the upper
bound of their index argument, so a negative capture id was accepted at
boot and dereferenced an out-of-bounds array entry at runtime, crashing
the worker on the very first request.
* slz: Several issues were fixed in the SLZ library.
A stream alternating many literals in the 144-255 range with cheap
back-references could keep inflating indefinitely instead of falling
back to a stored block, exceeding the library's documented worst-case
output size by several percent. A new accounting mechanism now bounds
this overhead. Practical impact on haproxy requires tune.bufsize above
~43 kB with the default reserve.
Five small correctness fixes inherited from upstream libslz were also
backported: Avoid reading up to a few bytes past the end of very short
inputs on architectures without fast unaligned access; stop appending an
extra, misplaced block to an already-finished deflate/gzip/zlib stream
(which could corrupt the trailing checksum in ~2% of fuzzed streams); fix
the Adler32 checksum accumulator sign handling on 32-bit systems
(affecting the zlib format only); avoid an undefined-behaviour signed left
shift when assembling input words byte by byte; and use the exact bit cost
when deciding whether to emit the last literals of a block as a stored
block, avoiding compressed output slightly larger than the documented
worst case.
* peers: A heap overflow when replicating large stick-table dictionary
entries was fixed.
peer_prepare_updatemsg() never verified that a stick-table entry's
dictionary value (e.g. server_key, up to ~16 kB) actually fit in the
update message being built. Since the peers protocol is plain-text and
unauthenticated, a rogue or compromised peer could plant an oversized
entry that overflows the 16 kB trash buffer as soon as the victim
replicates ("teaches") it, confirmed as a heap-buffer-overflow write. The
function now checks the available room before encoding and fails cleanly
if it doesn't fit. This was reported and fixes by Matt Suiche from Tolmo
Inc.
And, as usual, the bunch of minor fixes here and there, mainly raised during
AI-assisted code reviews. Most were never noticed:
* HTX API: Some bugs about how the HTX API was used were fixed here and
there.
* http-act: Double-frees and a couple of state bugs on parsing errors were
fixed.
* http-fetch/http-ana/http-htx: Few out-of-bounds reads were fixed.
* http-conv: The last input character could be lost when calling url-dec
converter, when the input buffer was full. This was fixed by failing the
converter in that case.
* mux-h1: An extra 200ms delay was observed on some H2-to-H1 messages
because the end of the message was not always properly detected. This
case is now properly handled.
* sample: An edge case in be2hex() was fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47353.html
Signed-off-by: Fred Lefranc <fred.lefranc.evs@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
With this the test verifies not only that Apache can work in
principle, but also that it works with a read-only rootfs. Because of
the read-only rootfs the test itself cannot write to /root, so store
the test download in /tmp.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The previous configuration placed both logs and PID file in /var/logs,
which is not writable with a read-only rootfs (e.g. squashfs), as well
as non-standard. Starting HTTPD during boot failed with:
(30)Read-only file system: AH00091: httpd: could not open error log file /var/logs/error_log.
AH00015: Unable to open logs
An additional issue was that the Buildroot-default --prefix=/usr
override meant various Apache-internal directories (e.g. htdocs) were
placed directly in /usr. Note that the upstream default prefix is
/usr/local/apache2, not /usr/local.
Using the "Debian" layout provides a standard-compatible layout with
logs in /var/log/apache2 and PID file in /var/run/apache2 (both in
tmpfs with the default Buildroot fstab). Both directories need to
exist when the server starts, so handle that in the init script.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
- Switch to release tarball using GitHub generated checksum
- Drop backported patch
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
When wchar in uClibc is enabled, just enable uchar support, too.
Adds 5kb to the C library on aarch64. Makes the default uClibc
config more compatible to musl and glibc.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Enable FENV support unconditionally when a hard-float toolchain is in use.
Useful for packages as quickjs and chawan.
Adds 24kb to the C library on aarch64.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://www.openssh.org/releasenotes.html#10.5p1
Changes since OpenSSH 10.4
==========================
This release contains a number of security fixes and small bugfixes.
Security
========
* ssh-agent(1): fix an interaction between agent locking and the
session-bind@openssh.com extension that is used to identify
forwarded agents. These binding requests were refused when the
agent was locked, with the result that operations that were
intended to be limited to local use only could be performed
remotely, including the ability to add PKCS#11 tokens and make
use of keys that had destination restrictions applied.
Reported by sn0x-sharma
* ssh(1): avoid potential realloc use-after-free in the client if a
remote forwarding is added via the local session multiplexing
socket while a remote forwarding open request is pending with the
server. Report and fix from Brian Mingus of Cognatory
* sshd(8): make the authorized_keys "restrict" keyword apply
correctly to tunnel forwarding too (which is administratively
disabled by default). Reported by Erichen, Institute of Computing
Technology, Chinese Academy of Sciences
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit cd3a2f0ff3 switched the
build system to meson which depends on c17:
9f16597859 (line_0cc1139e3_A5)
Add the necessary dependency and propagate to reverse dependencies to
fix a build error caught by the Gitlab pipelines:
br-test-pkg/bootlin-aarch64-glibc-old/build/libdvdcss-1.5.0/meson.build:1:0:
ERROR: None of values ['c17'] are supported by the C compiler. Possible
values for option "c_std" are ['none', 'c89', 'c99', 'c11', 'gnu89',
'gnu99', 'gnu11']
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 4ab91a29d8 bumped the
package to version 26.1.3 which first included upstream commit
94a6274275
causing a build error with this defconfig
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV5_EABI_UCLIBC_STABLE=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
Add a patch to disable some assembler intructions which are not
available with a toolchain configure for soft-float.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
host-flex/host-bison are needed when building GCC from Git or from a
snapshot, not from release tarballs. The condition for the dependency
was actually incorrect: it was needed for the ARC-specific gcc
version (BR2_GCC_VERSION_ARC) but not for the ARC architecture in
general: building upstream GCC release tarballs for ARC does not
require host-flex/host-bison.
Cc: ARC Maintainers <arc-buildroot@synopsys.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
A new (and hopefully definitive) CPE is to be used for TF-A:
cpe:2.3:o:trustedfirmware:trusted_firmware-a:
as reported in TF-A directly[1]. NVD correctly reports[2] the new CPE
deprecates the "old" one Buildroot was using.
CVEs for projects under the TrustedFirmware umbrella are now seemingly
handled under the CPE vendor "trustedfirmware".
[1] efd7b189fa%5E%21/
[2] https://nvd.nist.gov/products/cpe/detail/2E1BD3E8-DF65-42E3-A0BA-747137D6DEF2
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
With qemu version 11.0.0, support for microblazeel has been folded into the
microblaze target. This means that the run command for microblazeel-mmu needs
to be changed to reflect this.
See the notes in the qemu bump commit to 11.0.0 for more details:
9a5369effd
See also qemu removed feature documentation:
https://gitlab.com/qemu-project/qemu/-/blob/v11.0.0/docs/about/removed-features.rst#qemu-system-microblazeel-removed-in-11-0
Run command for qemu versions prior to 11.0.0:
qemu-system-microblazeel -M petalogix-s3adsp1800 -kernel output/images/linux.bin -serial stdio
New run command since qemu version 11.0.0:
qemu-system-microblaze -M petalogix-s3adsp1800,endianness=little -kernel output/images/linux.bin -serial stdio
Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Kanak Shilledar <kanak.shilledar@axis.com>
[Julien:
- fix new command line in commit log
- add link to qemu removed feature documentation in commit log
- change link to buildroot commit from github to gitlab
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Packaging changes:
- Drop patch that is upstream (it was an upstream backport)
- double-conversion now requires CMake 3.29, so we select
BR2_HOST_CMAKE_AT_LEAST_3_29
Upstream changes:
CMake: Raised required version to 3.5 by @heirecka in #240
Bump ossf/scorecard-action from 2.4.0 to 2.4.1 by @dependabot[bot] in #241
Always initialize decimal-point variable. by @floitsch in #244
Explain that ToShortest might not be the shortest. by @floitsch in #245
Add higher bound for cmake. by @floitsch in #246
Bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #248
Bump lukka/get-cmake from 4.0.2 to 4.0.3 by @dependabot[bot] in #250
Bump lukka/get-cmake from 4.0.3 to 4.1.0 by @dependabot[bot] in #252
Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #253
Bump lukka/get-cmake from 4.1.0 to 4.1.1 by @dependabot[bot] in #254
Add alias double-conversion::double-conversion by @Flamefire in #255
Revert "Add _ITERATOR_DEBUG_LEVEL=2 and _DEBUG defines (#202)" by @Osyotr in #256
Bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #259
Install pkg-config file (from CMake build) by @Ericson2314 in #262
Update CI runners and minimal cmake. by @floitsch in #257
Bump lukka/get-cmake from 4.1.1 to 4.1.2 by @dependabot[bot] in #258
Bump lukka/get-cmake from 4.1.2 to 4.2.0 by @dependabot[bot] in #264
Bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #265
Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #266
Prepare new release. by @floitsch in #267
See https://github.com/google/double-conversion/releases/tag/v3.4.0
Tested in a defconfig that has the two reverse dependencies of
double-conversion in Buildroot:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_QT6=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON_UJSON=y
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changes:
Security and robustness release. Notable cramfsck changes:
* Reject dirent names containing "/", "." or ".." to close a path
traversal during `cramfsck -x` (reported in issue #12).
* Open regular files with O_CREAT|O_EXCL during extraction to
prevent duplicate-dirent attacks from truncating files reached
via a previously-extracted symlink.
* Fix outbuffer NUL termination and a 1-byte overflow in
do_symlink when running with both -v and -x.
* Harden romfs_read against truncated/malformed images by
zero-filling the window buffer and checking lseek/read returns.
* Reject directory entries that extend past their parent's size.
Documentation: README now documents cramfsck and lists all current
mkcramfs options; stale hard-link and endianness claims corrected;
NOTES trimmed of the 25-year-old Future Development section.
(See https://github.com/npitre/cramfs-tools/releases/tag/v2.2)
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit
c66d1ba685b0d03b28967d2f7a48f6c64687efa2 ("Fortran: Add a shared
memory multi process coarray implementation [PR88076]"), libgfortran
now unconditionally uses fork(), which makes it impossible to build
Fortran support on noMMU architectures.
In follow-up commit efb497c23a6f4109bf8794342617cbc161c08301, it was
made even more clear: if you don't have fork() and you're not on
WIN32:
+#else
+#error "no way known to start child processes."
+#endif
There are apparently no autobuilder failures for this issue, but the
simple defconfig below allows to trigger the build failure:
BR2_arm=y
BR2_cortex_m7=y
BR2_GCC_VERSION_16_X=y
BR2_TOOLCHAIN_BUILDROOT_FORTRAN=y
Even though this issue is only starting from GCC 16.x, we make Fortran
unavailable on noMMU configurations regardless of the GCC version,
with the reasoning that:
1. Fortran on noMMU is unlikely to be in use
2. Moving forward, all future versions of GCC will have this
restriction
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project website instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
project repository instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog since 1.0.9:
Fix race in thread-per-connection mode on wake-up signal
between daemon and thread that could result in lost wake-ups
and thus connections that did not finish processing.
Fix rare assertion failure in relation to suspend-and-resume
processing (harmless if assertions were turned off).
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/signalwire/freeswitch/releases/tag/v1.11.2
"This is an important release containing extensive security hardening
across the core, mod_rtmp, mod_xml_rpc and mod_sofia, alongside the new
interface allowlist, stricter DTLS/STUN validation for media sessions,
and a modernized build system. We strongly encourage all users to
upgrade to v1.11.2 as soon as possible."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch which is included in this release.
Added patches to fix build of host utils and added dependency to
host-tiff. Otherwise build errors will occur when the host does not
provide tiffio.h.
These changes are necessary due to changes introduced by this version
bump which includes upstream commit
a60119408c
added in 2023. No LTS backport needed in buildroot.
Switched to github helper to download the current git tree instead of
using outdated tarball snapshots.
The currently used tarball contains the git tree as of 2020-08-14:
6ec23e5a7e
The newest tarball provided by upstream
https://files.freeswitch.org/downloads/libs/spandsp-3.0.0-0d2e6ac65e.tar.gz
contains the git tree as of 2023-06-16:
0d2e6ac65e
and lacks the fix for gcc-14.x added to buildroot in patch 0002.
Build-tested using this defconfig:
BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_INIT_NONE=y
BR2_PACKAGE_BLUEZ_ALSA=y
BR2_PACKAGE_FREESWITCH=y
BR2_PACKAGE_WIRESHARK=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Github repository has been renamed from dracut-ng to dracut. The
wiki still exists, but the actual documentation has been moved to
dracut-ng.github.io.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Redis 8.10 is a new feature release, see the changes:
https://github.com/redis/redis/blob/8.10.0/00-RELEASENOTES
Since upstream commit 4dd58caa7cc23225b01f31e7bd9a1ed0af7e49ad [1],
Redis must now be built with `make build redis` to avoid building extra
modules, which are distributed within the source code archive since 8.10.0
Moreover, because the default upstream configuration now includes those
modules, attempting to launch redis-server with this would fail, because
it cannot load the missing modules. Therefore, we use the provided
`make sync-redis-conf` to regenerate a full redis configuration that
take the absence of modules into account, and we install that config
file instead of the default one.
[1] 4dd58caa7c
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch `0008-awk.c-fix-CVE-2023-42366-bug-15874.patch` was introduced
in [1]. The IGNORE_CVES entry was removed while the patch is still
present in [2].
Re-introduce this IGNORE_CVES entry.
[1] 75c594d446 package/busybox: fix pending CVEs
[2] f88537c46b package/busybox: drop stale IGNORE_CVES entries
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
[Julien: fix patch number in comment (s/0008/0007/)]
Signed-off-by: Julien Olivain <ju.o@free.fr>
In commit e427f85e29 ("boot/grub2: fix
build issue since 2.14 version bump") we added some patches that
require regenerating the configure script. Consequently, we added
GRUB2_AUTORECONF = YES and HOST_GRUB2_AUTORECONF = YES.
Except that grub2 is special. While the host package is indeed using
host-autotols-package, the target package is using generic-package,
making GRUB2_AUTORECONF = YES basically a no-op.
Except that since we're patching configure.ac, the build realize at
build time that configure is older than configure.ac, regenerates it
at that time, and re-runs the configure script without the right
environment variables causing build failures.
We fix that by doing the autoreconf step "manually" for the target
grub2 package.
Fixes:
https://autobuild.buildroot.org/results/11802ca1762e046328df324d33a1ad813fcd92e8/
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When adding the libldns and python_scp, the corresponding tests were not
added to DEVELOPERS, preventing correct notifications in case of tests
failures.
Add the missing entries to enable proper author notifications in case of
failing tests.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since upstream commit 0c716a157be460006a4b762625de329b5e36dbf9 (first
release: v2026.07) mkeficapsule supports PKCS#11 keys, and in turn
requires GnuTLS with PKCS#11 support.
Without it, building mkeficapsule for the target fails:
HOSTLD tools/mkeficapsule
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: tools/mkeficapsule.o: in function `main':
mkeficapsule.c:(.text.startup+0x530): undefined reference to `gnutls_pkcs11_init'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x544): undefined reference to `gnutls_pkcs11_add_provider'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x5fc): undefined reference to `gnutls_pkcs11_obj_list_import_url4'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x620): undefined reference to `gnutls_x509_crt_import_pkcs11'
/home/fiona/br-test-pkg/bootlin-armv5-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/14.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: mkeficapsule.c:(.text.startup+0x1334): undefined reference to `gnutls_pkcs11_deinit'
collect2: error: ld returned 1 exit status
The error can be reproduced using "utils/test-pkg -c" with the
following config:
BR2_PACKAGE_UBOOT_TOOLS=y
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y
For host-uboot-tools this was solved in Buildroot commit
6597563da7 "package/gnutls: add host
support for pkcs11" by unconditionally enabling PKCS#11 support for
host-gnutls. For the target a more fine-grained approach is desirable,
so instead select BR2_PACKAGE_P11_KIT if
BR2_PACKAGE_UBOOT_TOOLS_MKEFICAPSULE=y and propagate dependencies.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes following CVE's:
CVE-2026-70368: Fixed an out-of-bounds memory
access triggered by logging attacker-controlled protocol messages longer
than 1,024 bytes (thanks to AISLE Research and Clemens Lang).
CVE-2026-70367: Fixed a SOCKS server mode bypass of the localhost
destination filter using alternate local-address encodings and
interface-scoped IPv6 destinations (thanks to AISLE Research and Clemens
Lang).
Complete Changelog is here:
https://www.stunnel.org/NEWS.html
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
SDL3_gfx provides basic antialiased drawing routines such as lines,
circles or polygons, an interpolating rotozoomer for SDL surfaces,
framerate control and MMX image filters, as an extension to SDL3.
https://github.com/sabdul-khabir/SDL3_gfx
Signed-off-by: Michael Fischer <mf@go-sys.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit fef9cad1fe ("package/libxmlsec1:
bump version to 1.3.12") has introduced a gcc 7.x and atomic
dependency, but the Config.in comment dependencies are not correct:
+comment "libxmlsec1 needs a toolchain w/ gcc >= 7"
+ depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_7 || !BR2_TOOLCHAIN_HAS_ATOMIC
Indeed, we treat BR2_TOOLCHAIN_HAS_ATOMIC like an architecture
dependency in Buildroot, so it should be:
+comment "libxmlsec1 needs a toolchain w/ gcc >= 7"
+ depends on BR2_TOOLCHAIN_HAS_ATOMIC
+ depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_7
so that the comment does NOT show up when BR2_TOOLCHAIN_HAS_ATOMIC is
false.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Test an actual D-Bus round-trip using easydbus:
- obtain a name on the system bus
- subscribe to a signal on a chosen object/interface
- emit signal with a string payload
- run the easydbus mainloop
- verify the handler received the expected payload
This covers both the default Lua interpreter (Lua 5.4) and LuaJIT
(Lua 5.1 ABI).
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
[Julien:
- move test files into a rootfs-overlay
- move common BR2_PACKAGE_{,EASY}DBUS configs to EasyDBusBase
- make stricter check of script output
- add DEVELOPERS entry for rootfs-overlay files
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream removed configure option INSTALL_EXAMPLE_CODE with commit
8434de3cbc
which was first released with version 2.11.0.
Upstream re-added a similar configure option named INSTALL_EXAMPLE_CODE
with commits
f8d989160e7c803c8538
which were first released with version 2.15.0.
Buildroot bumped the package to 2.15.0 with
8e713dcc88 and forgot to rename the
configure option.
Remove libva/x11/wayland-related configure option due to upstream commit
8434de3cbc
which was first released with version 2.11.0. Remove the selection of
optional packages for these dependencies as well.
Removed unneeded libatomic handling.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog 2.5..2.6:
treewide:
Migrate documentation to readthedocs
Emit more specific error messages for USB permission-based access issues
Add unit tests
snagflash:
Support compressed input files, e.g. *.wic.bz2
Refactor fastboot-uboot logic to factor out common code and improve logging
Automatically detect when oem_run isn't supported by U-Boot, and fallback to ucmd
snagrecover:
Support Renesas RZ/N1 platforms
Support SoC model aliases, and add i.MX8MP alias
Handle relative path prefixes with the -F syntax
Changelog 2.6..2.6.1:
snagrecover:
Correct i.MX93 ROM code recovery which doesn't support control endpoint HID commands
Add multi-board support to AM335x recovery setup script
Add i.MX7Solo support
treewide:
Fix broken links in documentation
Drop Python 3.9 support
Add CI for Python 3.14
One packaging-related change is that Snagboot would now
unconditionally import the bzip2, gzip and lzma Python modules, which
are not necessarily available. Since these are only needed when
compressed images are provided as input, we submitted a patch upstream
to make those imports only when compressed files are provided as
input, relaxing those dependencies.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream doesn't provide any useful changelog, but the number of
1.5.0..1.6.2 commits is reasonable:
bfc28c7 Define {MAX_,}RESERVED_BLOCKS as floats
5b93731 Recover automatic block number calculation
d6e659d Correct message for minimum block count
1b2a30e Correct also commented code to take into account reserved blocks
944a4fd Indirect blocks must be taken into account for stats
3e2fce1 Restore (MAX_)RESERVED_BLOCKS to integer division
b571221 Add missing newlines on error messages.
cd4ff51 don't call ftruncate() on stdout
6909cde Enable system locale - change from the standard (C) to system locale.
9651f5d Fix alignment issues for strict architectures
4a99c22 Hardcode length of hardcoded char array instead of sizeof(long)
1f38ba4 Add ordered directory traversal
84c2d01 Add ordered directory traversal test
467ebe5 Fix formatting of man page references
810c12e Fix auto-block calculation from PR #5 merge
28988bd Skip device table entry when parent path is not a directory (from PR #33)
45191ab Fix ordered directory traversal from PR #34 merge
b615521 configure.ac: teach autoreconf to detect and install macros in m4
81028ca configure.ac: upgrade ancient snprintf macro to modern autoconf-archive edition
67661a1 Fix EXTRA_DIST: reference new ax_func_snprintf.m4 instead of deleted ac_func_snprintf.m4
907737e Remove incorrect address
4c4343d Add licensing information
cb5f584 Add license information
a60ccd9 Use strrchr to split path:dest so host paths may contain colons (fixes#23)
44ff03d Implement sparse_super feature with superblock/GDT backups (fixes#29)
8b8f2d1 Add extended attributes (xattr) support (fixes#9)
d0a9274 Optimize block/inode allocation for large filesystems (fixes#31)
b69c34e Fix -d dir:/path destination: restore colon after stats pass, auto-create intermediate dirs
2c38700 Add 9 functional tests for previously untested features
3d3bcb6 remove useless NEWS file
03dee74 Bump version to 1.6.0 (fixes#28)
c8f41b9 Make xattr copying opt-in with -X/--xattrs flag (fixes#40)
3324695 Bump version to 1.6.1
4e5d8ae Update README: add -X/--xattrs, SOURCE_DATE_EPOCH, and missing device table types
bf5b1a0 Bump version to 1.6.2
This commit also updates the COPYING license file hash, after an update
of the FSF, in upstream commit:
907737e4e8
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: fix COPYING license file hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog (https://www.bytereef.org/mpdecimal/changelog.html) 4.0.0 to
4.0.1:
features
Add Cygwin support.
Update config.guess and config.sub to the latest versions.
build fixes
Fix pkg-config files for custom paths.
Set LD/LDXX unconditionally to CC/CXX, since LDFLAGS/LDXXFLAGS from ./configure rely on it.
macOS: use libdir instead of RPATH for the install_name.
This commit also updates the COPYRIGHT.txt license file hash, after a
year update.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[Julien: fix COPYRIGHT.txt license file hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/irql-notlessorequal/intel-vaapi-driver/blob/2.4.5/NEWS
This bump follows
39d2ff612f
"Intel archived intel/intel-vaapi-driver at 2.4.1 and advises forking.
irql-notlessorequal/intel-vaapi-driver is the active continuation (119
commits ahead, tagged releases, Chromium fixes), so track it at 2.4.5.
[...]
The fork renamed the wayland meson option, so switch with_wayland to
with_wayland_drm in all DISPLAYSERVER branches. Also drop the dead
01.org PKG_SITE."
Updated license file and hash due to upstream commit:
7343767d87
Also switch build system to meson.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
- Update BOTAN_VERSION to 3.11.1
- Remove 0001-Add-more-value-barriers-to-avoid-compiler-induced-side-channels.patch
as it is already integrated upstream in this version.
Fixed in 3.11.1:
- CVE-2026-34580: Resolve certificate verification bypass bug introduced
in 3.11.0 (GH #5500)
- CVE-2026-34582: Resolve TLS 1.3 client authentication bypass (GH #5599)
Fixed in 3.11.0:
- CVE-2026-32877: Fix a heap over-read during SM2 decryption (GH #5450)
- CVE-2026-32883: Fix an OCSP response forgery vulnerability (GH #5449)
- CVE-2026-32884: Fix a name constraints bypass for DNS names (GH #5448)
- Remove the --disable-altivec configuration option as it has been removed
from the Botan build system in version 3.x
- Optimize the --disable-neon logic using the yx pattern.
In Botan 3.x, the --disable-neon flag is specifically targeted at the
arm32 architecture. Furthermore, Buildroot's BR2_ARM_CPU_HAS_NEON
variable is only defined for 32-bit ARM, which previously caused a
false-positive --disable-neon flag to be passed on AArch64 builds
- Update license.txt hash in botan.hash due to the copyright year update
to 2026
https://botan.randombit.net/news.html#version-3-11-1-2026-03-31
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: fix CVE numbers in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
- botan dropped the usage of Boost.Filesystem in 2.10.0 [0]
- botan never actively searched for Boost.System, as it is header-only
the dependecy can be dropped too
The only part of boost botan currently uses is asio. So use --with-boost option
when boost is selected.
[0] aff8cc8a7a
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changes made in this release:
Ben Wolsieffer (1):
nptl: fix getting main stack size on no-MMU
Max Filippov (4):
stdio: fix %a formatting of inf and nan
stdio: fix radix point output for %a
stdio: output sign with NaNs
stdio: restrict first digit of %a output to 0 or 1
Ramin Moussavi (19):
libintl.h: route stubs through format_arg inlines; fix gettext_noop
build: scope .NOTPARALLEL to locale targets only, restore parallel build
limits.h: define PAGE_SIZE/PAGESIZE like musl, fixing the gdb build
wait4: fall back to waitid(2) at runtime when wait4 returns ENOSYS
pagesize: restore PAGE_SHIFT fallback for binfmt_flat (no auxv)
buildsys: build locale headers in-tree, not via a recursive sub-make
extra/locale: skip locales the build host cannot provide
csky: fix struct semid_ds layout for TIME64
csky: make __kernel_uid_t/__kernel_gid_t 32-bit
hppa: fix inotify/signalfd/timerfd flag values
hppa: do not set IPC_64 for the SysV IPC *ctl commands
x86: fix struct semid_ds layout for TIME64
i386: add CFI to __libc_i386_syscall6 for cancellation unwinding
i386: do not set IPC_64 for the SysV IPC *ctl commands on 5.1+ kernels
buildsys: terminate .eh_frame in shared objects
m68k: make the __jmp_buf layout match what setjmp.S actually saves
inet: use the direct accept4 syscall when __NR_accept is missing
m68k: implement atomic operations with the CAS instruction
libc: fix struct shmid_ds layout for TIME64
Waldemar Brodkorb (10):
netinet/in.h: sync with glibc
bits/fcntl-linux.h: sync with glibc
add copy_file_range syscall wrapper
sys/fanotify.h: drop include to fix c-sky compilation
adjtimex: fix for architectures lacking __NR_clock_adjtime, f.e. frv
sys/user.h: restore required macros
netinet/tcp.h: sync with glibc
loongarch: add basic static only support
riscv: setcontext: fix linking error
bump version for 1.0.59 release
ramin (16):
ldso: harden _dl_tls_get_addr_soft against an unusable DTV
microblaze: implement atomic operations with lwx/swx
ldso: microblaze: add missing addend to R_MICROBLAZE_TLSDTPREL32
ldso: make the _dl_tls_get_addr_soft DTV check microblaze-specific
microblaze: fix struct semid_ds layout for TIME64
m68k: fix struct semid_ds layout for TIME64
mips: fix fallocate() 64-bit argument passing on n32
mips: fix mmap64() for large offsets on n32
mips: fix setjmp() on n32/n64 (.cpreturn, not .cprestore)
mips: always set IPC_64 for the SysV IPC *ctl commands
libc: fix struct msqid_ds layout for TIME64 on all common-header arches
linuxthreads: fix SIGSEGV in MIPS cancellable wrappers (waitpid, nanosleep)
ldso: serialize dl_iterate_phdr to fix concurrent unwind hang on SMP
nptl: cancel the current thread directly instead of via SIGCANCEL
mips: only n32/n64 always need IPC_64, not o32
m68k: use the kernel cmpxchg helper for atomics on ColdFire
Patch 0001 is applied upstream and is removed here.
Fixes:
- https://autobuild.buildroot.net/results/2bd/2bd73b0060cad4f44649ffe4ea60c4775160d86e
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the bump of grub2 to version 2.14, the build fails on some
configurations with:
/home/autobuild/autobuild/instance-8/output-1/host/bin/grub-mkimage: error: `/home/autobuild/autobuild/instance-8/output-1/build/grub2-2.14/build-i386-pc/grub-core//kernel.img' is miscompiled: its start address is 0x9074 instead of 0x9000: ld.gold bug?.
We are not the only ones affected: OpenEmbedded has the issue as well,
addressed in commit
66aefeca48,
and this commit points that libreboot and Gentoo have also adopted the
same temporary fix: revert two upstream commits.
So to fix the issue in Buildroot, we take the same approach. It is
temporary, and there is an upstream patch series under discussion to
really fix the problem. But as this series has 9 patches still under
discussion, we take the simpler approach of reverting two simpler
patches for the time being.
host-pkgconf is needed as an additional dependency because
configure.ac using m4 macros provided by host-pkgconf.
Fixes:
https://autobuild.buildroot.net/results/89b/89b907278cada3d7ca1fee2d08d66921ffb4d7cc/build-end.log
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In order to verify that pyudev works fine, including with just
libudev-zero, add a basic test for this package.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 3f24135c56 ("package/libinput:
only needs libudev, not udev daemon") changed libinput to depend on
libudev instead of udev.
However, BR2_PACKAGE_LIBINPUT_PYTHON_TOOLS selects
BR2_PACKAGE_PYTHON_PYUDEV, which depends on udev, causing a broken
dependency chain:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_PYTHON_PYUDEV
Depends on [n]: BR2_PACKAGE_PYTHON3 [=y] && BR2_PACKAGE_HAS_UDEV [=n]
Selected by [y]:
- BR2_PACKAGE_LIBINPUT_PYTHON_TOOLS [=y] && BR2_PACKAGE_LIBINPUT [=y] && BR2_PACKAGE_PYTHON3 [=y]
Turns out that after experimenting, the majority of the pyudev
functionality works fine with just libudev. Only pyudev.udev_version()
has been detected as not working as it calls into udevadm. But the
actual features to enumerate devices and get their characteristics
just fine.
So, to fix the issue, we change the dependency of python-pyudev to
just libudev instead of udev.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 5394df6400 ("package/tpm2-tss:
add Mbed-TLS crypto backend support") added a dependency to
BR2_PACKAGE_TPM2_TSS_FAPI, and a comment about this
dependency. However, the comment is shown even if other
architecture-related dependencies are not met.
This commit fixes that by only displaying the comment when relevant,
i.e when BR2_TOOLCHAIN_HAS_SYNC_4.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In commit 5394df6400 ("package/tpm2-tss:
add Mbed-TLS crypto backend support"), a depends on
!BR2_PACKAGE_MBEDTLS was added to BR2_PACKAGE_TPM2_TSS_FAPI, but this
new dependency was not properly propagated to the reverse
dependencies, causing kconfig warnings such as:
WARNING: unmet direct dependencies detected for BR2_PACKAGE_TPM2_TSS_FAPI
Depends on [n]: BR2_PACKAGE_TPM2_TSS [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y] && !BR2_PACKAGE_MBEDTLS [=y]
Selected by [y]:
- BR2_PACKAGE_TPM2_TOOLS_FAPI [=y] && BR2_PACKAGE_TPM2_TOOLS [=y] && BR2_TOOLCHAIN_HAS_SYNC_4 [=y]
This commit properly propagates this new dependency to
BR2_PACKAGE_TPM2_TOOLS_FAPI, fixing the kconfig warning.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
It has been good practice for a while to describe the kind of change
in the commit message of any patch that changes license file
hashes. This is important so any substantial changes don't go
unnoticed. However it wasn't explicitly stated in the manual, fix
that.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Localedef is built from the glibc source code, so license information
is the same.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The COPYINGv3 license file was added with upstream commit
e067e53080386e93dcf8b07e25fb6656f2c8941e, it applies to scripts used
during build.
LGPL-3.0+ applies to sysdeps/htl/raise.c, which is used for the Hurd
platform. Buildroot builds only Linux, so the file should not be
compiled, but it is part of the downloaded (and possibly shared, if
"make legal-info" is used) archive. The same applies to the manual.
Checked against the copyright file of the Debian "libc6" package (as
of 2.42-17 and 2.43-2), note that Debian excludes the manual.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://gcc.gnu.org/pipermail/gcc-announce/2026/000193.html
GCC 16.2 is a bug-fix release from the GCC 16 branch
containing important fixes for regressions and serious bugs in
GCC 16.1 with more than 102 bugs fixed since the previous release.
For the list of bugs fixed in this version, see:
https://gcc.gnu.org/gcc-16/changes.html#16.2
Removed patch 0003 which was backported from the gcc-16 branch and is
included in this release.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This reverts commit 72f7aa47e7.
The MALLOC_SIMPLE workaround is no longer needed: the root cause, a
zero _dl_pagesize on noMMU/FLAT targets, is fixed by commit
35d3927e85 ("package/uclibc: fix for noMMU targets using FLAT
binaries").
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This reverts commit 832ff692ab.
The MALLOC_SIMPLE workaround is no longer needed: the root cause, a
zero _dl_pagesize on noMMU/FLAT targets, is fixed by commit
35d3927e85 ("package/uclibc: fix for noMMU targets using FLAT
binaries").
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This reverts commit dd67de1bd3.
The MALLOC_SIMPLE workaround is no longer needed: the root cause, a
zero _dl_pagesize on noMMU/FLAT targets, is fixed by commit
35d3927e85 ("package/uclibc: fix for noMMU targets using FLAT
binaries").
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
The ts4900 defconfig was removed, this package is no longer used.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This configuration for the TS-4900 was added back in September
2016 (commit 3138ab3fee), and has not
been updated in any significant way since then.
This defconfig still use a 4.12 kernel that is no longer maintained.
Remove its support.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728914086 (ts4900_defconfig)
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This configuration for the s6lx9 microboard was added back in March 2012
(commit 49084a1982), and has not been
updated in any significant way since then.
This defconfig still use a 4.4.7 (no longer maintained) and out of tree
devicetree (lx9_mmu.dts).
Remove its support.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14728914045 (s6lx9_microboard_defconfig)
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Now that gdb 17.x has been added[1], and gdb 16.x made the default[2],
let's remove support for gdb 14.x.
Aside from the usual removal, we also simplify things a bit as GDB
14.x was the last version not depending on gcc >= 9.x. As it is now a
mandatory dependency we move it outside the choice.
[1] 4868e0dd62
[2] 23e70547ca
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The bluez5 plugin can encode and decode LC3 (Bluetooth LE Audio) when
built against liblc3, but the meson option was unconditionally disabled.
Enable it when BR2_PACKAGE_LIBLC3 is set, using the same conditional
idiom as the neighbouring opus and aac codecs.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
liblc3 is the Google implementation of LC3, the mandatory codec of the
Bluetooth LE Audio profiles. The PipeWire bluez5 plugin can use it to
encode and decode LE Audio streams.
https://github.com/google/liblc3
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wiki.gnome.org has a big deprecation warning saying "All information
on this site is out of date and should not be used." Point at the
librsvg project on gitlab.gnome.org instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Both libConfuse and ethtool support is relatively new features. Enable
optional support for them, including an example /etc/mini-snmpd.conf
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
A start script has been missing since the package was added, so the
daemon was not started automatically on sysv/busybox systems.
This also fixes a regression in systemd builds introduced in fccdc6bd,
when the package switched from local unit file to upstream.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This bumps from v1.6 directly to v2.0, for details, please see:
- https://github.com/troglobit/mini-snmpd/releases/tag/v1.7
- https://github.com/troglobit/mini-snmpd/releases/tag/v2.0
The release tarball is the canonical supported source for the project
and also ships a pre-generated configure script, hence the switch.
This commit removes the package patch, which is now included in the new
version. The .checkpackageignore file is also updated accordingly.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: update .checkpackageignore to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
libgtk4 passes -Dintrospection=disabled unconditionally, so Gtk-4.0.gir is
never installed. webkitgtk depends on gobject-introspection and generates
WebKit-6.0.gir, which includes Gtk-4.0.gir, so building both fails:
FAILED: WebKit-6.0.gir
Couldn't find include 'Gtk-4.0.gir' (search path:
'['.../usr/share/gir-1.0', ...]')
Tie the option to BR2_PACKAGE_GOBJECT_INTROSPECTION and add the dependency,
the way package/libgtk3 already does. Systems without introspection keep the
previous behaviour.
Signed-off-by: Alsey Coleman Miller <alseycmiller@gmail.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Whether the host libglib2 picks up sysprof support depends on whether
libsysprof-capture happens to be installed on the build machine, which
makes the host build depend on the host environment. Disable sysprof
explicitly for the host build so the result is deterministic.
Keep sysprof enabled for the target build: it is useful to profile and
measure the performance of applications running on the target.
Signed-off-by: Jean-Michel Hautbois <jeanmichel.hautbois@yoseli.org>
[Fiona: also apply to package/libglib2/libglib2-bootstrap]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Update libxmlsec from 1.3.9 to 1.3.12. The package then needs a few
adjustments:
- there are undefined references to xmlDebugDumpDocument ([1]):
unit_tests/transform_helpers_unit_tests.c:291:9: error: implicit
declaration of function ‘xmlDebugDumpDocument’
[-Wimplicit-function-declaration]
This is due to xmlsec1 unit tests being built systematically, and
depending on libxml2 being built with --with-debug, so patch
apps/Makefile.am accordingly at build time to disable unit tests build.
- the build can fail with older GCC versions due to an unimplemented
parameter ([2]):
aarch64-linux-gcc.br_real: error: unrecognized command line option \
‘-Wformat-overflow=2’; did you mean ‘-Wstrict-overflow=’?
This format-overflow parameter has been implemented in GCC 7, so make
the package depend on GCC >= 7. Another solution could have been to
pass --disable-pedantic to the package's configure, but that sounds a
bit strong just to disable a parameter that has been exisiting for
almost 10 years.
- the build can fail on missing atomics ([3]):
[...]/bootlin-m68k-5208-uclibc/host/opt/ext-toolchain/m68k-buildroot-uclinux-uclibc/bin/ld.real:
[...]/bootlin-m68k-5208-uclibc/host/bin/../m68k-buildroot-uclinux-uclibc/sysroot/usr/lib/libcrypto.a(libcrypto-lib-threads_pthread.o):
in function `CRYPTO_atomic_store': threads_pthread.c:(.text+0xcd2):
undefined reference to `__atomic_is_lock_free'
So make the package depend on libatomic.
This commit updates the license hash, after a year update in [4].
[1] https://gitlab.com/jolivain/buildroot/-/pipelines/2527527034
[2] https://gitlab.com/jolivain/buildroot/-/jobs/14449681615
[3] https://gitlab.com/jolivain/buildroot/-/jobs/14449681621
[4] 2e557ee8a0
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Co-Developed-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Julien: update license hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Running TestUsbIp may fail when checking if two QEMU USB Keyboards are
reported by lsusb. On fast host, the second QEMU USB keyboard may not
aleady detected when lsusb is executed. So wait a bit, to let the new
keyboard be detected.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See release announce [1].
This commit also removes the package patch, which was accepted upstream
in [2]. The comment before "FWTS_AUTORECONF = YES" is changed to
"No configure in tarball", because the patch 0001 is removed, but the
autoreconf is still needed.
[1] https://lists.ubuntu.com/archives/fwts-devel/2026-July/014207.html
[2] 3bf8a5f393
Signed-off-by: Julien Olivain <ju.o@free.fr>
Duplicate of lua-argparse.
Note: the argparse package was introduced in Buildroot commit [1].
lua-argparse was introduced in [2]. For consistency with other Lua
packages which has the "lua-" prefix, this commit removes the package
without the prefix.
[1] 169d1632d5
[2] e70abe9716
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump Xen from 4.19.5 to 4.21.1.
Resolved in version bump:
- 0002-Arm-platforms-fix-build-with-gcc15.patch
Upstream: https://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=39f95089e2ba15c5438ce904c0cbbd8d79d3e6e7
The git-checkout.sh fix for non-master branch checkout is now included:
https://xenbits.xenproject.org/gitweb/?p=xen.git;a=commitdiff;h=01fb23dd71006d87e874f310e9c50f31582f274e
Remaining patches refreshed for updated context:
- 0001-No-trace-backend.patch (Buildroot specific, cross-compile workaround)
- 0002-Update-linker-flags.patch (Buildroot specific, cross-compile workaround)
Starting with Xen 4.20, qemu-xen is no longer bundled in the release
tarball. Add a new qemu-xen package that provides the qemu-xen source
tree with required meson subprojects pre-populated. This avoids any
network access during the build.
New dependencies:
- qemu-xen (provides qemu-xen source for tools build)
- host-python-distlib (needed by QEMU's mkvenv)
The qemu-xen package:
- Fetches qemu-xen via git (without recursive submodules to avoid
massive ROM downloads)
- Pre-populates required meson subprojects (keycodemapdb,
berkeley-softfloat-3, berkeley-testfloat-3) from gitlab archives
- Applies packagefiles overlays (meson.build) for subprojects that
need them
- Removes .wrap files for unused subprojects to prevent any network
access attempts during the build
- Patches xen_native.h #error to #warning for cross-compile
Tested with:
support/testing/run-tests \
-d dl -o output_folder \
tests.package.test_xen.TestXenAarch64
support/testing/run-tests \
-d dl -o output_folder \
tests.package.test_xen.TestXenArmv7
Both aarch64 and arm32 runtime tests pass.
Quick build defconfig used for iteration:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_XEN=y
BR2_PACKAGE_XEN_HYPERVISOR=y
BR2_PACKAGE_XEN_TOOLS=y
# BR2_TARGET_ROOTFS_TAR is not set
Related prior attempts:
https://patchwork.ozlabs.org/project/buildroot/patch/20260211055138.719459-1-matthew.l.weber@gmail.com/https://patchwork.ozlabs.org/project/buildroot/patch/20251007164756.893264-1-titouan.christophe@mind.be/
Cc: Neal Frager <neal.frager@amd.com>
Cc: Julien Olivain <ju.o@free.fr>
Cc: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Cc: John Ernberg <john.ernberg@actia.se>
Signed-off-by: Matthew Weber <mathew.l.weber3@boeing.com>
[Julien:
- update qemu-xen package url in Config.in
- split XEN_DEPENDENCIES lines
- add COPYING license hash in qemu-xen.hash
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit aedf131da6 bumped the
package to 8.5.0 which made opcache a mandatory dependency but kept the
CFLAGS added in 2015 with buildroot commit
e054764917.
As it turns out we need to remove the CFLAGS to fix the build with the
bootlin-aarch64-glibc-old defconfig as detected by the Gitlab pipelines:
ext/opcache/shared_alloc_posix.o: In function `create_segments':
shared_alloc_posix.c:(.text+0xcc): undefined reference to `shm_open'
shared_alloc_posix.c:(.text+0x11c): undefined reference to `shm_unlink'
shared_alloc_posix.c:(.text+0x19c): undefined reference to `shm_unlink'
shared_alloc_posix.c:(.text+0x1b8): undefined reference to `shm_unlink'
as they seem to disturb the detection of librt.
It is unclear which upstream commits added since 2015 fixed the original
problem so a backport to LTS branches is not advised.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream bumped the minimum required gcc version from 6.1 to 8.1 in
commit 84ec3ddf9fd3 ("bump minimum gcc version to 8.1"), so the build
now fails with "Compiler too old; need at least gcc 8.1" on older
toolchains.
There is no gcc 8.0.x release (the 8.x series starts at 8.1.0), so
BR2_TOOLCHAIN_GCC_AT_LEAST_8 is enough to express this dependency.
While at it, add the gcc version to the openblas-arch comment, which
only checked for C++ support and would therefore stay hidden on
toolchains that are too old.
Fixes: 597d5d10ec ("package/armadillo: bump to version 15.0.1")
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BR2_ARCH_IS_64 is set for mips64/mips64el even when the n32 ABI is
used, so openblas was built with BINARY=64. Its build system then
passes -mabi=64, which conflicts with the n32 sysroot:
gnu/stubs.h:35:11: fatal error: gnu/stubs-n64_hard.h: No such file
or directory
For openblas, BINARY refers to the pointer size rather than to the
architecture, and n32 uses 32-bit pointers, so BINARY=32 is correct
there.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog since 1.0.7
- 1.0.9: This is a bugfix release, fixing minor vulnerabilities
and expanding the test suite.
- 1.0.8: This is a bugfix release, fixing minor security
vulnerabilities and expanding the test suite.
Signed-off-by: Michele Comignano <mcdev@playlinux.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v56 April 2024" to "v62 May 2025".
Note: in this release, the package source archive name changed to
include a revision. This commit adds a new _REVISION variable with the
value published in the corresponding NXP BSP.
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v57 July 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v58 November 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v58 November 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v58 November 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v58 November 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version is aligned with NXP Linux BSP version "LF6.12.49_2.2.0".
License hashes changed because the LA_OPT_NXP_Software_License changed
from "v58 November 2024" to "v63 May 2025".
Signed-off-by: Sébastien Szymanski <sebastien.szymanski@armadeus.com>
Reviewed-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com>
Tested-by: Laurentiu Mihalcea <laurentiu.mihalcea@nxp.com> # MX95-15x15-FRDM
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit [1] "package/uboot-tools: fix host FIT signature support"
slightly changed the logic in which the file
$(@D)/include/generated/autoconf.h is created.
When there is no Kconfig sub-option selected, the file is no longer
created and the build fails with error:
include/linux/kconfig.h:4:10: fatal error: generated/autoconf.h: No such file or directory
The issue can be reproduced with the with the simple commands:
cat >.config <<EOF
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_HOST_UBOOT_TOOLS=y
EOF
make olddefconfig
make host-uboot-tools
This commit fixes the issue by simply adding a touch of the file
at the beginning to make sure it will always exist.
[1] 928cc5dc5c
Cc: James Hilliard <james.hilliard1@gmail.com>
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Update License hash due to year change.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: add "package/" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Update License hash due to year change to 2026.
Signed-off-by: Adam Duskett <adam.duskett@amarulasolutions.com>
[Julien: add "package/" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since Buildroot commit [1] "package/gcc: switch to GCC 15.x as the
default", compiling freescale_imx91frdm_defconfig fails in TF-A with
error:
include/drivers/nxp/trdc/imx_trdc.h:7: error: header guard 'IMX_TRDC_H' followed by '#define' of a different macro [-Werror=header-guard]
7 | #ifndef IMX_TRDC_H
include/drivers/nxp/trdc/imx_trdc.h:8: note: 'IMX_XRDC_H' is defined here; did you mean 'IMX_TRDC_H'?
8 | #define IMX_XRDC_H
The issue happen because this defconfig is using a Buildroot
(internal) toolchain which uses gcc version 15 by default.
This issue was fixed upstream in [2], first included in TF-A v2.13.
This commit updates U-Boot, TF-A and Linux to use the NXP
tag lf-6.18.20-2.0.0, which include this fixes.
Note that, as described in the commit log of [3] which was used as a
base for this defconfig, U-Boot and Linux were forks. Now the
necessary patches are included in the vendor BSP, this commit
switches those repos to use the vendor ones.
This commit also removes the linux-headers.hash custom hash file
which was never needed, because the defconfig used an external
toolchain.
Also, due to the upstream uboot commit [4], this commit adds a uboot
config fragment to disable CONFIG_EFI_CAPSULE_AUTHENTICATE, to
remove the dependency on the command "cert-to-efi-sig-list", provided
the host efitools package, which is not yet in Buildroot.
This commit was run tested on board 700-94610 Rev A1.
[1] a75b8623f5
[2] 2e9198d0e0%5E%21/
[3] 2e05f22ff8
[4] fd58c275f6
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since Buildroot commit [1] "package/gcc: switch to GCC 15.x as the
default", compiling freescale_imx93frdm_defconfig fails in TF-A with
error:
include/drivers/nxp/trdc/imx_trdc.h:7: error: header guard 'IMX_TRDC_H' followed by '#define' of a different macro [-Werror=header-guard]
7 | #ifndef IMX_TRDC_H
include/drivers/nxp/trdc/imx_trdc.h:8: note: 'IMX_XRDC_H' is defined here; did you mean 'IMX_TRDC_H'?
8 | #define IMX_XRDC_H
The issue happen because this defconfig is using a Buildroot
(internal) toolchain which uses gcc version 15 by default.
This issue was fixed upstream in [2], first included in TF-A v2.13.
This commit updates U-Boot, TF-A and Linux to use the NXP
tag lf-6.18.20-2.0.0, which include this fixes.
Note that, as described in the commit log of [3] which introduced
this defconfig, U-Boot and Linux were forks. Now the necessary
patches are included in the vendor BSP, this commit switches those
repos to use the vendor ones.
While at it, this commit also switches the defconfig to use an
external glibc stable Bootlin toolchain, to follow recommendations
from [4]. Since an external toolchain is used, the linux-headers.hash
custom hash file is no longer needed and is also removed. At the
time of this commit, the Bootlin stable toolchain is a gcc 14.
Also, due to the upstream uboot commit [5], this commit adds a uboot
config fragment to disable CONFIG_EFI_CAPSULE_AUTHENTICATE, to
remove the dependency on the command "cert-to-efi-sig-list", provided
the host efitools package, which is not yet in Buildroot.
This commit was run tested on board 700-94611 Rev B1.
[1] a75b8623f5
[2] 2e9198d0e0%5E%21/
[3] 2e05f22ff8
[4] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
[5] fd58c275f6
Reported-by: Robert P. J. Day <rpjday@crashcourse.ca>
Tested-by: Robert P. J. Day <rpjday@crashcourse.ca>
Signed-off-by: Julien Olivain <ju.o@free.fr>
U-Boot host tools use the tools configuration namespace when code calls
CONFIG_IS_ENABLED(). With USE_HOSTCC, CONFIG_IS_ENABLED(FIT_SIGNATURE)
resolves to CONFIG_TOOLS_FIT_SIGNATURE, while
CONFIG_VAL(FIT_SIGNATURE_MAX_SIZE) resolves to
CONFIG_TOOLS_FIT_SIGNATURE_MAX_SIZE.
The host-uboot-tools package only generates the old CONFIG_FIT_SIGNATURE
define. This makes tools/Makefile include fit_check_sign, but the host code
sees FIT signature support as disabled and the OpenSSL-backed signing and
verification objects are omitted. As a result, mkimage accepts a signature
node without writing its value or injecting a required public key.
fit_check_sign then has no required key and reports success without
checking the configuration signature.
A FIT-support-only configuration never exercises this path, which is why
the existing hash-only runtime test still passes.
Generate the tools FIT signature options needed by the host code and pass
CONFIG_TOOLS_LIBCRYPTO=y so the OpenSSL-backed signing, verification and
cipher objects are selected. Keep CONFIG_FIT_SIGNATURE=y in the make
options because U-Boot tools/Makefile still uses it to build
fit_check_sign.
Extend TestHostUbootTools to create an RSA-signed FIT, require a 256-byte
configuration signature and a required public key, verify the FIT, corrupt
the signature, and require verification to fail.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Julien: add comments in runtime test]
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://www.samba.org/samba/history/samba-4.24.5.html
This is a security release in order to address the following defects:
o CVE-2026-6949:
TSIG packet with name compression can crash DNS
Incorrect size calculations when a TSIG record contains
compressed names can lead to a large out-of-bounds write
causing the server to crash.
https://www.samba.org/samba/security/CVE-2026-6949.html
o CVE-2026-58216:
An authenticated user could possibly crash a KDC process
A kpasswd packet that contains malformed ASN.1 might cause
the server to access 6 bytes of unallocated memory. This
memory is not exposed to the user, but in some
circumstances the server could crash.
https://www.samba.org/samba/security/CVE-2026-58216.html
o CVE-2026-58218:
DNS signing DoS via TKEY name cache exhaustion
An unauthenticated user can repeatedly register names TKEY
names, which floods a cache causing legitimate TKEYs to be
expunged. This can practically block the use DNS TSIG
signing.
https://www.samba.org/samba/security/CVE-2026-58218.html
o CVE-2026-58221:
Samba AD authenticated LDAP access domain takeover
Samba AD low-privilege authenticated LDAP access allows
modifications to internal LDB special DNs, which permits a
domain takeover.
https://www.samba.org/samba/security/CVE-2026-58221.html
o CVE-2026-58222:
Samba AD LDAP Compare filter injection and trusted-request
confusion disclose protected attributes
An ordinary authenticated domain user can bypass access
checks and query confidential Active Directory attributes
(such as KDS root keys) via LDAP Compare requests. Due to a
filter injection flaw and trusted execution context, the
LDAP Compare operation can be turned into a
protected-attribute disclosure oracle.
https://www.samba.org/samba/security/CVE-2026-58222.html
o CVE-2026-58224:
The CTDB protocol has bounds checking issues
CTDB fails to do integrity checking of received packets.
This includes failure to check field lengths against packet
lengths when unmarshalling packets.
https://www.samba.org/samba/security/CVE-2026-58224.html
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The --with-systemd option controls only if systemd units are
installed, so there is no build time dependency. Disable systemd
unconditionally for the host package because Buildroot cannot and
should not install systemd units on the host.
Fixes host-p11-kit install error:
install: reguläre Datei '/usr/lib/systemd/user/p11-kit-server.socket' kann nicht angelegt werden: Keine Berechtigung
install: reguläre Datei '/usr/lib/systemd/user/p11-kit-server.service' kann nicht angelegt werden: Keine Berechtigung
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Disable some new configure options which we do not support.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Changelog since 1.0.6:
This is a bugfix release, fixing modest security vulnerabilities
discovered by A. Ramos.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
docker-credential-gcr calls pthread_getattr_np() which is only available
with NPTL; i.e. always available with glibc (where it originates from,
since 2.2.3), always available with musl (which has had it since 0.9.10
in 2013), and only available when uClibc has NPTL (since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/525273d178d89ae8eef306d6ec662af368f20f73/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/strukturag/libheif/releases/tag/v1.23.1
Fixes the following CVEs:
CVE-2026-62289 (GHSA-jc8f-p23p-5hjg)
Integer underflow in Fraction constructor via double clap transform
application
CVE-2026-62291 (GHSA-xpw3-9rhw-482x)
Heap out of bounds write in libheif uncompressed encoder when writing
images with mismatched auxiliary alpha dimensions
CVE-2026-62292 (GHSA-73p7-m7gg-w2jv)
Out-of-bounds read in uncompressed unci tile range slicing
CVE-2026-62377 (GHSA-9ww4-9v47-m7pj)
Reachable assertion in HeifContext::get_track() aborts on a valid-but-
empty HEIF sequence file
(GHSA-46rp-pcq2-rpmr)
Heap out-of-bounds write in the uncompressed encoder for RRGGBB images
with interleaved bit-depth ≤ 8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/notes.html#notes-for-bind-9-20-26https://downloads.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.htmlhttps://seclists.org/oss-sec/2026/q3/208
Fixes
CVE-2026-10723: Incorrect acceptance of NSEC3 records
CVE-2026-10822: Key Record using PRIVATEDNS algorithm may lead to unexpected exit
CVE-2026-11331: Potential wildcard CNAME RPZ policy bypass
CVE-2026-11605: Unnecessary validation of DNSSEC signed records
CVE-2026-11622: Potential memory usage beyond configured limits
CVE-2026-11721: Cache poisoning possible with label count discrepancy, RRSIG, and wildcards
CVE-2026-12617: Record ordering based unexpected exit with CNAME or DNAME
CVE-2026-13204: Unexpected exit in certain situations with NSEC and NSEC3 both present
CVE-2026-13321: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: update pgp key id in hash file comment]
Signed-off-by: Julien Olivain <ju.o@free.fr>
BSD-0-Clause is not a recognized SPDX license identifier. 0BSD is used
in the LICENSE file, and LICENSE.0BSD matches the 0BSD license text
[1].
[1] https://spdx.org/licenses/0BSD.html
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
A few headers outside libiberty use LGPL-2.1+, too, and other headers
and some scripts use GPL-2.0+.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BSD-0-Clause is not a recognized SPDX license identifier. 0BSD is used
in the source SPDX-License-Identifier headers, and the associated text
[1] matches the COPYING.0BSD file.
FSFUL and FSFULLR are the "few permissive licenses" of certain build
system files mentioned in COPYING.
Move "Public Domain" to the end of the list because it applies only to
a few files.
[1] https://spdx.org/licenses/0BSD.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
All these packages are part of Buildroot and thus under
GPL-2.0-or-later unless stated otherwise, as described in COPYING.
package/skeleton-custom is excluded because it provides a way to copy
skeleton data from any location chosen by the user, the license of
which is unknown to Buildroot.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.96 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.96 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.211 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.211 and, for the SD
configuration, also updates U-Boot to version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.1.177. The size of
xipImage has increased by 23131 bytes (1696766 bytes compared to
1673635 in version 6.1.167).
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board hangs after starting init:
[ 1.231624] Run /sbin/init as init process
[ 1.235599] with arguments:
[ 1.238549] /sbin/init
[ 1.241331] earlyprintk
[ 1.244018] with environment:
[ 1.247143] HOME=/
[ 1.249554] TERM=linux
[ 1.252177] consoleblank=0
No error message is printed and the boot simply stalls at this
point.
The STM32F769 has no MMU, and uClibc's standard malloc()
implementation returns NULL for allocations performed during early
init on this target, causing init to fail.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via a uClibc config fragment. Unlike
the STM32F429/STM32F469 fix, the fragment is kept board-specific
since the STM32F769 is a Cortex-M7 board and does not belong to the
stm32f4xx family.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board fails to boot:
sh: out of memory
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---
The STM32F469 has no MMU, and uClibc's standard malloc() implementation
returns NULL for allocations performed during early init on this target,
causing init to abort immediately.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via the uClibc config fragment already
introduced for the STM32F429 in board/stmicroelectronics/common/stm32f4xx/,
which addresses the same issue on this Cortex-M4/noMMU board.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board fails to boot:
sh: out of memory
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
CPU: 0 PID: 1 Comm: init Not tainted 6.1.167 #2
Hardware name: STM32 (Device Tree Support)
Function entered at [<0800ea1e>] from [<0800de7b>]
Function entered at [<0800de7b>] from [<080e4991>]
Function entered at [<080e4991>] from [<080e2d19>]
Function entered at [<080e2d19>] from [<080125eb>]
Function entered at [<080125eb>] from [<08012b09>]
Function entered at [<08012b09>] from [<08012b69>]
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---
The STM32F429 has no MMU, and uClibc's standard malloc() implementation
returns NULL for allocations performed during early init on this target,
causing init to abort immediately.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via a uClibc config fragment. The
fragment is placed under board/stmicroelectronics/common/stm32f4xx/,
rather than under the board-specific directory, so that it can be
shared with the STM32F469, another Cortex-M4/noMMU board affected by
the same issue, which will be fixed in a subsequent patch.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.39 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
882f83806d
Added patch to fix build errors which would be introduced by this bump:
86baa66fc9
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.12.1https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
Fixes the following security problems:
CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
CVE-2026-59843: Denial of service via zero advertised channel packet size
CVE-2026-59844: Denial of service via oversized SFTP read length
CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
CVE-2026-59849: Denial of service via automatic certificate authentication loop
CVE-2026-59850: Use-after-free via data callbacks on closed channels
CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
Zero-initialize every ssh_string
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
"bzip2-1.0.4" is not a valid SPDX license identifier. The license text
in archival/libarchive/bz/LICENSE in the busybox source matches the
text associated with the bzip2-1.0.6 identifier [1].
[1] https://spdx.org/licenses/bzip2-1.0.6.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Nettle manual (nettle.html in the source archive) states:
> Nettle is dual licenced under the GNU General Public License version
> 2 or later, and the GNU Lesser General Public License version 3 or
> later. When using Nettle, you must comply fully with all conditions
> of at least one of these licenses. [...]
This means "or" is the correct description. Ellipsis covers a note
that a few files are licensed more permissively.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
All these bundled subprojects explicitly give "Apache-2.0 OR
LGPL-2.1-or-later" in their README.md files.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
docker-credential-gcr calls pthread_getattr_np() which is only available
with NPTL; i.e. always available with glibc (where it originates from,
since 2.2.3), always available with musl (which has had it since 0.9.10
in 2013), and only available when uClibc has NPTL (since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/3ed18da254082b7823b49be4578274792bb7380e/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
amazon-ecr-credential-helper calls pthread_getattr_np() which is only
available with NPTL; i.e. always available with glibc (where it
originates from, since 2.2.3), always available with musl (which has
had it since 0.9.10 in 2013), and only available when uClibc has NPTL
(since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/4e6e13f1161485b412d4601cb8972a1524ddd2d6/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When building pahole using a modern GCC (e.g. when building
host-pahole), discarded-qualifiers and unused-but-set-variable warnings
are produced. In builds that don't set CMAKE_BUILD_TYPE=Release, -Werror
gets set and causes a build failure.
Fix this by backporting an unreleased upstream patch (for
discarded-qualifiers) and adding another pending one for
unused-but-set-variable (and, arguably, a correctness issue).
Fixes: https://autobuild.buildroot.org/results/ba7/ba79fb9d08b2c6ec573b79fdbb6b4880bf603a57
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit fabcd7c8cc bumped the
package from 28.0 to 30.0 which includes upstream commit
a01cb6e63f
that was first included in version 29.0 and added among others
-fstack-protector-all to cxx_flags guarded with a new configure option
ENABLE_HARDENING which default to ON.
This commit causes build errors with toolchains with SSP support:
[ 44%] Linking CXX executable ../bin/bitcoin
/home/autobuild/autobuild/instance-40/output-1/host/lib/gcc/i686-buildroot-linux-musl/15.2.0/../../../../i686-buildroot-linux-musl/bin/ld:
CMakeFiles/bitcoin.dir/bitcoin.cpp.o:
in function `fs::PathToString(fs::path const&)':
bitcoin.cpp:(.text+0x4c):
undefined reference to `__stack_chk_fail_local'
Upstream later removed the forementioned configure option with commit
00ba3ba303
that was first included in version 30.0 so we need to remove
-fstack-protector-all from CMakeLists.txt.
Fixes:
https://autobuild.buildroot.net/results/093/093253c79fed1c5b93decc3124e9ef4622168efe/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Boot an armv5 image running the mdnsd responder alongside the mquery
client, then check that service discovery works: mquery browses for the
bundled _http._tcp service and mdnsd, on the same host, answers over the
loopback of the eth0 multicast group.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
[Julien: add "mdnsd -v" invocation to show version]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The mdnsd project has always been both a daemon and a library you can
link to your own application. With v1.0 a major bug (requiremnt on an
internal header, config.h) has been removed, enabling installation of
.a and .h files to staging.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/ppp-project/ppp/releases/tag/v2.5.3
Removed patch 0001 which is not needed anymore due to fixes committed to
all relevant kernel versions:
https://github.com/ppp-project/ppp/pull/504#issuecomment-2337005682
Removed patches 0002 & 0003 which are included in this release.
Added new patch to fix build errors seen with older gcc versions
detected by the Gitlab pipelines. These build errors are introduced in
the new dhcpv6relay plugin which was added to pppd 2.5.3, no backport to
buildroot LTS branches necessary.
Switched back to upstream tarball which now contains the previously
missing license files added by upstream commit
9f612dc02c
and drop autoreconf as well.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Major release, multibyte text can now be typed, displayed, and edited in
UTF-8 locales. Also, syntax highlighting, a visible region, and side by
side windows.
Release notes: https://github.com/troglobit/mg/releases/tag/v4.0
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/tuxera/ntfs-3g/wiki/NTFS-3G-Release-Historyhttps://seclists.org/oss-sec/2026/q3/152
Multiple vulnerabilities have been discovered in ntfs-3g.
A new version 2026.7.7 is now available at https://github.com/tuxera/ntfs-3g
(ntfscat) Fix heap memory corruption when processing a corrupt or maliciously crafted filesystem. (CVE-2026-42616)
Fix heap memory corruption when copying index data from root to an index block in a corrupt or maliciously crafted filesystem. (CVE-2026-42617)
Fix single-byte heap buffer overflow when decompressing maliciously crafted compressed file data. (CVE-2026-42618)
Fix heap buffer overflow when copying the tail data of an index block to a freshly allocated block. (CVE-2026-46569)
Fix out-of-bounds read when processing symlink reparse data in a corrupt or maliciously crafted filesystem. (CVE-2026-46571)
Fix heap memory corruption for maliciously crafted or corrupt index data descending to an out-of-bounds tree depth. (CVE-2026-46570)
Fix heap buffer overflow for maliciously crafted or corrupt index data during a node split. (CVE-2026-46572)
Fix heap buffer overflow when building inherited ACL data. (CVE-2026-56135)
Fix out of bounds access when clearing an index root in maliciously crafted or corrupt index data. (CVE-2026-56136)
Switched to sha256 tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
We changed the suffix of tarballs for Cargo-fetched packages in
commit [1], which affects out-of-tree packages, so it makes sense
to document that in the migration guide.
[1] e8c8bd9bc5
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add link to the commit changing the archive format]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The go-mod has changed with upstream commit 870378ba1685 (Move skopeo to
go.podman.io), so adapt appropriately.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
[Julien: remove extra "." in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch 0002-Makefile.am-fix-build-without-makeinfo.patch is not longer
needed since it builds even if 'makeinfo' is not installed, so it's removed.
For release annoucne, see:
https://lists.gnu.org/archive/html/info-gnu/2025-12/msg00002.html
Changelog:
Changes are detailed in the git repo logs:
$ git clone git://git.sv.gnu.org/guile.git
$ git whatchanged
Signed-off-by: Pedro Aguilar <paguilar@paguilar.org>
[Julien:
- remove .checkpackageignore entry to fix check-package error
- add link to release announce
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Both packages use the same tarball as source.
Added comments to keep the version number in sync.
Transformed minizip-zlib.hash into a link to ../libzlib/libzlib.hash.
Added MINIZIP_ZLIB_DL_SUBDIR = libzlib so minizip-zlib uses the same
tarball as libzlib.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
During its configure step, libgpg-error needs awk:
configure -> src/gen-lock-obj.sh -> objdump + awk on test binary
This call is used on the output from objdump on a test binary to
retrieve the size of some data structure, and generate accordingly an
internal header (lock-obj-pub.native.h). However, libgpg-error buildroot
package does not depend explicitely on host-gawk: if host-gawk is not
part of the build, or if it is built later than libgpg-error,
libgpg-error autotool tooling will eventually pick the build machine
awk. On top of this issue, despite the configure.ac suggesting that it
supports different implementations of awk, libgpg-error configure step
will not parse correctly the output from objdump when using mawk,
leading to a wrong lock-obj-pub.native.h header being generated:
With gawk:
typedef struct
{
long _vers;
union {
volatile char _priv[24];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0, \
0,0,0,0,0,0,0,0}}}
With mawk:
typedef struct
{
long _vers;
union {
volatile char _priv[0];
long _x_align;
long *_xp_align;
} u;
} gpgrt_lock_t;
#define GPGRT_LOCK_INITIALIZER {1,{{}}}
This issue has been observed for example on Debian 13 with mawk
installed: it fails to parse mtx_size, leading to a size 0, and so
generating crashes at runtime because of the invalid size embedded in
libgpg-error.
Side note: the lock-obj-pub.native.h header file is correctly
generated, when using mawk 1.3.4 20200120 from Debian 12.
The described issue happen with mawk 1.3.4 20250131 from Debian 13.
libgpg-error should be fixed upstream to properly handle this data
structure size guessing even when using mawk, but anyway the
corresponding buildroot package should not randomly use the build
machine host tooling or buildroot-provided host tooling depending on
whether host-gawk has been selected and built before it.
Enforce an explicit dependency on host-gawk for libgpg-error to make
sure that it systematically uses the buildroot-provided awk.
Co-developped-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Signed-off-by: Bernard Gautier <bernard.gautier@nav-timing.safrangroup.com>
Co-developped-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Julien: add the side note that mawk from debian 12 works]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 2774502344 bumped the
package from 4.2.2 to 6.2.3. Upstream added the usage of
std::scoped_lock in version 6.2.0:
a760b3278a
causing a build error detected by the Gitlab pipelines for the
bootlin-aarch64-glibc-old defconfig:
../src/inc/upnpapi.h:132:22: error:
‘scoped_lock’ is not a member of ‘std’
scoped_lock was introduced in gcc 7.1:
https://gcc.gnu.org/onlinedocs/libstdc++/manual/status.html#status.iso.2017
so we raise the minimum required gcc version accordingly.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
CVE-2026-39822: os: root escape via symlink plus trailing slash
go1.26.5 (released 2026-07-07) includes security fixes to the
crypto/tls and os packages, as well as bug fixes to the compiler,
the runtime, the go command, and the net, os, and syscall packages.
https://go.dev/doc/devel/release#go1.26.5
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Version 0.24.13 change log:
* configuration
- add range checks to number parser
- copy replay_gain_mode when creating a new partition
* storage
- curl: eliminate auth probe requests
* decoder
- opus: do not add 5 dB to Opus header playback gain
* tags:
- id3: limit ID3 tags to 4 MB
* output
- pipewire: fix file descriptor leak bug after connect failure
- pipewire: support the "media.album" tag
* systemd: allow AF_NETLINK when UPnP is enabled
In addition, the fix for fmt 12.2.0 is also included in this release
(https://github.com/MusicPlayerDaemon/MPD/commit/88d5b52).
Fixes:
../src/net/ToString.cxx: In function 'std::string ToString(SocketAddress)':
../src/net/ToString.cxx:80:37: error: 'format' is not a member of 'fmt'
80 | return fmt::format("[{}]:{}", host, serv);
| ^~~~~~
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog since 1.0.5:
Fix various minor issues, like theoretical
integer overflows for extreme inputs or NULL
dereferences if the application passes NULL
where it should not.
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.rust-lang.org/2026/07/09/Rust-1.97.0/
Rust received a change in Cargo's vendoring logic which produces
different vendor directory contents:
Add $comment to .cargo-checksum.json to clarify this file is not
a security mechanism.
https://github.com/rust-lang/cargo/pull/16967
Therefore the hashes of all Cargo-fetched packages need to be
updated. This commit changes the suffix of Cargo packages from
-cargo5 to -cargo6, and updates all hashes.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Drop util-linux dependency, libsmartcols is no longer used.
Bump GCC requirement from 4.9 to 13 for gnu2x and C23 enum underlying
types support.
See the release note of the new version:
https://github.com/DPDK/grout/releases/tag/v0.15.0
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Reviewed-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.211 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This patch bumps:
- U-Boot to version v2026.07
- Linux kernel to version 6.12.95 (LTS)
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.38 and U-Boot to
version 2026.07.
Tested on ci20.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.38 and U-Boot to
version 2026.07.
Tested on beaglebone black.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump bootgen to xilinx_v2026.1 release.
The following patches are now included and can be removed:
0001-lms-hash-sigs-hss_param.c-add-stdio.h-include.patch
0002-flexlexer-use-embedded-win_include-flexlexer.h.patch
bootgen xilinx_v2026.1 now requires C++ version 14, so the build command has
been updated to reflect this.
Add dependency on BR2_HOST_GCC_AT_LEAST_5 as gcc v5 is needed for C++
version 14 support.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Now that all Xilinx board configs have been bumped to xilinx_v2026.1, bump the
default version of xilinx-prebuilt to xilinx_v2026.1.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Now that all Xilinx board configs have been bumped to xilinx_v2026.1, bump the
default version of xilinx-embeddedsw to xilinx_v2026.1.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Now that all Xilinx boards have been bumped to xilinx_v2026.1,
the xilinx_v2025.2 hashes can be removed.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump versal2_vek385_defconfig to xilinx_v2026.1.
xilinx_v2026.1 includes the following software versions:
arm-trusted-firmware v2.14
linux v6.18.10
optee-os v4.9
plm xilinx_v2026.1
psmfw xilinx_v2026.1
uboot v2026.01
with all Xilinx downstream commits included with xilinx_v2026.1.
xilinx_v2026.1 was run tested on a vek385 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump versal defconfigs to xilinx_v2026.1.
xilinx_v2026.1 includes the following software versions:
arm-trusted-firmware v2.14
linux v6.18.10
plm xilinx_v2026.1
psmfw xilinx_v2026.1
uboot v2026.01
with all Xilinx downstream commits included with xilinx_v2026.1.
xilinx_v2026.1 was run tested on a vek280 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump zynqmp defconfigs to xilinx_v2026.1.
xilinx_v2026.1 includes the following software versions:
arm-trusted-firmware v2.14
linux v6.18.10
pmufw xilinx_v2026.1
uboot v2026.01
with all Xilinx downstream commits included with xilinx_v2026.1.
xilinx_v2026.1 was run tested on a zcu102 evaluation board.
xilinx_v2026.1 was run tested on a kv260 starter kit.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump zynq defconfigs to xilinx_v2026.1.
xilinx_v2026.1 includes the following software versions:
linux v6.18.10
uboot v2026.01
xilinx_v2026.1 was run tested on a zc702 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add hashes for the Xilinx vendor repo xilinx_v2026.1 release tag.
Create a new sub-dir including the version name because the legal-info hashes
change between versions for linux and the arm-trusted-firmware. This way, any
time there is a version bump, the new version hashes can be added before the
old version hashes are removed and the legal-info can always be verified.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.95 and U-Boot to
version 2026.07 for
- stm32mp135f_dk_defconfig
- stm32mp157a_dk1_defconfig
- stm32mp157c_dk2_defconfig
Tested on STM32MP157C-DK2 Discovery Board.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump TF-A LTS LTS version to 2.12 for:
- stm32mp135f_dk_defconfig
- stm32mp157a_dk1_defconfig
- stm32mp157c_dk2_defconfig
Bump the OP-TEE version to 4.9.0 for:
- stm32mp135f_dk_defconfig
Tested on STM32MP135F-DK and STM32MP157C-DK2 boards.
While at it, fix the below U-Boot build error by adding
BR2_TARGET_UBOOT_NEEDS_DTC=y
Adding host-dtc avoid the following build error, when the host has
libyaml:
/usr/bin/ld.bfd: scripts/dtc/yamltree.o: in function `yaml_propval_int':
yamltree.c:(.text+0x130): undefined reference to `yaml_sequence_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x13d): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x19f): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x1ae): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x22d): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x286): undefined reference to `yaml_sequence_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x293): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: scripts/dtc/yamltree.o: in function `yaml_tree':
yamltree.c:(.text+0x380): undefined reference to `yaml_mapping_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x38b): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x417): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x427): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x461): undefined reference to `yaml_sequence_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x46e): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x513): undefined reference to `yaml_sequence_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x520): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x5b0): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x5c0): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x6a7): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x6b4): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x6da): undefined reference to `yaml_mapping_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x6e5): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x74d): undefined reference to `yaml_scalar_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x75d): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: scripts/dtc/yamltree.o: in function `dt_to_yaml':
yamltree.c:(.text+0x8a5): undefined reference to `yaml_emitter_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x8b2): undefined reference to `yaml_emitter_set_output_file'
/usr/bin/ld.bfd: yamltree.c:(.text+0x8bf): undefined reference to `yaml_stream_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x8cc): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x8e5): undefined reference to `yaml_document_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x8f2): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x911): undefined reference to `yaml_sequence_start_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x91e): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x93c): undefined reference to `yaml_sequence_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x949): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x95b): undefined reference to `yaml_document_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x968): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x974): undefined reference to `yaml_stream_end_event_initialize'
/usr/bin/ld.bfd: yamltree.c:(.text+0x981): undefined reference to `yaml_emitter_emit'
/usr/bin/ld.bfd: yamltree.c:(.text+0x98f): undefined reference to `yaml_emitter_delete'
Signed-off-by: Raphaël Gallais-Pou <rgallaispou@gmail.com>
[Julien:
- change error log to english locale in commit log
- also add BR2_TARGET_UBOOT_NEEDS_DTC=y in stm32mp157c_dk2_defconfig
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Bump TF-A LTS 2.12
- Bump u-boot to version 2026.04.
smhload command has been removed from u-boot 2022.07 [1], use
"load hostfs" generic command as suggested by the documentation [2].
This commit adds BR2_TARGET_UBOOT_NEEDS_DTC=y, because the new
2026.04 version does need dtc. Adding host-dtc also avoid uboot build
failures on hosts with libyaml (uboot builds its own dtc if none is
defined in DTC build variable).
This commit also removes BR2_TOOLCHAIN_BUILDROOT_CXX=y, which was
forgotten when the defconfig was switched to Bootlin toolchain, in
commit [3].
[1] dcc4f9623e
[2] https://docs.u-boot-project.org/en/latest/usage/semihosting.html#migrating-from-smhload
[3] dbe0896826
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Julien:
- add BR2_TARGET_UBOOT_NEEDS_DTC=y
- remove BR2_TOOLCHAIN_BUILDROOT_CXX=y
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Future U-Boot 2026.07 will build mkeficapsule with pkcs11 support. [1]
This causes link errors with Buildroot, such as the following one:
mkeficapsule.c:(.text.startup+0xcd3): undefined reference to `gnutls_pkcs11_init'
(Other symbols the linker complains about are: gnutls_pkcs11_add_provider,
gnutls_pkcs11_obj_list_import_url4, gnutls_x509_crt_import_pkcs11 and
gnutls_pkcs11_deinit.)
The following example commands can be used to reproduce the issue:
make qemu_aarch64_ebbr_defconfig
echo 'BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.07-rc3"' >>.config
echo 'BR2_TARGET_UBOOT_NEEDS_GNUTLS=y' >>.config
echo '# BR2_DOWNLOAD_FORCE_CHECK_HASHES is not set' >>.config
make olddefconfig
make uboot
This commit adds the pkcs11 support for host-gnutls.
In Buildroot, since host-gnutls is currently only needed by uboot
(and other uboot derivatives such as uboot-tools) the pkcs11 support
is added unconditionally to host-gnutls.
Link: 0c716a157b [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
libcamera has moved for a while now to gitlab.freedesktop.org. The
mirror on git.linuxtv.org is still active, but it isn't the canonical
repository and has less bandwidth than freedesktop.org. Switch the
libcamera source URL to gitlab.freedesktop.org.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
[Julien: removed trailing slash in _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add upstream commit to buildroot to fix build errors introduced by the
upcoming bump of acl to 2.4.0:
https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html
"Compatibility Notes
- libacl now exports the new functions acl_get_file_at(),
acl_set_file_at(), acl_delete_def_file_at(), and acl_extended_file_at(),
which are declared in <sys/acl.h>. This may cause conflicts in programs
that define functions of the same name and link against libacl.
One such program is GNU tar which defines its own versions of functions
like acl_get_file_at(). The fix is to rename those functions. (In the
case if GNU tar, a fix is already on the way.)"
This patch will also fix build errors seen on the autobuilders for
host-tar on hosts which already provide acl >= 2.4.0.
Fixes:
https://autobuild.buildroot.net/results/478/478a9781f481df7cf2eecda80a4c13f900a0dc80/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
23ec782856
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
8d8e1930b8
Reported by nvidia
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822
format [0] for source list files; it carries a source list file that
points to the current repository, not to the snapshot.
Even though we do inject an old-style source list that points to the
snapshot repository, the packages in the current repository are more
recent than the one in the snapshot, so when we install our packages,
they get retrieved mostly from the current repository rather than from
the snapshot. The image is not reproducible.
Switch to using the new deb822-style source list file.
Note: we do not need to carry the "Latest just before" trick: the
snapshot repository will use the most recent actual snapshot before the
requested dated, so we can just use the date of the image we use (stuck
at midnight because we don't have better).
Since the snapshot repository can be really slow, while at the same time
the remote http server not dropping connections, it can take a very long
while to build the image; add a timeout so that stale connections are
detected and re-attemped early-ish (the timeout applies to both the
connect and the actual download, so it should be large enough to
accomodate slowish network connections).
Fixes: c95d5b8e1e (support/docker: move to current bookworm (Debian
12) snapshot)
[0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Commit da9dcddff1 (package/mosquitto: requires cmake >= 4.3) added
a requirement against cmake 4.3 for the target variant, but forgot
to add the same requirement to the host variant.
Do so, for the same reasons as reported for the target variant in
da9dcddff1.
Fixes: da9dcddff1
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
https://www.openssh.org/releasenotes.html#10.4p1
Changes since OpenSSH 10.3
==========================
This release contains a number of security fixes as well as general
bugfixes and a couple of new features.
Security
========
* sftp(1): when downloading files on the command-line using
"sftp host:/path .", a malicious server could cause the file to
be downloaded to an unexpected location. This issue was identified
by the Swival Security Scanner.
* scp(1): when copying files between two remote destinations, do
not allow a malicious server to write files to the parent
directory of the intended target directory. This issue was
identified by the Swival Security Scanner.
* sshd(8): when using the "internal-sftp" SFTP server implementation
(this is not the default), long command lines were previously
truncated silently after the 9th argument. If a security-relevant
option was in the 10th or later position, it would be discarded.
Reported by Steve Caffrey.
* sshd(8): add a documentation note to mention that the
GSSAPIStrictAcceptorCheck option is ineffective when the server
is joined to a Windows Active Directory. Reported by Yarin Aharoni
of Safebreach.
* sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
as it was documented to do. Note that PermitTunnel is not enabled
by default. Reported independently by Huzaifa Sidhpurwala of
Redhat and Marko Jevtic.
* sshd(8): avoid a potential pre-authentication denial of service
when GSSAPIAuthentication was enabled (this feature is off by
default). This was not mitigated by MaxAuthTries, but would be
penalised by PerSourcePenalties. This was reported by Manfred
Kaiser of the milCERT AT (Austrian Ministry of Defence).
* sshd(8): fix a number of cases where the minimum authentication
delay was not being enforced. Reported by the Orange Cyberdefense
Vulnerability Team.
* ssh(1): fix a possible client-side use-after-free if the server
changes its host key during a key reexchange. This was reported by
Zhenpeng (Leo) Lin of Depthfirst.
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit cc5c36afff bumped fmt to
version 12.2.0 which breaks the gerbera build. To fix the problem we add
two upstream patches.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes:
https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2026-0003.html
Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.
Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
UEFI platforms with a Devicetree have recently gained support for some form
of network booting. [1][2]
On those platforms, the UEFI firmware downloads the disk image over the
network and presents it to UEFI applications using the simple filesystem
protocol. This is sufficient for OS loaders such as e.g. GRUB to find their
configuration and load the kernel image.
The firmware must also describe the ramdisk to the OS, so that it finds its
root filesystem. On ACPI based platforms this is done with an NVDIMM
Firmware Interface Table (NFIT). On Devicetree based platforms, this can be
done with a pmem node. [3]
Add a kernel config fragment to add pmem support, which enables network
boot on UEFI platforms with Devicetree.
Also, briefly mention that we support this scenario in the readme.
This can be tested on Qemu, with the following procedure:
Build aarch64_efi_defconfig in a folder, to obtain output/images/disk.img,
and serve the image over HTTP with python:
$ python -m http.server -d output/images/
In another terminal and another folder, configure a U-Boot based firmware
starting from qemu_aarch64_ebbr_defconfig, and with the following
additional configurations:
BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.04"
BR2_TARGET_UBOOT_NEEDS_DTC=y
Add the following U-Boot configurations to
board/qemu/aarch64-ebbr/u-boot.fragment:
CONFIG_EFI_HTTP_BOOT=y
CONFIG_NET_LWIP=y
Build everything; you should obtain output/images/flash.bin.
Start Qemu as per board/qemu/aarch64-ebbr/readme.txt, but omitting the hd0
-device and -drive stanzas.
U-Boot should start; interrupt it with enter.
At U-Boot prompt, type the following commands:
=> setenv loadaddr 0x43000000
=> efidebug boot rm 0
=> efidebug boot add -u 0 net http://10.0.2.2:8000/disk.img
=> efidebug boot order 0
=> bootefi bootmgr
U-Boot should download the disk image over HTTP and boot Linux with UEFI.
Look for the following message in Linux boot log, to confirm that it did
indeed mount its rootfs from the downloaded image:
EXT4-fs (pmem0p2): mounted filesystem ...
Link: https://www.linaro.org/blog/installing-fedora-with-uefi-http-boot/ [1]
Link: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack [2]
Link: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md [3]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2026-34933:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
any unprivileged local user can crash avahi-daemon by sending a single
D-Bus method call with conflicting publish flags. This issue has been
patched in version 0.9-rc4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-34933
- 0be89b6bb5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream v85 no longer requires the -Dfwctl=enabled / -Dkeyutils=enabled
workaround, so drop both options along with the stale comment.
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html
Fixes CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243 & CVE-2026-20244.
"Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency
to resolve CVE-2026-41676."
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch which is included in this bump.
Fixes CVE-2026-5435, CVE-2026-6238 & CVE-2026-6791.
git shortlog 4070d808bea1c077eb7e7d52b52b91cae98205d5..
Adhemerval Zanella (3):
math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)
Florian Weimer (8):
iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
resolv: Declare __p_class_syms, __p_type_syms for internal use
resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
resolv: Improve formatting of unknown records in ns_sprintrrf
resolv: Check for inet_ntop failure in ns_sprintrrf
resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)
Jakub Jelinek (1):
Rename __unused fields to __glibc_reserved.
John David Anglin (1):
hppa: Fix missing call to __feraiseexcept (BZ 34306)
Pino Toscano (1):
Hurd: comment PF_LINK/AF_LINK defines
Sam James (1):
elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]
Samuel Thibault (3):
Hurd: comment PF_ROUTE/AF_ROUTE defines
Hurd: comment ioctls which cannot currently compile
Hurd: restore some SIOC ioctls
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The 'mlkem.h' header is no longer present in wolfssl v5.9.2 [1] and the
content was merged in the 'wc_mlkem.h' header.
[1] 7a2cf5b655
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the bump of autoconf to version 2.73 in commit a6e8c07a33,
the TestApache test fails on CI runners (and in autobuilders [2]) with
our current docker image (GCC 12.2.0) :
gcc: error: unrecognized command-line option '-std=gnu23'; did you mean '-std=gnu2x'?
make[3]: *** [Makefile:136: tools/gen_test_char] Error 1
Autoconf 2.73 introduced checks for the C23 standard [1]. During the
configuration step, it tests the target compiler. If the target compiler
supports it (e.g., GCC 14+), autoconf caches `ac_cv_prog_cc_c23=yes`
and appends `-std=gnu23` to the compiler flags.
Later in the process, APR uses the `AX_PROG_CC_FOR_BUILD` macro to
configure the host compiler in order to build the `gen_test_char`
utility. However, APR's `ax_prog_cc_for_build.m4` macro uses a
pushdef/popdef mechanism that only isolates older C standards.
It fails to isolate the newly introduced `ac_cv_prog_cc_c23` variable
because the ax_prog_cc_for_build.m4 file was not updated to handle it.
As a result, the host compiler evaluation reads the target's cached
variables, assumes the host compiler also supports C23 (which it may not),
and attempts to use `-std=gnu23`. If the host compiler
(e.g., GCC 12 on GitLab CI) is older, the build crashes.
To fix this without heavily patching APR's m4 macros, we explicitly
disable the C23 standard detection for the host compiler in APR_CONF_ENV
when GCC<14. Since APR is a mature project that does not require C23
features, preventing its use here is a safe and robust workaround.
Doing so will not disable C23 for the target build if the target compiler
is GCC 14+; it will only prevent the host compiler from using it when
building APR's tools; according to the build logs, ac_cv_prog_cc_c23
will be set to "no" for the target compiler if it does not support C23,
and will be set to "-std=gnu23" if it does.
It's important to note that this error could also occur with other
packages that use autotools-package if "AUTORECONF" is set to "yes".
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/15112315884
[1] https://gcc.gnu.org/cgit/gcc/commit/?id=fad61bf73b3158157a136bf4d9373fc3d9afe319
[2] https://autobuild.buildroot.org/results/d7d/d7d2703e42034d9c11de89b2b3b6cf401f677aa3
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Changes with nginx 1.30.3
*) Security: a heap memory buffer overflow might occur in a worker
process when using a configuration with "ignore_invalid_headers off;"
and "large_client_header_buffers" with large configured values when
proxying a specially crafted request to HTTP/2 or gRPC backend,
allowing an attacker to cause worker process memory corruption or
segmentation fault in a worker process (CVE-2026-42055).
Thanks to Mufeed VH of Winfunc Research.
*) Security: a heap memory buffer overread might occur in a worker
process while handling a specially sent response with decoding from
UTF-8 via the "charset_map" directive, allowing an attacker to cause
a limited disclosure of worker process memory or segmentation fault
in a worker process (CVE-2026-48142).
Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See here for a complete Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html
Security Fixes:
GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Agec is a simple file encryption tool that implements the
age format in C with minimal dependencies. The tool supports
asymmetric encryption based on X25519, and a passphrase
encryption based on scrypt.
https://git.sr.ht/~min/agechttps://age-encryption.org
Encryption is silently broken for files <35 bytes, so add a patch submitted
upstream to fix that.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For more information on the release, see:
- https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18
It fixes the following vulnerabilities:
- CVE-2026-48163:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST
the donor node is interpolating parameters that the joiner sent into
the command line. Not all parameters were properly validated which
could allow a malicious joiner to execute arbitrary shell commands on
the donor side via the rsync SST method. This issue has been patched
in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48163
- CVE-2026-48165:
MariaDB server is a community developed fork of MySQL server. From
versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-
privileged MariaDB user could've used wsrep_sst_receive_address or
wsrep_sst_donor global system variables to execute shell commands as
the uid of the mariadbd process on the galera joiner node. This issue
has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-48165
- CVE-2026-49261:
MariaDB server is a community developed fork of MySQL server. Versions
10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through
11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with `wsrep_notify_cmd`
enabled would execute shell commands embedded in the name of the
joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
12.3.2. As a workaround, anyone who cannot upgrade now should disable
`wsrep_notify_cmd`.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2026-49261
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
In the precedent patch "support/testing: test_gnupg2.py: use
assertRunNotOk()" [1] a small typo (OK instead of Ok) was introduced
in the test_gnupg2.py file, which caused a runtime failure.
This patch simply replace "self.assertRunNotOK(cmd)" with
"self.assertRunNotOk(cmd)" to correct this typo.
[1] cb791850ad
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Fiona: fix commit message formatting]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
- CVE-2026-55200:
libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
bounds write vulnerability in ssh2_transport_read() that fails to
enforce upper bounds on packet_length field. Remote attackers can send
crafted SSH packets with excessively large packet_length values to
corrupt heap memory and achieve remote code execution.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55200
- 97acf3dfda
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Fixes the following vulnerability:
- CVE-2026-55199:
libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
handler in src/packet.c that allows a malicious SSH server to cause a
client CPU exhaustion loop by sending a crafted extension count value.
A malicious server can set nr_extensions to 0xFFFFFFFF during key
exchange, causing the client to spin in a tight CPU loop for over 60
seconds because return values from _libssh2_get_string() are unchecked
and the session timeout does not apply to CPU-bound loops.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-55199
- 17626857d2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
- CVE-2026-6192:
A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
impacts the function opj_pi_initialise_encode in the library
src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
attack must be carried out locally. The exploit is publicly available
and might be used. The identifier of the patch is
839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
patch to address this issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-6192
- 839936aa33
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
The sample script would've passed even if the connections list was
empty. Check that there is at least one connection, and that the
sample script can read loopback device information.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The new test inherits from TestIptables, with only minimal changes to
use the nftables backend instead.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
In 11aa1cfa5a the patch was accidentally
moved into a versioned directory with the wrong version (2.82.0
instead of 2.82.4) and thus not applied. However, there have been no
issues reported.
The patch description mentions being needed to fix build errors in
package/atk and package/libnice. It was originally added in
b094f88a4d, and amended for libnice in
2c916b400b. package/atk was removed in
2c3ca7bea1, because atk has been merged
into at-spi2-core. Both at-spi2-core and libnice are Meson packages,
as was atk at the time of its removal.
Both current packages build with the following configuration (tested
using utils/test-pkg):
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_GOBJECT_INTROSPECTION=y
BR2_PACKAGE_LIBNICE=y
BR2_PACKAGE_AT_SPI2_CORE=y
Evidently the patch is no longer needed, presumably because the
correct search path for GIR files is set by other means, and we can
remove it instead of fixing the version number of the patch directory.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Libglib2-bootstrap is only used as dependency to build
gobject-introspection and then libglib2 with GOI support. It should
not be installed to target, even if in practice libglib2 should
overwrite anything it has installed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The 7.0.x series is now EOL upstream, so drop the linux-headers
option and add legacy handling for it.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit f89ca996b6 fixed the
build of linux-pam with musl in 2020 but did not remove the restric-
tions in place for login/runuser/su which were added earlier with
these commits:
login (2015): 25ecd24579
runuser (2017): 09860f354a
su (2017): c6488923fb
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
TestIptables expect netfilter legacy tables enabled in the kernel.
Make sure we use iptables-legacy:
iptables --version
iptables v1.8.11 (legacy)
The test would fail if nftables compat (iptables-nft) is enabled.
iptables --version
iptables v1.8.11 (nf_tables)
Add the following configuration fragment to enable iptables-nft:
BR2_PACKAGE_IPTABLES_NFTABLES=y
BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y
Acked-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Since kernels 6.17, support for netfilter legacy tables were disabled
by default [1] but iptables package needs Netfilter legacy tables
support enabled in the kernel when nftables compat is not enabled.
Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and
CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17.
Fixes:
[BRTEST# iptables --flush
modprobe: module ip_tables not found in modules.dep
iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
Perhaps iptables or your kernel needs to be upgraded.
On the other hand, when nftables compat (iptables-nft) is used by
default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable
nft protocol support in the kernel.
iptables --version
iptables: Failed to initialize nft: Protocol not supported
Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for
NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with
CONFIG_NFT_SOCKET needed to pass the TestIptables with
nftables compat (iptables-nft) enabled.
Without CONFIG_NFT_SOCKET:
iptables --policy INPUT ACCEPT
iptables v1.8.11 (nf_tables): TABLE_ADD failed (Operation not supported): table filter
So, enable kernel support for iptables-legacy only if nftables compat
is not enabled by default. Enable iptables-nft support when nftables
compat is enabled, even if not used by default.
[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Fiona: fix typo in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
This patch fixes a build error introduced by buildroot commit
460700d38e which took not into account
that only certain drivers support Gallium VA-API:
../output-1/build/mesa3d-26.1.2/meson.build:742:3: ERROR: Feature
gallium-va cannot be enabled: VA state tracker requires at least one
of the following gallium drivers: r600, radeonsi, nouveau, d3d12
(with option gallium-d3d12-video), virgl.
Fixes:
https://autobuild.buildroot.net/results/16b/16b2a63b444d7f84ceab5134ce9ff63e910537a7/
which includes configure option -Dgallium-drivers=etnaviv,r300.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
With an older cmake version, like the 3.25.1 as available in the docker
reference image, mosquitto fails to build when ccache is enabled:
[ 98%] Building CXX object lib/cpp/CMakeFiles/mosquittopp.dir/mosquittopp.cpp.o
In file included from [...]/buildroot/output/build/mosquitto-2.1.2/lib/cpp/mosquittopp.cpp:17:
[...]/buildroot/output/host/opt/ext-toolchain/i686-buildroot-linux-gnu/include/c++/15.1.0/cstdlib:83:15: fatal error: stdlib.h: No such file or directory
83 | #include_next <stdlib.h>
| ^~~~~~~~~~
compilation terminated.
Officially, mosquitto only requires cmake 3.18, but that proves to not
be enough, in fact...
We workaround that by requiring cmake 4.3, which is the one version that
could be tested with our host-cmake.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Add basic smoke test for glmark2 running in a nested qemu guest with
virtio-gpu-gl-pci.
The outer machine uses the Mesa softpipe driver for GLES support with
minimal dependencies. Just test virgl for now, as lavapipe
(software Vulkan driver) requires LLVM, and this validates
virglrenderer.
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
[Romain: add gitlab-runner "2xlarge" tag]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Add virglrenderer, an optional dependency of QEMU, which facilitates
acceleration of rendering and optionally video decode through
virtio-gpu.
Add an upstream patch to fix the build with glibc 2.43, not present in a
stable release yet.
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Libepoxy is a library for handling OpenGL function pointer management.
It has backends for egl/glx, which may at one point have been mandatory
to enable, but the library now builds with none of the above enabled
features, as seen below.
libepoxy 1.5.10
User defined options
Cross files : /home/joseph/br-test-pkg/arm-aarch64/build/libepoxy-1.5.10//buildroot-build/cross-compilation.conf
b_pie : false
b_staticpic : true
buildtype : release
build.cmake_prefix_path: /home/joseph/br-test-pkg/arm-aarch64/host/lib/cmake
default_library : shared
docs : false
egl : no
glx : no
libdir : lib
build.pkg_config_path : /home/joseph/br-test-pkg/arm-aarch64/host/lib/pkgconfig
prefix : /usr
strip : false
tests : false
x11 : false
Removing these dependencies allows for some applications that require it
as a build dependency, but otherwise can run headless or without GL, to
build and function, using other graphics APIs or display pipelines.
Weston, for example, can still use Vulkan and DRM when linked to
libepoxy without GL/EGL/X11 support.
Acked-by: Arnout Vanecappelle <arnout@rnout.be>
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Upstream passt only documents runtime dependencies; and they advertise
being able to run on kernel 3.8 or later. However, they do not document
the build dependencies.
Since 2025_06_11.0293c6f, upstream requires kernel headers >= 5.9, as
they make use of linux/close_range.h, only introduced in 5.9.
Add a dependency to kernel headers, and propagate it to podman's passt
backend.
Fixes: 6a192b0d28
Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.
This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:
FOO_SITE_METHOD = git
FOO_SITE = git@github.com:<project>/<repo>.git
Which ends up in the SBOM as:
[
{
"type": "vcs",
"url": "git@github.com:<project>/<repo>.git",
"comment": "git repository"
}
]
This (correctly) causes Dependency track to reject the SBOM import with:
{
"status": 400,
"title": "The uploaded BOM is invalid",
"detail": "Schema validation failed",
"errors": [
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
"$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
]
}
The CycloneDX spec indeed requires a URI:
The URI (URL or URN) to the external reference. External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)
https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url
The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:
Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
can be used for fetching, but this is inefficient and deprecated; do not use
them).
The native transport (i.e. git:// URL) does no authentication and should
be used with caution on unsecured networks.
The following syntaxes may be used with them:
• ssh://[user@]host.xz[:port]/path/to/repo.git/
• git://host.xz[:port]/path/to/repo.git/
• http[s]://host.xz[:port]/path/to/repo.git/
• ftp[s]://host.xz[:port]/path/to/repo.git/
An alternative scp-like syntax may also be used with the ssh protocol:
• [user@]host.xz:path/to/repo.git/
So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit b94ada7608 added "wchar,
dynamic library" to the package comment displayed when the package is not
available although the package does not depend on these features.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
There are a number of runtime tests that checks that a command fails as
expected, so add an assertRunNotOk() similar to the existing assertRunOk()
to handle that instead of open coding it everywhere.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since NetworkManager 1.54, packaged since commit 24827ae398
(package/network-manager: bump to 1.56.0), new services related to
running in an initrd are now installed, which prevents proper startup,
with systemd reporting that two units declare the same BusName.
When systemd is configured without initrd support, drop the
NetworkManager initrd-related services.
Fixes: 24827ae398
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Marcus Hoffmann <buildroot@bubu1.eu>
Acked-by: TIAN Yuanhao <tianyuanhao3@163.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Security fixes:
CVE-2026-53613 - mount(8) TOCTOU race on target path.
The SUID mount does not pin the mount target directory, allowing a
race between path resolution and the actual mount syscall. A local
attacker can swap an ancestor directory component between these
steps to redirect a mount to an arbitrary location.
Reported-by: Xinyao Hu
CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change.
The X-mount.owner, X-mount.group, and X-mount.mode options use
path-based lchown()/chmod() after mounting. An attacker can swap
the target between mount and the ownership/mode change to gain
control of arbitrary files.
Reported-by: Xinyao Hu
CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2.
The environment variable LIBMOUNT_FORCE_MOUNT2 is not filtered
via safe_getenv() in SUID context. A local attacker can force
the legacy mount(2) code path, which uses a two-step bind+remount
or propagation sequence with a window where security flags (nosuid,
noexec, ...) are not yet applied.
Reported-by: Xinyao Hu
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.5-ReleaseNotes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
With 8536a5d04a the upstream default
config is used, changing EnableNetworkConfiguration.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
In a standalone iwd setup having openresolv or systemd-resolved to
apply DNS config is useful, but if iwd is used with another network
management service (e.g. NetworkManager) the dependency is
unnecessary.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Note this changes EnableNetworkConfiguration from true to false
according to the upstream default, users who want a standalone iwd
setup which handles DHCP will need to adjust the config. Adjusting
NameResolvingService according to selected packages is unlikely to
have unexpected effects, so keep that.
This makes iwd work as a drop-in replacement for wpa_supplicant with
NetworkManager.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
The built-in default of iwd is to log to stderr, which is lost when
sent to the background.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
* Explicitly set shell type. Shellcheck doesn't know OpenRC, but the
script as such is POSIX shell.
* Override warnings not applicable in context.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
With the action function as the last command in the script its return
code automatically becomes that of the script, and without explicit
exit shellcheck does not complain about unused functions.
Also wait for the process to stop in "stop", and simplify restart.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
If sending the stop signal failed for whatever reason, waiting for an
existing PID file to disappear is likely to block indefinitely.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
The exit status of the last command automatically becomes the exit
status of the script. And if there is no explicit exit shellcheck
accepts unused functions (here: start/stop/... called via variable).
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
libudev-zero version 1.0.4 added support for usb.ids with commit
2bebebc9e0
Also select hwdata when libudev-zero implementation for udev is used to
more useful output from usbutils. This is strictly speaking an optional
dependency but would be confusing if it weren't working.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Marcus: add note about selecting hwdata]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
https://github.com/illiliti/libudev-zero/releases/tag/1.0.4
Removed patch which is included in this release.
Added buildroot-specific PREFIX to _BUILD_CMDS to override default
'/usr/local' in upstream Makefile to be compatible with the install
location of usb.ids provided by the hwdata package.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Buildroot commit aa5e3eec63 bumped the
package to version 7.0 which includes commit
33b950714a
that adds an include of linux/time_types.h.
This header file was added in linux kernel version 5.1:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=ca5e9aba753ed15d173c7a7b88e4d402b7ca8121
Fixes build errors:
In file included from ../bundled/linux/include/uapi/linux/cgroupstats.h:20:0,
from netlink_nlctrl.c:11:
../bundled/linux/include/uapi/linux/taskstats.h:21:30: fatal error:
linux/time_types.h: No such file or directory
detected by the Gitlab pipelines with the following defconfigs:
- br-arm-full-static
- bootlin-aarch64-glibc-old
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream commit
a00a3cce3c
added the code of gli & glm in-tree and removed the usage as external
packages.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error not caught by the autobuilders with this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_FORCE_HOST_BUILD=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_KODI_SCREENSAVER_RSXS=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_LIBUDEV_ZERO=y
Raised minimum version for all addons as requested by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes:
* CVE-2023-7216 [1]
A path traversal vulnerability was found in the CPIO utility. This
issue could allow a remote unauthenticated attacker to trick a user into
opening a specially crafted archive. During the extraction process, the
archiver could follow symlinks outside of the intended directory, which
could be utilized to run arbitrary commands on the target system.
* CVE-2026-28525 [2]
SWUpdate contains an integer underflow vulnerability in the multipart
upload parser in mongoose_multipart.c that allows unauthenticated
attackers to cause a denial of service by sending a crafted HTTP POST
request to /upload with a malformed multipart boundary and controlled
TCP stream timing. Attackers can trigger an integer underflow in the
mg_http_multipart_continue_wait_for_chunk() function when the buffer
length falls within a specific range, causing an out-of-bounds heap read
that writes data beyond the allocated receive buffer to a local IPC
socket.
For full release notes, see:
https://github.com/sbabic/swupdate/releases/tag/2026.05
Remove patch that has been merged upstream for this release.
[1] https://github.com/advisories/GHSA-v9vx-4mxw-76j2
[2] https://github.com/advisories/GHSA-hggv-rg65-qf4h
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Our docker image was finally updated to Debian 12 and now provide Qemu
7.2.15 [1]. We can safely revert this workaround for older Qemu version.
[1] e5bbe020ca
This reverts commit 37e23e0dd7.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the ti_am6x configurations to use the Bootlin glibc stable
prebuilt external toolchain, as recommended in the Buildroot meeting
report from ELCE 2024: https://elinux.org/Buildroot:DeveloperDaysELCE2024
This will reduce the number of Gilab-CI minute used to tests each
defconfig (1h10 -> 52 minutes).
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Bump gcc-bare-metal to gcc 16.1.0.
0001-libcody-Make-it-buildable-by-C-11-to-C-26.patch is already included in
gcc 16.1.0, so this patch can be removed.
See here for changes:
https://gcc.gnu.org/gcc-16/changes.html
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The NVD database schema has the following entry
```
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*",
"versionEndIncluding": "4.2.8",
},
```
Which make every patch revision of the package ntp match to the
CVE-2015-7977.
This commit ignore this entry.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See the release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.6/
This fixes the following vulnerabilities:
- CVE-2026-6873 : Signed cookie salt namespace collision
- CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS
in the SMTP backend
- CVE-2026-8404 : Potential exposure of private data via case-sensitive
Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing
Vary: Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
in Vary header
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Migrate from autotools to meson.
The COPYING file now points to separate license texts under LICENSES/
instead of embedding them [1], so update DBUS_LICENSE_FILES and
hashes. Expand DBUS_LICENSE for the AFL-2.0 dbus/dbus-arch-deps.h.in
header and the bundled TCL/pycrypto-origin code used by the library.
Drop the stale optional xlib_libSM dependency: the meson build only
checks for x11 for X11 autolaunch support.
[1] 272928bbbf
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
[Fiona:
- include LicenseRef-CMakeScripts and LicenseRef-GAP in DBUS_LICENSE
and DBUS_LICENSE_FILES
- include link to the primary COPYING split in commit message
]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Fixes the following security issues:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed double-free when checking OCSP stapled response.
(CVE-2026-35188)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
Fixed AES-OCB IV ignored on EVP_Cipher() path.
(CVE-2026-45445)
Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
(CVE-2026-7383)
Fixed out-of-bounds read in CMS password-based decryption.
(CVE-2026-9076)
Fixed heap buffer over-read in ASN.1 content parsing.
(CVE-2026-34180)
Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
(CVE-2026-34181)
Fixed NULL dereference in certificate verification with OCSP Checking.
(CVE-2026-42765)
Fixed possible NULL dereference in password-dased CMS decryption.
(CVE-2026-42766)
Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
(CVE-2026-42767)
Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
and PKCS7_decrypt().
(CVE-2026-42768)
Fixed trust anchor substitution via cert/issuer typo in CMP
rootCaKeyUpdate.
(CVE-2026-42769)
Fixed FFC-DH peer validation uses attacker-supplied q.
(CVE-2026-42770)
Fixed incorrect tag processing for empty messages in AES-GCM-SIV
and AES-SIV modes.
(CVE-2026-45446)
For more details, see the release notes and advisory:
https://github.com/openssl/openssl/releases/tag/openssl-3.6.3https://openssl-library.org/news/secadv/20260609.txt
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
*) SECURITY: CVE-2026-49975: mod_http2 denial of service
(cve.mitre.org)
Memory Allocation with Excessive Size Value vulnerability in
Apache HTTP Server's mod_http leads to denial of service via
malicious HTTP requests.
This issue affects Apache HTTP Server: from 2.4.17 through
2.4.67.
Credits: Quang Luong of Calif.IO in collaboration with OpenAI
Codex
*) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
handles exhausted (cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server module
mod_http2 when file handles are already exhausted.
This issue affects Apache HTTP Server: from 2.4.55 through
2.4.67.
Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)
*) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
Signed Char Overflow (cve.mitre.org)
Buffer Underwrite vulnerability in Apache HTTP Server on crafted
regular expressions in the configuration.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
mod_proxy_ftp (cve.mitre.org)
Loop with Unreachable Exit Condition ('Infinite Loop')
vulnerability in the mod_proxy_ftp module in Apache HTTP Server
with an attacker controlled backend FTP server.
This issue affects undefined: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
`send_request` (cve.mitre.org)
Buffer Over-read vulnerability in Apache HTTP Server via
outbound OCSP requests to an attacker controlled OCSP server
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-44119: escalation of privilege through
expressions in .htaccess in multiple modules (cve.mitre.org)
Improper Privilege Management vulnerability in Apache HTTP
Server 2.4.67 and earlier allows local .htaccess authors to read
files with the privileges of the httpd user.
This issue affects Apache HTTP Server: from through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Lucian Nitescu
*) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
can cause crash (cve.mitre.org)
Out-of-bounds Read vulnerability in Apache HTTP Server with
mod_headers and mod_mime and multiple response languages.
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
(cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with mod_xml2enc, xml2StartParse, and untrusted content
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
(cve.mitre.org)
A path handling issue in mod_dav_fs in Apache 2.4.67 and
earlier allows a WebDAV content author to directly manipulate
trusted DAV property databases, potentially causing child
process crashes.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Zhenpeng (Leo) Lin at depthfirst
*) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
overflow (cve.mitre.org)
Heap-based Buffer Overflow vulnerability in Apache HTTP Server
with malicious backend servers and ProxyPassReverseCookie*
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Arkadi Vainbrand
*) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
(cve.mitre.org)
A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
and earlier allows an attack by an untrusted backend.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Elhanan Haenel
*) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
A cross-site scripting vulnerability exists in mod_proxy_ftp's
HTML directory list generation in Apache HTTP Server 2.4.67 and
earlier when listing FTP directory contents either via forward
or reverse proxy configuration.
Users are recommended to upgrade to version 2.4.68, which fixes
this issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
*) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
(cve.mitre.org)
Use After Free vulnerability in Apache HTTP Server with mod_ldap
in per-directory configuration
This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
Users are recommended to upgrade to version 2.4.68, which fixes
the issue.
Credits: Pavel Kohout, Aisle Research, Aisle.com
For more details, see the CHANGES file:
https://downloads.apache.org/httpd/CHANGES_2.4.68
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See the release notes:
https://github.com/redis/redis/blob/8.6.4/00-RELEASENOTES
This fixes the following vulnerabilities:
- CVE-2026-23479:
Redis is an in-memory data structure store. In redis-server from 7.2.0
until 8.6.3, the unblock client flow does not handle an error return
from `processCommandAndResetClient` when re-executing a blocked
command. If a blocked client is evicted during this flow, an
authenticated attacker can trigger a use-after-free that may lead to
remote code execution. This has been patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-23479
- CVE-2026-23631:
Redis is an in-memory data structure store. In all versions of redis-
server with Lua scripting, an authenticated attacker can exploit the
master-replica synchronization mechanism to trigger a use-after-free
on replicas where replica-read-only is disabled or can be disabled,
which may lead to remote code execution. A workaround is to prevent
users from executing Lua scripts or avoid using replicas where
replica-read-only is disabled. This is patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-23631
- CVE-2026-25243:
Redis is an in-memory data structure store. In versions of redis-
server up to 8.6.3, the RESTORE command does not properly validate
serialized values. An authenticated attacker with permission to
execute RESTORE can supply a crafted serialized payload that triggers
invalid memory access and may lead to remote code execution. A
workaround is to restrict access to the RESTORE command with ACL
rules. This is patched in version 8.6.3.
https://www.cve.org/CVERecord?id=CVE-2026-25243
- CVE-2026-25588:
RedisTimeSeries is a time-series module for Redis. In all versions
before 1.12.14 of RedisTimeSeries, the module does not properly
validate serialized values processed through the Redis RESTORE
command. An authenticated attacker with permission to execute RESTORE
on a server with the RedisTimeSeries module loaded can supply a
crafted serialized payload that triggers invalid memory access and may
lead to remote code execution. A workaround is to restrict access to
the RESTORE command with ACL rules. This has been patched in version
1.12.14.
https://www.cve.org/CVERecord?id=CVE-2026-25588
- CVE-2026-25589:
RedisBloom is a probabilistic data structures module for Redis. In all
versions of RedisBloom before 2.8.20, the module does not properly
validate serialized values processed through the Redis RESTORE
command. An authenticated attacker with permission to execute RESTORE
on a server with the RedisBloom module loaded can supply a crafted
serialized payload that triggers invalid memory access and may lead to
remote code execution. A workaround is to restrict access to the
RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
https://www.cve.org/CVERecord?id=CVE-2026-25589
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The upcoming bump of spirv-llvm-translator to 22.1.3 includes upstream
commit
5a8baf6cd2
which depends on an upstream patch to spirv-headers:
b8a3296847
according to
https://github.com/KhronosGroup/SPIRV-LLVM-Translator/pull/3721
but this patch is not included in any release of spirv-headers yet so we
need to add it to buildroot to prevent a build error with
spirv-llvm-translator 22.1.3.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://www.alsa-project.org/wiki/Changes_v1.2.15.3_v1.2.16#tinycompress
Sent patch 0001 upstream and added Upstream: tag.
Added patch 0002 to fix musl build error introduced by this version
bump:
cb3340621f
Added dependency to host-pkgconf, the build fails without it due to this
version bump:
1.2.13:
checking pkg-config is at least version 0.9.0... ./configure: line 16805:
/home/bernd/buildroot/output/host/bin/pkg-config: No such file or directory
no
checking that generated files are newer than configure... done
1.2.16:
checking pkg-config is at least version 0.9.0... ./configure: line 18346:
/home/bernd/buildroot/output/host/bin/pkg-config: No such file or directory
no
configure: error: pkg-config not found
This behaviour is caused by the usage of newer autotools to create the
configure script:
# Generated by GNU Autoconf 2.69 for tinycompress 1.2.13.
# Generated by GNU Autoconf 2.72 for tinycompress 1.2.16.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
https://gitlab.com/sane-project/backends/-/releases/1.2.1https://gitlab.com/sane-project/backends/-/releases/1.3.1https://gitlab.com/sane-project/backends/-/releases/1.4.0
Removed patch which is included in this release.
Added sha256 tarball provided by upstream.
The build of the umax_pp backend fails for microblazeel/mipsel/powerpc
when used with uClibc (detected by the Gitlab pipelines):
umax_pp_low.c: In function ‘sanei_umax_pp_initPort’:
umax_pp_low.c:835:7: error: implicit declaration of function 'iopl'
[-Wimplicit-function-declaration]
835 | if (iopl (3) != 0)
Fix this by disabling that backend under those conditions. The proper
way to do that would be to patch configure.ac to add an option to
exclude specific backends, and then give the corresponding CONF_OPT.
However, that's quite a complex patch for such a corner case, so instead
simply patch configure to remove the umax_pp backend from ALL_BACKENDS.
We only want to do this conditionally, so do it with sed in a post-patch
hook rather than with a patch.
Fixes:
https://autobuild.buildroot.net/results/364/364bfa29f9df16079dd10be628ddefcf80f581f9/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Arnout: do it in a post-patch instead of post-extract hook]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
../lib/wp/log.c:780:49: error: implicit declaration of function ‘gettid’;
did you mean ‘getgid’? [-Wimplicit-function-declaration]
780 | g_autofree gchar *tid = g_strdup_printf("%d", gettid());
The problem was hidden by pipewire being broken with uClibc since at
least Sep 2024: https://autobuild.buildroot.net/results/ee5/ee50c8331946814c2fecb0ca56ca51c1bb0bc551/
Pipewire was bumped from 0.3.81 to 1.2.2 in Aug 2024 with buildroot commit
93b72692c3 which afaics caused all uClibc
builds to fail due to missing tss_t() whose usage was added to pipewire in
version 1.1.81, see
de0db48f17
and later removed with
9c19284f7f
in version 1.3.81.
In wireplumber the relevant part of code with gettid() was added in
version 0.5.9. Buildroot bumped wireplumber from 0.5.5 directly to 0.5.10
with commit c42b26bb47.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: unwrap URLs in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Last release dates back to Jul 2023 with >3000 commits since then:
https://github.com/lensfun/lensfun/issues/2634
Removed patch which is included in this version.
Renamed CMake option PYTHON to INSTALL_PYTHON_MODULE:
Upstream renamed PYTHON to PYTHONINTERP_FOUND with commit
824b9d36c1
and later guarded the python code with a new CMake option
INSTALL_PYTHON_MODULE which we now use.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
-kernel dts moved to vendor sub-directory
-U-Boot needs GnuTLS for the mkeficapsule tool
Signed-off-by: Jan Havran <havran.jan@email.cz>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
https://mesonbuild.com/Release-notes-for-1-11-0.html
Removed patch which is included in this bump.
Disabled the usage of ccache in mesa3d with BR2_PACKAGE_MESA3D_RUSTICL=y
due to upstream commit:
aac5f78580
(bisected https://github.com/mesonbuild/meson/compare/1.10.1...1.10.2 to
find the offending commit, the same defconfig works with meson 1.10.1)
Without this change mesa3d configure is broken:
output/build/mesa3d-26.0.3/src/gallium/frontends/rusticl/meson.build:420:27:
ERROR: No build machine compiler for 'src/gallium/frontends/rusticl/proc/lib.rs'
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add the sigsum-c library, which is a more lightweight alternative to
sigsum-go when only proof verification is needed or needs to be embedded
in some other program.
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Changelog:
https://git.linuxtv.org/libcamera.git/tag/?h=v0.7.1
libcamera is now using C++20. This minimal gcc version is increased
to gcc-10. This commit also removes the gcc >= 5 requirement for
the lc-compliance sub-option and the CXXFLAGS condition in the .mk
file. Those are no longer needed. The Config.in comments about the
required gcc version are also updated.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Building Stellarium includes the download of external tarballs during
configure.
This fails with host-cmake during configure stage:
CMake Error at md4c-subbuild/md4c-populate-prefix/src/md4c-populate-stamp/download-md4c-populate.cmake:163 (message):
Each download failed!
error: downloading 'https://github.com/mity/md4c/archive/refs/tags/release-0.5.2.tar.gz' failed
status_code: 1
status_string: "Unsupported protocol"
log:
--- LOG BEGIN ---
Protocol "https" not supported
closing connection #-1
due to buildroot commit f87138339b which
disabled SSL support for host-cmake.
This patch uses _EXTRA_DOWNLOADS to provide these tarball to allow
offline builds.
No autobuilder error was recorded, the build error can be reproduced
with this defconfig:
BR2_x86_64=y
BR2_x86_corei7=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_CORE_I7_GLIBC_BLEEDING_EDGE=y
BR2_FORCE_HOST_BUILD=y
BR2_PACKAGE_STELLARIUM=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_QT5=y
BR2_PACKAGE_XORG7=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Bump qt5 packages to latest submodule versions from
https://invent.kde.org/qt/qt/qt5/-/tree/kde/5.15
qtbase repo is a few commits after a tag named v5.15.18-lts-lgpl so
assume it's now 5.15.18.
qt5base patches are updated to make them apply silently and cleanly.
For qt5webengine-chromium:
- 0001-Add-python3-build-support.patc is removed as commit 68302c9ea158
("Enable building with Python 3") contains similar changes,
- 0004-Migrate-presubmit-to-python3.patch is only partially kept as
commit 68302c9ea158 ("Enable building with Python 3") contains similar
changes,
- 0006-Fix-build-in-Python-3.11-invalid-mode-rU.patch is only partially
kept as commit 68302c9ea158 ("Enable building with Python 3") contains
similar changes,
- 0007-Replace-imp.load_source-with-importlib-equivalent.patch is
removed as commit 68302c9ea158 ("Enable building with Python 3")
contains similar changes,
- 0010-Fix-building-with-system-libxml2.patch is removed as commit
c98d28f2f0f2 ("Fix building with system libxml2") contains similar
changes,
- 0012-Include-cstdint-for-uintptr_t-uint8_t-etc.patch is renamed
0009-Include-cstdint-for-uintptr_t-uint8_t-etc.patch and contains more
file patching to make qt5webengine build again,
Also make sure that the patches that have an upstream reference use the
proper Upstream: tag, so we can remove them from checkpackageignore.
For qt5webengine:
- 0002-Add-python3-build-support.patch is removed as commit 2294cc4ed5fd
("Add option to chose python version for building 5.15 WebEngine")
contains similar changes. It now supports both Python2 and Python3 and
defaults to Python2 if found first. This can be overridden with
-webengine-python-version python3 in QT5WEBENGINE_CONF_OPTS but this
was unnecessary in my tests as Python3 was properly selected from
$(HOST_DIR)/bin/.
qt5webengine-chromium is updated with qt5webengine following the logic
stated in Buildroot commit c53455ea4f
("package/qt5/qt5webengine-chromium: bump version after qtwebengine
bump").
I am unsure whether qt5webengine-chromium-catapult also requires an
update.
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
[Arnout: fix Upstream: tags]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This adds support for compiling the systemd-boot efi application down
to aarch64 in buildroot. This is supported already by the software and
requires only a change in Config.in to allow buildroot to benefit.
Signed-off-by: Jack Wearden <jack@jackwearden.co.uk>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
This release updates the upstream icon set and related assets.
Refresh the source hash for the new release. Also drop the "v" tag
prefix as upstream dropped it starting from v5.0.
License changes:
- Upstream introduced SVG icons as a first-class feature alongside the
traditional icon fonts starting with v5.0.
- The new icon designs (delivered as SVG and JS assets) are licensed
under CC-BY-4.0 (attribution is satisfied by the copyright comments
in the files).
- The webfont files themselves remain under OFL-1.1, and helper styles
and build code remain under the MIT license.
- Hence, the license is updated to: OFL-1.1 (fonts), MIT (code), CC-BY-4.0 (icons)
- Add LICENSE.txt for hash verification.
Directory changes:
- Drop "less" and "fonts". LESS support has been completely dropped by
upstream in v7.0, and the old font files directory was renamed.
- Add "webfonts", which contains the newer .woff2 webfonts.
- Add "js", which contains scripts for the SVG + JS rendering method.
- Add "sprites" and "svgs", which contain SVG sprite sheets and raw SVG
icons (the CC-BY-4.0 assets) respectively.
- Installing all these directories allows users to choose between the
various rendering methods (CSS+webfonts, SVG+JS, CSS sprite sheets,
or direct SVG usage) for their target systems.
For detailed Chngelog
- https://fontawesome.com/changelog
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add mbedtls crypto backend support for lightweight build
BR2_PACKAGE_TPM2_TSS_FAPI depends on openssl explicitly
Rewrite fapi -> FAPI
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Passing runtime configuration to tests in BRConfigTest class variables
requires the "fork" start method for multiprocessing. With
"forkserver" (default for POSIX platforms since Python 3.14) class
variables modified in the parent process are lost, because the child
process does not inherit the full Python state. This broke the way
support/testing/run-tests sets configuration for BRConfigTest, so a
start method override was added in commit
3d2141bcee.
Instead this patch adds a settings dataclass (requires Python >= 3.7)
which is serialized into an environment variable from run-tests and
read during BRConfigTest.__init__(). Reading is skipped if the
environment variable is not set so test discovery (not execution)
works without configuration (e.g. utils/get-developers uses this).
With that, run-tests no longer relies on a specific multiprocessing
start method.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Now that we have added support for GCC 16.x, made GCC 15.x the
default, let's drop support for GCC 13.x.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien:
- remove remaining gcc-13 patches from commit 10ccbe079c
- move legacy option to 2026.08 version section
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
As Thomas stated in 3bb260cf38:
The br-arm-internal-glibc.config is generally used as a configuration
to test the bleeding edge versions of components. However, it has been
lagging behind somewhat, so let's bring it up-to-date:
- Binutils 2.46.x
- GCC 16.x
Let the fun begin in the autobuilders!
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Now that GCC 16.x support has been added, follow our usual strategy of
making GCC 15.x the default GCC version.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This patch allows to use an external toolchain based on gcc 16.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
In order to add gcc 16 support in follow-up commits, introduce
BR2_TOOLCHAIN_GCC_AT_LEAST_16 symbol.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/facebook/rocksdb/blob/v11.0.4/HISTORY.md
Removed patch 0001 which is included in this release:
53c8f739fd
Added upstream PR to fix build error.
Updated hash of README.md due to various upstream commits:
https://github.com/facebook/rocksdb/commits/v10.7.5/README.md
Switched build system to cmake.
Added configure parameter -DFAIL_ON_WARNINGS=OFF which converts many
"may be used uninitialized" errors into warnings which fixes build
errors introduced by the upcoming gcc version 16.x.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: remove .checkpackageignore entry to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Added patch to enable rtti, needed for upcoming bump of rocksdb to fix
link error:
output/per-package/rocksdb/host/bin/../lib/gcc/x86_64-buildroot-linux-
gnu/15.2.0/../../../../x86_64-buildroot-linux-gnu/bin/ld:
librocksdb.so.10.7.5: undefined reference to `typeinfo for snappy::Sink'
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
OpenJDK 25 is the latest release.
See: https://endoflife.date/oracle-jdk
- BR2_OPENJDK_VERSION_LATEST is now set to 25.
- Add version-specific patches for 25.0.2+10:
- 0001: Add ARCv2 ISA processors support to Zero
- 0002: Compile OpenJDK in headless mode without requirements
- 0003: Fix ambiguous cmp() overload in aarch64 macro assembler
(older GCC 6.x compatibility)
- 0004: Fix constexpr on non-literal type in Shenandoah GC
(older GCC 6.x compatibility)
- Add -fpermissive to fix template definition error with older GCC.
- Update HOST_OPENJDK_BIN_VERSION for OpenJDK 25.
- Update the expectedVersion variable in JniTest.java from 0x00150000
(JNI 21) to 0x00180000 (JNI 24/25).
Tested with:
$ ./support/testing/run-tests -o ~/br-test-py/ -d ~/br-test-dl/ \
tests.package.test_openjdk.TestOpenJdk
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
[Bernd:
- rebased on bump of versions 17 & 21
- build-tested with gcc 16-snapshot]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien:
- add .checkpackageignore entry to fix check-package error
- reformat patches with without numbering to fix check-package error
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add comment to clarify that autoreconf is still needed even after the
patches are removed to update ax_cxx_compile_stdcxx.m4 for compatibility
with gcc >= 16.x
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This patch adds fixes for cups-filters so it can be build with newer
versions of qpdf that made changes to PointerHolder:
https://github.com/qpdf/qpdf/blob/v12.3.2/manual/design.rst#smart-pointers
Build-tested using this defconfig:
BR2_PACKAGE_CUPS=y
BR2_PACKAGE_CUPS_FILTERS=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: SKIPPED
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: SKIPPED
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: SKIPPED
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: OK
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: OK
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: SKIPPED
br-arm-full-nothread [31/32]: SKIPPED
br-arm-full-static [32/32]: SKIPPED
32 builds, 6 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
This solution avoids[1] a version bump of this package while keeping
compatibility with the newest version of qpdf. The bump of qpdf is
needed to fix build errors with gcc 16.x.
[1] https://lists.buildroot.org/pipermail/buildroot/2025-August/784931.html
Thomas: "which means duplicating all the crazy dependencies of
libcupsfilters yes :/"
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changelog:
https://qpdf.readthedocs.io/en/stable/release-notes.html
Quoting the release notes for version 12.3.0:
"A C++20 compiler is now required to build or test qpdf."
Updated Config.in accordingly.
Updating source URL (Github) and updating build system to cmake.
Build-tested using this defconfig
BR2_PACKAGE_QPDF=y
BR2_PACKAGE_GNUTLS=y
BR2_PACKAGE_OPENSSL=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: SKIPPED
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: SKIPPED
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: SKIPPED
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: OK
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: OK
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: SKIPPED
br-arm-full-nothread [31/32]: SKIPPED
br-arm-full-static [32/32]: SKIPPED
32 builds, 6 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com>
[Bernd:
- bumped to 12.3.2
- raised gcc version to 10
- removed configure option -DSKIP_OS_SECURE_RANDOM=ON as suggested
by Angelo: https://lists.buildroot.org/pipermail/buildroot/2025-August/784962.html
- added build test results]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error with gcc 16.x:
interactive.c: In function 'interactiveShowData':
interactive.c:334:49: error: '%5d' directive output may be truncated
writing between 5 and 11 bytes into a region of size 7
[-Werror=format-truncation=]
334 | snprintf(strFl, sizeof(strFl), "%5d ", convert_altitude(modeC * 100));
| ^~~
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
DTUI is a small TUI for introspecting the state of the system/session
D-Bus. It shows current services and lets you introspect objects and
their interfaces.
This package is built with Rust/Cargo.
Upstream: https://github.com/Troels51/dtui
License: MIT
Signed-off-by: Christopher Obbard <obbardc@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
diff COPYRIGHT:
-Copyright (C) 2005-2025 Mike Pall. All rights reserved.
+Copyright (C) 2005-2026 Mike Pall. All rights reserved.
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
For change log since version 9.2.9, see:
https://www.swi-prolog.org/ChangeLog?branch=stable&from=9.2.9&to=10.0.2
This new version can no longer build in the source tree. Therefore,
this commit adds SWIPL_SUPPORTS_IN_SOURCE_BUILD = NO. Also, the target
swipl needs the host-swipl binary. It is searched by the cmake script.
This commit changes SWIPL_NATIVE_FRIEND variable to point to the
out-of-source build directory.
swipl has now a stricter ABI check of its prolog library bytecode
compiled files, compared to its builtin expected ABI:
https://github.com/SWI-Prolog/swipl/blob/V10.0.2/src/pl-init.c#L263
When cross-compiling, swipl is built on one side, and library files
are built with the host-swipl. The ABI string of the host-swipl and
target swipl must match. If not matching, swipl fail to start at
runtime with the error:
FATAL: could not find SWI-Prolog home
Tried source: compiled in
Found /usr/lib/swipl: ABI mismatch
This ABI string includes a signature of builtin modules. See:
https://github.com/SWI-Prolog/swipl/blob/V10.0.2/src/pl-init.c#L1653https://github.com/SWI-Prolog/swipl/blob/V10.0.2/src/pl-ext.c#L330
The swipl ncurses support is made with one those builtin module.
ncurses development files are likely present on host and likely not
enabled or needed on target, hence producing a different ABI
signature. For that reason, this commit disables ncurses on both the
host and target.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Buildroot commit aac3d2b402 added a hidden
boolean option that packages which depend on java on the host can select.
Since buildroot commit 5366b8f734 we can
provide our own host-openjdk-bin package.
Kodi previously used BR2_NEEDS_HOST_JAVA but was switched to host-open-
jdk-bin in this series.
The option BR2_NEEDS_HOST_JAVA is now unused and can be removed.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This patch removes the dependency on java being installed on the host,
instead we make use of our host-openjdk-bin package.
Build-tested using this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
by running 'utils/docker-run make kodi'.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
All patches that were applicable to GDB 16.1 are also applicable to
GDB 17.1. Rebased patch 0005. Added upstream patch 0010 to fix build
error with musl and upstream patch 0011 to fix build error on sparc.
Details about the 17.1 release:
https://sourceware.org/gdb/download/ANNOUNCEMENT
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Changelog:
* psc_misc: Add function to get PDC firmware version
* ipl: Fix mfg mode on C8000, rp34x0 and rp44x0
This has been tested on hp 712, booting from network and from disk.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Everyone thinks they like ARM but secretly they want to run
Linux on their Megadrive[0].
Building a working toolchain/userland for nommu m68k is a bit
difficult because of the bitrotten tools all over the place and
one big issue is GCC generates code that uses unaligned
accesses that will cause an exception on 68000 machines if you
aren't careful.
Buildroot can easily create a working toolchain and userland
for nommu m68k so why not?
0 - This isn't a joke, I'm working on this. I have u-boot working
on the Megadrive, Linux is already working on a bunch of 68000
machines and I just need to get everything a little bit smaller
to get into 4MB of RAM.
Signed-off-by: Daniel Palmer <daniel@thingy.jp>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
For release announce on mailing list, see [1].
For release general news, see [2].
This commit removes all package patches as they are all included in
this version, except patch #74 for which an alternate fix is included
in this new version in commit [3].
Tested by compiling and booting the defconfigs using grub2:
qemu_aarch64_sbsa_defconfig
qemu_arm_ebbr_defconfig
qemu_loongarch64_virt_efi_defconfig
qemu_riscv64_virt_efi_defconfig
pc_x86_64_bios_defconfig
pc_x86_64_efi_defconfig
and running the tests:
support/testing/run-tests \
-d dl -o output_folder \
tests.boot.test_grub \
tests.fs.test_iso9660
[1] https://lists.gnu.org/archive/html/grub-devel/2026-01/msg00029.html
[2] https://gitlab.freedesktop.org/gnu-grub/grub/-/blob/grub-2.14/NEWS
[3] 0739d24cd1
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
libcec only requires libudev, not a full udev daemon.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
libv4l only requires libudev, not a full udev daemon.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Arnout: rewrite install steps so they use the same make arguments as
the build step.]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Remove lvm2 !BR2_STATIC_LIBS dependency
(It still depends on !BR2_STATIC_LIBS by main BR2_PACKAGE_SYSTEMD)
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Remove lvm2 !BR2_STATIC_LIBS dependency
(It still depends on !BR2_STATIC_LIBS by BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS)
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Remove lvm2 !BR2_STATIC_LIBS dependency
(It still depends on !BR2_STATIC_LIBS by BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS)
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Remove lvm2 !BR2_STATIC_LIBS dependency
(It still depends on !BR2_STATIC_LIBS by BR2_PACKAGE_HOST_GO_TARGET_CGO_LINKING_SUPPORTS)
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Add static build support as lvm2 supports static library now
Cryptsetup external-tokens feature still requires dynamic library
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Add static build support for device mapper
Lvm2 standard install still requires dynamic library
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
New release with following changes:
Adam Lackorzynski (1):
termios.h: Add IBSHIFT
Charles Mirabile (11):
riscv: add defconfigs
riscv: add support for static pie binaries
riscv: add support for ucontext functions
pipe: directly invoke pipe2 from kernel when !UCLIBC_LINUX_SPECIFIC
Fix {g,s}ettimeofday when !UCLIBC_HAS_REALTIME
Fix build with static-pie but without nptl threads
do not remove bits/uClibc_ctype.h when !UCLIBC_HAS_CTYPE_TABLES
getopt-susv3: remove call to gettext `_` macro
readdir{,_r}: remove loop to skip files with d_ino == 0
spawn: allow file actions on no-mmu targets
getopt-susv3: add support for reseting the scan by setting optind to zero
Marcus Haehnel (1):
aarch64/fpu_control.h: Don't use gcc-internal types
Jan Klötzke (1):
elf/dl-support.c: remove unnecessary memset
Ramin Moussavi (9):
libsanitizer: arm/ucontext: fix VFP save/restore to use uc_regspace area
libsanitizer: arm/ucontext.h: add glibc-style REG_R0..REG_R15 aliases
libsanitizer: link.h/dl-iterate-phdr: expose dl_phdr_info TLS fields
libsanitizer: ldso: track _dl_load_adds/_dl_load_subs counters
libsanitizer: ldso: implement _dl_tls_get_addr_soft for dl_phdr_info::dlpi_tls_data
libsanitizer: drop __pagesize, make _dl_pagesize the single source of truth
libsanitizer: sys/user.h: remove obsolete BFD trad-core NBPG/UPAGES defines
libsanitizer: features.h: hard-wire _FILE_OFFSET_BITS=64 to match library's 64-bit off_t/ino_t
libsanitizer: fts.h: drop the bogus _FILE_OFFSET_BITS==64 #error
Waldemar Brodkorb (7):
bits/statx.h: add some missing defines
bits/statx.h: sync struct with glibc
sys/fanotify.h: sync with musl
libiconv: fix typedef of iconv_t
misc: add unicode character functions (c11)
netinet/tcp.h: sync with glibc
bump version for 1.0.58 release
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump amlogic-boot-fip to the latest commit on the LibreELEC/amlogic-boot-fip
master branch.
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Updating the hash of the WHENCE file, due to firmware additions and
firmware changes, but no changes to the redistribution/licensing
conditions.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
There are options to build only static or only shared libs. The default
is to build both.
Also update reverse dependencies. Note that lua-argon2 doesn't have the
"# libargon2" comment so presumably it needs shared libs itself.
Signed-off-by: Andreas Mohr <and@gmx.li>
[Arnout: also update reverse dependencies]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
- bump linux from 6.6.48 to 6.18.32
- bump arm-trusted-firmware from 2.10.5 to 2.12.1
- bump U-Boot from 2024.07 to 2026.04
U-Boot now needs GnuTLS for the mkeficapsule tool.
Signed-off-by: Mattia Narducci <mattianarducci1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
tpm2-tss is a dependency of systemd, which when enabled becomes a
dependency of util-linux.
tpm2-tss only really wants libuuid, so depend on util-linux-libs instead
breaking the dependency cycle.
Signed-off-by: John Ernberg <j@j-ernberg.se>
[Arnout: also select UTIL_LINUX_LIBS in Config.in]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The file was introduced in the project when postgresql support was added,
and has since never been used by the project internally.
They already depend on postgresql when the option is selected, so
let the postgresql package provide the header. Otherwise, the header
file provided by poco conflicts with the one provided by postgresql.
Cc: Yegor Yefremov <yegorslists@googlemail.com>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Commit 25af5a3b3a ("package/mpd: update version to 0.24") from March 2025
bumped mpd to a version that dropped support for the libsidplay2 library in
favor of libsidplayfp. [1]
Since libsidplayfp is not provided by buildroot and no one has complained
yet the sidplay feature is likely unused, as enabling it breaks the build.
Drop support. If someone needs it it can be re-added along with the
dependency.
Link: https://raw.githubusercontent.com/MusicPlayerDaemon/MPD/v0.24/NEWS [1]
Cc: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Doing so in the INSTALL_CMD makes the fstab adjustment subject to
overwrites by other packages during a per-package build.
Currently since per-package directories are populated using hardlinks
this adjustment propagates backwards into the skeleton package, but this
should not be relied upon.
Cc: Antoine Tenart <atenart@kernel.org>
Cc: Marcus Folkesson <marcus.folkesson@gmail.com>
Signed-off-by: John Ernberg <j@j-ernberg.se>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
By default, mesa uses -Dvideo-codecs=all_free which only includes
royalty-free codecs (AV1, VP9, MPEG-1/2, JPEG).
Add a new BR2_PACKAGE_MESA3D_PATENTED_VIDEO_CODECS option to set
-Dvideo-codecs=all, which additionally enables patent-encumbered
codecs (H.264, H.265, VC-1) for both Gallium VA-API and Vulkan
video decode/encode.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Arnout: add PATENTED to the config symbol name]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Since commit 361bfbc70b (package/mesa3d: disable libva support),
VA-API has been unconditionally disabled in mesa3d due to a circular
dependency between mesa3d, libva and libgl.
The circular dependency only occurs when mesa3d is the libgl provider,
i.e. when GLX is enabled without libglvnd. In that case:
mesa3d -> libva -> libgl -> mesa3d
Re-enable VA-API support as a new BR2_PACKAGE_MESA3D_GALLIUM_VA option,
guarded by a dependency that prevents the circular case. This allows
hardware video acceleration on AMD, Intel and other GPUs with Gallium
drivers.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Commit 9a5369effd which removed the
BR2_PACKAGE_QEMU_TARGET_MICROBLAZEEL symbol but forgot to introduce the
new "Legacy options removed in 2026.08" comment.
So the legacy symbol was incorrectly placed under
"Legacy options removed in 2026.05" comment.
Fix that.
Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
* backport locally patch [1] to fix build failure due to missing crypto
backend
* libconfig is required by default[2] so let's select it
* align swupdate.config to the most basic one with openssl crypto
backend enabled by default
* drop HAVE_LIBCRYPTO since it's not used anymore by swupdate even if
present
* add libgpgme support
[1]: 10334fb217
[2]: 4b9a71476c
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Changelog:
https://wiki.qemu.org/ChangeLog/11.0
Note:
- Support for all 32-bit host systems has been removed.
- Support for microblazeel has been folded into the microblaze target
Qemu v11.0.0 drops 32-bit support for hosts, all qemu builds must now be
64-bit. Hosts running 64-bit qemu builds can still emulate 32-bit
targets.
Confusingly, the qemu package is also capable of being built and running
on buildroot hosts, and targets. In any case, qemu only supports running
on 64-bit hosts (which may be buildroot targets), so adjust
BR2_PACKAGE_QEMU_ARCH_SUPPORTS_TARGET to indicate no support for 32-bit
buildroot targets, and drop configs for architectures like BR2_arm that
are implicitly 32-bit only.
Separately, the qemu microblazeel target was removed with commit
46a25ae3f0e75e230c06e21435850b1cd1c44f07, as the microblaze (qemu)
target supports both endiannesses, so that's fixed up in the package
Makefile as well.
Signed-off-by: Joseph Kogut <joseph@anodize.com>
[Romain: remove duplicate --disable-download from QEMU_CONFIGURE_CMDS]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
python-gymnasium selects python-numpy, but does not inherit the toolchain
requirements of numpy, which can lead to automatic selection of numpy
without proper toolchain support (C++, gcc >= 9, glibc/musl).
Fix this by adding all necessary toolchain dependencies that numpy
requires. Also update the help URL and add a comment explaining the
toolchain requirements.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a config for enabling the freedreno virtio KMD backend, in the same
pattern as amdgpu-virtio.
Signed-off-by: Joseph Kogut <joseph@anodize.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Since mesa3d v26.0 [0], the ACO compiler has been the default over LLVM.
This shader compiler backend has been used for even longer by the RADV
vulkan driver.
Let's make LLVM optional.
Users who wish to continue using LLVM must enable support in Mesa, and
override the default ACO compiler at runtime using an env var. [1]
Users who only want to use the default compiler backend may disable LLVM
support, and save a lot of time during the build.
[0] e26c28f311
[1] https://docs.mesa3d.org/envvars.html#envvar-AMD_DEBUG
Signed-off-by: Joseph Kogut <joseph@anodize.com>
Reviewed-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
cryptsetup support Mbed-TLS/mbedtls since 2.8.0:
cb7b7fd863
Signed-off-by: Andreas Mohr <and@gmx.li>
[Julien: add link in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
For change log, see:
https://github.com/FRRouting/frr/releases/tag/frr-10.5.4
Summary of Changes:
bfdd:
- cap IPv6 echo reflection to declared length
- account for FP offset in echo length checks
- fix recv errno filter logic in a few places
- tighten SBFD reflector packet sanity checks
- gate IPv6 echo reflection on known sessions
- tighten auth header parsing skeleton
- validate control packet length before session lookup
bgpd:
- Fix memleak when configuring rd
- Validate if NHC BGPID TLV value is non-zero
- Avoid having a dangling pointer after we free NHC attribute
- Check if BGPID NHC TLV exists when IPv6 next-hop is link-local
- Do not allocate NHC TLV with an extra trailer
- migrate timers during peer_xfer_conn to fix stale route cleanup
- honor 'no activate' for dynamic neighbors in peer-group
- Return immediately when dynamic capability action is not valid
- Validate BGP role capability when handling it dynamically
- fix neighbor IP comparison for IPv6 memcmp return values
- Don't mark nexthop as changed if a set next-hop unchanged is applied
- Return BGP_PEER_INTERNAL when first peer's as type is set to auto
- Update peer sort cache when remote-as auto is used and AS number changed
- Check dynamic capability action before validating ENHE capability
- Do not allocate stream if route-refresh capability is not received
- Move rpki strict check to bgp_accept()
- Fix memory leak for nhc attribute if ipv6 is link-local address
- Fix compilation for Debian 11 when printing uint64 values
- Return zero labels if no BOS found and it's not a withdraw label
- Fix signed overflow in hexstr2num()
- Check the length also when parsing ENCAP attr sub-TLVs
- Validate prefixlen before subtracting when parsing labeled unicast NLRI
- Reset the stream to attr_start + attribute_len when WITHDRAWN
- Revalidate locally originated routes against RPKI changes
- Check if prefixlen is not 0 when parsing flowspec stuff
- Prevent len_string going negative when trying to display flowspec entries
- fix import vrf on non existing vrf
- fix no vrf import command
- Free hostname for FQDN capability if the parsing goes wrong
- Validate MP_REACH_NLRI attribute against incorrect next-hop
- Fix dynamic FQDN capability handling
- Check if the remaining length for subtracting TLV length is enough
- Fix the end pointer boundaries for dynamic graceful restart capability
- Add missing returns when parsing enhanced route-refresh
- Return original as-path when reconciling AS versus AS4
- Do not process route-refresh for AFI/SAFI if it's not negotiated
- Check if we are not overusing error_data buffer when unknown cap received
- fix NHT for explicit link-local BGP peers
- improve packet parsing for EVPN and ENCAP/VNC
- Prevent heap use-after-free for tunnel encapsulation attribute
- Return 0 if AS4 capability is malformed
- close dynamic peer socket in ttl error path
- fix logic handling EVPN_FLAG_DEFAULT_GW
- avoid early return in MPLSVPN NLRI processing
- remove unneeded asserts in packet reads
eigrpd:
- fix byte order in Hello TLV decode functions
- Handling for malformed update packets
- enforce minimum TLV length in Hello handler
- reject invalid prefix mask len
- skip unknown and ignored TLVs
- Improve packet validation
isisd:
- Reject SRv6 Locator TLV with Loc-Size of zero
- consume leftover bytes after FAD sub-sub-TLV loop
- use correct min size values for srv6 subtlvs
- improve validation of flex-algo decoder
- Fix missing neighbor address Sub-TLVs after link-params change
- add unit test for remove_excess_adjs() memory leak fix
- fix memory leak in remove_excess_adjs()
- fix edge condition in max_lsp_count computation
ldpd:
- improve tlv validation in several places
lib:
- Report IPv6 MTU and not IPv4 for if_update_state_mtu6
- disable warning in zlog.c to match master
nhrpd:
- stop debugging auth credentials
- fix byte-order when comparing error code in shortcut path
- guard against zbuf_pulln NULL on truncated packets
- require auth for all received packet types
- harden debug packet parsing against malformed input
- validate AFI index in extension replies
ospf6d:
- move log call out of priv block
- remove asserts in packet-handling paths
- fix issues in ospf6 auth trailer code
ospfd:
- add LSA validation in the apiserver path
- add validation in several places before accessing
pceplib:
- validate during of_list TLV decoding
pimd:
- fix NOCACHE MFC resync detection log, add vrf name too
- use upstream-owned pim pointer in register and upstream timers
- use upstream-owned pim pointer in MSDP update paths
- avoid JP build deref through channel OIL
- guard RP RPF-failure mroute delete on detached OIL
- avoid null deref in upstream delete debug path
- guard channel OIL detach against stale pointers
- fix crash due to double free
- Ensure igmp message is of proper size
- Reject pim packets with a malformed header length
- Fix out of bounds read in AutoRP code
- igmpv3 never checks packet length and trusts the num-sources field
- Do not allow a register-stop message if not received from the RP
- Prevent received msg length from being larger than buffer
- Remove unnecessary asserts
- When receiving a register stop ensure we have enough data to read
- Ensure a register packet has enough space to read S,G data
- Ensure that header has space on packet
ripngd:
- fix data handling in several places
tests:
- Check if route-map with set nexthop unchanged does not prevent outgoing
- Check if mixed peer-group remote-as types can be used with auto
- Verify neighbor addr Sub-TLVs after link-params reset
- Expect return code being 0, not -1 when AS4 is empty or ASN is 0
vrrpd:
- replace some asserts
- only support ethernet in GARP code
- limit advertised timers to 12-bits
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
