Buildroot commit d4b8a42fb2 bumped the
package from 1.0.16 to 1.0.18.
Upstream added optional neon support in version 1.0.17:
f22cf00a86
The configure check detects neon support:
-- Performing Test HAVE_NEON
-- Performing Test HAVE_NEON - Success
but causes a build error at linking stage:
[100%] Linking CXX executable dec265
/builds/bkuhls/buildroot/br-test-pkg/bootlin-armv7m-uclibc/host/opt/ext-toolchain/arm-buildroot-uclinux-uclibcgnueabi/bin/ld.real:
error: ../libde265/libde265.a(hevcdsp_qpel_neon.S.o):
conflicting architecture profiles A/M
so we add a configure option to disable neon support.
The build error was not yet detected by the autobuilders but can be
reproduced using this defconfig:
BR2_arm=y
BR2_cortex_m4=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7M_UCLIBC_STABLE=y
BR2_PACKAGE_LIBDE265=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit d4b8a42fb2 bumped the
package to version 1.0.18 which introduced build errors on sparc:
/home/autobuild/autobuild/instance-21/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/15.2.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
../libde265/libde265.so.0.1.12: undefined reference to
`__atomic_fetch_add_4'
Fixes:
https://autobuild.buildroot.net/results/605/605dc19e86f113662cc35fe055c64c52698d70b4/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- Update email address to v@baodeep.com.
- Take over maintainership of package/amlogic-boot-fip.
Signed-off-by: Viacheslav Bocharov <v@baodeep.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bug fix of bug fix. Changes from version 0.24.10 -> 0.24.12:
* protocol
- fix path traversal bug
- allow empty URI in "lsinfo", "add" etc. (0.24.11 regression)
* playlist: do not allow newlines in song URIs
* input
- curl: require version 7.85.0
* decoder
- pcm: fix stack buffer overflow
- sidplay: fall back to SIDLiteBuilder if ReSIDfpBuilder is unavailable
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
wpewebkit depends directly on OpenGL ES and EGL support, but those
dependencies are not imposed by libepoxy itself. Update the inline
comments so they describe the actual dependency source before relaxing
libepoxy's package-level EGL/GL dependency.
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
BR2_PACKAGE_WESTON_XWAYLAND currently depends on BR2_PACKAGE_LIBEPOXY,
which implicitly requires either libGL or libEGL. However, the XWayland
glamor support uses libepoxy with EGL, so express that dependency
directly. With only libGL and no libEGL, it fails to build. E.g.,
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_ETNAVIV=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XWAYLAND=y
BR2_PACKAGE_LIBEPOXY=y
fails with:
In file included from ../glamor/glamor_priv.h:73,
from ../glamor/glamor_composite_glyphs.c:25:
../glamor/glamor_context.h:27:10: fatal error: epoxy/egl.h: No such file or directory
27 | #include <epoxy/egl.h>
| ^~~~~~~~~~~~~
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The current cog release only supports weston protocols up to weston 14
When weston was bumped to version 15 in
2e6b2b82d5 it broke building cog.
Backport a patch adding weston 15 support to cog.
Fixes: No usable weston-protocols dependency found
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Current build generated pkgconfig/libargon2.pc has wrong version string.
Version: ZERO
Signed-off-by: Andreas Mohr <and@gmx.li>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Fixes:
"missing #include <memory>" when building with GCC > 11.
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The commit adds an upstream patch to fix the following build failure:
jl2005c/jl2005bcd_decompress.c: In function 'jl2005bcd_decompress':
jl2005c/jl2005bcd_decompress.c:161:46: error: passing argument 3 of 'jpeg_mem_dest' from incompatible pointer type [-Wincompatible-pointer-types]
161 | jpeg_mem_dest (&cinfo, &jpeg_header, &jpeg_header_size);
| ^~~~~~~~~~~~~~~~~
| |
| long unsigned int *
Fixes:
- https://autobuild.buildroot.org/results/cb983d9ad90170aa8d7f2b9a5dfc30055d83b5de
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Tested-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
NSS Makefile build system is pretty weak if used with parallel build. In
this case what happens is that 'ifndef FREEBL_NO_DEPEND' appears in
lib/freebl/manifest.mn and coreconf/Linux.mk. When parallel building
variable FREEBL_NO_DEPEND gets defined if not defined to 1, but in the
2 occurences we end up having on variable set to 1 and 1 still not
defined. This results in:
`
/home/giuliobenetti/br-reproduce/3e046c996825447f48377f7c4361b5db26b84f95/output/host/lib/gcc/arm-buildroot-linux-musleabi/14.3.0/../../../../arm-buildroot-linux-musleabi/bin/ld: Linux2.6_arm_arm-buildroot-linux-musleabi-gcc.br_real_glibc_PTH_DBG.OBJ/Linux_SINGLE_SHLIB/lowhash_vector.o: in function `loader_GetOriginalPathname':
lowhash_vector.c:(.text.loader_GetOriginalPathname+0x68): undefined reference to `PR_SetError'
collect2: error: ld returned 1 exit status
`
So let's pass FREEBL_NO_DEPEND=1 when building to define that variable
instead to let NSS Makefile to calculate it.
Fixes:
https://autobuild.buildroot.net/results/ad4/ad40536728303c56d1d0968e38ac36da12cca416//
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Version 0.24.10 change log:
* input
- cache: fix deadlock bug
* decoder
- sidplay: support millisecond-precision time stamps
- sidplay: support libsidplayfp version 3
* database
- upnp: allow building with libupnp 1.14.30 which has fixed the API breakage
* Windows
- work around build failure due to zlib bug
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
There is no CVE assigned with the vendor name "cesenta".
The CPE ID introduced in [1], correctly reference "cesanta" as a CPE
vendor but introduced a typo while writing the vendor metadata in
`mongoose.mk`.
[1] 3d632c941f package/mongoose: add MONGOOSE_CPE_ID_VENDOR
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since the last version bump in commit [1] python-sdbus-modemmanager
install step miss-behave following the switch to poetry (as reported
by [2]).
The sdbus-modemmanager python module is intalled in a second
"modemmanager" subdirectory:
$(TARGET_DIR)/lib/python3.14/site-packages/sdbus_block/modemmanager/modemmanager/
This break existing python script using:
from sdbus_block.modemmanager import MMBearer
Fix tool.poetry install step by removing one "modemmanager".
[1] 7c30b1e522
[2] https://github.com/zhanglongqi/python-sdbus-modemmanager/issues/24
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904075359
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- CVE-2026-32853:
LibVNCServer versions 0.9.15 and prior (fixed in commit 009008e)
contain a heap out-of-bounds read vulnerability in the UltraZip
encoding handler that allows a malicious VNC server to cause
information disclosure or application crash. Attackers can exploit
improper bounds checking in the HandleUltraZipBPP() function by
manipulating subrectangle header counts to read beyond the allocated
heap buffer.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32853
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
- 009008e2f4
- CVE-2026-32854:
LibVNCServer versions 0.9.15 and prior (fixed in commit dc78dee)
contain null pointer dereference vulnerabilities in the HTTP proxy
handlers within httpProcessInput() in httpd.c that allow remote
attackers to cause a denial of service by sending specially crafted
HTTP requests. Attackers can exploit missing validation of strchr()
return values in the CONNECT and GET proxy handling paths to trigger
null pointer dereferences and crash the server when httpd and proxy
features are enabled.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-32854
- https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x
- dc78dee51a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit [1] updated the Kernel for this test, but forgot to
add the "arm/" prefix for the dtb path. Since Linux 6.5, .dts files
have been moved to "arch/arm/boot/dts/" and the test was not able to
find the file anymore, which caused the build to fail.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/14297955524
[1] 74e7e07f83
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien: reword commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This reverts commit 51365ff063.
This breaks u-boot < v2025.10 builds using binman, so revert it for now
given that v2025.10 is a quite recent release.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/14249332016
And many more.
Longer term we either want to upgrade all the defconfigs (which will not fix
the issue for external users) or find a way to patch older u-boot versions.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
https://www.python.org/downloads/release/python-3145/https://docs.python.org/release/3.14.5/whatsnew/changelog.html
This release includes various security fixes:
gh-148178: Hardened _remote_debugging by validating remote debug offset
tables before using them to size memory reads or interpret remote
layouts.
gh-149254: Update Android and iOS installer to use OpenSSL 3.0.20.
gh-149017: Update bundled libexpat to version 2.8.0.
gh-90309: Base64-encode values when embedding cookies to JavaScript
using the http.cookies.BaseCookie.js_output() method to avoid injection
and escaping.
gh-148395: Fix a dangling input pointer in lzma.LZMADecompressor,
bz2.BZ2Decompressor, and internal zlib._ZlibDecompressor when memory
allocation fails with MemoryError, which could let a subsequent
decompress() call read or write through a stale pointer to the already-
released caller buffer.
gh-148169: A bypass in webbrowser allowed URLs prefixed with %action to
pass the dash-prefix safety check.
gh-146333: Fix quadratic backtracking in configparser.RawConfigParser
option parsing regexes (OPTCRE and OPTCRE_NV). A crafted configuration
line with many whitespace characters could cause excessive CPU usage.
gh-146211: Reject CR/LF characters in tunnel request headers for the
HTTPConnection.set_tunnel() method.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix TDA4VM Starter-Kit defconfig pointing to TD4VM EVM instead of SK R5 and uboot
defconfigs.
The starter kit board boots just fine with the evm defconfigs, but it is more accurate
to use the start kit defconfigs for the starter kit board.
Note: those defconfigs have been present upstream since uboot v2024.10:
c9507f07a1
Signed-off-by: Sofiane HAMAM <sofiane.hamam@smile.fr>
[Julien: add note in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.25.10 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
compiler, the linker, the runtime, and the crypto/fips140, go/types, and os
packages.
https://go.dev/doc/devel/release#go1.25.10
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
CVE-2026-33811: net: crash when handling long CNAME response
CVE-2026-33814: net/http: infinite loop in HTTP/2 transport when given bad
SETTINGS_MAX_FRAME_SIZE
CVE-2026-39817: cmd/go: "go tool pack" does not sanitize output paths
CVE-2026-39819: md/go: "go bug" follows symlinks in predictable temporary
filenames
CVE-2026-39820: net/mail: quadratic string concatenation in consumeComment
CVE-2026-39823: html/template: bypass of meta content URL escaping causes
XSS
CVE-2026-39825: net/http/httputil: ReverseProxy forwards queries with more
than urlmaxqueryparams parameters
CVE-2026-39826: html/template: escaper bypass leads to XSS
CVE-2026-39836: net: panic in Dial and LookupPort when handling NUL byte on
Windows
CVE-2026-42499: net/mail: quadratic string concatenation in consumePhrase
CVE-2026-42501: cmd/go: malicious module proxy can bypass checksum database
go1.26.3 (released 2026-05-07) includes security fixes to the go command,
the pack tool, and the html/template, net, net/http, net/http/httputil,
net/mail, and syscall packages, as well as bug fixes to the go command, the
go fix command, the compiler, the linker, the runtime, and the
crypto/fips140, crypto/tls, go/types, and os packages.
https://go.dev/doc/devel/release#go1.26.3
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
CVE-2026-4367: libXpm Out-of-bounds read in xpmNextWord()
libXpm uses a number of internal helper functions to parse the XPM file
format.
One of these internal functions, xpmNextString(), checks for the NULL
terminator when looking for the end of the current string but not when
looking for the beginning of the next string.
A small XPM file with a malformed color table definition may cause the
function xpmNextWord(), called from xpmParseColors() following a call to
xpmNextString(), to start past the actual end of the file, causing an
out-of-bound read.
Advisory:
https://lists.x.org/archives/xorg-announce/2026-April/003690.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport 2 patches from upstream maintenance branch. Same fixes as
required for gcc-14.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport two patches from upstream gcc-14 maintenance branch. Requires
one more patch on top of the fix for gcc-15.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport patch that was applied upstream to the gcc-15 maintenance
branch.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Django 6.0.5 fixes three security issues with severity “low” and several bugs in 6.0.4.
Security Fixes:
* CVE-2026-5766: Potential denial-of-service vulnerability in ASGI
requests via file upload limit bypass ASGI requests with a missing
or understated Content-Length header could bypass the
FILE_UPLOAD_MAX_MEMORY_SIZE limit, potentially loading large files into
memory and causing service degradation.
As a reminder, Django expects a limit to be configured at the web server
level rather than solely relying on FILE_UPLOAD_MAX_MEMORY_SIZE.
This issue has severity “low” according to the Django security policy
* CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
Response headers did not vary on cookies if a session was not modified,
but SESSION_SAVE_EVERY_REQUEST was True. A remote attacker could steal a
user’s session after that user visits a cached public page.
This issue has severity “low” according to the Django security policy.
* CVE-2026-6907: Potential exposure of private data due to incorrect
handling of Vary: * in UpdateCacheMiddleware
Previously, UpdateCacheMiddleware would erroneously cache requests where
the Vary header contained an asterisk ('*'). This could lead to private
data being stored and served.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a misplaced </div> in the
django/contrib/admin/templates/admin/change_list.html template added
in Django 6.0 that could be problematic when overriding the pagination
block (#37029).
* Fixed a bug in Django 6.0 where deprecation warnings incorrectly
skipped lines from third-party packages prefixed with “django”
(#37067).
Release notes: https://docs.djangoproject.com/en/6.0/releases/6.0.5/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The FRR package currently only installs systemv services files. The
upstream package also provides a systemd service file and a service
template file. Install those when systemd is selected as an init
manager.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
And updates the kernel version used for the test_openjdk test to
the last LTS version (6.18.21). instead of 5.10.3, which is quite
old and may not be compatible with the latest OpenJDK versions.
This change was tested by running the openjdk test.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the Device Tree name for the vexpress platform to match the
new directory structure introduced in Linux 6.5.
Since kernel 6.5, the 'arch/arm/boot/dts/' directory was restructured
to avoid having thousands of files in a single folder. Device Trees
for ARM (32-bit) are now organized into subdirectories. For the
Versatile Express platform, the DTS file moved to the 'arm/'
subdirectory.
The build was failing with:
make[3]: *** No rule to make target 'arch/arm/boot/dts/vexpress-v2p-ca9.dtb'. Stop.
Adjust BR2_LINUX_KERNEL_INTREE_DTS_NAME from "vexpress-v2p-ca9" to
"arm/vexpress-v2p-ca9".
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the Device Tree name for the vexpress platform to match the
new directory structure introduced in Linux 6.5.
Since kernel 6.5, the 'arch/arm/boot/dts/' directory was restructured
to avoid having thousands of files in a single folder. Device Trees
for ARM (32-bit) are now organized into subdirectories. For the
Versatile Express platform, the DTS file moved to the 'arm/'
subdirectory.
The build was failing with:
make[3]: *** No rule to make target 'arch/arm/boot/dts/vexpress-v2p-ca9.dtb'. Stop.
Adjust BR2_LINUX_KERNEL_INTREE_DTS_NAME from "vexpress-v2p-ca9" to
"arm/vexpress-v2p-ca9".
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit bump the kernel version of this docker test (5.4->6.18), and thus
fixes several issues preventing the Docker Compose runtime test from
succeeding due to this bump:
Kernel Infrastructure:
The Docker daemon failed to start because the 'nat' table could not
be initialized. This was due to missing legacy Netfilter support.
- Enable CONFIG_NETFILTER_XTABLES_LEGACY to support iptables nat table.
- Enable CONFIG_NAMESPACES and CONFIG_USER_NS for container isolation.
- Enable CONFIG_TUN and CONFIG_VETH for container networking.
- Enable CONFIG_IKCONFIG and CONFIG_IKCONFIG_PROC for easier debugging.
Build Fixes:
While building the kernel tools, the libelf header was missing because
objtool was not handled correctly for this kernel version. This resulted
in a fatal error: "gelf.h: No such file or directory".
- Select BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y to build host-libelf.
Resources and Stability:
The previous 512MB of RAM was tight for the stack (Kernel +
Docker + Containerd + Python), potentially leading to Out-Of-Memory kills.
Idem for the disk size for Docker images/layers storage.
- Increase QEMU RAM to 1024MB (-m 1024M).
- Increase rootfs size to 1024MB.
- Switch to EXT4 (BR2_TARGET_ROOTFS_EXT2_4=y) for better stability
and modern feature support required by Docker's storage drivers.
Test Script Adjustments:
- Update rootfs path in the test script to point to rootfs.ext4.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the kernel configuration to support modern storage stacks
required for ISO booting on x86_64.
The transition from 4.19 to 6.18 requires explicit activation of:
- CONFIG_PCI: To discover the emulated IDE/SATA controllers.
- CONFIG_ATA & CONFIG_ATA_PIIX: Modern libATA drivers for QEMU's
chipset (replacing the legacy IDE subsystem).
- CONFIG_SCSI & CONFIG_BLK_DEV_SR: Necessary to handle the CD-ROM
as a SCSI device (/dev/sr0), which is mandatory for ISO9660.
Without these options, the kernel cannot locate or mount the
rootfs from the ISO image.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y :
While building the kernel tools, libelf header is missing because objtools
was not compiled by default on older kernel versions. This results in the following error:
[...]tools/objtool/include/objtool/elf.h:10:10: fatal error: gelf.h: No such file or directory
10 | #include <gelf.h>
That is why BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF was selected to build host-libelf.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien: updated kernel to 6.18.21]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Unlike libgpiod2, this version of libgpiod relies on the deprecated GPIO
ABI version 1. This ABI used to be enabled by default. However, since
Linux 7.1-rc1 (commit 7673e4c7f7f9 "Do not enable the v1 uAPI by
default"), this is not the case anymore. Failing to enable the ABI
results in a non-functional libgpiod. For instance:
# gpioinfo
gpioinfo: error creating line iterator: Invalid argument
Fix this by enabling the ABI v1 in LIBGPIOD_LINUX_CONFIG_FIXUPS.
Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The __name__ == '__main__' guard allows importing pkg-stats as a
module using importlib, circumventing the normal module filename
requirements. This in turn makes it possible to test/debug individual
functions.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The file handle can be iterated over directly and each line is used
exactly once, so the only effect of reading all lines into a list
first was higher memory use and complexity.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The filter is supposed to exclude host/target infra from output if the
respective package is not built with the current
configuration.
However, excluding host packages did not work correctly: If keep_host
is False because the host package is not built, the next branch was
checked and included the host infra in output with "target" type if
the target package is built. For a package that support host and
target build, but gets built only for the target, this leads to output
like (Meson example):
meson (target)
host-meson (target)
Skip host infra in the target branch instead. Also include
Package.infra in Package.__str__() result, which was needed for
debugging this bug.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: add it to the main help text, where it belongs]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Use only one of the classes for "error" or "warning" status so they
look different, and format the error/warning text for both. Do not
make the text a link if the URL is None.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The previous Config.* glob also caught linux/Config.ext.in and
package/php/Config.ext, as well as some backup files created by
editors (e.g. Config.in~ after editing a Config.in file in Emacs),
leading to wrong results depending on directory listing order.
Also use "with" to automatically close the file when the block is
left, even on error.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
I don't use maintain x11vnc in buildroot anymore and can't easily test.
Signed-off-by: Martin Kepplinger-Novaković <martink@posteo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Eudev install creates a symlink from $(sbindir)/udevadm to
$(bindir)/udevadm if sbindir and bindir are different [1].
Unfortunately the check considers only the configured values as
strings and does not resolve symlinks. This means that in a merged-bin
setup with sbindir=/sbin (symlink to /usr/sbin, which is a symlink to
/usr/bin) and bindir=/usr/bin the /usr/bin/udevadm binary gets
overwritten with a link to itself.
Set sbindir according to the merge setup to avoid the problem, bindir
defaults to /usr/bin in any case.
[1] 9e7c4e744b/src/udev/Makefile.am (L139-L140)
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
If sending the stop signal fails but the PID file exists the following
shutdown wait turns into an endless loop. Avoid that and return the
error immediately.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
With dlopen() enabled, kmod will load compression libraries only if
actually needed (loading compressed modules into the kernel does not
if the kernel can handle decompression, depending on its
configuration), and only the needed one.
Use compressed modules in the kmod test without enabling in-kernel
decompression to verify decompression in kmod works.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
The upstream changelog for version 34 states that the next major
version will drop the Autotools build, and the 34 series is meant for
distros to switch.
Notable changes in the Buildroot package:
* The Meson build handles symlink install, so we can drop the post
install hooks.
* Simplify the merged-usr and merged-bin symlink install handling.
Only the non merged-usr case needs special handling now for placing
the correct symlink to block busybox placing it's only kmod applet
symlink unto /sbin later.
* The previous point also means that host-kmod now installs the full
set of tools.
* Explicitly disable openssl support in host-kmod tools. It is enabled
by default and the build fails if OpenSSL cannot be found. In the
autotools build it was not explicitly set.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: explain the merged-bin, merged-usr simplifications in the
commit message]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Patch the parts of Make that use code invalid in C23. It wasn't
included when compiling with glibc but failed to build with musl.
Fixes#176. See also https://savannah.gnu.org/bugs/index.php?68302
Signed-off-by: Daniel Houck <Software@DRHouck.me>
[Marcus: link to savannah bug report also in the patchfile]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
OpenSSH checks during ./configure if the default location /var/run
exists on the build host, and defaults to ${sysconfdir} (/etc/ssh in
Buildroot) if not. This can break e.g. in a sandbox with its own mount
namespace where there is no reason to create a /var.
On the target this leads to errors when starting/stopping the service
from the init script, which expects the PID file at /var/run/sshd.pid if
sshd is running. A "stop" (including as part of "restart") or "reload"
will always fail with
no /usr/sbin/sshd found; none killed
from start-stop-daemon, even though sshd is running (because the PID
file doesn't exist where start-stop-daemon tries to read it).
On the other hand, a "start" command will try to start sshd even if it
is already running, because it cannot detect the running instance.
Unfortunately sshd does not fail directly in that situation (so the init
script completes), but something like the following appears in the log:
[May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on 0.0.0.0
failed: Address in use.
[May 04 14:48:05] auth sshd[4592]: error: Bind to port 22 on :: failed:
Address in use.
[May 04 14:48:05] auth sshd[4592]: fatal: Cannot bind any address.
Explicitly setting --with-pid-dir=/var/run overrides either default,
and only logs a warning if /var/run does not exist.
[1] 5fa60ae0d2/configure.ac (L5568-L5576)
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: expand commit message after discussion on ML]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Fixes the following security issue:
CVE-2026-4046: iconv crash due to assertion failure with untrusted input
https://sourceware.org/git/?p=glibc.git;a=blob;f=advisories/GLIBC-SA-2026-0007;h=b880fb55449693b879beae443e5d9bc1070b938b;hb=HEAD
git shortlog 2.43-17-gdd9945c0b..2.43-22-g8362e8ce1
Adhemerval Zanella (1):
elf: Use dl-symbol-redir-ifunc.h instead _dl_strlen
Adhemerval Zanella Netto (1):
riscv: Resolve calls to memcpy using memcpy-generic in early startup
Florian Weimer (1):
Use pending character state in IBM1390, IBM1399 character sets (CVE-2026-4046)
Michael Jeanson (1):
tests: fix tst-rseq with Linux 7.0
Xi Ruoyao (1):
elf: parse /proc/self/maps as the last resort to find the gap for tst-link-map-contiguous-ldso
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bugfix release fixing crash / NULL pointer access issues and gsasl
authentication compatibility with Microsoft servers.
Mutt 2.2.14 was released on February 20, 2025. This is a bug-fix release,
fixing a couple possible crashes, in GPGME and with IMAP when logging out,
and correcting a small issue with unnecessary encoding of "." in attachment
names (2231 encoding).
Mutt 2.2.15 was released on October 2, 2025. This is a bug-fix release,
fixing an IMAP search/limit bug, a compilation issue, and containing a
workaround for gsasl SMTP authentication issues with some MS servers. A few
parts of the documentation were also improved.
Mutt 2.2.16 was released on November 22, 2025. This is a bug-fix release,
fixing a resource leak when compiled with OpenSSL/LibreSSL, which could
eventually result in new connections failing.
http://www.mutt.org/news.html
The 2.2.16 release is not available on bitbucket, so change to the official
ftp.mutt.org location instead.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bugfix release with large number of (security) fixes.
For 6.2.26:
- a severe issue was found in the compression library (slz) where
specially crafted patterns with tune.bufsize above 17408 or
tune.maxrewrite below 964 (both non-default) could cause output
buffer overflows due to the overhead exceeding the promised
worst-case growth bound of 5 bytes and reach up to 1/16 of the
input contents. Given that the compression output is hardly
controllable, and the canaries at the end of the pools will catch
this at release time, the risk of exploitation by a hostile server
is close to zero, however it will cause repeated crashes if such a
crafted file is present on a server and regularly downloaded. A
workaround consists in keeping tune.maxrewrite at least 1/16 of
tune.bufsize or just not changing them since the defaults are safe.
A CVE was requested two weeks ago for this one, I'll mention it when
it arrives.
- HTTP/2 incomplete transfer detection was missing for HEADERS frames
carrying END_STREAM. When relayed to an HTTP/1.1 server that
responds before the end of the transfer, this can result in bytes
of the next request over the same connection to be ignored. Most of
the time it will cause the connection to be dropped due to an
unparsable request, but when combined with "http-reuse never", or
on totally idle servers, the client could expect the second request
to reuse the same connection and perform a content smuggling attack
that would allow to pass an unverified request to a server. For
those who can't upgrade, a temporary workaround is to disable
HTTP/2 by specifying "alpn http/1.1" on bind lines and adding
"disable-h2-upgrade" in HTTP frontends. A CVE will be requested for
this one.
- HTTP/1.1 bodyless messages announcing a non-null Content-Length did
not force close mode on the backend, potentially causing
desynchronisation between HAProxy and the server in conjunction
with other bugs.
- FCGI record length truncation with large bufsize (>=65544) could
enable request smuggling into PHP-FPM since the 16-bit
content_length field silently truncated to 65535 bytes.
- an unvalidated SNI name_len field in ClientHello could cause OOB
heap reads of up to 65KB via XXH3, smp_dup(), and log-format leaks
on any TCP frontend using req.ssl_sni, possibly causing crashes when
used.
- ECDSA JWT signatures with ES256/384/512 could cause a heap overflow
of ~14 bytes in the DER conversion before verification.
- Lua's httpclient headers conversion accepted more than 101 headers
without bound checking, causing a stack buffer overflow reachable
from any Lua action/task/service.
- peers dictionary cache updates accepted an unvalidated entry id as
array index, allowing OOB heap writes at attacker-controlled
offsets.
- Lua had a use-after-free of HTTP reason strings managed by Lua's GC
between set_status() and start_response(), potentially leaking
adjacent information from memory.
- the regsub sample function could leak ~9-50KB of stale heap data
when back-reference expansion overflowed the output buffer.
- SPOE decode_varint() had no iteration cap, allowing pointer
arithmetic to wrap and dereference memory ~64KB before the
allocation, causing SIGSEGV or parser confusion.
- in sample expressions, less common HTTP methods (PATCH etc.) are
represented by both an enum and a string. The string part was not
handled correctly in sample duplication functions, resulting in
their contents appearing empty when trying to fetch the method.
- QPACK varint decoding is now also limited to 62-bit, and had a risk
of 1-byte OOB reads on truncated streams, which could cause
incorrect header decoding.
- config: a few argument parsing errors in conditional expressions
used in ".if" could be misreported and even cause a crash during
the parsing. Also, a few keywords relying on warnif_misplaced_*
didn't check the return value and didn't count emitted warnings as
warnings.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47016.html
For 6.2.27:
A major issue were fixed by this release. It was related to the scheme-based
normalization. The presence of commas in Host header and authority was permitted
and would be used to compare the values, which then would differ when read via
hdr(host) which splits them on commas, and under certain circumstances, trigger
crashes (at least it did in the OSS-Fuzz environment when injecting the values
directly at the HTX layer). The issue was fixed. Remains the case of the comma
characters in authorities. Even though the spec permits commas in authorities
(not in domain names), there is currently no use case for this and it causes an
ambiguity with the historical use of hdr(host), so we preferred to just deny
them. The change was performed on the 3.4-dev10 and postponed for the next 3.3
release. It will probably be backported to lower versions too.
An issue in the FCGI multiplexer was fixed. The function responsible to emit
FCGI_PARAM records was not handling cases of full buffer in a consistent
way. The issue was quite limited, but the "http-send-name-header" option could
be silently ignored. The issue was fixed by reworking this function.
The scheme-based normalization was fixed to properly handle case of OPTIONS
requests. As stated in RFC9110#4.2.3, when the scheme-based normalization is
performed, an empty path must be normalized to "/", except for OPTIONS request.
Finally, a memory leak on error path (tools) and other minor issues were also
fixed.
For more details, see the announcement:
https://www.mail-archive.com/haproxy@formilux.org/msg47059.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
- CVE-2026-27654: Buffer overflow in ngx_http_dav_module when using the
alias directive with WebDAV COPY or MOVE requests.
- CVE-2026-27784 & CVE-2026-32647: Buffer overflows in ngx_http_mp4_module
when processing specially crafted MP4 files.
- CVE-2026-27651: NULL pointer dereference in the mail proxy module
during CRAM-MD5 or APOP authentication retries.
- CVE-2026-28753: DNS PTR record manipulation in auth_http or SMTP proxy.
- CVE-2026-28755: OCSP certificate check bypass in the stream module.
For a full list of changes, see:
https://nginx.org/en/CHANGES-1.28
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Use install -D so it also works if $(TARGET_DIR)/sbin does not exist yet.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release announce, see:
https://lore.kernel.org/netdev/20260413124459.1d6f40dd@phoenix.local/
- dpll: Fix notifications and add fractional frequency offset support
- tc: Add cake_mq support
- mptcp: Show interface names with color support
- devlink: Support param display and reset to defaults
- lib/bpf_legacy: Use userspace SHA-1
- Update kernel headers to 7.0-rc0
- Remove upstreamed musl patch
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: replace announce lwn URL with lore in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 7643670052 disabled
parallel builds in 2012.
Upstream fixed the problem in 2021:
855e1c28da9ea3d8b93c
with version 5.9.1 which was added to buildroot with commit
83b4337354.
Tested with -j100.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update to 3.3.0, see here for a changelog:
https://dillo-browser.org/release/3.3.0/
Update to use new homepage. Project is moving to their own
infrastructure.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: remove DILLO_SOURCE to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/jnwatson/py-lmdb/blob/py-lmdb_2.2.0/ChangeLog
Version 2.1.0 fixes the following CVEs:
- **CVE-2019-16224**: heap buffer overflow via `MDB_DUPFIXED` without
`MDB_DUPSORT` in on-disk `md_flags`. (#429)
- **CVE-2019-16225**: `SIGSEGV` from `P_DIRTY` flag set on mmap'd disk pages,
causing `mdb_page_touch()` to skip copy-on-write. (#429)
- **CVE-2019-16226**: out-of-bounds `memmove` in `mdb_node_del` via corrupt
`mn_hi` making `NODEDSZ()` huge. (#429)
- **CVE-2019-16227**: NULL pointer dereference of `mc_xcursor` when
`F_DUPDATA` is set on a node in a non-DUPSORT database. (#429)
- **CVE-2019-16228**: divide-by-zero from zero `mm_psize` in meta page
header. (#429)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://lists.exim.org/lurker/message/20260429.121733.f58d9686.en.html
Fixes CVEs:
CVE-2026-40684 Possible crash with malicious DNS data when using musl libc
On systems using musl libc (not glibc) due to an oddity in octal printing
it is possible to crash the connection instance when malformed DNS data
is present in PTR records.
CVE-2026-40685 Possible OOB read/write on corrupt JSON in header
configurations using json operators on invalid externally-provided input
could trigger heap corruption.
CVE-2026-40686 Possible OOB read with large UTF8 trailing characters
configurations using utf8 operators on malformed utf8 in headers could
trigger OOB reads and might trigger some data leak if error
messages are required for subsequent emails in the current connection
and similar malformed headers are present.
CVE-2026-40687 Possible OOB read/write with SPA authenticator
in configurations using the SPA authentication driver to a hostile/compromised
external SPA/NTLM connnection it is possible to trigger an OOB read/write
and crash the connection instance or possibly leak heap data to the instance.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This reverts commit 0d81107f02. The bug
the workaround is for was fixed in binutils 2.29.51 (first release
listed in bfd/ChangeLog after the fix), which is by now far older than
any version supported by Buildroot.
Compile tested with qemu_microblazeel_mmu_defconfig plus
BR2_PACKAGE_KMOD=y.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Enable the FORCE_CHECK_HASHES and the corresponding custom hashes.
This commit also removes the corresponding .checkpackageignore entry.
Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Michael Walle <mwalle@kernel.org>
[Julien:
- remove .checkpackageinore entry to fix check-package error
- remove unneeded linux-headers hash due to bootlin toolchain usage
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Use the precompiled stable toolchain from Bootlin.
Suggested-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump dracut package source to the newest version of the project,
dracut-ng, release 110.
The original dracut project is now inactive for a long period of time.
Dracut community has transitioned to the dracut-ng fork to continue
development. The migration ensures regular updates for security and bug
fixing, a better support of modern systemd features and kernel
requirements. It also allows alignment with major Linux distributions
(Fedora, Arch Linux, Gentoo), and other open source projects (Yocto).
Changes made :
- dracut.mk: change source to dracut-ng 110
- dracut.hash: adapt hash to dracut-ng 110
- dracut.mk: fix unused systemd symbolic links build error
- Config.in: adapt fs/cpio/Config.in to mention dracut-ng upgrade
- Config.in.host: adapt dracut Config.in.host to mention dracut-ng upgrade
- .checkpackageignore: remove 001-dracut.sh-don-t-unset-LD_PRELOAD.patch
Patch removals and additions :
- Removed 0001-dracut.sh-don-t-unset-LD_PRELOAD.patch:
Upstream dracut-ng removed the 'unset LD_PRELOAD' instruction, making this
patch obsolete.
- Added 0001-fix-functions-prevent-find_binary-from-dropping-last.patch:
Dracut-ng introduced a regression on non-merged-usr architectures.
This was traced down to a bug in find_binary() where a `while read`
loop drops the last PATH element if the string does not end with a colon.
This local patch fixes the Bash EOF read behavior.
Submitted upstream: https://github.com/dracut-ng/dracut-ng/pull/2416
All dracut related runtime tests, including non-merged-usr, have been
locally tested and passed successfully using the reference Buildroot
docker container.
Signed-off-by: Matéo Pourrier <mateo.pourrier@smile.fr>
[Julien: reword commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Changes in 1.22.5 (released 2026-02-06):
- Fix sizeof usage in set_active_node: Use 'sizeof active_list[0]'
instead of 'sizeof (line_node **)'
- Improve error message: Change "Is a directory" to "Invalid filename"
in may_access_filename function
Changes in 1.22.4 (released 2026-01-03):
- Skip check of ISO-8859-1 names on UTF-8-only systems in test suite
https://lists.gnu.org/archive/html/bug-ed/2026-02/msg00000.html
Tested Using:
- utils/test-pkg -a -p ed
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The "proxycommand" binary is used with SSH clients to connect to
ugetty over serial. Building it as a host package makes it easy to use
with Buildroot builds including ugetty on the target, without needing
a separate install.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Peter: use install -D]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The /etc directory is reserved for host-specific, system-wide
configuration maintained by the local administrator. Buildroot packages
should avoid placing files in /etc and instead install them under /usr
whenever possible.
Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
https://github.com/OpenSC/OpenSC/blob/0.27.1/NEWS
Switched to sha256 tarball hash provided by upstream.
Removed patch which is included in this release.
Fixes the following CVEs:
* CVE-2025-13763: Several uses of potentially uninitialized memory
detected by fuzzers
* CVE-2025-49010: Possible write beyond buffer bounds during processing
of GET RESPONSE APDU
* CVE-2025-66215: Possible write beyond buffer bounds in oberthur driver
* CVE-2025-66038: Possible read beyond buffer bounds when parsing
historical bytes in PIV driver
* CVE-2025-66037: Possible buffer overrun while parsing SPKI
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Disable building of man pages, which is now a separate option from
building html docs[1].
Add conditional support for parsing the NVMe Boot Firmware Table NBFT)
depending on whether libnvme is available.
Changes [2]:
=============================================
NetworkManager-1.56
Overview of changes since NetworkManager-1.54
=============================================
* Unify the versioning to use everywhere the scheme with the -rcX or -dev
suffixes when appropriate. This affects, for example, the URL and filename
of the release tarball and the version reported by nmcli and the daemon.
As an exception, the C API will continue to use the 90+ scheme for RC versions.
* nmcli now supports viewing and managing WireGuard peers.
* Support reapplying the "sriov.vfs" property as long as
"sriov.total-vfs" is not changed.
* Support reapplying "bond-port.vlans".
* Accept hostnames longer than 64 characters from DNS lookup.
* Make that global-dns configuration overwrites DNS searches and
options from connections, instead of merging all together.
* Add support for a new rd.net.dhcp.client-id option in
nm-initrd-generator.
* Add gsm device-uid setting to restrict the devices the connection applies to.
* Support configuring the HSR protocol version via the
"hsr.protocol-version" property.
* Fix a bug that makes broadband connections auto-connect getting
blocked if the connection tries to reconnect when modem status is
"disconnecting" / "disconnected".
* Treat modem connection not having an operator code available
as a recoverable error.
* Add support for configuring systemd-resolved's DNSSEC option
per-connection via the "connection.dnssec" connection property.
* Support configuring the HSR interlink port via the
"hsr.interlink" property.
* Fix some connection properties not being applied to vpn connections
(connection.mdns, connection.llmnr, connection.dns-over-tls,
connection.mptcp-flags, ipv6.ip6-privacy)
* Update n-acd to always compile with eBPF enabled, as support
for eBPF is now detected at run time.
* Add new MPTCP 'laminar' endpoint type, and set it by default alongside
the 'subflow' one.
* For private connections (the ones that specify a user in the
"connection.permissions" property), verify that the user can access
the 802.1X certificates and keys set in the connection.
* Introduce a libnm function that can be used by VPN plugins to check
user permissions on certificate and keys.
=============================================
NetworkManager-1.54
Overview of changes since NetworkManager-1.52
=============================================
* Add support for configuring per-device IPv4 forwarding via the
"ipv4.forwarding" connection property.
* Add a new "prefix-delegation" setting containing a "subnet-id"
property that specifies the subnet to choose on the downstream
interface when using IPv6 prefix delegation.
* Support OCI baremetal in nm-cloud-setup
* When activating a WireGuard connection to an IPv6 endpoint, now
NetworkManager creates firewall rules to ensure that the incoming
packets are not dropped by kernel reverse path filtering.
* Add support for configuring the loopback interface in nmtui.
* Most of the properties of ovs-bridge and ovs-port connections can
now be reapplied at runtime without bringing the connection down.
* Add a new "sriov.preserve-on-down" property that controls whether
NetworkManager preserves the SR-IOV parameters set on the device
when the connection is deactivated, or whether it resets them to
their default value.
* Introduce a new "ovs-dpdk.lsc-interrupt" property to configure the
Link State Change (LSC) detection mode for OVS DPDK interfaces.
* The initrd-generator now can parse the NVMe Boot Firmware Table
(NBFT) to configure networking during early boot.
* Add systemd services to provide networking in the initrd.
[1] a11760ef39
[2] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/nm-1-56/NEWS
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Overview of changes since NetworkManager-1.52.1[1]
* Support reapplying the "sriov.vfs" property as long as
"sriov.total-vfs" is not changed.
* For private connections (the ones that specify a user in the
"connection.permissions" property), verify that the user can access
the 802.1X certificates and keys set in the connection.
* Introduce a libnm function that can be used by VPN plugins to check
user permissions on certificate and keys.
[1] https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/1.52.2/NEWS
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
NetworkManager stopped requiring intltool with 1.40:
56b51b98fb/NEWS (L434)
Fixes: e7c20ad548
host-gettext is already an indirect dependency via package/libglib2.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Marcus: add reference to commit that updated NM to 1.40]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
There is no such option, and according to the commit history never
was. If BR2_PACKAGE_HOST_PYTHON3_SSL=y the build adds host-openssl to
HOST_PYTHON3_DEPENDENCIES directly.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
https://download.gnome.org/sources/libxml2/2.15/libxml2-2.15.3.news
- parser: Pass userData to SAX text callbacks in xmlParseReference (type-confusion)
- entities: copy children in xmlCopyEntity
- c14n: Fix Type confusion in xmlC14NProcessAttrsAxis
- python: Do not decref string after adding to the list (double-free / use-after-free)
- c14n: Reuse tmp_str, xmlStrcat reallocates *cur (double-free)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Building this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_NEON=y
BR2_PACKAGE_NEON_ZLIB=y
does not build libneon with zlib support, quoting configure log:
configure: zlib not enabled
although the configure parameter
--with-zlib=/home/bernd/buildroot/output/host/x86_64-buildroot-linux-gnu/sysroot
was used.
The reason is the addition of "=$(STAGING_DIR)" to --with-zlib which was
added to buildroot in 2008 with commit
cc6562ff83.
The upstream code, which expects only "yes", all other values lead to
the else-condition, is unchanged since 2004:
https://github.com/notroj/neon/blame/0.37.1/macros/neon.m4#L478
so a backport of this patch to LTS branches should be considered.
With this patch the configure log shows:
checking for zlib.h... yes
checking for inflate in -lz... yes
configure: zlib support enabled, using -lz
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/stevegrubb/libcap-ng/blob/v0.9.3/ChangeLog
The source tarball is not distributed on the project site anymore so we
switch to the github helper and need to enable autoreconf.
Added dependency to BR2_TOOLCHAIN_HAS_SYNC_4 to fix a build error:
/home/bernd/buildroot/test-libcap/bootlin-sparc-uclibc/host/opt/ext-toolchain/bin/../lib/gcc/sparc-buildroot-linux-uclibc/14.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld:
../src/.libs/libcap-ng.so: undefined reference to `__sync_bool_compare_and_swap_4'
due to this upstream commit added in version 0.9.2:
ba2e9e0319
Added _POST_EXTRACT_HOOKS and dependency to host-pkgconf to fix
autoreconf errors.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- sources are now hosted on Github
- ficl have its own LICENSE file
- remove one upstreamed patch
- support only static lib
- requires C11
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The 6.19.x series is now EOL upstream, so drop the linux-headers
option and add legacy handling for it.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 1c11f9020a removed the patch
changing configure.ac with the bump to 6.10, so it is no longer
needed.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Django 6.0.4 fixes one security issue with severity “moderate”, four
security issues with severity “low”, and several bugs in 6.0.3.
Security issues:
* CVE-2026-3902: ASGI header spoofing via underscore/hyphen conflation
ASGIRequest normalizes header names following WSGI conventions, mapping
hyphens to underscores. As a result, even in configurations where
reverse proxies carefully strip security-sensitive headers named with
hyphens, such a header could be spoofed by supplying a header named with
underscores.
Under WSGI, it is the responsibility of the server or proxy to avoid
ambiguous mappings. (Django’s runserver was patched in CVE 2015-0219.)
But under ASGI, there is not the same uniform expectation, even if many
proxies protect against this under default configuration (including
nginx via underscores_in_headers off;).
Headers containing underscores are now ignored by ASGIRequest, matching
the behavior of Daphne, the reference server for ASGI.
This issue has severity “low” according to the Django security policy.
* CVE-2026-4277: Privilege abuse in GenericInlineModelAdmin¶
Add permissions on inline model instances were not validated on
submission of forged POST data in GenericInlineModelAdmin.
This issue has severity “low” according to the Django security policy.
* CVE-2026-4292: Privilege abuse in ModelAdmin.list_editable¶
Admin changelist forms using list_editable incorrectly allowed new
instances to be created via forged POST data.
This issue has severity “low” according to the Django security policy.
* CVE-2026-33033: Potential denial-of-service vulnerability in
MultiPartParser via base64-encoded file upload¶
When using django.http.multipartparser.MultiPartParser, multipart
uploads with Content-Transfer-Encoding: base64 that include excessive
whitespace may trigger repeated memory copying, potentially degrading
performance.
This issue has severity “moderate” according to the Django security policy.
* CVE-2026-33034: Potential denial-of-service vulnerability in
ASGI requests via memory upload limit bypass¶
ASGI requests with a missing or understated Content-Length header could
bypass the DATA_UPLOAD_MAX_MEMORY_SIZE limit when reading
HttpRequest.body, potentially loading an unbounded request body into
memory and causing service degradation.
This issue has severity “low” according to the Django security policy.
Bugfixes:
* Fixed a regression in Django 6.0 where alogin() and alogout() did not
respectively set or clear request.user if it had already been
materialized (e.g., by sync middleware) (#37017).
* Fixed a regression in Django 6.0 in admin forms where
RelatedFieldWidgetWrapper incorrectly wrapped all widgets in a
<fieldset> (#36949).
* Fixed a bug in Django 6.0 where the fields.E348 system check did not
detect name clashes between model managers and related_names for
non-self-referential relationships (#36973).
Release Notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.4/
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For change log, see:
https://logging.apache.org/log4cxx/1.7.0/changelog.html
This fixes the following vulnerability:
- CVE-2026-40023:
Apache Log4cxx's XMLLayout
https://logging.apache.org/log4cxx/1.7.0/classlog4cxx_1_1xml_1_1XMLLayout.html,
in versions before 1.7.0, fails to sanitize characters forbidden
by the XML 1.0 specification https://www.w3.org/TR/xml/#charsets
in log messages, NDC, and MDC property keys and values, producing
invalid XML output. Conforming XML parsers must reject such
documents with a fatal error, which may cause downstream log
processing systems to drop or fail to index affected records.
An attacker who can influence logged data can exploit this
to suppress individual log records, impairing audit trails and
detection of malicious activity. Users are advised to upgrade to
Apache Log4cxx 1.7.0, which fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-40023
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Julien: add link to change log in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-transit-relay/blob/0.5.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of transitrelay,
the complete fix for the test_python_magic_wormhole runtime test
also requires the update of python-magic-wormhole-mailbox-server.
[1] 51365ff063
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
See NEWS:
https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/0.6.0/NEWS.md
The upstream source archive name changed (dash '-' changed to
underscore '_'). This commit updates _SOURCE to reflect that change.
This commit also updates _SITE to use a stable URL which will redirect
to the package archive, to reduce future maintenance.
This package has been broken at runtime since Buildroot commit [1]
"package/python-setuptools: bump to version 82.0.0", which removed
the python module 'pkg_resources' which was deprecated. This new
version removes those usage and fixes this issue. Setupuptools is still
erroneously listed as a dependency in the upstream setup.py[2] but is not
actually used anymore at runtime.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13904071794
Note: this commit fixes only the runtime invocation of
wormhole-mailbox, the complete fix for the test_python_magic_wormhole
runtime test also requires the update of
python-magic-wormhole-transit-relay.
[1] 51365ff063
[2] https://github.com/magic-wormhole/magic-wormhole-mailbox-server/blob/0.6.0/setup.py#L37
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Marcus: remove python-setuptools select from Config.in]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Remove the Old stable row, it is now thoroughly EOL.
Also remove the commented-out Candidate row. This update was done with
a (draft) script [1], and the script gets confused by the commented-out
row. The script is able to generate the row for a -rc1 release, so
there is no need for the commented-out row.
[1] https://gitlab.com/buildroot.org/buildroot-lts-tools/-/blob/main/tools/prepare-release?ref_type=heads
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Now that all Xilinx boards have been bumped to Linux 6.12.70, remove the hash
for the xlnx_rebase_v6.12_LTS_merge_6.12.60 release tag.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the versal2 defconfigs to Linux 6.12.70.
Run tested on a versal2 vek385 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the versal defconfigs to Linux 6.12.70.
Run tested on a versal vek280 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the zynqmp defconfigs to Linux 6.12.70.
Run tested on a zynqmp zcu102 evaluation board.
Run tested on a kria kv260 evaluation board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump the zynq defconfigs to Linux 6.12.70.
Run-tested on a ZC702 Evaluation Board.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/OpenSC/libp11/blob/libp11-0.4.18/NEWS
Removed all patches which are included in this release.
Switched to sha256 tarball hash provided by upstream.
Apply the fix for enginesdir to the newly introduced configure option
--with-modulesdir, added in version 0.4.14, as well:
8ff7952a81
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
libftdi1's commit 2a992306c0acf938b29fa0cd5fbc160e24424209 introduced
support for independent static/shared library building. But the proper
building of the ftid_eeprom tool was introduced later in commit
eaf42c00bfab5d6bbd8106b11a697ff4f2d7659f. So let's update to the latest
commit that also includes other fixes:
92d657bcb543a9622947d984d4a8e725fb680e8c ChangeLog: Add license clarifications
06fa7fa342a6976a3745894b46babfa5fde841f7 ftdipp: Add wrapper for ftdi_set_module_detach_mode()
120c3495ba82ae9c35a7518248b2e45dfbc36ea7 Merge branch 'prepare-release'
c4b7675a43dcd8fa7c1c42708d5665a2a02e86e4 Set version number to 1.6rc1
c0c8c923829e1c391d7ca951e12b50092d6435f1 Prepare changelog for 1.6rc1
9341a7e8efc07c213c872ced62fc03c03a270b44 Increase copyright year to 2026
f9301536f4004d42cec4dd36f2505679459aae4e Update AUTHORS with contributors since v1.5
ed9d31e41a6ec695fd610e4d718ccc8bb6aefa4b Merge branch 'clarify-license'
84497180578f481758042c73eee9ec0eb60bace3 COPYING.LIB: Update to LGPL v2.1
4ec5bc584c27c333f74eca524de5a0839c983935 LICENSE: Clarify the main ftdi lib is LGPL v2.1 only
61ad454af3e0a886a665659b73729872cfb564a0 LICENSE: Clarify ftdi_eeprom is GPL v2 only
630a27f240fd784c7c3f5d75e7c880eca3a66cf8 Replace tabs in fall-through comments
4f600d690ee0dcbecef4b02edb5700fe84c4a9b3 Modernize Boost detection for CMake 3.30+
f7ed9dd371f9387ed5b715a4f316eea9f85de48d python/CMakeLists.txt: rework Python development files detection
eaf42c00bfab5d6bbd8106b11a697ff4f2d7659f ftdi_eeprom: fix static build
f554d7cd432d3056b1ca62bf09cc4003bf307912 Ignore JetBrains IDE files
019f48462836c9f3a0a1f113a351395ddcf99640 CMake: auto-format all CMake files
Licence files changed due to copyright year change as also some licence
clarifications described in patches:
84497180578f481758042c73eee9ec0eb60bace3
4ec5bc584c27c333f74eca524de5a0839c983935
61ad454af3e0a886a665659b73729872cfb564a0
Fixes:
https://autobuild.buildroot.org/results/8e1299b9ce28df2a848310c5bfb968f59cd8794c/
Signed-off-by: Julien Olivain <ju.o@free.fr>
This version adds support for the wlr-foreign-toplevel-management and
drm-lease-v1 protocols; switches the wlroots dependency to 0.20.0; and
includes a few fixes. Release notes:
https://github.com/cage-kiosk/cage/releases/tag/v0.3.0
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Security fixes:
CVE-2026-27456 - mount(8) TOCTOU symlink attack via loop device.
The SUID mount follows symlinks when resolving loop backing file
paths. On systems where non-root users are permitted to mount loop
devices (via 'user' option in fstab), this allows access to
arbitrary files.
CWE-190 - Integer overflow in libblkid parse_dos_extended().
A crafted MBR disk image can cause uint32_t wraparound in EBR
chain processing, causing reported partitions to not match the
on-disk layout. Tools like udisks may then register a partition
at logical sector 0.
Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.4-ReleaseNotes
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit [1] "package/fakeroot: bump to version 1.37.2" introduced an
incorrect hash file format. The command "make check-package" reports
the error:
package/fakeroot/fakeroot.hash:2: expected three fields (https://nightly.buildroot.org/#adding-packages-hash)
This commit fixes that.
[1] a4f2419164
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerabilities:
- CVE-2026-29111 (fixed in 258.5):
systemd, a system and service manager, (as PID 1) hits an assert and
freezes execution when an unprivileged IPC API call is made with
spurious data. On version v249 and older the effect is not an assert,
but stack overwriting, with the attacker controlled content. From
version v250 and newer this is not possible as the safety check causes
an assert instead. This IPC call was added in v239, so versions older
than that are not affected. Versions 260-rc1, 259.2, 258.5, and 257.11
contain patches. No known workarounds are available.
https://www.cve.org/CVERecord?id=CVE-2026-29111
- CVE-2026-40226 (fixed in 258.6):
In nspawn in systemd 233 through 259 before 260, an escape-to-host
action can occur via a crafted optional config file.
https://www.cve.org/CVERecord?id=CVE-2026-40226https://github.com/systemd/systemd/security/advisories/GHSA-9mj4-rrc3-gjcx
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
[Marcus: note which minor versions included the respective security fixes]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
See NEWS:
https://codeberg.org/ivarch/pv/src/tag/v1.10.5/docs/NEWS.md
Changes in 1.10.5:
- Fix --bits option rate calculation and --gauge compatibility
- Security: ignore TMP/TMPDIR, improve memory safety
- Fix terminal state garbling on exit with --cursor
- Improve ETA calculation across suspend/resume
- Better --watchfd and --line-mode handling
- Address issues found by security audit tools
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
- move DEVELOPER entry in a separate commit
- add link to NEWS in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The host-mkpasswd package needs the <crypt.h> header file installed
on the host. This file was initially provided by the libc headers,
as part of its libcrypt implementation. libcrypt was removed in
glibc 2.39. Most Linux distributions continued to ship a libcrypt
replacement such as libxcrypt in their default installation.
Some mainstream Linux distribution (such as Debian testing) are
now starting to remove this libcrypt and <crypt.h> header from their
default image (of development files).
In that case, host-mkpasswd is failing to build with the error:
/buildroot/output/build/host-mkpasswd/mkpasswd.c:54:10: fatal error: crypt.h: No such file or directory
The issue can be reproduced by adapting the Buildroot Docker file,
by setting "FROM debian:testing-20260316" in [1] and removing
the build of tar.
Note: debian 13 (for example Docker tag trixie-20260316) still
includes the libcrypt-dev package by default, which provides crypt.h.
In Buildroot, there is already the host-heimdal and host-systemd
packages requiring host-libxcrypt. Also, the host-libxcrypt is a
small standalone package. For those reasons, instead of adding
the Buildroot prerequisite on the user host to provide a libcrypt
implementation, this commit simply add the package dependency to
host-libxcrypt, to make sure it will work in all situations.
[1] https://gitlab.com/buildroot.org/buildroot/-/blob/2026.02/support/docker/Dockerfile#L11
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
https://github.com/libexif/libexif/blob/v0.6.26/NEWS
* Security issues fixed:
* CVE-2026-40386: An unsigned integer underflow in Fuji and Olympus
makernote handling
* CVE-2026-40385: An unsigned integer overflow on 32bit systems in
Nikon makernote handling
* CVE-2026-32775: A buffer overwrite via integer underflow in makernote
handling
Switched to xz tarball and tarball hash provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The old u-boot version doesn't build anymore because of the following
error:
ModuleNotFoundError: No module named 'pkg_resources'
Bump it to the latest version 2026.04. While at it, also bump linux to
the latest LTS kernel (6.18). The new kernel grew in size, thus we also
have to enlarge the rootfs image.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/13858936681
Signed-off-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The bat 0.26.0 already depends on a newer version of the onig_sys crate,
so the problem that patch is fixing was no already no longer present.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See release announce:
2.3.1: https://lists.infradead.org/pipermail/linux-mtd/2026-April/113302.html
2.3.0: https://lists.infradead.org/pipermail/linux-mtd/2025-February/108248.html
Version 2.3.0 added the fsck.ubifs utility, so support it with
the new Kconfig option BR2_PACKAGE_MTD_FSCKUBIFS.
The new version also needs host-pkgconfig, as can be seen from the error
triggered during build tests:
checking pkg-config is at least version 0.9.0... ./configure: line 5613: buildroot/test-output/TestMtd/host/bin/pkg-config: No such file or directory
no
configure: error: pkg-config not found
make[1]: *** [package/pkg-generic.mk:263: buildroot/test-output/TestMtd/build/mtd-2.3.1/.stamp_configured] Error 1
Changelog: https://git.infradead.org/?p=mtd-utils.git;a=blob;f=CHANGELOG.md
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[Julien:
- add link to announce in commit log
- split long host dependency line
- reorder host dependencies alphabetically
- fix MTD_INSTALL_DEPENDENCIES to MTD_DEPENDENCIES
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Calian provides a diverse set of mission-critical solutions to solve
complex challenges for customers in defence, space, health and other
critical infrastructure industries.
We thanks them for contributing to the LTS maintenance as a bronze
sponsor.
[1] https://www.calian.com/
[2] https://www.linkedin.com/company/calian/
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Using this defconfig
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_STRONGSWAN=y
BR2_PACKAGE_STRONGSWAN_WOLFSSL=y
applied after 'git reset 10a70b1af6 --hard'
replicates the build error
http://autobuild.buildroot.net/results/278b3f74c48c858ae368d59069752adb69c05246
which was fixed in 2024 by
89d512729c
Note: The git tree was reset to the commit right before the fix.
Instead of using the fix mentioned above the build error is also fixed
when the buildroot commit 6c18375434 is
cherry-picked onto 10a70b1af6.
This means the build error mentioned above is really fixed by enabling
BR2_PACKAGE_WOLFSSL_ALL. Therefore we can remove the content of commit
89d512729c.
This commit also prevents a build error in strongswan
wolfssl_rsa_private_key.c: In function 'create_empty':
wolfssl_rsa_private_key.c:450:18: error: 'RsaKey' has no member named 'rng'
450 | this->rsa.rng = &this->rng;
caused by the upcoming bump of wolfSSL from 5.7.2 to 5.9.1 due to
upstream commit
cd88a8ae88
which was first included in wolfSSL 5.9.0.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update tinycbor to the latest version. This release migrates from a
hand-written Makefile to CMake, which required a number of patches to
restore parity with the old system:
- Fix building on toolchains without C++ support
- Keep installing the json2cbor command line tool
Also building on GCC versions older than 11 was fixed and subsequently
broken again, so this requires a refreshed version of the patch that was
already present for 0.6.1.
Changelog: https://github.com/intel/tinycbor/releases/tag/v7.0
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Quoting https://www.pcre.org/
"The older, but still widely deployed PCRE library, originally released
in 1997, is at version 8.45. This version of PCRE is now at end of
life, and is no longer being actively maintained. Version 8.45 is
expected to be the final release of the older PCRE library, and new
projects should use PCRE2 instead. [...]"
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://bbs.archlinux.org/viewtopic.php?pid=2129384#p2129384
Patches 0003 and 0004 add upstream commits to support pcre2.
Patch 0002 is a prerequisite for patch 0003 to apply cleanly to
Src/Modules/pcre.c.
Renamed ac_cv_prog_ variable due to changes in patch 0004.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream added additional and optional support for pcre2 in version
3.2.0:
6cf2fba94a
which was added to buildroot in 2021 with commit
5084994d3f.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Added patch 0006 which replaces the usage of pcre in favour of pcre2,
this is a rebased version of upstream commits used by OpenWRT:
75acd1cdc2
Added patch 0005 which is a prerequisite for patch 0006, also used by
OpenWRT.
Added patch 0007 which fixes a runtime crash caused by patch 0006.
Added Upstream: tag to patch 0001.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream added support for pcre2 with commit
430ed115ca
with version 3.2.8 which was added to buildroot with commit
747fed73f9.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Added two upstream commits to support pcre2 and switch the package from
pcre to pcre2.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Added two patches backported from the upstream branch c_icap_0_6_x which
were backported by Debian to the 0.5.x branch.
Build-tested using this defconfig:
BR2_PACKAGE_PCRE2=y
BR2_PACKAGE_C_ICAP=y
BR2_PACKAGE_C_ICAP_MODULES=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: FAILED
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: SKIPPED
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: SKIPPED
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: OK
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: OK
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: FAILED
br-arm-full-nothread [31/32]: SKIPPED
br-arm-full-static [32/32]: SKIPPED
32 builds, 4 skipped, 2 build failed, 0 legal-info failed, 0 show-info failed
The two build errors are unrelated to this patch, they are caused by
patch 0005-Fix-module-operation-prototypes-to-fix-GCC-15.x-buil.patch
which breaks the build with gcc <= 9.x:
http_auth.c: In function ‘basic_close’:
http_auth.c:412:25: error: parameter name omitted
void basic_close(struct ci_server_conf *)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/shadowsocks/shadowsocks-libev/releases/tag/v3.3.6
Upstream tarball does not contain submodules so we need to download the
git repo ourselves. Please note that these submodules cannot be provided
as system libraries:
6423c8e496
"These are vendored code built from git submodules, not system
libraries, [...]"
Removed all patches, they were either autoconf-related or are included
in this release.
Added patch to fix build with toolchains without c++.
Switched build system to cmake due to upstream removal of autoconf and
switched to pcre2 instead of pcre:
7bb250739e
The cmake build system always builds dynamic libraries:
https://github.com/shadowsocks/shadowsocks-libev/blob/v3.3.6/src/CMakeLists.txt#L252
so we added a dependency to !BR2_STATIC_LIBS and -DWITH_STATIC=OFF as
configure option.
Please note that this bump will not fix the build errors introduced by
the bump of glibc to version 2.43:
https://github.com/shadowsocks/shadowsocks-libev/issues/3032
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Updating the hash of the WHENCE file, due to firmware additions and
firmware changes, but no changes to the redistribution/licensing
conditions.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add three upstream patches to fix build with the upcoming bump of the
linux kernel to 7.0.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- updates the Kernel from LTS 6.6.14 to 6.18.16
- updates U-Boot from 2024.01 to 2026.04
- switches to Bootlin external glibc stable toolchain
- enable BR2_DOWNLOAD_FORCE_CHECK_HASHES=y, add custom hashes stored
in BR2_GLOBAL_PATCH_DIR="board/ti/am574x-idk/patches" and removes
the exception entry in .checkpackageignore.
- enable BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y to install the board
devicetree in the boot (vfat) partition keeping the directory
prefixes (ti/omap/am574x-idk.dtb). u-boot nowadays is looking for
boards devicetree using such directory prefixes [1].
Update genimange.cfg file accordingly.
- While at it, add a label to the boot (vfat) partition to not use a
generated label.
- set BR2_TARGET_ROOTFS_EXT2_SIZE="256M" since the rootfs no longer
fit in the default size (60M).
- Remove the rootfs partition predefined 1G size to avoid a parted
warning about "unallocated space within the partition."
- Update extlinux.conf kernel command line to use "console=ttyS2"
instead of "ttyS0". Seems a typo introduced with the defconfig
(AM57xx always used ttyS2 as kernel console).
[1] 649f4a7d3c
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Julien: add BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bug fixes:
- fix buffer over-read bugs when translating uAPI structs to library types
- fix variable and argument types where necessary
- sanitize values returned by the kernel to avoid potential buffer overflows
- fix memory leaks in gpio-tools
- add missing return value checks in gpio-tools
- fix period parsing in gpio-tools
- use correct loop counter in error path in gpio-manager
Improvements:
- make tests work with newer coreutils by removing cases checking tools'
behavior on SIGINT which stopped working due to changes in behavior of the
timeout tool
See: https://git.kernel.org/pub/scm/libs/libgpiod/libgpiod.git/tree/NEWS?h=v2.2.4
Note: this commit is marked as "security" update because it contains
security related bugfixes, but no CVE or advisory are published at
the time of this commit.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: add note in the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.21 and U-Boot to
version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.80 and U-Boot to
version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.80 and U-Boot to
version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release notes since edk2-stable202511, see:
https://github.com/tianocore/edk2/releases/tag/edk2-stable202602
This commit also updates the edk2-platforms packages with the last
commit merged at the edk2 release date (2026-02-13), which corresponds
to commit [1].
The edk2-non-osi package is not updated because it did not received
any commit since the last edk2 bump.
The commit removes the package patch 0001 which is included in
this new version. It also adds a new patch to fix parallel build
failures with a large number (>16) of processors. See:
https://github.com/tianocore/edk2/pull/12199
This commit has been runtime tested with tests using EDK2 package,
with commands:
support/testing/run-tests \
-d dl -o output_folder \
tests.boot.test_edk2 \
tests.boot.test_grub.TestGrubAArch64EFI \
tests.boot.test_grub.TestGrubRiscV64EFI \
tests.boot.test_grub.TestGrubX8664EFI \
tests.package.test_fwts
It has also been runtime tested (by booting in qemu) with defconfigs
using EDK2 package:
qemu_aarch64_sbsa_defconfig
qemu_loongarch64_virt_efi_defconfig
qemu_riscv64_virt_efi_defconfig
qemu_x86_64_efi_defconfig
[1] 23625e8124
Cc: Dick Olsson <hi@senzilla.io>
Cc: Romain Naour <romain.naour@smile.fr>
Cc: Vincent Stehlé <vincent.stehle@arm.com>
Tested-by: Julien Olivain <ju.o@free.fr>
Tested-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
OpenDoas: a portable version of OpenBSD's doas command.
doas is a minimal replacement for the venerable sudo.
https://github.com/Duncaen/OpenDoas
Signed-off-by: Francois Perrad <francois.perrad@gadz.org>
[Julien:
- add package description in commit log
- add comments justifying the generic-package infra
- add missing dependency on host-bison
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
go1.26.2 (released 2026-04-07) includes security fixes to the go command, the
compiler, and the archive/tar, crypto/tls, crypto/x509, html/template, and os
packages, as well as bug fixes to the go command, the go fix command, the
compiler, the linker, the runtime, and the net, net/http, and net/url packages.
CVE-2026-32289: html/template: JS template literal context incorrectly tracked
CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains
CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking
CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination
CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map
CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock
CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG
CVE-2026-32280: crypto/x509: unexpected work during chain building
CVE-2026-32281: crypto/x509: inefficient policy validation
https://go.dev/doc/devel/release#go1.26.2https://github.com/golang/go/issues?q=milestone%3AGo1.26.2+label%3ACherryPickApproved
Signed-off-by: Christian Stewart <christian@aperture.us>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
See the release notes:
https://github.com/redis/redis/blob/8.4.2/00-RELEASENOTES
================================================================================
Redis 8.4.2 Released Mon 23 Feb 2026 10:00:00 IST
================================================================================
SECURITY: There is a security fix in the release
- A user can manipulate data read by a connection by injecting \r\n sequences
into a Redis error reply
================================================================================
Redis 8.4.1 Released Sun 8 Feb 2026 9:00:00 IST
================================================================================
Update urgency: `SECURITY`: There are security fixes in the release.
- #T1837, #J1474 Hide Personally Identifiable Information from server log
- #P936 Cuckoo filter: crash on RDB load on 0 buckets (MOD-11593)
- #P945 Bloom filter: crash on RDB load on large number of filters (MOD-11590)
(And a whole lot of other bugfixes)
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.202 and U-Boot to
version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.202 and U-Boot to
version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.202 and, for the SD
configuration, also updates U-Boot to version 2026.04.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.1.167. The size of
xipImage has increased by only 10 bytes (1673635 bytes compared to
1673625 in version 6.1.159).
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://openssl-library.org/post/2026-04-07-release-announcement/
Fixes the following vulnerabilities:
CVE-2026-31790 - Incorrect Failure Handling in RSA KEM RSASVE Encapsulation.
CVE-2026-28386 - Out-of-bounds Read in AES-CFB-128 on X86-64 with AVX-512 Support.
CVE-2026-28387 - Potential Use-after-free in DANE Client Code.
CVE-2026-28388 - NULL Pointer Dereference When Processing a Delta CRL.
CVE-2026-28389 - Possible NULL Dereference When Processing CMS KeyAgreeRecipientInfo.
CVE-2026-28390 - Possible NULL Dereference When Processing CMS KeyTransportRecipientInfo.
CVE-2026-31789 - Heap Buffer Overflow in Hexadecimal Conversion.
Removed patch 0004 which is included in this release, merged in:
7936b4c415
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.21 and U-Boot to
version 2026.04.
Tested on beaglebone black.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This patch bumps:
- U-Boot to version v2026.04
- Linux kernel to version 6.12.80 (LTS)
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Snort is not maintained for a while now and blocks the removal of the
pcre(v1) package so we remove it from buildroot.
Point to snort3 as an alternative.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Cc: Sergio Prado <sergio.prado@e-labworks.com>
Cc: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Those target configurations marked as "secondary" will be tested with a
lower probability in autobuilders. The intent is to focus the Buildroot
development (and bugfixes) on mainstream configurations, while still
keeping some other, less common, configurations.
This commit marks the following CPU architectures as secondary:
BR2_arcle (ARC little endian)
BR2_armeb (ARM big endian)
BR2_aarch64_be (AArch64 big endian)
BR2_hppa (PA-RISC)
BR2_loongarch64
BR2_m68k
BR2_microblazeel (Microblaze AXI, little endian)
BR2_microblazebe (Microblaze non-AXI, big endian)
BR2_mips (MIPS, big endian)
BR2_mipsel (MIPS, little endian)
BR2_mips64 (MIPS64 big endian)
BR2_or1k (OpenRISC)
BR2_powerpc (PowerPC, big endian)
BR2_powerpc64 (PowerPC64, big endian)
BR2_s390x
BR2_sh (SuperH)
BR2_sparc
BR2_sparc64
BR2_xtensa
In the following CPU architecture, only specific configurations are
marked secondary:
In BR2_armeb (ARM little endian),
- armv4 cores (arm920t, arm922t, fa526/626, strongarm sa110/sa1100)
In BR2_riscv:
- all 32-bit configurations
- 64-bit no-MMU
In BR2_i386 (x86 32-bit),
- i486, i586 and X1000 CPU
There was no strict rule established to build this list of secondary
configurations. This list was built mainly from the observation of
which architecture/CPUs are still widely used in the field
(disregarding its age), the quality of their upstream support and
the general relevance in the Buildroot project.
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: use !BR2_HIDE_SECONDARY_TARGET_OPTIONS instead of
BR2_SHOW_SECONDARY_TARGET_OPTIONS]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The option is currently unused, which leads to a check-symbol warning.
Suggested-by: Arnout Vandecappelle <arnout@rnout.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
[Arnout: squash two patches]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The patch bumps the Linux kernel to version 6.12.80 and U-Boot to
version 2026.04 for
- stm32mp135f_dk_defconfig
- stm32mp157a_dk1_defconfig
- stm32mp157c_dk2_defconfig
The removed patches are contained in the new U-Boot version.
Tested on STM32MP157C-DK2 Discovery Board.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Suricata 6.x is EOL since August 1st, 2024:
https://forum.suricata.io/t/suricata-6-is-now-end-of-life-eol/4790
Version 6.0.20, used by buildroot, was the last release on the 6.x
branch. We bump to the newest available release, a backport to the LTS
branches should be considered.
The last common release of 6.0.20 with a 7.x version was with version
7.0.6 which fixed several CVEs in both versions back then:
https://forum.suricata.io/t/suricata-7-0-6-and-6-0-20-released/4728
New release notes following EOL of 6.x:
7.0.7: https://forum.suricata.io/t/suricata-7-0-7-released/4877
Contains these security fixes:
CVE-2024-45797: CRITICAL
CVE-2024-47187: CRITICAL
CVE-2024-47188: CRITICAL
CVE-2024-47522: HIGH
CVE-2024-45795: HIGH
CVE-2024-45796: HIGH
7.0.8: https://forum.suricata.io/t/suricata-7-0-8-released/5137
Contains these security fixes:
CVE-2024-55627: CRITICAL
CVE-2024-55605: CRITICAL
CVE-2024-55629: HIGH
CVE-2024-55628: HIGH
CVE-2024-55626: LOW
7.0.9: https://forum.suricata.io/t/suricata-7-0-9-released/5495
Contains these security fixes:
CVE-2025-29915: HIGH
CVE-2025-29917: HIGH
CVE-2025-29918: HIGH
CVE-2025-29916: Moderate
7.0.10: https://forum.suricata.io/t/suricata-7-0-10-released/5522
Contains no security fixes.
7.0.11: https://forum.suricata.io/t/suricata-7-0-11-released/5851
Contains these security fixes:
CVE-2025-53537: HIGH
CVE-2025-53538: HIGH
8.0 (released together with 7.0.11):
https://forum.suricata.io/t/suricata-8-0-0-released/5854
8.0.1: https://forum.suricata.io/t/suricata-8-0-1-and-7-0-12-released/6018
Contains these security fixes:
CVE-2025-59147: HIGH (7.0.x and 8.0.x)
CVE-2025-59148: HIGH (8.0.x only)
CVE-2025-59149: MODERATE (8.0.x only)
CVE-2025-59150: HIGH (8.0.x only)
8.0.2: https://forum.suricata.io/t/suricata-8-0-2-and-7-0-13-released/6100
Contains these security fixes:
CVE-2025-64344: HIGH (7.0.x and 8.0.x)
CVE-2025-64333: HIGH (7.0.x and 8.0.x)
CVE-2025-64332: HIGH (7.0.x and 8.0.x)
CVE-2025-64331: HIGH (7.0.x and 8.0.x)
CVE-2025-64330: HIGH (7.0.x and 8.0.x)
CVE-2025-64335: HIGH (8.0.x only)
CVE-2025-64334: HIGH (8.0.x only)
8.0.3: https://forum.suricata.io/t/suricata-8-0-3-and-7-0-14-released/6161
Contains these security fixes:
CVE-2026-22260
CVE-2026-22263
CVE-2026-22258
CVE-2026-22259
CVE-2026-22261
CVE-2026-22262
CVE-2026-22264
8.0.4: https://forum.suricata.io/t/suricata-8-0-4-and-7-0-15-released/6218
Contains these security fixes:
CVE-2026-31935
CVE-2026-31934
CVE-2026-31931
CVE-2026-31933
CVE-2026-31932
CVE-2026-31937
Rebased patches.
Upstream switched from pcre to pcre2 in version 7.0.0:
bce3c46874
Updated project URL, the old URL is not reachable anymore.
Added a cargo variable to _MAKE_ENV to fix build error introduced by the
bump to 8.x:
https://lists.buildroot.org/pipermail/buildroot/2025-September/786602.html
"The library suricata-htp appeared in suricata 8."
error: linking with `cc` failed: exit status: 1
|
= note: LC_ALL="C" PATH="/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/bin:/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/bin:/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/bin:/home/adymov/build_fw/binaries/vpnfw/host/bin:/home/adymov/build_fw/binaries/vpnfw/host/sbin:/home/adymov/.local/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin" VSLANG="1033" "cc" "-Wl,--version-script=/tmp/rustcQjKpH4/list" "-Wl,--no-undefined-version" "-m64" "/tmp/rustcQjKpH4/symbols.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.00.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.01.rcgu.o" "/home/adymov/build_fw/binaries/vpnf
w/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.02.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.03.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.04.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.05.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.06.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.07.rcgu.o" "/home/adymov/build_fw/binaries
/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.08.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.09.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.10.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.11.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.12.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.13.rcgu.o" "/home/adymov/build_fw/bin
aries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.14.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.suricata_htp.26578ac6e8e15929-cgu.15.rcgu.o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/suricata_htp.9o2zvkk1iz7v62w1p151csbmg.rcgu.o" "-Wl,--as-needed" "-Wl,-Bstatic" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libflate2-c96dc52b792974fc.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libminiz_oxide-9a5e6c87bd0989fa.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libadler2-15e2a2214e20491a.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/targe
t/x86_64-unknown-linux-gnu/release/deps/liblibz_sys-b9befbb3035c2fca.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libcrc32fast-0a43d2846a4a9b36.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libcfg_if-360ab3241b788fcb.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/liblzma_rs-9f468070623da4fd.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libcrc-bf45046f4b8356ef.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libbyteorder-dfc24cad053c0b20.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/liblibc-ed317864a666eb97.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/targ
et/x86_64-unknown-linux-gnu/release/deps/libbase64-a4f094197250161c.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/liblazy_static-5ba27f73220e0e24.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libnom-4108c1713f94c8d7.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libbrotli-98d4b766d2a5f84b.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libbrotli_decompressor-59c8bf34b757d6b2.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/liballoc_stdlib-703a31eff75062d1.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/liballoc_no_stdlib-5d20fd5d2a496308.rlib" "/home/adymov/build_fw/binaries/vpnfw/bui
ld/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libtime-44b9873eb3882e39.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libitoa-416b9fe21b8f56dc.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libtime_core-eab4204f5d5ed516.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libnum_conv-f033d8bf2b8b56f6.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libderanged-bdda0d83f774c73b.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libpowerfmt-3c6a581bbf7aead2.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libbstr-346bfb9c2bf6a77a.rlib" "/home/adymov/build_fw/binaries/vpnfw/bui
ld/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libregex_automata-b93a7f9635e4dd42.rlib" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/release/deps/libmemchr-a87a7ebd56a50ef2.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libstd-22be60875a4ac8d7.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libpanic_unwind-4b832a03827ff95e.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libobject-a25e7f31e2204719.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libmemchr-1f1858edbb50ccb5.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libaddr2line-1319b75889377807.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libgimli-c9972d847170eb93.rlib" "/home/adymov/build_fw/bina
ries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/librustc_demangle-0868a75d0b80f801.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libstd_detect-f4254a923640cbea.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libhashbrown-f21de9b2e2c92770.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_alloc-cf868f78468d45dd.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libminiz_oxide-cce9a55233783113.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libadler-6ef1f692f91f321e.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libunwind-d2b4a3bc57672e2c.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libcfg_if-9d8e4e6f4cb45592.rlib" "/home/adymov/build_fw/binaries/vp
nfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/liblibc-858b7338441a56b6.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/liballoc-d182631d04e1eed2.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/librustc_std_workspace_core-7874c355ab5ed077.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libcore-46b25da62cc69443.rlib" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib/libcompiler_builtins-c71612932829263c.rlib" "-Wl,-Bdynamic" "-lz" "-lgcc_s" "-lutil" "-lrt" "-lpthread" "-lm" "-ldl" "-lc" "-Wl,--eh-frame-hdr" "-Wl,-z,noexecstack" "-L" "/home/adymov/build_fw/binaries/vpnfw/host/bin/../x86_64-tss-linux-gnu/sysroot/usr/lib" "-L" "/home/adymov/build_fw/binaries/vpnfw/host/lib64/rustlib/x86_64-unknown-linux-gnu/lib" "-o" "/home/adymov/build_fw/binaries/vpnfw/build/suricata-8.0.0/rust/target/x86_64-unknown-linux-gnu/relea
se/deps/libsuricata_htp.so" "-Wl,--gc-sections" "-shared" "-Wl,-z,relro,-z,now" "-Wl,-O1" "-nodefaultlibs"
= note: /usr/bin/ld: cannot find /lib64/libc.so.6: No such file or directory
collect2: error: ld returned 1 exit status
error: could not compile `suricata-htp` (lib) due to 1 previous error
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For change log, see:
https://github.com/sharkdp/hyperfine/blob/v1.20.0/CHANGELOG.md
Update hyperfine from 1.19.0 to 1.20.0.
This release adds the --reference-name option, extends
--ignore-failure to accept comma-separated exit codes, adds
improvements to the bundled Python scripts, and fixes command naming
with parameter scans.
Refresh the vendored cargo tarball hash for the new release.
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
- remove quote in commit title
- add link to changelog
- update DEVELOPERS file in a separate commit
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes a build error when pod2man is missing on the host:
pod2man ./tools/lsmac.pl >lsmac.1 || { rm -f lsmac.1 ; false ; }
/bin/sh: line 1: pod2man: command not found
Fixes:
https://autobuild.buildroot.net/results/999/9996e81429f90f4615755827ac182094d416c467/
Although the build error only occurs since 2026-03-05 it should be
backported to LTS branches because the last change to the buildroot
package dates back to 2024.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch 0001, included upstream:
b8b1e9751e
Removed patch 0002, included upstream:
0a51c8bc62
Removed patch 0003, included upstream:
c9ddace67b
Removed patch 0004 which was never sent upstream, also libnet still
provides libnet-config and causes no build errors. Porting this patch to
the modified configure.ac script does not create any benefits so we drop
this patch along with autoreconf.
Removed patch 0005, included upstream:
742424ddd7
Removed patch 0006, included upstream:
e97f8e9d4b1e340b1eb3
Wchar is needed since this commit was added to 1.48.1:
8107128098
Pcre2 is now required instead of pcre:
cfcf1e6e9c
Updated license hash due to upstream commit:
fc5db167de
Removed /pcap from configure option pcap-includes due to upstream commit
110fa39f8f
which now searches for pcap/pcap.h instead of pcap.h:
110fa39f8f (diff-49473dca262eeab3b4a43002adb08b4db31020d190caaad1594b47f1d5daa810R200-R303)
Added ac_cv_path_NGREP_PCRE2_CONFIG_SCRIPT to _CONF_ENV to avoid
/usr/bin/pcre2-config being found.
Added ac_cv_path_LIBNET_CONFIG_BIN to _CONF_ENV as follow-up to the
removal of patch 0004.
Build-tested using this defconfig:
BR2_PACKAGE_LIBNET=y
BR2_PACKAGE_NGREP=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: OK
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: OK
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: OK
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: OK
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: OK
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: SKIPPED
br-arm-full-nothread [31/32]: OK
br-arm-full-static [32/32]: OK
32 builds, 1 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 0645cb39e0 bumped the
package from 1.7 to 1.8.1.
Upstream included commit
f614f35e73
in version 1.8 to switch from pcre to pcre2 but the buildroot package
was not updated accordingly.
Pcre2 was already selected by pango -> libglib2 -> pcre2 so this bug was
never noticed.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Needed for the upcoming bump of sord from 0.16.12 to 0.16.22:
ec186c111b
Build-tested using this defconfig:
BR2_PACKAGE_ZIX=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: OK
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: OK
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: OK
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: OK
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: OK
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: OK
br-arm-full-nothread [31/32]: OK
br-arm-full-static [32/32]: OK
32 builds, 0 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 00317f0aff switched the
package from pcre to pcre2 but forgot update the Kconfig help text.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream allows to replace pcre with std::regex since version 2.0.0:
731bc83a98
We switch the package to the new code path to prepare for the removal
of the unmaintained pcre package.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The custom patch to enforce project as C project as been merged upstream
since then, but it is not released yet. This commit updates the patch to
apply it on top of 1.4.3, and use the opportunity to fix the patch file
name to match the commit title.
Since version 1.4.0, openscap depends on PCRE2 rather than PCRE.
https://github.com/OpenSCAP/openscap/releaseshttps://github.com/OpenSCAP/openscap/compare/1.3.12...1.4.3
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Julien: remove "select BR2_PACKAGE_PCRE_UTF"]
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release notes since 1.0.2, see:
https://github.com/embetrix/bmap-writer/releases/tag/1.0.4https://github.com/embetrix/bmap-writer/releases/tag/1.0.3
This version includes upstream fixes for static linking issues
related to libarchive. In previous versions, CMake's
FindLibArchive module did not propagate private dependencies,
leading to link-time errors (e.g. missing zlib, bzip2, lz4,
liblzma, zstd) in static build environments such as Buildroot.
The upstream build system has been updated to correctly handle
these dependencies, allowing us to drop the downstream patch.
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien: add links to release notes]
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://sourceforge.net/p/giflib/code/ci/6.1.2/tree/NEWS
Patch 0001 was removed because it is included in this release:
dd8b375e2a/
Patch 0002 is not needed anymore because upstream removed gif2rgb from
the list of installable make targets:
35dc68311a/
Updated license hash due to upstream commit
4a425b7348/
The CVEs mentioned in the release notes (CVE-2021-40633 &
CVE-2025-31344) are related to gif2rgb only.
Build-tested using this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_EFL=y
# BR2_PACKAGE_EFL_EEZE is not set
# BR2_PACKAGE_EFL_FONTCONFIG is not set
# BR2_PACKAGE_EFL_GSTREAMER1 is not set
# BR2_PACKAGE_EFL_LIBFRIBIDI is not set
# BR2_PACKAGE_EFL_ELPUT is not set
# BR2_PACKAGE_EFL_LIBSNDFILE is not set
# BR2_PACKAGE_EFL_PULSEAUDIO is not set
# BR2_PACKAGE_EFL_UTIL_LINUX_LIBMOUNT is not set
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_LUAJIT=y
BR2_PACKAGE_OPENJDK=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_IMLIB2=y
BR2_PACKAGE_IMLIB2_GIF=y
BR2_PACKAGE_LEPTONICA=y
BR2_PACKAGE_LIBGDIPLUS=y
BR2_PACKAGE_WEBP=y
BR2_PACKAGE_DLIB=y
BR2_PACKAGE_GDAL=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
These patches fix build errors which would be introduced by the upcoming
bump of giflib to 6.1.2.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
See the release notes of intermediate versions:
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.28.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.29.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.30.2
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.31.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.32.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.33.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.34.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.35.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.36.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.0
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.1
- https://github.com/yhirose/cpp-httplib/releases/tag/v0.37.2
This fixes numerous vulnerabilities:
- CVE-2026-21428:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.0, the ``write_headers``
function does not check for CR & LF characters in user supplied
headers, allowing untrusted header value to escape header lines. This
vulnerability allows attackers to add extra headers, modify request
body unexpectedly & trigger an SSRF attack. When combined with a
server that supports http1.1 pipelining (springboot, python twisted
etc), this can be used for server side request forgery (SSRF). Version
0.30.0 fixes this issue.
https://www.cve.org/CVERecord?id=CVE-2026-21428
- CVE-2026-22776:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.30.1, a Denial of Service (DoS)
vulnerability exists in cpp-httplib due to the unsafe handling of
compressed HTTP request bodies (Content-Encoding: gzip, br, etc.). The
library validates the payload_max_length against the compressed data
size received from the network, but does not limit the size of the
decompressed data stored in memory.
https://www.cve.org/CVERecord?id=CVE-2026-22776
- CVE-2026-28434:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a
C++ exception and the application has not registered a custom
exception handler via set_exception_handler(), the library catches the
exception and writes its message directly into the HTTP response as a
header named EXCEPTION_WHAT. This header is sent to whoever made the
request, with no authentication check and no special configuration
required to trigger it. The behavior is on by default. A developer who
does not know to opt in to set_exception_handler() will ship a server
that leaks internal exception messages to any client. This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28434
- CVE-2026-28435:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.35.0, cpp-httplib (httplib.h) does not
enforce Server::set_payload_max_length() on the decompressed request
body when using HandlerWithContentReader (streaming ContentReader)
with Content-Encoding: gzip (or other supported encodings). A small
compressed payload can expand beyond the configured payload limit and
be processed by the application, enabling a payload size limit bypass
and potential denial of service (CPU/memory exhaustion). This
vulnerability is fixed in 0.35.0.
https://www.cve.org/CVERecord?id=CVE-2026-28435
- CVE-2026-29076:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to version 0.37.0, cpp-httplib uses
std::regex (libstdc++) to parse RFC 5987 encoded filename* values in
multipart Content-Disposition headers. The regex engine in libstdc++
implements backtracking via deep recursion, consuming one stack frame
per input character. An attacker can send a single HTTP POST request
with a crafted filename* parameter that causes uncontrolled stack
growth, resulting in a stack overflow (SIGSEGV) that crashes the
server process. This issue has been patched in version 0.37.0.
https://www.cve.org/CVERecord?id=CVE-2026-29076
- CVE-2026-31870:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.1, when a cpp-httplib client uses
the streaming API (httplib::stream::Get, httplib::stream::Post, etc.),
the library calls std::stoull() directly on the Content-Length header
value received from the server with no input validation and no
exception handling. std::stoull throws std::invalid_argument for non-
numeric strings and std::out_of_range for values exceeding ULLONG_MAX.
Since nothing catches these exceptions, the C++ runtime calls
std::terminate(), which kills the process with SIGABRT. Any server the
client connects to — including servers reached via HTTP redirects,
third-party APIs, or man-in-the-middle positions can crash the client
application with a single HTTP response. No authentication is
required. No interaction from the end user is required. The crash is
deterministic and immediate. This vulnerability is fixed in 0.37.1.
https://www.cve.org/CVERecord?id=CVE-2026-31870
- CVE-2026-32627:
cpp-httplib is a C++11 single-file header-only cross platform
HTTP/HTTPS library. Prior to 0.37.2, when a cpp-httplib client is
configured with a proxy and set_follow_location(true), any HTTPS
redirect it follows will have TLS certificate and hostname
verification silently disabled on the new connection. The client will
accept any certificate presented by the redirect target — expired,
self-signed, or forged — without raising an error or notifying the
application. A network attacker in a position to return a redirect
response can fully intercept the follow-up HTTPS connection, including
any credentials or session tokens in flight. This vulnerability is
fixed in 0.37.2.
https://www.cve.org/CVERecord?id=CVE-2026-32627
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For changelog, see [1].
Also, kirk removed update the "--framework ltp" option in [1]
and "--sut host" in [2]. This commit updates the test_ltp_testsuite
runtime test to remove those options to reflect those changes.
[1] https://github.com/linux-test-project/ltp/releases/tag/20260130
[2] 818abbb90e
[3] d2761ce865
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
[Julien:
- add link to changelog
- update test_ltp_testsuite.py
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Require host-pkgconf only for libtirpc is not enough because libmnl
requires as well.
Upstream added it since 20200515 commit
553ca8ea3b ("net/route: Add netlink based route change tests")
using it in m4/ltp-libmnl.m4.
Later, in 20210524 in commit
6e17e2ba13 ("configure: Improve error message on missing pkg-config")
configure.ac required it explicitly:
m4_ifndef([PKG_CHECK_EXISTS],
[m4_fatal([must install pkg-config or pkgconfig and pkg.m4 macro (usual dependency), see INSTALL])])
This fixes error:
checking pkg-config is at least version 0.9.0... ./configure: line 7419: br-mips64r6-el-hf-glibc/host/bin/pkg-config: No such file or directory
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
sbctl intends to be a user-friendly secure boot key manager
capable of setting up secure boot, offer key management
capabilities, and keep track of files that needs to be
signed in the boot chain.
Signed-off-by: Hendrik De Vloed <hendrik.devloed@dekimo.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a basic runtime test for memcached. The test starts memcached and
checks if it responds to a basic set/get request.
Signed-off-by: Franciszek Stachura <fbstachura@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a basic runtime test for the python-gymnasium package.
This test verifies the fundamental operations of the library by:
- Importing `gymnasium`.
- Creating a "CartPole-v1" environment.
- Resetting the environment.
- Taking a random action step.
- Closing the environment.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien:
- sort DEVELOPERS entries alphabetically
- fix file name typo in DEVELOPERS
- remove selection of dependencies in test config
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a basic runtime test for the python-farama-notifications package.
This test verifies that the `farama_notifications` package can be
imported successfully and that a test notification can be stored
within its `notifications` dictionary-like object.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien:
- sort DEVELOPERS entries alphabetically
- remove underscore in test class name
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a basic runtime test for the python-cloudpickle package.
This test verifies the fundamental serialization capabilities of the
library by:
- Importing `cloudpickle`.
- Defining a simple Python function (fibonacci).
- Using `cloudpickle.dumps()` to serialize this function.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
[Julien: fix flake8 warnings to fix check-package errors]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add support for the python-gymnasium package, which provides a
standard API for reinforcement learning and a broad suite of
reference environments. Gymnasium is the maintained successor
to OpenAI Gym, developed by the Farama Foundation.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add support for the python-farama-notifications package,
which provides a unified notification mechanism for all
libraries maintained by the FaramaFoundation.
This package is used by Farama projects such as gymnasium
to deliver runtime and deprecation notifications in a
consistent way.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add support for the python-cloudpickle package, which provides
a Pickler class that extends the standard pickle.Pickler functionality.
This package is required as a dependency for gymnasium and other
machine learning or scientific computing libraries that require
advanced object serialization.
Signed-off-by: Xukai Wang <kingxukai@zohomail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The libnss_ato module is a set of C library extensions which allows to
map every nss request for unknown user to a single predefined user.
Signed-off-by: Vincent Jardin <vjardin@free.fr>
Signed-off-by: Vincent Cruz <mooz@blockos.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/fwupd/fwupd-efi/releases/tag/1.8
Added TARGET_LD to _MESON_EXTRA_BINARIES due to upstream commit
a7ac71e3b3
which causes a misdetection of the linker used.
Build log without specifying TARGET_LD:
Program ld.bfd found: YES (/usr/bin/ld.bfd)
[...]
/usr/bin/ld.bfd: cannot represent machine `aarch64'
Build log with specifying TARGET_LD:
Program ld.bfd found: YES
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issue:
CVE-2026-34155: Improper Signing of Plain Bundles Exceeding 2 GiB
RAUC bundles using the 'plain' format exceeding a payload size of 2 GiB
cause an integer overflow which results in a signature which covers only the
first few bytes of the payload. Given such a bundle with a legitimate
signature, an attacker can modify the part of the payload which is not
covered by the signature.
Bundles using the recommended 'verity' or 'crypt' formats are not affected.
For more details, see the advisory:
https://github.com/rauc/rauc/security/advisories/GHSA-6hj7-q844-m2hxhttps://github.com/rauc/rauc/releases/tag/v1.15.2
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This is an in-tree description of Buildroot's security policies
Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
To avoid having to move all the sponsors through the bootstrap 'row'
when adding a new "past sponsor" on top of the current stack, this
commit make the card rely on flexboxes instead of the bootstrap
internals.
This make sure that the body of the card always fit the row height and
the also make sure that the image always fit properly without having to
touch the inline css.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Clicking on the mailto tag will prefill the email with the following
content:
> Thanks for showing interest in the Buildroot LTS Sponsorship. We would
> appreciate if you could introduce yourself and your company by
> answering the following questions: in which products do you use
> Buildroot ? How are you using Buildroot ? How many different
> configurations do you have ? How long do you support your products ?
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Make the section header take the whole screen size for device with a
small screen (mobile phones).
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
We have received report from people about the section pointer that makes
them want to click on the "Sponsor Now !" section.
The original idea was to be able to link sub-section but let's make this
section is not clickable instead.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The edk2 package fails to build with gcc 15, with the following error:
EfiRom.c:78:17: error: assignment discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
Cherry-pick one patch from edk2-stable202602 to fix this.
This can be verified with the tests.boot.test_edk2 python tests.
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
[Julien: add "host" gcc 15 and glibc 2.43 in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Config.in selects libiconv in certain situations (uClibc with locales
not enabled). This may lead to a build error with utils/test-pkg -p mpd.
Add missing optional dependency and restore sorting order.
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The documentation feature was introduced with version 0.22, but is not
used. Instead two other options (also introduced with 0.22) control
building HTML manual and man pages. If the tools needed are not found,
the documentation build finishes silently.
Save Meson some effort by setting both options to 'false'.
Signed-off-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://github.com/gerbera/gerbera/blob/v3.2.0/ReleaseNotes.md
Removed patch which is included in this release.
Added optional dependency to libpqxx which needs to be built with CMake.
Added optional dependency to new libzippp package.
Added cxxopts as new dependency:
72f7655e86
Updated config.xml following a note from the release notes:
"xmlns was renamed to xml-ns for compliance reasons"
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The upcoming version bump of gerbera includes optional PostgreSQL
support using libpqxx which will only be detected if libpqxx was built
with CMake:
Quoting the error message with libpqxx being built with autoconf:
CMake Error at CMakeLists.txt:685 (find_package):
By not providing "Findlibpqxx.cmake" in CMAKE_MODULE_PATH this project has
asked CMake to find a package configuration file provided by "libpqxx", but
CMake did not find one.
Could not find a package configuration file provided by "libpqxx" with any
of the following names:
libpqxxConfig.cmake
libpqxx-config.cmake
Add the installation prefix of "libpqxx" to CMAKE_PREFIX_PATH or set
"libpqxx_DIR" to a directory containing one of the above files. If
"libpqxx" provides a separate development package or SDK, be sure it has
been installed.
usr/lib/pkgconfig/libpqxx.pc is still provided by the CMake build system.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This header-only library is needed for gerbera bump to 3.2.0.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package will be used as an optional dependency by the upcoming
gerbera bump.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since llama.cpp update in Buildroot commit [1], the test_aichat can
fail for several reasons:
The loop checking for the llama-server availability can fail if curl
succeed, but the returned json data is not formatted as expected.
This can happen if the server is ready but the model is not completely
loaded. In that case, the server returns:
{"error":{"message":"Loading model","type":"unavailable_error","code":503}}
This commit ignore Python KeyError exceptions while doing the
server test, to avoid failing if this message is received.
Also, this new llama-server version introduced a prompt caching, which
uses too much memory. This commit completely disable this prompt
caching by adding "--cache-ram 0" in the llama-server options.
[1] 05c36d5d87
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes: https://github.com/ggml-org/llama.cpp/releases
Merge BR2_PACKAGE_LLAMA_CPP_SERVER into BR2_PACKAGE_LLAMA_CPP_TOOLS, as
both of these options must be enabled to build tools like llama-cli and
llama-server. See upstream commit [1].
Since the Buildroot option BR2_PACKAGE_LLAMA_CPP_SERVER is removed, this
commit also removes it from support/testing/tests/package/test_aichat.py
which was using it.
[1] a180ba78c7
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
[Julien:
- reindent options in .mk
- remove BR2_PACKAGE_LLAMA_CPP_SERVER in test_aichat.py
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
drm_info is a small utility to dump info about DRM devices.
Link: https://gitlab.freedesktop.org/emersion/drm_info
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Julien:
- sort selected packages in Config.in alphabetically
- remove comment for license in hash file
- move "v" from _VERSION to _SITE
- switch _SITE to use gitlab release archives and add _SOURCE
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fix a silent build issue with the host-bootgen package if host-flex is already
built. The host-flex package will install a version of the flexlexer.h header
file that is not compatible with the version embedded in bootgen.
While the build will still 'succeed', the binary will not be correct. This
can be seen by just running the binary that is built. By default, running
bootgen without any parameters should print the help menu, but if the wrong
version of flexlexer.h is used, it will print the following instead:
$ output/host/bin/bootgen
****** Bootgen v2025.1-Merged
**** Build date : Mar 18 2026-07:08:01
** Copyright 1986-2022 Xilinx, Inc. All Rights Reserved.
** Copyright 2022-2025 Advanced Micro Devices, Inc. All Rights Reserved.
ERROR: syntax error
-h
Add a patch to the bootgen package that corrects the issue.
Upstream: CR to AMD jira
Signed-off-by: Neal Frager <neal.frager@amd.com>
Tested-by: Steven J. Hill <steven.hill@collins.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Backport a patch from Xen 4.21 to fix the following build errors for Arm v7
with gcc-15:
xen-4.14.6/xen/include/asm/platforms/midway.h:1: error: header guard '__ASM_ARM_PLATFORMS_MIDWAY_H' followed by '#define' of a different macro [-Werror=header-guard]
xen-4.14.6/xen/include/asm/platforms/omap5.h:1: error: header guard '__ASM_ARM_PLATFORMS_OMAP5_H' followed by '#define' of a different macro [-Werror=header-guard]
Since the external 32b arm toolchain has been updated to a version based on
gcc-15, the tests.package.test_xen.TestXenArmv7 python test does not build
anymore.
Adding the patch repairs it.
Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13518318473
Fixes: 86d453a7dc ("toolchain/toolchain-external/toolchain-external-arm-arm: bump to 15.2.rel1")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Alistair Francis <alistair@alistair23.me>
Cc: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add myself to packages recently orphaned which I am going to continue.
Signed-off-by: Manuel Diener <manuel.diener@oss.othermo.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the imxrt1050-evk_defconfig (using U-Boot v2025.07 and
binman) fails to build with the following error [1]:
ModuleNotFoundError: No module named 'pkg_resources'
Update the defconfig to use a more recent U-Boot v2026.01, to fix the
build and at the same time bump Linux to version 6.18.18.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/13476922027
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: fix defconfig name in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- bumps the Linux kernel to 6.18.18
- bumps the U-Boot to 2026.01
- switches to a stable glibc Bootlin external toolchain
- enables force hashes check
- enlarge the rootfs size to 256M
The updated U-Boot should also fix the CI build of the board.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/13458392713
Run-tested on the board.
Signed-off-by: Dong Wang <wangdong115@foxmail.com>
[Julien:
- remove .checkpackageignore entry to fix check-package error
- move uboot.hash in its correct directory
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- bumps the Linux kernel to 6.18.18
- bumps the U-Boot to 2026.01
- switches to a stable glibc Bootlin external toolchain
The updated U-Boot should also fix the CI build of the board.
Fixes: https://gitlab.com/buildroot.org/buildroot/-/jobs/13458392712
Run-tested on the board.
Signed-off-by: Dong Wang <wangdong115@foxmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This feature was made optional in mesa3d 25.2.0 as it is deprecated,
however some packages still require it so lets add a new config
option that those packages can select until they no longer require
this feature.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Add 'source' attribute to each CVE in vulnerabilities node, including NVD
URL reference to enable proper import into Dependency-Track.
Dependency-Track's VEX importer requires the source attribute to
properly process vulnerability entries. Without it, vulnerabilities are
skipped during import with "does not have an ID and / or source" warnings.
Include the full NVD URL following the CycloneDX 1.6 documentation format:
https://nvd.nist.gov/vuln/detail/{CVE-ID}
Test Environment:
- Buildroot: 2025.02.11 (or master)
- Dependency-Track: v4.13.6
Test Results - BEFORE (without source attribute):
apiserver_1 | 2026-02-23 16:05:40,890 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #0 does not have an ID and / or source; Skipping it
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #1 does not have an ID and / or source; Skipping it
...
apiserver_1 | 2026-02-23 16:05:40,941 WARN [CycloneDXVexImporter] VEX vulnerability at position #19 does not have an ID and / or source; Skipping it
apiserver_1 | 2026-02-23 16:05:40,941 INFO [CycloneDXVexImporter] The uploaded VEX does not contain any applicable vulnerabilities; Skipping VEX import
Test Results - AFTER (with source):
apiserver_1 | 2026-02-23 16:17:13,492 INFO [VexUploadProcessingTask] Processing CycloneDX VEX uploaded to project: e43fe185-c0a3-4e3a-a908-667344a66a9c
apiserver_1 | 2026-02-23 16:17:14,054 INFO [VexUploadProcessingTask] Completed processing of CycloneDX VEX for project: e43fe185-c0a3-4e3a-a908-667344a66a9c
CVEs are correctly imported in Dependency-Track
Signed-off-by: Fabien Lehoussel <fabien.lehoussel@smile.fr>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The 2025.11.x series was dropped with the 2026.02 release, so
(temporarily) re-add it. It will be dropped again with the 2026.02.1
release.
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Following changes made it into the release:
Joris van Rantwijk (1):
Fix adjtimex() with TIME64
Waldemar Brodkorb (8):
sys/stat.h: remove _STAT_VER/_MKNOD_VER
fix gettid() declaration
add statx syscall wrapper
sparc: add optimize build support for leon3
sparc: sync with Linux kernel definition, fixes gdb compile
fix compile error on earlier Kernels predating statx
select: fix compilation failure with very old kernel
bump version for 1.0.57 release
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Julien Olivain <ju.o@free.fr>
uclibc 1.0.57 added a statx() syscall wrapper in upstream commit [1].
zfs fail to build with uclibc 1.0.57 (not yet in Buildroot), because:
1. uclibc <fcntl.h> internally includes <sys/stat.h>, and
2. a zfs test redefines a statx() wrapper with a slightly different
prototype.
In that case, zfs fails to compile with error:
tests/zfs-tests/cmd/statx.c:58:1: error: conflicting types for 'statx'; have 'int(int, const char *, int, unsigned int, void *)'
Issue has been reported upstream at [2].
This commit adds a package patch to fix that issue.
[1] d3a819aff2
[2] https://github.com/openzfs/zfs/pull/18316
Signed-off-by: Julien Olivain <ju.o@free.fr>
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the iot-gate-imx8_ebbr_defconfig (using U-Boot v2025.07 and
binman) fails to build with the following error [1]:
ModuleNotFoundError: No module named 'pkg_resources'
Update the defconfig to use a more recent U-Boot v2026.01, to fix the
build.
Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13476922237 [1]
Fixes: 51365ff063 ("package/python-setuptools: bump to version 82.0.0")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
[Julien: update custom uboot.hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Python setuptools has removed the obsolete pkg_resources python module in
v82.0.0. This module is used by the binman command in U-Boot until
v2025.10.
Since the python-setuptools package has been updated to v82.0.0 in
Buildroot, the python test tests.boot.test_atf.TestATFAllwinner (using
U-Boot v2023.10 and binman) fails to build with the following error [1]:
ModuleNotFoundError: No module named 'pkg_resources'
Update test_atf to use a more recent U-Boot v2026.01 (and add the
dependency on GNU TLS), to fix the build.
Link: https://gitlab.com/buildroot.org/buildroot/-/jobs/13500946337 [1]
Fixes: 51365ff063 ("package/python-setuptools: bump to version 82.0.0")
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: James Hilliard <james.hilliard1@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream removed the old license file
772c03afe1
and added a new one
5634c661b8
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: remove LICENSE.txt entry in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the ARM external toolchain to the latest 15.2.rel1
release from ARM.
This involves:
- Updating the version, site URL, and source filename in .mk
- Updating the SHA256 hash in .hash
- Updating the display name and GCC version dependency in Config.in
Verified by booting on a default Qemu configuration.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the ARM aarch64-be external toolchains to the latest 15.2.rel1
release from ARM.
This involves:
- Updating the version, site URL, and source filename in .mk
- Updating the SHA256 hash in .hash
- Updating the display name and GCC version dependency in Config.in
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien: add newline at end of file to fix check-package error]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Update the ARM aarch64 external toolchain to the latest 15.2.rel1
release from ARM.
This involves:
- Updating the version, site URL, and source filename in .mk
- Updating the SHA256 hash in .hash
- Updating the display name and GCC version dependency in Config.in
Verified by booting on a default Qemu configuration.
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The host mkfs.xfs is needed to create XFS root filesystems
in Buildroot.
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Remove incorrect $BINARIES_DIR reference from the symbolic link creation to
make a relative path and not an absolute path.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Reviewed-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Backport upstream patches to fix a silent crash in U-Boot on
STM32MP135F-DK.
Fixes:
799d184e89
Signed-off-by: Thomas Richard <thomas.richard@bootlin.com>
[Romain: add Fixes link]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Specifying a list of br2-external trees is poorly documented, and the
only example uses a colon to separate the br2-external paths.
Adding the support for colon-separated list is the biggest mistake that
was made when introducing support for multiple br2-external [0]. Indeed,
both space and colon can be used to separate entries in the list, and it
is also possible to mix the two. However, internally, the list is stored
as a space-separated list, and all the code will split on spaces.
Besides, all other lists in Buildroot are a space-separated:
BR2_ROOTFS_DEVICE_TABLE
BR2_ROOTFS_STATIC_DEVICE_TABLE
BR2_TARGET_TZ_ZONELIST
BR2_ROOTFS_USERS_TABLES
BR2_ROOTFS_OVERLAY
BR2_ROOTFS_PRE_BUILD_SCRIPT
BR2_ROOTFS_POST_BUILD_SCRIPT
BR2_ROOTFS_POST_FAKEROOT_SCRIPT
BR2_ROOTFS_POST_IMAGE_SCRIPT
...
So, using colons is odd.
The fact that BR2_EXTERNAL is passed on the command line rather than
being a Kconfig item is not a reason enough to justify that it be
colon-separated.
Change the documentation to only mention using a space-separated list.
Of course, for backward compatibility, we keep the code as-is to accept
a colon-separated list, but we just do not advertise it.
Note that keeping the split on colons means that colons are not accepted
in pathnames of br2-external trees; in practice, this is not a new
restriction, or one that could lift as usign colons in Makefiles are
problematic anyway.
[0] in 20cd497387 core: add support for multiple br2-external trees
Reported-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
Reported-by: Brandon Maier <Brandon.Maier@collins.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Cc: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Boring changes: either do what shellcheck suggested, or comment why we
don't want to fix the code.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The trap was initially introduced in c5fa9308ea (core/br2-external:
properly report unexpected errors), in 2017, to catch all unexpected
errors, back when a single file was generated, and errors emitted to
stderr.
Since commit d027cd75d0 (core: generate all br2-external files in
one go), in 2019 the single output file 'ofile' is no longer created,
as multiple output files were then introduced, while messages for
*expected errors* were redirected to a Makefile variable assignment
emitted on stdout, at which point the script just exits (in error);
expected failures only occur in do_validate().
Unexpected errors can only occur on failure to create, or write to,
output files, either '.br2-external.mk' in do_validate() or do_mk(),
or any of the kconfig fragments in do_kconfig(). Cause for failure to
create those can only be a no-space-left-on-device condition, as they
are created in a directory that was just created by the script earlier
in main(), and thus has the necessary mode; failure to create that
directory is now caught explicitly.
A trap on ERR is not called when the shell exits explicitly with a call
to 'exit', thus, only failures to create or write to output file would
be caught. In that case, we are better off not trying to write to those
files anyway: failure to create the file would already be reported by
the shell on stderr, while disk-full would not allow to store the output
anyway...
In any case, the script exits in error, which is going to be caught by
the caller, which will terminate.
So, drop the trap altogether.
As a side effect, that squelches a shellcheck error.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
That plugin can be used instead of the builtin support to persist the
mosquitto state across restarts.
Note that this plugin has a dependency, so we don't use the $(if)
one-liner.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Until version 2.0.x, support for using static password or ACL files, was
builtin to the broker. With version 2.1.x, two new plugins have been
introduced to replace the builtin support, which is now deprecated and
will get removed in the next version.
Add two new configuration options for those plugins.
We decided to do a single commit, rather than one per option, because
they are relatively tied together (ACL needs passwords, at least).
We also choose to make those options enabled by default, because the
traditional way to configure mosquitto is to use static files for
authentication and authorization, and the builtin support if now
deprecated in favour for the plugins.
The usual ifeq-else-endif conditional block is a bit verbose when just
setting an option ON or OFF, when no additional dependency is needed.
Instead, use the not-unusual $(if)-inline one-liner. For consistency,
switch the existing dynamic-security plugin to use that one-liner too.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The mosquitto broker (not the library) can have listeners configured to
serve HTTP requests; it can optionally accept (some) HTTP API requests
on such listeners.
Add a new option to enable the availability of http_pi.
Note that we do not just depend on libmicrohttpd to be enabled, because
the HTTP API is a security boundary, and enabling it must be an explicit
decision.
Co-developped-by: Titouan Christophe <titouan.christophe@mind.be>
[yann.morin@orange.com: make it an explicit option]
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Mosquitto 2.1.x adds the possibility to use a builtin websocket
implementation, as an alternative to using libwebsockets.
When using libwebsockets as the implementation, only the broker supports
websockets, and CLI tools do not; only when using the builtin one are
websockets usable with CLI tools (and the broker, of course).
Add a choice to select what type of websockets support to enable, if
any. Since the builtin implementation is still new, we keep the
libwebsockets one available.
Since this inverts the dependency logic to libwebsockets, we can't
provide a backward compatibility with existing (def)config files.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
mosquitto_{ctrl,db_dump,passwd,signal} can be handy to interact with
the mosquitto broker during development, but are usually unnecessary
on the target.
Add an option to enable or disable them. Make that new option enabled
by default when the broker is enabled, to keep backward compatibility
with previous (def)config files.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Fiona Klute <fiona.klute@gmx.de>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
mosquitto_pub/sub/rr can be handy to test a broker from the command
line, but they can get superfluous when only the broker is required
on the target.
Add an option to enable or disable them. Make that new option enabled
by default to keep backward compatibility with previous (def)config
files.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Version 2.1.x has introduced a cmake-based build, and upstream strongly
recomends using it over the legacy Makefiles, which will ultimately be
retired.
So we do the switch, which cause quite some noise in the .mk file, but
at the same time allows for a bit of cleanup in the build process, as we
can now use the cmake-package infra.
Mosquitto now wants to peek into the malloc() internals for memory
tracking, and that only works on systems with an MMU (uClibc-ng does not
expose it for noMMU builds, as it's part of its malloc-standard
implementation).
Static-only builds are broken, even when only building the library. This
seems beyond a simple repair, so just require shared libs now (since
we're requiring an MMU as well, requiring shared libs is not too much of
an additional burden).
cJSON is now a required dependency, used in common parts of the code
(not just for the plugins).
There are a few options that we forcibly disable; they'll get addressed
in followup patches.
There are still a few build failures that are difficult to account for
(except):
$ printf 'BR2_PACKAGE_MOSQUITTO=y\n' >mosq.cfg
$ ./utils/docker-run ./utils/test-pkg -d $(pwd)/run-tests -c mosq.cfg -p mosquitto
br-arm-full-static [5/6]: FAILED
=> old uClibc-ng, would need __GNU_SOURCE (with dunder) to define
getrandom(); no longer needed since uClibc-ng 1.0.50; would need
openssl otherwise
bootlin-aarch64-glibc-old [6/6]: FAILED
=> really old glibc, missing getrandom(); would need openssl
Drop our existing patches, they've either been applied upstream, or are
no longer needed. Add new patches to fix various build issues
(submission upstream pending the signature of the CLA..,).
Thanks a lot to Titouan for providing his initial work on the update!
Some of his findings ended up in this patch. 👍
Note: by lack of a trusted path back to the PGP key that signed the
archive, the comment was dropped, as checking a signature without a
trust-chain does not make much sense...
Co-developped-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
[Romain: remove "mosquitto broker" comment for static builds]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Updating the hash of the WHENCE file, due to firmware additions and
firmware changes, but no changes to the redistribution/licensing
conditions.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://curl.se/ch/8.19.0.htmlhttps://curl.se/docs/security.html
Fixes the following CVEs:
CVE-2026-3805: use after free in SMB connection reuse
CVE-2026-3784: wrong proxy connection reuse with credentials
CVE-2026-3783: token leak with redirect and netrc
CVE-2026-1965: bad reuse of HTTP Negotiate connection
Switch to sha256 tarball hash provided by upstream.
Updated license hash due to copyright year bump:
e83c82f05f
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add back pgp signature info in hash file]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Building Go 1.26 and later requires Go 1.24.6 or later for bootstrap.
To support this we use Go version 1.25.8 as the version for
go-bootstrap-stage5 and have the build for Go 1.26.1 depend on
go-bootstrap-stage5.
Go version 1.25.8 is the latest Go version we can build using
go-bootstrap-stage4.
The package build for go-bootstrap-stage5 is effectively identical to
go-bootstrap-stage4 with only the Go version and stage number changed.
Go 1.28 is expected to require a minor release of Go 1.26 for bootstrap.
Fixes the following security vulnerabilities:
- CVE-2026-25679: net/url: reject IPv6 literal not at start of host
- CVE-2026-27142: html/template: URLs in meta attribute actions not escaped
- CVE-2026-27137: crypto/x509: incorrect enforcement of email constraints
- CVE-2026-27138: crypto/x509: panic in name constraint checking: certificates
- CVE-2026-27139: os: FileInfo can escape from a Root
For full release notes, see:
https://go.dev/doc/devel/release#go1.26.0
Signed-off-by: Christian Stewart <christian@aperture.us>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit switches the aarch64_efi_defconfig to an external glibc
stable Bootlin toolchain, to follow recommendation from [1].
Since an external toolchain is used, the linux-headers.hash custom
hash file is no longer needed and is removed.
[1] https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- updates the Kernel from 6.10 to 6.18.16
- updates U-Boot from 2024.07 to 2026.01
- updates arm-trusted-firmware from v2.11 to v2.12 LTS
- switches to Bootlin external glibc stable toolchain
Replace OP-TEE TEE binary file tee-pager_v2.bin by tee-raw.bin using
the new option BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN.
Remove unsued linux-headers.hash since we now use a prebuilt toolchain.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Replace OP-TEE TEE binary file tee-pager_v2.bin by tee-raw.bin using
the new option BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN.
Remove unsued linux-headers.hash since we use a prebuilt toolchain.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
There was a previous attempt in commit [1] to bump the kernel to 6.18
but the SD card failed at boot. It seems the actual issue is related to
the "cheap" (or fake?) SD card with SD UHS SDR50 speed.
This offending SD card come from a lot recently purchased in order to
fix my “Too many boards, not enough SD cards” issue.
[1] 4abb8a98b2
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The commit [1] update arm-trusted-firmware to v2.12 LTS without
removing the custom file hash.
While at it, remove unused linux-headers.hash since we already use a
prebuilt toolchain.
[1] 4abb8a98b2
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This defconfig use BR2_TARGET_UBOOT_CUSTOM_MAKEOPTS to provide the path
to the TEE in raw binary format but use the legacy file name
"tee-pager_v2.bin" rather than the recommended "tee-raw.bin" [1][2].
Instead of just replacing the file name, use the newly introduced
BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE_RAW_BIN option. Since this option
needs BR2_TARGET_UBOOT_NEEDS_OPTEE_TEE, we now have an explicit
dependency between u-boot and optee-os package.
Previously we had an indirect dependency: optee-os <- ATF <- u-boot
with both BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL32_OPTEE and
BR2_TARGET_UBOOT_NEEDS_ATF_BL31 options enabled at the same time.
[1] 376cb124dd
[2] 4e0b8238ee
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
OP-TEE generates a few binaries that can be used by u-boot on some
platforms (Rockchip, Texas Instruments K3) using TEE variable.
Add a link to the OP-TEE documentation were we can find easily the
desciption for each TEE format that can be used by u-boot.
For convenience, copy tee.elf and tee.bin description in each option
choice help text.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Remove myself from packages that I'm no longer personally interested in.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Subproject tarballs are not provided anymore:
https://discourse.llvm.org/t/llvm-22-1-0-released/89950
"Please note since the last release the subproject tarballs have been
removed"
https://discourse.llvm.org/t/rfc-do-something-with-the-subproject-tarballs-in-the-release-page/75024/14
Used upstream tarball llvm-project-22.1.0.src.tar.xz for all packages
and linked subproject hash files to ../llvm-project.hash.
Removed patches which fix build errors caused by subproject tarballs.
Removed handling of third-party-21.1.8.src.tar.xz which is included in
the monolithic tarball.
Added _SUBDIR variable or updated _INSTALL_CMDS when needed.
For compiler-rt:
Removed both patches, they are not needed anymore.
Added patch to fix aarch64 build.
Added dependency on gcc >= 15.x because libcxx now depends on gcc >=
15.x: https://github.com/llvm/llvm-project/pull/165684
warning "Libc++ only supports GCC 15 and later"
Building with gcc 14.x causes many build errors like
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/is_array.h:43:68:
error: expected primary-expression before ')' token
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/is_array.h:43:44:
error: there are no arguments to '__is_unbounded_array' that depend on
a template parameter, so a declaration of '__is_unbounded_array' must
be available [-fpermissive]
output/build/compiler-rt-22.1.0/compiler-rt/buildroot-build/lib/fuzzer/libcxx_fuzzer_x86_64/build/include/c++/v1/__type_traits/decay.h:22:32:
error: expected type-specifier before '__decay'
A corresponding bug report sent upstream
https://github.com/llvm/llvm-project/issues/174203
was answered:
https://github.com/llvm/llvm-project/issues/174203#issuecomment-3711113919
"Our policy is rather clear: Only the latest GCC is supported."
and an update to supported compiler versions was committed:
d1146b1ddd
Updated TestClangCompilerRT to use a gcc 15-based toolchain.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit will also switch to the Bootlin glibc stable toolchain.
Switch to Bootlin glibc stable toolchain as requested by the 2024
Buildroot meeting report:
https://elinux.org/Buildroot:DeveloperDaysELCE2024#Rules_for_defconfigs
Signed-off-by: Scott Fan <fancp2007@gmail.com>
[Julien:
- remove no longer needed linux-headers.hash
- change comment in linux.hash to take hash from upstream
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
FTXUI is a simple cross-platform C++ library for terminal
based user interfaces.
Signed-off-by: Gilles Talis <gilles.talis@gmail.com>
[Julien: remove FTXUI_SOURCE to use the default archive name]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Replaced install_prefix with DESTDIR in _INSTALL_TARGET_OPTS following
changes in upstream Makefiles, for example:
acb9dd88dc (diff-d56275146b88014f5017f78d3eb4ccdb545c8b82d94877b09ef33bac8f228414L13)
Build-tested using this defconfig
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_XSCREENSAVER=y
arm-aarch64 [ 1/32]: OK
bootlin-aarch64-glibc [ 2/32]: OK
bootlin-aarch64-glibc-old [ 3/32]: SKIPPED
bootlin-arcle-hs38-uclibc [ 4/32]: OK
bootlin-armv5-uclibc [ 5/32]: OK
bootlin-armv7-glibc [ 6/32]: OK
bootlin-armv7m-uclibc [ 7/32]: SKIPPED
bootlin-armv7-musl [ 8/32]: OK
bootlin-m68k-5208-uclibc [ 9/32]: SKIPPED
bootlin-m68k-68040-uclibc [10/32]: OK
bootlin-microblazeel-uclibc [11/32]: SKIPPED
bootlin-mips64el-glibc [12/32]: OK
bootlin-mipsel32r6-glibc [13/32]: OK
bootlin-mipsel-uclibc [14/32]: OK
bootlin-openrisc-uclibc [15/32]: OK
bootlin-powerpc64le-power8-glibc [16/32]: OK
bootlin-powerpc-e500mc-uclibc [17/32]: OK
bootlin-riscv32-glibc [18/32]: OK
bootlin-riscv64-glibc [19/32]: OK
bootlin-riscv64-musl [20/32]: OK
bootlin-s390x-z13-glibc [21/32]: OK
bootlin-sh4-uclibc [22/32]: OK
bootlin-sparc64-glibc [23/32]: OK
bootlin-sparc-uclibc [24/32]: SKIPPED
bootlin-x86-64-glibc [25/32]: OK
bootlin-x86-64-musl [26/32]: OK
bootlin-x86-64-uclibc [27/32]: OK
bootlin-x86-i686-musl [28/32]: OK
bootlin-xtensa-uclibc [29/32]: OK
br-arm-basic [30/32]: SKIPPED
br-arm-full-nothread [31/32]: SKIPPED
br-arm-full-static [32/32]: SKIPPED
32 builds, 8 skipped, 0 build failed, 0 legal-info failed, 0 show-info failed
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error with gcc 9.x:
output/build/libheif-1.21.1/libheif/nclx.h:128:50: error:
'bool nclx_profile::operator==(const nclx_profile&)
const' cannot be defaulted
using this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_STATIC_LIBS=y
BR2_PACKAGE_LIBHEIF=y
According to https://github.com/strukturag/libheif/issues/1615#issuecomment-3457979167
gcc >= 10 with support for C++20 is needed for the package.
The failing code was introduced upstream in version 0.21.0 with commit
a62f933e38
which was added to buildroot with commit
a8aed698c7.
Also removed -std=c++11 from CXXFLAGS.
The build error was not yet recorded by the autobuilders.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 72c7d99e22 switched the
build system to meson which causes an error during configure:
output/build/libvips-8.17.2/meson.build:108:4:
ERROR: Problem encountered: GModule is not supported on your system,
please reconfigure with -Dmodules=disabled
using this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
BR2_TOOLCHAIN_EXTERNAL_URL="http://autobuild.buildroot.org/toolchains/tarballs/br-arm-full-static-2020.11.2.tar.bz2"
BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_4=y
BR2_TOOLCHAIN_EXTERNAL_LOCALE=y
# BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG is not set
BR2_TOOLCHAIN_EXTERNAL_CXX=y
BR2_STATIC_LIBS=y
BR2_PACKAGE_LIBVIPS=y
Added configure options for -Dmodules to fix the problem which was not
yet caught by the autobuilders.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
These modules were dropped in Python 3.13 as per PEP 594.
The current version in Buildroot is 3.14.3.
- Remove the TODO and related config overrides in python3.mk.
- Remove BR2_PACKAGE_PYTHON3_OSSAUDIODEV from Config.in.
- Add BR2_PACKAGE_PYTHON3_OSSAUDIODEV to Config.in.legacy.
See [1] [2] [3].
[1] https://peps.python.org/pep-0594/
[2] fc07fe4e37
[3] 17e1fe0f9b
Signed-off-by: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
[Julien:
- add links in commit log
- move legacy option in 2026.05 section
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit a035a0f99f bumped the
package to 6.0.2 which includes upstream commit
e806051f40
that adds optional support for libkrb5, enabled by default.
When building without libkrb5 we need to disable its support to avoid
a configure error:
configure: Build with gssapi_krb5 support
checking for gssapi/gssapi.h... no
configure: error: You need gssapi development files to compile libsmb2.
Fixes:
https://autobuild.buildroot.net/results/166/166fb283ef8830930ce191b4418d01e6c82176f5/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Drop no longer required python-pytz runtime dependency.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://codeberg.org/tenacityteam/libid3tag/releases/tag/0.16.4
"We now provide our own source packages instead of using Codeberg's
pre-generated sources, guaranteeing that the hash won't change."
Removed patches which are included in this bump.
Used tarball and its hashes provided by upstream.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
sntp/crypto.c includes sntp/config.h, then sntp/crypto.h which includes
ntp_stdlib.h which in turn includes l_stdlib.h that contains
#ifndef HAVE_MEMCHR
extern void *memchr(const void *s, int c, size_t n);
#endif
and breaks the build with glibc 2.43.
sntp/config.h does not contain any information about memchr() while the
top-level config.h does but this top-level config.h is not included
because sntp/Makefile lacks -I$(top_builddir) so sntp/config.h gets
included which does not define HAVE_MEMCHR although glibc does provide
memchr() but sntp/configure lacks a check for memchr().
This was not a problem with previous glibc versions but due to recent
C23 changes in glibc the ntp build is now broken.
To fix the problem we add a configure check for memchr() to
sntp/configure so HAVE_MEMCHR gets defined in sntp/config.h.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The artifacts URL has been moved to https and domain to .org to
improve security and avoid redirection issues. This ensures that
downloads of kernels and rootfs images during runtime tests are
encrypted and verified.
The change has been tested by running a runtime test, confirming the
correct download and renaming of artifacts from the new URL:
Downloading to .../tmpyotq8uor
Renaming from .../tmpyotq8uor to .../kernel-versatile-5.10.202
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
With U-Boot 2022.04 gnutls is required for building the hostool
mkeficapsule.
mkeficapsule tool is built by default if EFI_LOADER is set since u-boot
2024.10 [1].
Thus the BR2_TARGET_UBOOT_NEEDS_GNUTLS config is needed.
This commit also updates the defconfig to the new convention:
- It adds custom hashes, enable BR2_DOWNLOAD_FORCE_CHECK_HASHES=y and
BR2_GLOBAL_PATCH_DIR="board/khadas/vim3/patches" to store the files.
[1] b7a625b1ce
Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Julien:
- squashed linux and u-boot bumps
- change linux.hash comment reuse hashes published upstream
- increase BR2_TARGET_ROOTFS_EXT2_SIZE to 256M
- remove partition size constraint in genimage.cfg
- remove .checkpackageignore entry to fix check-package error
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit [1] was applied without fixing the edk2-platform patch
newlines which are changed by the mailing list. As a result,
the patch fails to apply.
This commit fixes the issue.
[1] 21baec5ef5
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release notes since edk2-stable202508, see:
https://github.com/tianocore/edk2/releases/tag/edk2-stable202511
This commit also updates the edk2-platforms packages with the last
commit merged at the edk2 release date (2025-11-19), which corresponds
to commit [1].
The edk2-non-osi package is also updated the same way, which
corresponds to commit [2].
This commit also adds an edk2-platforms package patch to fix a Marvell
build failure seen with the SolidRun MacchiatoBin platform.
This commit has been runtime tested with tests using EDK2 package,
with commands:
support/testing/run-tests \
-d dl -o output_folder \
tests.boot.test_edk2 \
tests.boot.test_grub.TestGrubAArch64EFI \
tests.boot.test_grub.TestGrubRiscV64EFI \
tests.boot.test_grub.TestGrubX8664EFI \
tests.package.test_fwts
It has also been runtime tested (by booting in qemu) with defconfigs
using EDK2 package:
qemu_aarch64_sbsa_defconfig
qemu_loongarch64_virt_efi_defconfig
qemu_riscv64_virt_efi_defconfig
qemu_x86_64_efi_defconfig
[1] 1e64c1109a
[2] 94d0489811
Cc: Dick Olsson <hi@senzilla.io>
Cc: Romain Naour <romain.naour@smile.fr>
Cc: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes the test relying on it.
[1] 1fb88ffe28
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
EDK2 removed OVMF IA32 support in commit [1], which is included in
version edk2-stable202511. This commit removes tests relying on it.
[1] 1fb88ffe28
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
While there is only one CVE number assigned (CVE-2025-14523) for one of
the patches included in this release, the bulk of the the changes are
security fixes.
Release notes may be found at:
25eac15300
Fixes:
https://www.cve.org/CVERecord?id=CVE-2025-14523
Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The zjit option introduces a rust dependency and due to that not
being handled appropriately it can cause build failures if this
feature gets incorrectly autodetected as being available.
This feature was introduced when ruby was bumped to version 4.0.0
in f594f86f9d.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Now that custom arm-trusted-firmware versions can specify license files, add
license file hashes for the Xilinx custom arm-trusted-firmware version.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Now that custom Linux versions can specify license files, add license file
hashes for the Xilinx custom Linux version.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit 127f36b406 ("package/ruby: bump to version 4.0.1") adjusted
RUBY_VERSION_EXT, but ruby 4.0.1 still installs its extensions into the
4.0.0 subdir:
ls target/usr/lib/ruby/
4.0.0 site_ruby vendor_ruby
So revert the RUBY_VERSION_EXT change to ensure the unneeded extensions are
correctly removed.
Signed-off-by: William Sherrer <william@sherrer.com>
[Peter: significantly extend commit message]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Patches mostly backported with the basis of the work of Ubuntu Security
team. See [1].
Fix the following vulnerabilities:
- CVE-2024-32661:
FreeRDP is a free implementation of the Remote Desktop Protocol.
FreeRDP based clients prior to version 3.5.1 are vulnerable to a
possible `NULL` access and crash. Version 3.5.1 contains a patch for
the issue. No known workarounds are available.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-32661
- CVE-2026-23530:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0,`freerdp_bitmap_decompress_planar` does not validate
`nSrcWidth`/`nSrcHeight` against `planar->maxWidth`/`maxHeight` before
RLE decode. A malicious server can trigger a client‑side heap buffer
overflow, causing a crash (DoS) and potential heap corruption with
code‑execution risk depending on allocator behavior and surrounding
heap layout. Version 3.21.0 contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23530
- CVE-2026-23531:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, in ClearCodec, when `glyphData` is present,
`clear_decompress` calls `freerdp_image_copy_no_overlap` without
validating the destination rectangle, allowing an out-of-bounds
read/write via crafted RDPGFX surface updates. A malicious server can
trigger a client‑side heap buffer overflow, causing a crash (DoS) and
potential heap corruption with code‑execution risk depending on
allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23531
- CVE-2026-23532:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
FreeRDP client’s `gdi_SurfaceToSurface` path due to a mismatch between
destination rectangle clamping and the actual copy size. A malicious
server can trigger a client‑side heap buffer overflow, causing a crash
(DoS) and potential heap corruption with code‑execution risk depending
on allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23532
- CVE-2026-23533:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
RDPGFX ClearCodec decode path when maliciously crafted residual data
causes out-of-bounds writes during color output. A malicious server
can trigger a client‑side heap buffer overflow, causing a crash (DoS)
and potential heap corruption with code‑execution risk depending on
allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23533
- CVE-2026-23534:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to version 3.21.0, a client-side heap buffer overflow occurs in the
ClearCodec bands decode path when crafted band coordinates allow
writes past the end of the destination surface buffer. A malicious
server can trigger a client‑side heap buffer overflow, causing a crash
(DoS) and potential heap corruption with code‑execution risk depending
on allocator behavior and surrounding heap layout. Version 3.21.0
contains a patch for the issue.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23534
- CVE-2026-23948:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, a NULL pointer dereference vulnerability in
rdp_write_logon_info_v2() allows a malicious RDP server to crash
FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with
cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-23948
- CVE-2026-24675:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, urb_select_interface can free the device's MS config on
error but later code still dereferences it, leading to a use after
free in libusb_udev_select_interface. This vulnerability is fixed in
3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24675
- CVE-2026-24676:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, AUDIN format renegotiation frees the active format list
while the capture thread continues using audin->format, leading to a
use after free in audio_format_compatible. This vulnerability is fixed
in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24676
- CVE-2026-24679:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, The URBDRC client uses server-supplied interface numbers as
array indices without bounds checks, causing an out-of-bounds read in
libusb_udev_select_interface. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24679
- CVE-2026-24681:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, aAsynchronous bulk transfer completions can use a freed
channel callback after URBDRC channel close, leading to a use after
free in urb_write_completion. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24681
- CVE-2026-24682:
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior
to 3.22.0, audin_server_recv_formats frees an incorrect number of
audio formats on parse failure (i + i), leading to out-of-bounds
access in audio_formats_free. This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24682
- CVE-2026-24683:
FreeRDP is a free implementation of the Remote Desktop Protocol.
ainput_send_input_event caches channel_callback in a local variable
and later uses it without synchronization; a concurrent channel close
can free or reinitialize the callback, leading to a use after free.
Prior to 3.22.0, This vulnerability is fixed in 3.22.0.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24683
[1] https://launchpad.net/ubuntu/+archive/primary/+sourcefiles/freerdp2/2.6.1+dfsg1-3ubuntu2.10/freerdp2_2.6.1+dfsg1-3ubuntu2.10.debian.tar.xz
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
- CVE-2025-62168:
Squid is a caching proxy for the Web. In Squid versions prior to 7.2,
a failure to redact HTTP authentication credentials in error handling
allows information disclosure. The vulnerability allows a script to
bypass browser security protections and learn the credentials a
trusted client uses to authenticate. This potentially allows a remote
client to identify security tokens or credentials used internally by a
web application using Squid for backend load balancing. These attacks
do not require Squid to be configured with HTTP authentication. The
vulnerability is fixed in version 7.2. As a workaround, disable debug
information in administrator mailto links generated by Squid by
configuring squid.conf with email_err_data off.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-62168
- 0951a06810
The backport has been compared against debian patch [1].
[1] https://sources.debian.org/src/squid/6.13-2%2Bdeb13u1/debian/patches/CVE-2025-62168.patch
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For changes, see:
- https://github.com/vim/vim/compare/v9.1.2017...v9.1.2148
Fixes the following vulnerabilities:
- CVE-2026-25749:
Vim is an open source, command line text editor. Prior to version
9.1.2132, a heap buffer overflow vulnerability exists in Vim's tag
file resolution logic when processing the 'helpfile' option. The
vulnerability is located in the get_tagfname() function in src/tag.c.
When processing help file tags, Vim copies the user-controlled
'helpfile' option value into a fixed-size heap buffer of MAXPATHL + 1
bytes (typically 4097 bytes) using an unsafe STRCPY() operation
without any bounds checking. This issue has been patched in version
9.1.2132.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-25749
- 0714b15940
- CVE-2026-26269:
Vim is an open source, command line text editor. Prior to 9.1.2148, a
stack buffer overflow vulnerability exists in Vim's NetBeans
integration when processing the specialKeys command, affecting Vim
builds that enable and use the NetBeans feature. The Stack buffer
overflow exists in special_keys() (in src/netbeans.c). The while
(*tok) loop writes two bytes per iteration into a 64-byte stack buffer
(keybuf) with no bounds check. A malicious NetBeans server can
overflow keybuf with a single specialKeys command. The issue has been
fixed as of Vim patch v9.1.2148.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-26269
- c5f312aad8
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 3d2141bcee("support/testing/run-tests: specify multiprocessing
method") added a call to multiprocessing.set_start_method('fork') as a
workaround for python 3.14, which changed the default start method to
forkserver - Which is incompatible with the nose2 setup.
multiprocessing.set_start_method() is only supposed to be called a maximum
of 1 time per process and throws a RuntimeError if called more than that
(even with the same arguments):
>>> import multiprocessing
>>> multiprocessing.set_start_method('fork')
>>> multiprocessing.set_start_method('fork')
Traceback (most recent call last):
File "<python-input-2>", line 1, in <module>
multiprocessing.set_start_method('fork')
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
File "/usr/lib/python3.13/multiprocessing/context.py", line 247, in set_start_method
raise RuntimeError('context has already been set')
Debian included a similar patch in python3-nose2 0.51.1-2 (currently in
testing/unstable) which adds its own call to set_start_method():
https://salsa.debian.org/python-team/packages/nose2/-/blob/debian/0.15.1-2/debian/patches/0004-plugins-mp-set-context-to-fork-for-Python-3.14-mp-AP.patch?ref_type=tags
Which comes from:
https://github.com/nose-devs/nose2/pull/644
As discussed in the upstream PR, this is not a correct fix is wrong and
breaks various use cases. An issue has been opened to get this fixed in the
Debian packaging at:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1129350
But until that is done, rework the patch to:
- Only override set_start_method() if needed to limit impact
- Monkey patch set_start_method() so additional calls are ignored
To unbreak run-test on affected Debian systems and add some documentation to
make it clear why this is done.
[Peter: use allow_none / force optional arguments as pointed out by Julien]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When the toolchain involved in openscap build does not support C++, the
configure step fails with the following error:
-- Detecting CXX compiler ABI info
-- Detecting CXX compiler ABI info - failed
-- Check for working CXX compiler: /bin/false
-- Check for working CXX compiler: /bin/false - broken
CMake Error at /usr/share/cmake/Modules/CMakeTestCXXCompiler.cmake:73 (message):
The C++ compiler
"/bin/false"
is not able to compile a simple test program.
It fails with the following output:
Change Dir: '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
Run Build Command(s): /usr/bin/cmake -E env VERBOSE=1 /usr/bin/make -f Makefile cmTC_1834b/fast
make[1]: Entering directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
/usr/bin/make -f CMakeFiles/cmTC_1834b.dir/build.make CMakeFiles/cmTC_1834b.dir/build
make[2]: Entering directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
Building CXX object CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o /bin/false -o CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o -c /home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI/testCXXCompiler.cxx
make[2]: *** [CMakeFiles/cmTC_1834b.dir/build.make:81: CMakeFiles/cmTC_1834b.dir/testCXXCompiler.cxx.o] Error 1
make[2]: Leaving directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
make[1]: *** [Makefile:134: cmTC_1834b/fast] Error 2
make[1]: Leaving directory '/home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/buildroot-build/CMakeFiles/CMakeScratch/TryCompile-tUydqI'
CMake will not be able to correctly generate this project.
Call Stack (most recent call first):
CMakeLists.txt:11 (project)
-- Configuring incomplete, errors occurred!
make: *** [package/pkg-generic.mk:263: /home/autobuild/autobuild/instance-6/output-1/build/openscap-1.3.12/.stamp_configured] Error 1
make: Leaving directory '/home/autobuild/autobuild/instance-6/buildroot'
The openscap project does not contain any C++ file, and so does not need
a C++ capable compiler. Bring the to-be-integrated-upstream patch
enforcing C language in CMakeLists.txt to prevent this build failure.
Fixes: https://autobuild.buildroot.org/results/1fe550ffa79f0a083a450ae03fe067a8ab7336be
Fixes: https://autobuild.buildroot.org/results/e9d52b52658544916022050c78dcb137ca6c97e0
Fixes: https://autobuild.buildroot.org/results/4a9c21763aaddb217ee5f8bb8947faad9767baa3
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Reviewed-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This defconfig can be built without problems:
BR2_x86_64=y
BR2_GCC_VERSION_15_X=y
BR2_PACKAGE_SAFECLIB=y
However adding rocketlake as architecture variant
BR2_x86_64=y
BR2_x86_rocketlake=y
BR2_GCC_VERSION_15_X=y
BR2_PACKAGE_SAFECLIB=y
causes a build error:
str/vsnprintf_s.c: In function 'safec_ftoa.isra':
str/vsnprintf_s.c:523:24: error: writing 32 bytes into a region of size
31 [-Werror=stringop-overflow=]
523 | buf[len++] = '0';
with gcc 15.x only, gcc =< 14.x is not affected, reason unknown.
This commit adds two upstream commits which fix the problem.
No autobuilder error was recorded.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 101997e334 added binutils
2.46.0 to -next branch causing a build error with shim:
output/per-package/shim/host/bin/x86_64-buildroot-linux-gnu-objcopy:
shimx64.so: file format not recognized
output/per-package/shim/host/bin/x86_64-buildroot-linux-gnu-objcopy:
mmx64.so: file format not recognized
Added an upstream patch to fix the problem.
No backport to buildroot LTS branches necessary.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
- CVE-2025-34450:
merbanan/rtl_433 versions up to and including 25.02 and prior to
commit 25e47f8 contain a stack-based buffer overflow vulnerability in
the function parse_rfraw() located in src/rfraw.c. When processing
crafted or excessively large raw RF input data, the application may
write beyond the bounds of a stack buffer, resulting in memory
corruption or a crash. This vulnerability can be exploited to cause a
denial of service and, under certain conditions, may be leveraged for
further exploitation depending on the execution environment and
available mitigations.
For mroe information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-34450
- 25e47f8932
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
- CVE-2026-25556:
MuPDF versions 1.23.0 through 1.27.0 contain a double-free
vulnerability in fz_fill_pixmap_from_display_list() when an exception
occurs during display list rendering. The function accepts a caller-
owned fz_pixmap pointer but incorrectly drops the pixmap in its error
handling path before rethrowing the exception. Callers (including the
barcode decoding path in fz_decode_barcode_from_display_list) also
drop the same pixmap in cleanup, resulting in a double-free that can
corrupt the heap and crash the process. This issue affects
applications that enable and use MuPDF barcode decoding and can be
triggered by processing crafted input that causes a rendering-time
error while decoding barcodes.
For more information, see
- https://www.cve.org/CVERecord?id=CVE-2026-25556
- https://cgit.ghostscript.com/cgi-bin/cgit.cgi/mupdf.git/commit/?id=d4743b6092d513321c23c6f7fe5cff87cde043c1
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
* create a board/freescale/imx6ull-evk folder dedicated to upstream Linux
and U-Boot to ease maintainance.
* clean up both imx6ullevk and imx6ull-evk readme.txt files
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: fix IMX6ULLQSG url in readme.txt]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed all patches because they are included in this release.
Added two upstream patches which fix build with glibc 2.43.
Added optional dependency to gnutls introduced by upstream commit
c9215365ef
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
For release notes since version 3.12.07-3-g4546973, see:
https://github.com/electronicarts/EASTL/releases
Updated license hash due to upstream commit
c18a037660
Added patch to raise make_minimum_required in subproject EABase that was
added by upstream commit
c530255b69
using FetchContent_Declare which downloads the source during configure
so we do not have a chance to use _POST_EXTRACT_HOOKS to patch the
source code directly.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Julien: add comment in commit log about the previous version number]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Which is a 2.5G Ethernet PHY.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
[Julien: add LICENSE.airoha entry in linux-firmware.hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Change summary:
https://git.libssh.org/projects/libssh.git/tag/?h=libssh-0.11.4
Fixes:
CVE-2025-14821: libssh loads configuration files from the C:\etc directory
on Windows
CVE-2026-0964: SCP Protocol Path Traversal in ssh_scp_pull_request()
CVE-2026-0965: Possible Denial of Service when parsing unexpected
configuration files
CVE-2026-0966: Buffer underflow in ssh_get_hexa() on invalid input
CVE-2026-0967: Specially crafted patterns could cause DoS
CVE-2026-0968: OOB Read in sftp_parse_longname()
libssh-2026-sftp-extensions: Read buffer overrun when handling SFTP
extensions
Signed-off-by: Mattias Walström <lazzer@gmail.com>
[Julien:
- add link to upstream change summary
- fix signature link in hash file
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 0433c8d02a bumped
libinput to version 1.31.0 which causes a build error with wlroot:
../backend/libinput/switch.c: In function ‘handle_switch_toggle’:
../backend/libinput/switch.c:32:9: error: enumeration value
‘LIBINPUT_SWITCH_KEYPAD_SLIDE’ not handled in switch [-Werror=switch]
32 | switch (libinput_event_switch_get_switch(sevent)) {
The build error was not yet detected by the autobuilders but can be
reproduced using this defconfig:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_WLROOTS=y
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerabilities:
- CVE-2024-50382:
Botan before 3.6.0, when certain LLVM versions are used, has compiler-
induced secret-dependent control flow in lib/utils/ghash/ghash.cpp in
GHASH in AES-GCM. There is a branch instead of an XOR with carry. This
was observed for Clang in LLVM 15 on RISC-V.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-50382
- 53b0cfde58
- CVE-2024-50383:
Botan before 3.6.0, when certain GCC versions are used, has a
compiler-induced secret-dependent operation in lib/utils/donna128.h in
donna128 (used in Chacha-Poly1305 and x25519). An addition can be
skipped if a carry is not set. This was observed for GCC 11.3.0 with
-O2 on MIPS, and GCC on x86-i386. (Only 32-bit processors can be
affected.)
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-50383
- 53b0cfde58
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add configs/versal_vpk120_defconfig to the list of files I maintain.
Signed-off-by: Neal Frager <neal.frager@amd.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following vulnerability:
- CVE-2025-63938:
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in
the strip_return_port() function within src/reqs.c.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-63938
- 3c0fde9498
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerability:
- CVE-2025-50681:
igmpproxy 0.4 before commit 2b30c36 allows remote attackers to cause a
denial of service (application crash) via a crafted IGMPv3 membership
report packet with a malicious source address. Due to insufficient
validation in the `recv_igmp()` function in src/igmpproxy.c, an
invalid group record type can trigger a NULL pointer dereference when
logging the address using `inet_fmtsrc()`. This vulnerability can be
exploited by sending malformed multicast traffic to a host running
igmpproxy, leading to a crash. igmpproxy is used in various embedded
networking environments and consumer-grade IoT devices (such as home
routers and media gateways) to handle multicast traffic for IPTV and
other streaming services. Affected devices that rely on unpatched
versions of igmpproxy may be vulnerable to remote denial-of-service
attacks across a LAN .
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-50681
- 2b30c36e6a
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This minor release contains a fix for building with host glibc 2.43,
which fails otherwise.
Signed-off-by: Paul Kocialkowski <paulk@sys-base.io>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For more information on the version bump, see:
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md
- https://github.com/ImageMagick/ImageMagick/compare/7.1.2-12...7.1.2-15
Fixes the following vulnerabilities:
- CVE-2026-22770:
The BilateralBlurImage method will allocate a set of double buffers
inside AcquireBilateralTLS. But, in versions prior to 7.1.2-13, the
last element in the set is not properly initialized. This will
result in a release of an invalid pointer inside DestroyBilateralTLS
when the memory allocation fails.
https://www.cve.org/CVERecord?id=CVE-2026-22770
- CVE-2026-23874:
Versions prior to 7.1.2-13 have a stack overflow via infinite
recursion in MSL (Magick Scripting Language) `<write>` command when
writing to MSL format.
https://www.cve.org/CVERecord?id=CVE-2026-23874
- CVE-2026-23876:
Prior to versions 7.1.2-13 and 6.9.13-38, a heap buffer overflow
vulnerability in the XBM image decoder (ReadXBMImage) allows an
attacker to write controlled data past the allocated heap buffer
when processing a maliciously crafted image file. Any operation that
reads or identifies an image can trigger the overflow, making it
exploitable via common image upload and processing pipelines.
https://www.cve.org/CVERecord?id=CVE-2026-23876
- CVE-2026-24481:
Prior to versions 7.1.2-15 and 6.9.13-40, a heap information
disclosure vulnerability exists in ImageMagick's PSD (Adobe
Photoshop) format handler. When processing a maliciously crafted PSD
file containing ZIP-compressed layer data that decompresses to less
than the expected size, uninitialized heap memory is leaked into the
output image.
https://www.cve.org/CVERecord?id=CVE-2026-24481
- CVE-2026-25638:
Prior to versions 7.1.2-15 and 6.9.13-40, memory leak exists in
`coders/msl.c`. In the `WriteMSLImage` function of the `msl.c` file,
resources are allocated. But the function returns early without
releasing these allocated resources.
https://www.cve.org/CVERecord?id=CVE-2026-25638
- CVE-2026-25794:
`WriteUHDRImage` in `coders/uhdr.c` uses `int` arithmetic to compute
the pixel buffer size. Prior to version 7.1.2-15, when image
dimensions are large, the multiplication overflows 32-bit `int`,
causing an undersized heap allocation followed by an out-of-bounds
write. This can crash the process or potentially lead to an out of
bounds heap write.
https://www.cve.org/CVERecord?id=CVE-2026-25794
- CVE-2026-25795:
Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSFWImage()`
(`coders/sfw.c`), when temporary file creation fails, `read_info` is
destroyed before its `filename` member is accessed, causing a NULL
pointer dereference and crash.
https://www.cve.org/CVERecord?id=CVE-2026-25795
- CVE-2026-25796:
Prior to versions 7.1.2-15 and 6.9.13-40, in `ReadSTEGANOImage()`
(`coders/stegano.c`), the `watermark` Image object is not freed on
three early-return paths, resulting in a definite memory leak
(~13.5KB+ per invocation) that can be exploited for denial of
service.
https://www.cve.org/CVERecord?id=CVE-2026-25796
- CVE-2026-25798:
Prior to versions 7.1.2-15 and 6.9.13-40, a NULL pointer dereference
in ClonePixelCacheRepository allows a remote attacker to crash any
application linked against ImageMagick by supplying a crafted image
file, resulting in denial of service.
https://www.cve.org/CVERecord?id=CVE-2026-25798
- CVE-2026-25799:
Prior to versions 7.1.2-15 and 6.9.13-40, a logic error in YUV
sampling factor validation allows an invalid sampling factor to
bypass checks and trigger a division-by-zero during image loading,
resulting in a reliable denial-of-service.
https://www.cve.org/CVERecord?id=CVE-2026-25799
- CVE-2026-25897:
Prior to versions 7.1.2-15 and 6.9.13-40, an Integer Overflow
vulnerability exists in the sun decoder. On 32-bit systems/builds, a
carefully crafted image can lead to an out of bounds heap write.
https://www.cve.org/CVERecord?id=CVE-2026-25897
- CVE-2026-25989:
Prior to versions 7.1.2-15 and 6.9.13-40, a crafted SVG file can
cause a denial of service. An off-by-one boundary check (`>` instead
of `>=`) that allows bypass the guard and reach an undefined
`(size_t)` cast.
https://www.cve.org/CVERecord?id=CVE-2026-25989
- CVE-2026-26066:
Prior to versions 7.1.2-15 and 6.9.13-40, a crafted profile contain
invalid IPTC data may cause an infinite loop when writing it with
`IPTCTEXT`.
https://www.cve.org/CVERecord?id=CVE-2026-26066
- CVE-2026-26283:
Prior to versions 7.1.2-15 and 6.9.13-40, a `continue` statement in
the JPEG extent binary search loop in the jpeg encoder causes an
infinite loop when writing persistently fails. An attacker can
trigger a 100% CPU consumption and process hang (Denial of Service)
with a crafted image.
https://www.cve.org/CVERecord?id=CVE-2026-26283
- CVE-2026-26284:
Prior to versions 7.1.2-15 and 6.9.13-40, ImageMagick lacks proper
boundary checking when processing Huffman- coded data from PCD
(Photo CD) files. The decoder contains an function that has an
incorrect initialization that could cause an out of bounds read.
https://www.cve.org/CVERecord?id=CVE-2026-26284
- CVE-2026-26983:
Prior to versions 7.1.2-15 and 6.9.13-40, the MSL interpreter
crashes when processing a invalid `<map>` element that causes it to
use an image after it has been freed.
https://www.cve.org/CVERecord?id=CVE-2026-26983
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit 2882cf4ae6 bumped the
package from 2.44.4 to 2.48.3. This bump includes upstream commit
3b54e45d63
which was added to wpewebkit 2.45.1:
https://wpewebkit.org/release/wpewebkit-2.45.1.html
"Use Skia by default instead of Cairo for rendering."
The upstream commit includes dependencies to fontconfig & freetype which
were not added to buildroot and cause build errors with this defconfig:
BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
BR2_PACKAGE_WPEWEBKIT=y
BR2_PACKAGE_WPEWEBKIT_SANDBOX=y
BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA=y
BR2_PACKAGE_WPEWEBKIT_MEDIA_STREAM=y
BR2_PACKAGE_WPEWEBKIT_WEBDRIVER=y
Reported-by: Julien Olivain <ju.o@free.fr>
[https://patchwork.ozlabs.org/project/buildroot/patch/20251017131035.224739-1-aperez@igalia.com/#3599999]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Acked-by: Adrian Perez de Castro <aperez@igalia.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For more information about the release, see:
- https://github.com/c-ares/c-ares/releases/tag/v1.34.6
Fixes the following vulnerability:
- CVE-2025-62408:
c-ares is an asynchronous resolver library. Versions 1.32.3 through
1.34.5 terminate a query after maximum attempts when using
read_answer() and process_answer(), which can cause a Denial of
Service. This issue is fixed in version 1.34.6.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-62408
- 714bf5675c
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security vulnerability:
- CVE-2025-68615:
net-snmp is a SNMP application library, tools and daemon. Prior to
versions 5.9.5 and 5.10.pre2, a specially crafted packet to an net-
snmp snmptrapd daemon can cause a buffer overflow and the daemon to
crash. This issue has been patched in versions 5.9.5 and 5.10.pre2.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68615
- b4e6f826d9
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The 2026.02-rc1 release forgot to update the series and date and the
2025.02.11 release forgot to update the data, fix that.
Reported-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Now that binutils 2.46.0 has been introduced and binutils 2.45.1 made
the default version, drop the oldest supported version, binutils 2.43,
keeping only the 3 last versions supported: 2.44, 2.45.1 and 2.46.0.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Now that support for binutils 2.46.0 has been introduced, we follow our
policy of making binutils 2.45.1 the default version.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://sourceware.org/pipermail/binutils/2026-February/148149.html
" This release contains numerous bug fixes, and also the following new
features:
* Support for new instructions added to AMD, ARM and RISC-V
architectures.
* Support for version 3 of the SFrame standard.
* The readelf program can now display the contents of Global Offset
Tables.
* Improved linker tagging support."
We bring and rebased patches 0001 and 0002 that we carry for binutils
2.45.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Removed patch that fixed building with libseccomp and old kernel headers
as systemd has fixed that upstream now.
Notable changes:
- Add -Dlibmount=enabled to host and target build. Disabling this
option disables building most of systemd's tools apart from
libsystemd.
- remove gcrypt and gnutls from dependencies and build options.
openssl is the only supported crypto library now.
- Disable nspawn build for host variant and add a Config.in option
for the target variant.
- systemd now requires kernel >= 5.4 while the recommended kernel
version moved to >=5.7. This make systemd depend on
BR2_TOOLCHAIN_HEADERS_AT_LEAST_5_4, removing various dependencies
on older kernel header versions from sub options.
- The sha256sum of LICENSES/README.md changed due to various
license clarification, removal of some vendored files as well as
changing some file paths. Licensing did not actually change.
For changelog, see:
https://github.com/systemd/systemd/blob/v258.3/NEWS
Tested with `./support/testing/run-tests tests.init.test_systemd`
All tests passed
One of the tests now needs a bigger rootfs size.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Peter: fix check-package warnings]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When trying to build host-dtc on a host with glibc 2.43, the build fails
on the following error:
libfdt/fdt_overlay.c: In function ‘overlay_fixup_phandle’:
libfdt/fdt_overlay.c:424:21: error: assignment discards ‘const’
qualifier from pointer target type [-Werror=discarded-qualifiers]
424 | sep = memchr(fixup_str, ':', fixup_len);
| ^
libfdt/fdt_overlay.c:434:21: error: assignment discards ‘const’
qualifier from pointer target type [-Werror=discarded-qualifiers]
434 | sep = memchr(name, ':', fixup_len);
| ^
fdtput.c: In function ‘create_node’:
fdtput.c:235:11: error: assignment discards ‘const’ qualifier from
pointer target type [-Werror=discarded-qualifiers]
235 | p = strrchr(node_name, '/');
| ^
cc1: all warnings being treated as errors
make[2]: *** [Makefile:359: fdtput.o] Error 1
make[2]: *** Waiting for unfinished jobs....
cc1: all warnings being treated as errors
make[2]: *** [Makefile:359: libfdt/fdt_overlay.o] Error 1
make[1]: *** [package/pkg-generic.mk:273:
/home/alexis/src/buildroot/dtc/build/host-dtc-1.7.2/.stamp_built] Error 2
make: *** [Makefile:83: _all] Error 2
The issue can be reproduced on master with this minimal defconfig on a
host having glibc 2.43:
BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_PACKAGE_QORIQ_MC_UTILS=y
(QORIQ_MC_UTILS will pull HOST_DTC)
This error is due to some functions prototype update in glibc 2.43 for
ISO C23 (see [1], point 3 in the NEWS list). The corresponding fix has
already been integrated upstream, but it has not been released since
then.
Bring the corresponding upstream patch to allow host-dtc to build on
affected hosts.
[1] https://lists.gnu.org/archive/html/info-gnu/2026-01/msg00005.html
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The used Linux kernel (4.14.336) does not contain the default license files
as those were only added in 4.16 with commit e00a844aca ("LICENSES: Add
Linux syscall note exception"), so specify the correct license file to fix:
make legal-info
..
cp: cannot stat '/path/to/output/build/linux-headers-4.14.336/LICENSES/preferred/GPL-2.0': No such file or directory
And add the sha256sum to the .hash file.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien:
- reword commit title
- actually add BR2_LINUX_KERNEL_LICENSE_FILES in defconfig
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The used Linux kernel (4.14.336) does not contain the default license files
as those were only added in 4.16 with commit e00a844aca ("LICENSES: Add
Linux syscall note exception"), so specify the correct license file to fix:
make legal-info
..
cp: cannot stat '/path/to/output/build/linux-headers-4.14.336/LICENSES/preferred/GPL-2.0': No such file or directory
And add the sha256sum to the .hash file.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: reword commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Commit 50958bcdac ("linux: Add support for custom license files") added a
default value for the license files and made the option visible (E.G.
editable) when a custom VCS or tarball version is used, but it is also
needed for users of an older _CUSTOM_VERSION (E.G. mainline release), as
the referenced files were only added in Linux 4.16 with commit e00a844aca
("LICENSES: Add Linux syscall note exception"), so change that.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
It was recently announced on the list that Marcus joined the maintainer
team, so add a news entry about it as well.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When using a specific git repo and version for at91bootstrap3,
BR2_TARGET_AT91BOOTSTRAP3_LICENSE_FILES defaults to "LICENSES/MIT.txt".
However the git version we use (namely v3.10.3) does not provide this
file. Actually, it does not provide a license file at all. This causes
‘make legal-info’ to fail with:
>>> at91bootstrap3 v3.10.3 Collecting legal info
sha256sum: /builds/buildroot.org/buildroot/output/build/at91bootstrap3-v3.10.3/LICENSES/MIT.txt: No such file or directory
ERROR: while checking hashes from boot/at91bootstrap3/at91bootstrap3.hash
ERROR: LICENSES/MIT.txt has wrong sha256 hash:
ERROR: expected: 5a3809b1c2ba13b7242572322951311c584419f1f8516f665d6c06f0668d78de
ERROR: got :
ERROR: Incomplete download, or man-in-the-middle (MITM) attack
Let's be explicit that there is no license file to check.
Fixes:
- https://gitlab.com/buildroot.org/buildroot/-/jobs/12992815386
- https://gitlab.com/buildroot.org/buildroot/-/jobs/12992815390
Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The Buildroot commit [1] introduced two small typos, while doing the
updates to announce new releases.
The version 2025.02.10 release date is 2026-01-20 (and not 2022).
See the original announce [2].
The 2025.02.10 archive link in news.html has also a missing dot.
This commit fixes those typo in order to fix the website.
[1] 21dda0665e
[2] https://lore.kernel.org/buildroot/9b9654f8-6cdd-4108-b932-79509e455148@rnout.be/
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libxmslec1 build fails on some configurations with the following build
logs:
CC libxmlsec1_openssl_la-kw_des.lo
kw_des.c:75:8: error: unknown type name 'xmlSecKWDes3Klass'; did you mean 'xmlSecKWAesKlass'?
75 | static xmlSecKWDes3Klass xmlSecOpenSSLKWDes3ImplKlass = {
| ^~~~~~~~~~~~~~~~~
| xmlSecKWAesKlass
kw_des.c:77:5: error: initialization of 'int' from 'int (*)(struct _xmlSecTransform *, xmlSecByte *, size_t, size_t *)' {aka 'int (*)(struct _xmlSecTransform *, unsigned char *, long unsigned int, long unsigned int *)'} makes integer from pointer without a cast [-Wint-conversion]
77 | xmlSecOpenSSLKWDes3GenerateRandom, /* xmlSecKWDes3GenerateRandomMethod generateRandom; */
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kw_des.c:77:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass')
kw_des.c:77:5: error: initializer element is not computable at load time
kw_des.c:77:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass')
kw_des.c:78:5: error: excess elements in scalar initializer
78 | xmlSecOpenSSLKWDes3Sha1, /* xmlSecKWDes3Sha1Method sha1; */
| ^~~~~~~~~~~~~~~~~~~~~~~
kw_des.c:78:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass')
kw_des.c:79:5: error: excess elements in scalar initializer
79 | xmlSecOpenSSLKWDes3BlockEncrypt, /* xmlSecKWDes3BlockEncryptMethod encrypt; */
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
kw_des.c:79:5: note: (near initialization for 'xmlSecOpenSSLKWDes3ImplKlass')
kw_des.c:80:5: error: excess elements in scalar initializer
80 | xmlSecOpenSSLKWDes3BlockDecrypt, /* xmlSecKWDes3BlockDecryptMethod decrypt; */
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[...]
This build failure is due to those struct definitions being set
conditionally in src/kw_aes_des.h behind a XMLSEC_NO_DES define, and
this define ending up being 1 on some builds. We could assume that the
makefiles in libxmlsec should just not try to build any DES related file
when XMLSEC_NO_DES is set to 1 (and so, in this specific case, not try
to build src/openssl/kw_des.c), but the autotools tooling in the project
is not the one setting XMLSEC_NO_DES: there is a mismatch between
detected features at configure time and build time.
- at build time, the tooling just checks if user has passed
`--enable-des=no`. If so, it sets XMLSEC_NO_DES, otherwise it assumes
that DES support is available.
- at build time, libxmlsec tries to build openssl backend. This backend
checks OpenSSL features, especially whether OPENSSL_NO_DES is set (and
if so, it enforces XMLSEC_NO_DES to 1 as well)
- This OPENSSL_NO_DES comes from libopenssl configuration headers
installed in sysroot. Its presence is driven by the `no-des` option
passed at libopenssl configure time
- This `no-des` flag is driven by buildroot option
BR2_PACKAGE_LIBOPENSSL_ENABLE_DES
There are multiple options to fix this package here:
1. fixing upstream package to make the features detection more robust (eg
check openssl headers at configure time to ensure that DES is
supported)
2. enforce XMLSEC_NO_DES if BR2_PACKAGE_LIBOPENSSL_ENABLE_DES is not set
3. systematically enforce XMLSEC_NO_DES=1
Now:
- 1 may take time, and would then need a temporary patch to live in
buildroot while the fix is accepted upstream and released
- 2 works only for libopenssl, what if libressl is used ?
- DES usage is discouraged anyway, as stated by configure logs:
[...]
checking for DES support... yes (use discouraged)
[...]
As the package has been introduced very recently, there's a very low
chance to break any user use case by completely disabling DES support.
Systematically disable DES support in libxmlsec1 to discourage usage and
fix build failure when the corresponding SSL library does not expose DES
support.
Fixes: https://autobuild.buildroot.org/results/3e15f03dc0211c622125ebb69ff7230ce900029a/
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* bumps ATF to version 2.14.0
* forces check hashes
* switches to extlinux
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
* switches to extlinux
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
* switches to extlinux
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit also updates
olimex_a20_olinuxino_lime_defconfig
olimex_a20_olinuxino_lime2_defconfig
to use this new rootfs_overlay_mali directory.
This is to differentiate for the upcoming patch for
a20_olinuxino_micro_defconfig
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: add extra info in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
* switches to extlinux
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
* switches to extlinux
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien:
- change linux.hash comment to use hash from upstream
- add "_lime" in commit title
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version lf-6.12.49-2.2.0
* bumps U-Boot to version lf-6.12.49-2.2.0
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
* forces check hashes
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch:
* bumps Linux kernel to version 6.18.8
* bumps U-Boot to version 2026.01
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: change linux.hash comment to use hash from upstream]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The `pocoo:jinja2` CPE introduced in commit [1] is not deprecated but is
no longer used. All the security issue on the Github Advisory reference
CVE with the `palletsprojects:jinja` CPE instead (see [2]).
This commit updates the CPE accordingly.
[1] 165f60a092 package/python-jinja2: add CPE variables
[2] https://github.com/pallets/jinja/security/advisories/GHSA-cpwx-vrp4-4pq7
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Optional udisks support is useful for mounting USB sticks via
pcmanfm.
gvfs meson.build has recognized this udisks2 option for quite
some time, since upstream commit [1] first included in version
1.35.2 (released on 2017-11-13).
[1] cdc33bf54f
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
[Julien: add comment in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
commit cf686670b9 introduced a patch that
was later included in a release which made the usage of libesmtp
configurable. Later the switch was moved to the main CMakeLists.mk [0].
while the patch introduced the build flag LOG4CXX_ENABLE_ESMTP the
change to the .mk file used LOG4CXX_ENABLE_LIBESMTP.
So correct this.
Fixes:
CMake Warning:
Manually-specified variables were not used by the project:
LOG4CXX_ENABLE_LIBESMTP
[0] https://github.com/apache/logging-log4cxx/blob/rel/v1.3.1/CMakeLists.txt#L93
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit backports an upstream patch fixing CVE-2024-10963. See:
https://github.com/linux-pam/linux-pam/issues/834https://github.com/linux-pam/linux-pam/pull/854
Fixes:
- CVE-2024-10963:
Pam: improper hostname interpretation in pam_access leads to access
control bypass
A flaw was found in pam_access, where certain rules in its
configuration file are mistakenly treated as hostnames. This
vulnerability allows attackers to trick the system by pretending
to be a trusted hostname, gaining unauthorized access. This issue
poses a risk for systems that rely on this feature to control who
can access certain services or terminals.
https://www.cve.org/CVERecord?id=CVE-2024-10963
Signed-off-by: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Julien:
- fix check-package errors
- add info in commit log
- rebase patch on v1.6.1 to avoid patch offsets
- add "CVE:" tag in patch
- add comment with patch name near _IGNORE_CVES in .mk
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
This commit:
- updates the Kernel from LTS 6.6.30 to 6.12.70
- updates U-Boot from 2024.04 to 2026.01
- updates arm-trusted-firmware from v2.10 to v2.12 LTS
- switches to Bootlin external glibc stable toolchain
Note: Using the kernel 6.18.9, the SD card fail at boot:
mmc1: SDHCI controller on 4fb0000.mmc [4fb0000.mmc] using ADMA 64-bit
Waiting for root device /dev/mmcblk1p2...
mmc1: error -110 whilst initialising SD card
So let's use stable kernel 6.12.y for the time being.
Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Julien: update linux.hash comment to use upstream hash]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Please note that the fix for CVE-2024-52615 introduces CVE-2025-59529
which is not fixed yet (https://github.com/avahi/avahi/pull/808). You
can mitigate this vulnerability by setting the `enable-wide-area=no`
option.
Patch `0011-properly-randomize-query-id-of-DNS-packets.patch` modify
`configure.ac` and then `AVAHI_AUTORECONF` is set.
This commit fixes the following vulnerabilities:
- CVE-2021-3468:
A flaw was found in avahi in versions 0.6 up to 0.8. The event used to
signal the termination of the client connection on the avahi Unix
socket is not correctly handled in the client_work function, allowing
a local attacker to trigger an infinite loop. The highest threat from
this vulnerability is to the availability of the avahi service, which
becomes unresponsive after this flaw is triggered.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2021-3468
- 447affe299
- CVE-2023-38469:
A vulnerability was found in Avahi, where a reachable assertion exists
in avahi_dns_packet_append_record.
https://www.cve.org/CVERecord?id=CVE-2023-38469
- CVE-2023-38470:
A vulnerability was found in Avahi. A reachable assertion exists in
the avahi_escape_label() function.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-38470
- a337a1ba7d
- CVE-2023-38471:
A vulnerability was found in Avahi. A reachable assertion exists in
the dbus_set_host_name function.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-38471
- github.com/avahi/avahi/commit/894f085f402e023a98cbb6f5a3d117bd88d93b09
- CVE-2023-38472:
A vulnerability was found in Avahi. A reachable assertion exists in
the avahi_rdata_parse() function.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-38472
- b024ae5749
- CVE-2023-38473:
A vulnerability was found in Avahi. A reachable assertion exists in
the avahi_alternative_host_name() function.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2023-38473
- b448c9f771
- CVE-2024-52615:
A flaw was found in Avahi-daemon, which relies on fixed source ports
for wide-area DNS queries. This issue simplifies attacks where
malicious DNS responses are injected.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-52615
- 4e2e1ea090
- https://github.com/avahi/avahi/issues/810 (introduce regression CVE-2025-59529)
- CVE-2024-52616:
A flaw was found in the Avahi-daemon, where it initializes DNS
transaction IDs randomly only once at startup, incrementing them
sequentially after that. This predictable behavior facilitates DNS
spoofing attacks, allowing attackers to guess transaction IDs.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2024-52616
- f8710bdc8b
- CVE-2025-68276:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an
unprivileged local users can crash avahi-daemon (with wide-area
disabled) by creating record browsers with the
AVAHI_LOOKUP_USE_WIDE_AREA flag set via D-Bus. This can be done by
either calling the RecordBrowserNew method directly or creating
hostname/address/service resolvers/browsers that create those browsers
internally themselves.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68276
- 2d48e42d44
- CVE-2025-68468:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
avahi-daemon can be crashed by sending unsolicited announcements
containing CNAME resource records pointing it to resource records with
short TTLs. As soon as they expire avahi-daemon crashes.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68468
- f66be13d7f
- CVE-2025-68471:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier,
avahi-daemon can be crashed by sending 2 unsolicited announcements
with CNAME resource records 2 seconds apart.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-68471
- 9c6eb53bf2
- CVE-2026-24401:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. In versions 0.9rc2 and
below, avahi-daemon can be crashed via a segmentation fault by sending
an unsolicited mDNS response containing a recursive CNAME record,
where the alias and canonical name point to the same domain (e.g.,
"h.local" as a CNAME for "h.local"). This causes unbounded recursion
in the lookup_handle_cname function, leading to stack exhaustion. The
vulnerability affects record browsers where AVAHI_LOOKUP_USE_MULTICAST
is set explicitly, which includes record browsers created by resolvers
used by nss-mdns. This issue is patched in commit
78eab31128479f06e30beb8c1cbf99dd921e2524.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-24401
- 78eab31128
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The github repository lathiat/avahi now redirect to avahi/avahi.
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Introduce the openscap package. openscap is a command line tool allowing
to scan a system configuration to perform security compliance checks.
The tool consumes XCCDF and OVAL files to perform system evaluation
against a list of policies.
The package provides both a target and a host build configuration, as it
is needed on both sides:
- it is needed on the host to allow building the security policy files
to be embedded on the target
- it is needed on the target to actually parse and evaluate those
security policy files.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
[Thomas:
- Drop dependency on openssl, apparently not needed
- Depend on gcrypt if !nss, as either can be used
- Add missing dependency on libxslt]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
libcurl host build support has initially been added with 736e0fc5d6
("libcurl: add host variant") while adding support for host-cargo build,
and reverted with 69e84008ab ("Revert "libcurl: add host variant"")
when standalone cargo build has been removed.
In order to bring in an upcoming commit a new host package that
depends on libcurl, re-enable host-libcurl build support.
This reverts commit w9e84008abf87eaeeb3f2d53c880cf33492a3bf8, with the
exception of the post-patch hook which is no longer needed.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Commit 7eeb574f0e introduced the
libxmlsec1 making libxslt a mandatory dependency, which it isn't.
This commit therefore make libxslt an optional dependency of the
target libxmlsec1 package, and drops the dependency entirely for the
host package.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes CVE-2025-14550:
There was a potential DoS vector for users of the
``asgiref.wsgi.WsgiToAsgi`` adapter. Malicious requests, including an
unreasonably large number of values for the same header, could lead to
resource exhaustion when building the WSGI environment.
Changelog: https://github.com/django/asgiref/blob/3.11.1/CHANGELOG.txt
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The CPIO filesystem generated by the test_firewalld test is too
large, and doesn't fit as an initramfs in the 256MB of RAM available
in the versatilepb machine. This causes a "Initramfs unpacking failed:
write error" when booting, and many files being missing from the root
filesystem, ultimately causing the test to fail.
The test_firewalld test initially started to fail following a systemd
update [1][3]:
[BRTEST# systemctl is-active firewalld
failed
But really started to crash at boot following a python 3.14 update
[2][4]:
Run /init as init process
/init: exec: line 15: /sbin/init: not found
Also, update TestFirewalldSysVInit to use ext2 instead of cpio.
[1] 926e0504d0
[2] a0a6abc8b1
Fixes:
[3] https://gitlab.com/buildroot.org/buildroot/-/jobs/12944797059
[4] https://gitlab.com/buildroot.org/buildroot/-/jobs/11856840940
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issues:
- CVE-2025-13473 (low): Username enumeration through timing difference in mod_wsgi authentication handler
- CVE-2025-14550 (moderate): Potential denial-of-service vulnerability via repeated headers when using ASGI
- CVE-2026-1207 (high): Potential SQL injection via raster lookups on PostGIS
- CVE-2026-1285 (moderate): Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods
- CVE-2026-1287 (high): Potential SQL injection in column aliases via control characters
- CVE-2026-1312 (high): Potential SQL injection via QuerySet.order_by and FilteredRelation
See the release notes here:
https://docs.djangoproject.com/en/dev/releases/6.0.2/
Also includes the bugfixes from version 6.0.1:
https://docs.djangoproject.com/en/dev/releases/6.0.1/
Signed-off-by: Manuel Diener <manuel.diener@othermo.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Introduce the libxmlsec1 library package. libxmlsec implements XML
security standards.
The library has only a few mandatory dependencies(libxml2 and libxslt
and a crypto library). It needs one of the following cryptographic
libraries: OpenSSL, NSS, or Gcrypt/GNUTLS. Default to openssl for now to
keep the package simple.
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Fixes the following security vulnerabilities:
CVE-2026-1584: libgnutls: Fix NULL pointer dereference in PSK binder
verification
A TLS 1.3 resumption attempt with an invalid PSK binder value in ClientHello
could lead to a denial of service attack via crashing the server.
The updated code guards against the problematic dereference.
CVE-2025-14831: libgnutls: Fix name constraint processing performance issue
Verifying certificates with pathological amounts of name constraints
could lead to a denial of service attack via resource exhaustion.
Reworked processing algorithms exhibit better performance characteristics.
For more details, see the release notes:
https://lists.gnupg.org/pipermail/gnutls-help/2026-February/004914.html
Drop now upstreamed 0001-audit-crau-fix-compilation-with-gcc-11.patch:
f5666f8f1f
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following vulnerabilities:
CVE-2025-61732: cmd/cgo: remove user-content from doc strings in cgo ASTs
A discrepancy between how Go and C/C++ comments were parsed allowed for code
smuggling into the resulting cgo binary.
To prevent this behavior, the cgo compiler will no longer parse
user-provided doc comments.
CVE-2025-68121: crypto/tls: unexpected session resumption when using
Config.GetConfigForClient
Config.GetConfigForClient is documented to use the original Config's session
ticket keys unless explicitly overridden. This can cause unexpected
behavior if the returned Config modifies authentication parameters, like
ClientCAs: a connection initially established with the parent (or a sibling)
Config can be resumed, bypassing the modified authentication requirements.
If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on
the server) or InsecureSkipVerify is false (on the client), crypto/tls now
checks that the root of the previously-verified chain is still in
ClientCAs/RootCAs when resuming a connection.
Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar
issue related to session ticket keys being implicitly shared by
Config.Clone. Since this fix is broader, the Config.Clone behavior change
has been reverted.
Note that VerifyPeerCertificate still behaves as documented: it does not
apply to resumed connections. Applications that use
Config.GetConfigForClient or Config.Clone and do not wish to blindly resume
connections established with the original Config must use VerifyConnection
instead (or SetSessionTicketKeys or SessionTicketsDisabled).
For more details, see the announcement:
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Blake3 unconditionally enables C++ support, which unconditionally
requires C++20 when built with cmake >= 3.12, even when this is not
required.
Fixing this does not look trivial, and rather than botching the build,
just require C++20, available from gcc 8.x onward.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Use of threading requires a C++20 compiler, and the oneTBB
implementation. oneTBB is missing from Buildroot, but a system
one may be used if found.
Even if the default for threading is disabled, explicitly state so,
in case the default changes in the future.
Also disable examples, we don't and won't need them.
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Heiko Thiery <heiko.thiery@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Ensure that the SHA_CRYPT option is enabled when the system configuration is
set to SHA256/512, as otherwise passwd complains when a password is changed:
passwd
...
Invalid ENCRYPT_METHOD value: 'SHA512'.
Defaulting to DES.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
As described in https://gitlab.com/buildroot.org/buildroot/-/issues/160, the
github mirror is getting shut down - So move to the sourceware.org git repo.
The github mirror was originally used because of performance and reliability
issues with sourceware, but that seems be resolved now after server/RAM
upgrades - E.G. from the sourceware news:
April 22, 2024
server2.sourceware.org now has 512GB RAM, thanks Red Hat.
https://sourceware.org/
So change back to fetch glibc (and localedef) from sourceware.org over git.
Notice: The git archiving leads to slightly different paths and permissions
in the tarball, but the file content is identical:
mkdir a && tar -C a -x --strip-components=1 -f \
path/to/glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125.tar.gz
mkdir b && tar -C b -x --strip-components=1 -f \
path/to/glibc-2.42-51-gcbf39c26b25801e9bc88499b4fd361ac172d4125-git4.tar.gz
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien:
- add missing SoB line
- fix command lines in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Unfortunately, if all optee-related packages are not updated at the same
time, optee-test will not build. This commit bumps all the optee
components at once.
The version bump is needed since optee-examples and optee-test can no
longer compile (compatibility with CMake < 3.5 has been removed from
CMake).
For release details, see:
https://github.com/OP-TEE/optee_os/blob/4.9.0/CHANGELOG.md#op-tee---version-490-2026-01-16
Signed-off-by: Jakob Kastelic <jkastelic@thinksrs.com>
[Julien: add link to release details]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since commit 0e3ddc9dc8 "{linux,
linux-headers}: split hash file in before and from 6.17" there are two
hash file variants, and symlinks for the individual versions. These
were not updated in 48186093fd "bump
5.{10, 15}.x / 6.{1, 6, 12, 18}.x series".
Fixes: 48186093fd
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Swig has a compiled in absolute path to its data files, which can be
overridden using the SWIG_LIB environment variable:
https://github.com/swig/swig/blob/v4.1.1/Source/Modules/main.cxx#L931-L945
This unfortunately means that host-swig misbehaves when used in the SDK, as
this points to the ${HOST_DIR}/bin of the build, which may not be available
when the SDK is used.
The issue was reported upstream but rejected in
https://github.com/swig/swig/issues/253, so instead add a wrapper script
which calculates a sensible SWIG_LIB relative to the wrapper location unless
SWIG_LIB is set, similar to how we do it for E.G. gcc or pkgconf.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Peter: add quotes to make shellcheck happy]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Commit [1] introduced a patch to fix CVE-2025-62291. Since [2] the
security patches neeed to reference the vulnerability with the `CVE: `
trailer in the patch header.
[1] b009935e27 package/strongswan: add patch to fix CVE-2025-62291
[2] 1167d0ff3d docs/manual: mention CVE trailer
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
On Buildroot 2025.05.3, Meson's custom LLVM parser uses llvm-config
with a default search path of /usr/bin, causing it to detect the host
system's llvm-config (version 18.1.3) instead of the buildroot-compiled
one. This forces all LLVM-related packages to match version 18.1.3, but
since the host system lacks llvmspirvlib, the build fails. This patch
forces Meson to use the buildroot-compiled llvm-config.
On the master branch, the meson is somehow able to find the right
llvm-config, so reproduction only seems to be possible if the host
machine ships with a newer version as the one buildroot is using.
llvm-config found: YES
([...]/output/host/bin/llvm-config)
21.1.8
Run-time dependency LLVM (modules: bitwriter, core, coverage, engine,
executionengine, instcombine, irreader, libdriver, linker, lto,
mcdisassembler, mcjit, native, option, scalaropts, target,
transformutils, all-targets, coroutines, frontenddriver, frontendhlsl,
lto, windowsdriver) found: YES 21.1.8
Note that LLVM_CONFIG is a CMake option, not a Meson one. This is because
Meson has custom dependency resolution logic for LLVM (see
https://mesonbuild.com/Dependencies.html#llvm). The EXTRA_BINARIES mechanism
cannot be used here, as it only applies to cross-compilation scenarios, which
does not apply to host-mesa3d builds.
Reproduction (On BR2 tag: 2025.05.3):
BR2_x86_64=y
BR2_x86_atom=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_X86_64_GLIBC_STABLE=y
BR2_LINUX_KERNEL=y
BR2_LINUX_KERNEL_CUSTOM_VERSION=y
BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.1.24"
BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/pc/linux.config"
BR2_LINUX_KERNEL_INSTALL_TARGET=y
BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_LLVM=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_I915=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_IRIS=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_MESA3D_OPENGL_ES=y
Fixes:
llvm-config found: YES (/usr/bin/llvm-config-18) 18.1.3
Run-time dependency LLVM (modules: bitwriter, core, coverage, engine, executionengine, instcombine, irreader, libdriver, linker, lto, mcdisassembler, mcjit, native, option, scalaropts, target, transformutils, all-targets, coroutines, frontenddriver, frontendhlsl, lto, windowsdriver) found: YES 18.1.3
Dependency LLVMSPIRVLib found: NO. Found 15.0.0.0 but need: '>= 18.1' ; matched: '>= 15.0.0.0', '< 18.2'
Run-time dependency llvmspirvlib found: NO (tried cmake)
output/build/host-mesa3d-25.0.6/meson.build:1882:21: ERROR: Dependency lookup for LLVMSPIRVLib with method 'pkgconfig' failed: Invalid version, need 'LLVMSPIRVLib' ['>= 18.1'] found '15.0.0.0'.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Romain:
- Update the commit title
- Update commit log about this issue on master branch
https://lore.kernel.org/buildroot/CACXRmJh1-5Cy92kF9TM5nDs_uB90WAe5iOGmNNL2E-cMhJE7GA@mail.gmail.com/
]
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Buildroot commit [1] introduced a new Buildroot-Initialize.cmake file,
to mimic the upstream Linux-Initialize.cmake.
However, this upstream file was introduced in commit [2], which was
introduced in CMake 3.27.
When compiling a cmake package on a host with a cmake older than
version 3.27 (for example, the Buildroot Docker reference image has
cmake 3.25), the configuration fails with the error:
CMake Error at /buildroot/output/host/share/buildroot/Platform/Buildroot-Initialize.cmake:1 (include):
include could not find requested file:
Platform/Linux-Initialize
Call Stack (most recent call first):
/usr/share/cmake-3.25/Modules/CMakeSystemSpecificInitialize.cmake:21 (include)
CMakeLists.txt:20 (project)
CMake version < 3.27 is setting its LINUX predefine elsewhere (see
commit log of [1]), so this commit fixes the issue by simply making
the include optional. This will guarante thee cmake predefines will
be present in all the cases.
Fixes:
[1]
[1] ef9f0a07ed
[2] cc737ae829
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The old URL now leads to an HTTP 404 not found error.
Update it to the new one which contains the hashes for the current
release as well as older ones.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
The current 'install' target comprises 'install-libs', 'install-apps'
and 'install-docs'.
In our case we don't want to install documentation to the target, so
just run the other two.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
It should be noted that because the python bindings have wrong default
include dirs, they are useless if the includes are not provided
externally.
Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
When BR2_UCLIBC_INSTALL_UTILS is enabled, utils such as getconf, ldd,
locale get installed to TARGET_DIR. However, they do not get installed
to STAGING_DIR, which is annoying as it means that they are not part
of external toolchains built by Buildroot.
This commit adjusts the uclibc package to make sure those tools also
get installed to STAGING_DIR.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The UCLIBC_INSTALL_UTILS_STAGING is really badly named, as it doesn't
install anything to STAGING_DIR. Instead, it installs the host variant
of ldd and ldconfig into $(HOST_DIR)/bin. Therefore, rename it to
UCLIBC_INSTALL_HOST_UTILS.
This is important as a follow-up commit will re-introduce a
UCLIBC_INSTALL_UTILS_STAGING variable which really installs things
into STAGING_DIR.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Upstream is dead, website unreachable, and the use case in 2026 is
dubious, so drop the package.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The ukify tool can be used to create Unified Kernel Images.
Signed-off-by: Bram Vlerick <bram.vlerick@openpixelsystems.org>
[Arnout:
- Remove the target option.
- Use enabled/disabled instead of true/false.
- Always enable for host build.
- Add dependency on host-python-pefile.
]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
When building system binaries you may not even want TCG support if you
are only intending to use KVM. Provide the options so the user can
select only what they need.
With only KVM selected the QEMU build will generally only build the
binary for your target system. We keep TCG support on by default so as
not to break existing defconfigs.
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Although it is possible to configure an AArch64 CPU without support
for EL2 in practice all the common AArch64 have supported
virtualisation from the start.
If we really wanted to be strict we could blacklist known non-EL2 CPUs
but AFAICT all the current ones in the config have EL2.
I should also note KVM on Arm is deprecated and was removed from the
kernel in v6.10.
Reviewed-by: Jesse Taube <jesse@rivosinc.com>
Reviewed-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The current generated cJSONConfig.cmake holds hard coded path of libraries and makes it impossible to use in SDKs.
Use CMakePackageConfigHelpers and @PACKAGE_INIT@ to make them suit for real environment dynamically.
Signed-off-by: Guillaume Chaye <guillaume.chaye@zeetim.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The .mk file currently states:
If LWS_MAX_SMP=1, then there is no code related to pthreads
compiled in the library. If unset, LWS_MAX_SMP defaults to 32 and a
small amount of pthread mutex code is built into the library.
However, this is incorrect: when unset, LWS_MAX_SMP is actually set to
1, so mutexes aren't built in.
To fix, set it to 32 explicitly when threads are enabled. Why 32?
Because
https://libwebsockets.org/lws-api-doc-master/html/md_README.coding.html
states:
You can control the context basic data allocation for
multithreading from Cmake using -DLWS_MAX_SMP=, if not given it's
set to 32.
Signed-off-by: Bart Van Severen <bart.vanseveren@barco.com>
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
When given a certificate directory with --with-ca-path, curl doesn't
list the files in that directory. Instead, it uses the certificate hash
to directly open the requested CA certificate. Therefore, putting a
bundle in that directory and removing all the individual certificates is
not possible.
In order to support use of the bundle, a separate configuration option
--with-ca-bundle is needed. With this option, it is possible to remove
the individual certificates and include just the bundle, which reduces
the size of the root filesystem a bit.
Note that the bundle is generated by the ca-certificates package, which
also installs the individual certificates and the hash symlinks. It
keeps both individual certificates and the bundle in the target.
Signed-off-by: Lance Fredrickson <lancethepants@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Changes:
- Fix memory leak in which() on realloc() failure
- Fix pidfile() to handle missing trailing slash in prefix path
Changes to src/pidfile.c do not affect the licensing terms, but
require updating the hash of this file that is used as one of the
license files.
https://github.com/troglobit/libite/releases/tag/v2.6.2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Unfortunately, parts of the library is not very no-MMU friendly atm.
The below check fails due to runbg.c requiring fork().
$ ./utils/test-pkg -c libite.config -p libite
bootlin-armv5-uclibc [1/6]: OK
bootlin-armv7-glibc [2/6]: OK
bootlin-armv7m-uclibc [3/6]: FAILED
bootlin-x86-64-musl [4/6]: OK
br-arm-full-static [5/6]: OK
arm-aarch64 [6/6]: OK
The dependency was introduced in libite v2.6.0, so this patch should
be backported to v2025.02.x.
Fixes:
https://autobuild.buildroot.net/results/6c6fd2ae410a82c44da54ee13a09a38a7ab220c1/
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
With the latest U-Boot update, U-Boot now handles this step in the
board setup removing the need to set this from a custom boot script.
Remove redundant fdt set command from boot script.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Bump Linux to latest release tag: linux4microchip+fpga-2025.10. This
includes the latest features and bug fixes. Included is a kernel bump to
v6.12.48.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Bump U-Boot to latest release tag: linux4microchip+fpga-2025.10. This
includes the latest features and bug fixes. Included is a U-Boot version
bump to v2025.07.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Bump Linux to latest release tag linux4microchip+fpga-2025.10. This
includes the latest features and bug fixes. Included is a kernel version
buump to v6.12.48 and a GPIO driver fix.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Bump U-Boot to latest release tag linux4microchip+fpga-2025.10. This
includes the latest features and bug fixes. Included is a U-Boot version
update from v2023.07 to v2025.07.
Signed-off-by: Jamie Gibbons <jamie.gibbons@microchip.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
There are several use cases for installing additional files in the boot
partition that is read by the RPi firmware.
- autoboot.txt is an optional configuration file for the RPi
firmware [1]. Supporting several autoboot files will enable A/B
setups, as using the renameat2() system call with the RENAME_EXCHANGE
flag will let users atomically replace one autoboot configuration
file with the other. This improves reliability in the case of an
update which could potentially be interrupted.
- Multiple cmdline.txt files are useful in the context of a new
[boot_partition] conditional filter introduced in config.txt in
commit [2]. This is useful for A/B systems to have identical BootFS
partitions on both slots, and not have to edit the kernel command line
to ensure the kernel will load the right rootFS after update of the
BootFS.
- rpi-firmware contains DTB overlays for many "standard" hats, but a
custom hat may require a custom overlay.
Although it is possible to install additional files in the boot
partition in the post-image script, it is very convenient to be able to
use the standard RPi post-image script in
board/raspberrypi/post-image.sh. That script looks in
$BINARIES_DIR/rpi-firmware, so it is convenient to be able to place
additional files there.
Add the option BR2_PACKAGE_RPI_FIRMWARE_EXTRA_FILES which is simply a
list of files to be copied to $BINARIES_DIR/rpi-firmware, which will
eventually end up as the boot partition. Make sure that this is done as
the last step of RPI_FIRMWARE_INSTALL_IMAGES_CMDS, so the files can
override files installed by earlier steps.
[1] https://www.raspberrypi.com/documentation/computers/config_txt.html#autoboot-txt
[2] d50b2b32f1
Signed-off-by: Olivier Benjamin <olivier.benjamin@bootlin.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
For release notes, see:
https://gitlab.winehq.org/wine/wine/-/releases/wine-11.0
The --without-osmesa configure option was removed upstream, in
commit [1]. This commit removes the options from _CONF_OPTS.
Also, since upstream commit [2], the /usr/bin/wine program became
a "tool". It needs to be enabled when cross-compiling. As suggested
in [3], this commit adds --enable-tools in WINE_CONF_OPTS.
This commit also updates the LICENSE file hash, after year
update in [4].
[1] 370e7d9a50
[2] 6d28db86c9
[3] https://bugs.winehq.org/show_bug.cgi?id=57847
[4] ab59cc16c5
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Adds a new user-configurable string to arch/Config.in.riscv, and in
arch/arch.mk.riscv appends it to GCC_TARGET_ARCH.
This enables custom extensions/combinations to be easily configured.
Signed-off-by: Charlie Jenkins <charlie@rivosinc.com>
Reviewed-by: Jesse Taube <Mr.Bossman075@gmail.com>
[Arnout:
- fix check-package warnings
- introduce ARCH_RISV_ISA_EXTRA to simplify stripping of quotes
]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
This commit adds the -N/--needs-update option, disabled by default,
to list only packages with newer upstream versions. All other packages
will be excluded from the HTML or JSON output.
Signed-off-by: Kadambini Nema <kadambini.nema@gmail.com>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Commit 105e4618c5 added a patch to fix
CMake 4 compatibility, but due to line endings issues the patch
doesn't apply properly. This commit fixes the patch so that it does
apply as it should.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Currently, the relocate-sdk.sh script scans the whole extracted SDK tree
to find instances of paths it needs to replace, which can take a
significant amount of time when the SDK is large, particularly relative
to the number of files that actually need to change.
However, the resulting list only depends on the SDK tarball itself, so
we can calculate it at build time and ship it with the tarball so
relocate-sdk.sh can use it directly.
Testing this on my machine with somewhat IOPS-limited rotating media,
the time goes down from:
$ time ./relocate-sdk.sh
Relocating the buildroot SDK from [...] to [...] ...
./relocate-sdk.sh 5.19s user 26.21s system 9% cpu 5:34.40 total
To:
$ time ./relocate-sdk.sh
Relocating the buildroot SDK from [...] to [...] ...
./relocate-sdk.sh 0.49s user 0.29s system 103% cpu 0.749 total
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Commit [1] bumped glibc from 2.42-3-gbc13db739 to 2.42-51-gcbf39c26b
to fix some CVEs, but forgot to add those CVEs to GLIBC_IGNORE_CVES.
This was needed because the GLIBC_CPE_ID_VERSION used for CVE checks
remains to the same value "2.42" which is marked as vulnerable to
those CVEs.
This commit adds those _IGNORE_CVES with the corresponding upstream
commit references, to make sure they will not be reported by the
"make pkg-stats" command.
Fixes:
- [1]
[1] 18de297a5a
Cc: Waldemar Brodkorb <wbx@openadk.org>
Cc: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
When running "make pkg-stats" on a host with Python 3.14 (e.g.
Fedora 43 for example), the execution fails with the error:
Checking URL status
Traceback (most recent call last):
File "/buildroot/support/scripts/pkg-stats", line 1387, in <module>
__main__()
~~~~~~~~^^
File "/buildroot/support/scripts/pkg-stats", line 1368, in __main__
loop = asyncio.get_event_loop()
File "/usr/lib64/python3.14/asyncio/events.py", line 715, in get_event_loop
raise RuntimeError('There is no current event loop in thread %r.'
% threading.current_thread().name)
RuntimeError: There is no current event loop in thread 'MainThread'.
This is due to a breaking change introduced in Python 3.14
asyncio.get_event_loop(). See [1]. Before Python 3.14, this call was
creating and setting an event loop if there was none. This situation
is now a runtime error.
In order to fix this issue with newer Python version, while keeping
backward compatibility, this commit replaces the code:
loop = asyncio.get_event_loop()
by an explicit event loop creation:
loop = asyncio.new_event_loop()
asyncio.set_event_loop(loop)
This commit was tested on a Fedora 43 host with Python-3.14.2, and
with the Buildroot Docker image plus the python3-aiohttp package
which is a Debian 12 with Python-3.11.2.
[1] https://docs.python.org/3.14/library/asyncio-eventloop.html#asyncio.get_event_loop
Signed-off-by: Julien Olivain <ju.o@free.fr>
Tested-by: Vincent Fazio <vfazio@xes-inc.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Commits [1] and [2] are installing host SDK files
"$(HOST_DIR)/usr/share".
check-package (see [3]) reports the error:
package/pico-sdk/pico-sdk.mk:23: install files to $(HOST_DIR)/ instead of $(HOST_DIR)/usr/
package/pico-sdk/pico-sdk.mk:24: install files to $(HOST_DIR)/ instead of $(HOST_DIR)/usr/
package/picotool/picotool.mk:15: install files to $(HOST_DIR)/ instead of $(HOST_DIR)/usr/
This commit installs the host SDK files to "$(HOST_DIR)/share" to fix
this error.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/12970341499
[1] ceb800d3c6
[2] 926381d360
[3] 29a0dd4a30
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Currently, when both libnss and GnuTLS are present, NetworkManager will
get linked to libnss.
The NetworkManager project doesn't recommend one over the other
officially and has supported both from day one back in 2007.
Arguments which one to prefer can be made in either direction:
Points in favor of libnss:
- It's the default value in the NM build system, so it would be the
preferred backend if both are available and we didn't supply any
options to the build process
- It's probably the more mature of the two, given that it's being used
in Mozilla products
Points in favor of GnuTLS:
- While both backends seem feature-equivalent, the
_nm_crypto_verify_pkcs8 function is stubbed out in the libnss
code[1].
- Both Debian and Fedora explicitly select GnuTLS in their packages. At
least in the case of Fedora it seems to have been a conscious
choice[2].
Given what it's actually used for in the code base, the choice does not
matter a lot. However, since it is marginally more feature-complete and
seems to be preferred by other distributions, let's switch to GnuTLS.
[1] 36f8de25c4/src/libnm-crypto/nm-crypto-nss.c (L523-540)
[2] 29a9c41bea
Signed-off-by: Florian Larysch <fl@n621.de>
Reviewed-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
The network-manager package currently pulls in either gnutls or libnss,
neither of which are very common and it might be the only reason why
they are present on a system.
However, most of NetworkManager works just fine without any cryptography
support, it only seems to be used in test cases and 802.1X support code.
Remove the dependency but use a library if it is present.
Note that this changes the default behavior. If network-manager was the
only package pulling in gnutls, it won't do this anymore and use the
"null" backend. Add a note about this to the manual.
Signed-off-by: Florian Larysch <fl@n621.de>
Tested-by: Marcus Hoffmann <buildroot@bubu1.eu>
Reviewed-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Marcus: Change buildroot version to 2026.02 in migrating.adoc]
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Add BR2_PACKAGE_DPDK_APPS_LIST to control which DPDK applications are
built:
- empty : use DPDK defaults
- none : disable all apps (-Ddisable_apps='*')
- list : pass to -Denable_apps= (comma-separated)
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add BR2_PACKAGE_DPDK_LIBS_LIST to control which DPDK libraries are
built:
- empty : use DPDK defaults
- none : disable all libs (-Ddisable_libs='*')
- list : pass to -Denable_libs= (comma-separated)
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add BR2_PACKAGE_DPDK_DRIVERS_LIST to control which DPDK applications are
built:
- empty : use DPDK defaults
- none : disable all drivers (-Ddisable_drivers='*/*')
- list : pass to -Denable_drivers= (comma-separated)
Signed-off-by: Maxime Leroy <maxime@leroys.fr>
[Julien: slightly change the drivers Config.in help text:
- rename net/ixgbe to net/intel/ixgbe
- change find -maxdepth value to 3
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
When the host system has asciidoctor and po4a/poman installed,
util-linux detect them and automatically enable manual pages and
their translations. This can significantly increase the package
build time (in my case, from 20s to 1m50s). See upstream
commit [1] and [2].
Since manual pages are not needed in Buildroot, this commit adds in
_CONF_OPTS for host host and target variants the options to always
disable the detection of those programs (--disable-asciidoc
--disable-poman). This will always disable the generation of manual
pages.
Note: Buildroot attempts to globally disable documentation for
autotools packages by passing various --disable-docs configure
options (see [3]), but those are not recognized by util-linux.
This commit also reorder the options for UTIL_LINUX_CONF_OPTS.
[1] 9acfc349e0
[2] 236421a491
[3] https://gitlab.com/buildroot.org/buildroot/-/blob/2025.11/package/pkg-autotools.mk#L184-186
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
There are multiple defconfig fragments we can select to modify the final
tiboot3.bin image to support different boot methods or enable features
supported by a board. Allow the ti-k3-r5-loader package to select
defconfig gragments during a build
Signed-off-by: Bryan Brattlof <bb@ti.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
LLVM is already implicitly enabled for host-mesa3d when
BR2_PACKAGE_MESA3D_NEEDS_PRECOMP_COMPILER is selected. This blind
option is automatically enabled when LLVM is required by drivers such
as intel-iris, panfrost, imagination, or intel-vulkan.
The BR2_PACKAGE_MESA3D_LLVM option also independently selects host-llvm,
but this change makes the dependency more explicit for host-mesa3d
builds.
Note that disabling LLVM is not possible for host-mesa3d, as the build
will fail with:
../../../br-test-pkg/bootlin-armv5-uclibc/build/host-mesa3d-25.3.2/meson.build:847:3: ERROR: Feature llvm cannot be disabled: CLC requires LLVM
Signed-off-by: Thomas Devoogdt <thomas@devoogdt.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Backport two security fixes from upstream. They are in newer releases,
but to facilitate backporting to our LTS releases, this backports the
fixes.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The dependencies on Boost.System, Boost.Filesystem were removed in
v23.0 [0][1] and Boost.Thread in v21.99 [2].
This was never reflected in the Buildroot package so do it now.
[0] 07269321f3
[1] b87f9c5edf
[2] 06e1d7d81d
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Commit [1] added the "Upstream:" package patch tag, but forgot to
remove the corresponding .checkpackageignore entry.
This commit fixes that.
Fixes:
package/efl/0001-ecore_fb-fix-build-with-tslib.patch:0: lib_patch.Upstream was expected to fail, did you fix the file and forget to update .checkpackageignore?
[1] bac34296bf
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Peter: Fix flake8 warning, use http.server instead of relying on
connectivity]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Patch 0001 has the upstream information, just not properly formatted,
so we fix this.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Thomas: extracted from a bigger patch from Bernd]
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
According to the official requirements, bindgen needs libclang to
parse C/C++ headers. libclang is loaded at runtime by bindgen, which
is why we didn't notice any build issue. However, using bindgen on a
simple header file blows up:
thread 'main' panicked at bindgen/lib.rs:616:27:
Unable to find libclang: "couldn't find any valid shared libraries matching: ['libclang.so', 'libclang-*.so', 'libclang.so.*', 'libclang-*.so.*'], s
et the `LIBCLANG_PATH` environment variable to a path where one of these files can be found (invalid: [])"
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
So far, bindgen was only used by mesa3d, and it turns out that mesa3d
also depends on clang, which pulls in host-clang, so the problem was
not visible. However, as we're about to use bindgen for other
things (namely Rust support in Linux), this issue needs to be fixed.
See:
https://rust-lang.github.io/rust-bindgen/requirements.html
Signed-off-by: El Mehdi YOUNES <elmehdi.younes@smile.fr>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
mpg123 supports (and prefers) SDL2 as well for the sdl backends since 1.26.9
with:
792615f651
So support that here as well.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Arm Trusted Firmware (TF-A) can be used to load U-Boot or another
bootloader, which in turn loads the Linux kernel. However, TF-A is
capable of loading the kernel directly. To this end, we need to define
the BL33 and BL33_CFG compile options containing, respectively, the
zImage and the DTB.
This config introduces a new config option,
BR2_TARGET_ARM_TRUSTED_FIRMWARE_LINUX_AS_BL33, which sets the BL33 and
BL33_CFG parameters, and ensures that the kernel is built before the
TF-A by having linux as a _DEPENDENCY of the TF-A.
Signed-off-by: Jakob Kastelic <kastelic.jakob@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
The new target provides a convenient way to run utils/check-package on
any external trees, using .checkpackageignore files from the
respective trees if present.
While .checkpackageignore should be used as little as possible, in a
few cases adding overrides for false-positives to the affected files
is not feasible, a practical example of this is a Markdown file
misidentified as Python by libmagic (likely due to code blocks).
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
[Arnout: set ${ignore} explicitly to empty, in case it exists in the
environment.]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The test failed in the past, due to kbd build failure. See [1].
This specific issue was fixed by commit [2].
This commit was originally written to workaround this issue, which was
unrelated to the actual package being tested. Since systemd-vconsole
is not needed anyway, this commit removes it from the test config.
[1] https://gitlab.com/buildroot.org/buildroot/-/jobs/12363929666
[2] d98d9ba28f
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
[Julien: reword the commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Testing with a really old toolchain is helpful to catch issues related
to kernel headers version issues, gcc version issues, etc. We chose a
glibc toolchain though as old musl or uClibc-ng versions tend to lack
a number of features that are needed by modern software.
This toolchain is placed near the top of toolchain-configs.csv, so
that it is used as part of the "base" set of toolchain that test-pkg
uses, even without the -a option.
test-pkg takes the 6 first toolchains of this CSV file for its base
test, and actually the comment in toolchain-configs.csv was wrong
since commit 53a8c5150e, which removed a
toolchain from the base set, but not realizing that test-pkg would
anyway continue to test the first 6 toolchains.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The prebuilt MIPS64 toolchains are very old, causing build issues (for
example recently with the systemd v258 update). Replace them both a
single toolchain configuration that uses one of the mips64el Bootlin
toolchains.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- br-i386-pentium4-full.config as an x86 32-bit toolchain test is
already reasonably covered by bootlin-x86-i686-musl.config
- br-microblazeel-full-internal.config as a Microblaze toolchain test is
already reasonably covered by bootlin-microblazeel-uclibc.config
- br-powerpc-internal-full.config and br-powerpc-603e-basic-cpp.config
as PowerPC 32-bit toolchain tests are already reasonably covered by
bootlin-powerpc-e500mc-uclibc.config
- br-powerpc64-power7-glibc.config as a PowerPC 64-bit toolchain test
is already reasonably covered by
bootlin-powerpc64le-power8-glibc.config
- br-riscv64-full-internal.config as a RISC-V 64-bit toolchain test is
already reasonably covered by bootlin-riscv64-glibc.config and
bootlin-riscv64-musl.config
- br-s390x-z13-internal-glibc.config as a s390 toolchain test is
already reasonably covered by bootlin-s390x-z13-glibc.config
- br-xtensa-full-internal.config as an Xtensa toolchain test is
already reasonably covered by bootlin-xtensa-uclibc.config
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Building internal toolchains takes a long time, and since the
differences between the 3 internal ARM toolchains is just the libc,
and we're already testing uclibc/musl with external toolchains, it
doesn't make much sense to build 3 different ARM internal toolchains.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
We're already testing the ARC architecture with one Bootlin toolchain,
it doesn't make sense to also test with two Buildroot internal
toolchains the ARC architecture, which is not a primary architecture
for Buildroot.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Added four upstream patches backported from FreeRDP 3.x.
The remaining build error:
/home/bernd/buildroot/output/build/freerdp-2.11.7-18-g0ee17e2f8e49d56ab5b90d5160fa8f87ffc445e0/
channels/client/tables.c:129:22:
error: initialization of ‘UINT (*)(void)’ {aka ‘unsigned int (*)(void)’}
from incompatible pointer type ‘UINT (*)(void *)’ {aka ‘unsigned int (*)(void *)’}
[-Wincompatible-pointer-types]
129 | { "oss", "", oss_freerdp_rdpsnd_client_subsystem_entry },
is fixed by adding -Wno-incompatible-pointer-types to CFLAGS due to
tables.c being dynamically created during the build and backporting the
supposed upstream fix
fe6d861a5c
is too invasive.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
We're about to bump abseil to a version >= 20250512.02, which requires
C++17, meaning that protobuf/grpc will also C++17. This in turn means
that the grpc support in collectd will also need C++17.
So just like our current patch 0002-configure.ac-fix-grpc-build.patch
updates the collectd logic from C++11 to C++14, this new
patch (accepted upstream) updates the collectd logic again from C++14
to C++17.
Signed-off-by: Michael Nosthoff <buildroot@heine.tech>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
In linux 6.17, the license file LICENSES/preferred/GPL-2.0 was modified.
As a result, also its hash changed, and the hash was duly updated in
commit d6c0f0015b. Of course, this is only
valid for kernel versions from 6.17 - but at the time, we only set
LINUX_LICENSE_FILES for the latest kernel version, not for any other
kernel versions.
Since commit 305a2d91731fade45f35c259cb012bdf17e8dbeb, we also set
LINUX_LICENSE_FILES for all other versions, including e.g. the CIP
versions. Similarly, we now set LICENSE_FILES for all linux-headers
versions. Thus, the hash check of the license file fails for all older
kernel versions.
Fix this by splitting the hash file in two hash files: before-6.17 and
from-6.17. We keep just two hash file rather than a separate one for
each version to limit the number of files that need to be updated when
bumping kernel versions. Create symlinks for all the CIP version in
linux and for all supported versions in linux-headers.
Include the CIP versions as well for linux-headers. They are used when
the kernel is set to the CIP version and linux-headers to
same-as-kernel.
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The linux-headers package was not providing any license file for any
version other than the latest one.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
For the headers-as-kernel case, use LINUX_LICENSE_FILES and disable the
Kconfig option entirely.
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The AT91Bootstrap3 package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Note that version 3.X of at91bootstrap didn't have an open source
license and no license file either. Keep that behavior.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The ATF package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The Barebox package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The OpenSBI package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The OP-TEE OS package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The U-Boot package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
The Linux package was not providing any license file when a custom
Linux version was selected.
Fix this by adding a Kconfig option to specify the license file,
with a default value set to the commonly used license paths.
Signed-off-by: Kory Maincent <kory.maincent@bootlin.com>
[Arnout: use a single Kconfig option with conditional prompt]
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
Building berkeleydb is broken with a non-threaded toolchain with gcc >=
14.x:
../src/rep/rep_method.c:1740:25: error: implicit declaration of function
'__repmgr_get_nsites'; did you mean '__rep_get_nsites'?
[-Wimplicit-function-declaration]
1740 | return (__repmgr_get_nsites(env, n));
According to src/repmgr/repmgr_util.c, line 503+, the function
'__repmgr_get_nsites' mentioned in the gcc error message "may only be
called after threads have been started".
This source file repmgr_util.c belongs to REPMGR_OBJS according to
dist/Makefile.in, line 249+, which is, according to dist/configure.ac,
line 956, only build if thread support is present.
In a non-threaded build '__repmgr_get_nsites' does not exist causing the
build error.
To fix the build error we disable replication for non-threaded
toolchains.
Using gcc 13.x the build error does not occur, tested with this
defconfig:
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_PTHREADS_NONE=y
BR2_GCC_VERSION_13_X=y
BR2_PACKAGE_BERKELEYDB=y
Using this minimal gcc 14.x-based defconfig
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_PTHREADS_NONE=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_BERKELEYDB=y
the build error can be reproduced.
The oldest build error of this kind, afaics, dates back to 2024-06-13:
https://autobuild.buildroot.net/results/e0d/e0d6bdbef01bee277b0da83605b2906af876058a/
Fixes:
https://autobuild.buildroot.net/results/792/792ed942d17bb8d00cd321536a102f6dd63b6a8a/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The package imports itself in setup.py to get the package-name and
version number. Dping this during the buildroot build would require
buisling host-python with sqlite support, which we are currently not set
up for. It also seems wasteful for just extracting the version number
and package name, so instead we replace the import by using a hardcoded
package-name and the version number stored in buildroot.
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Add a defconfig to run Linux on a large range of 32-bit HP PA-RISC 1.1
Workstations, such as the HP 9000 700 and Visualize workstations.
While at it, add this defconfig to myself in DEVELOPERS.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Palo is a PA-RISC/Linux boot loader.
It can be used to make bootable disk images or network bootable images.
While at it, add this boot package to myself in DEVELOPERS.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a defconfig to run Linux on a HP Visualize B160L PA-RISC
Workstation, emulated with Qemu.
While at it, add this defconfig to myself in DEVELOPERS.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Romain Naour <romain.naour@gmail.com>
[Julien: update kernel to 6.18.7 to align with other qemu defconfigs]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add support for the Precision Architecture (a.k.a. PA-RISC),
a 32-bit architecture developed by Hewlett Packard.
While at it, add this arch to myself in DEVELOPERS.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Julien Olivain <ju.o@free.fr>
[Julien: arch "arch/" prefix in commit title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add a host-picotool package to picotool.
This will allow users to build rpi pico applications on the host system.
Signed-off-by: Jesse Taube <Mr.Bossman075@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add a host-pico-sdk package to pico-sdk.
This will allow users to build rpi pico applications on the host system.
Signed-off-by: Jesse Taube <Mr.Bossman075@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
pico-sdk and picotool 2.x.x adds support for the rp2350 bump package to
latest version.
picotool needs mbedtls for --hash --sign and --offset.
Clone submodules in pico-sdk to provide the nessasaary files for
picotool to build and link mbedtls and other optional libraries.
Signed-off-by: Jesse Taube <Mr.Bossman075@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
See here for changes:
https://nginx.org/en/CHANGES-1.28
Following security related issues are fixed:
*) Security: processing of a specially crafted login/password when using
the "none" authentication method in the ngx_mail_smtp_module might
cause worker process memory disclosure to the authentication server
(CVE-2025-53859).
*) Security: insufficient check in virtual servers handling with TLSv1.3
SNI allowed to reuse SSL sessions in a different virtual server, to
bypass client SSL certificates verification (CVE-2025-23419).
*) Security: processing of a specially crafted mp4 file by the
ngx_http_mp4_module might cause a worker process crash
(CVE-2024-7347).
Thanks to Nils Bars.
*) Security: when using HTTP/3, processing of a specially crafted QUIC
session might cause a worker process crash, worker process memory
disclosure on systems with MTU larger than 4096 bytes, or might have
potential other impact (CVE-2024-32760, CVE-2024-31079,
CVE-2024-35200, CVE-2024-34161).
Thanks to Nils Bars of CISPA.
Update patch 0007, which does not apply cleanly.
License file was changed, year was bumped to 2025.
Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
For change log since 1.9.0, see:
https://codeberg.org/ivarch/pv/src/tag/v1.10.3/docs/NEWS.md
Upstream commit [1], included in version 1.9.42, introduced a use
of fork(). This commit adds this new dependency.
The pgp key ID used to sign the source archive changed. This commit
updates the comment in the hash file.
[1] fb7c05c262
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Buildroot commit 99585db1e8 bumped the
package from version 9.21.4 to 9.33.0.
Upstream added std::atomic to drbdmon with commit
3baf945732
to version 9.25.0 causing build errors:
/home/autobuild/autobuild/instance-2/output-1/per-package/drbd-utils/host/bin/../lib/gcc/microblazeel-buildroot-linux-uclibc/14.3.0/../../../../microblazeel-buildroot-linux-uclibc/bin/ld:
MessageLogNotification.o: in function `MessageLogNotification::query_log_changed()':
(.text+0xe8): undefined reference to `__atomic_exchange_1'
Fixes:
https://autobuild.buildroot.net/results/741/741606000c26bc994f243b0b865d26ff25592caa/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since its introduction in [1], by default the `generate-cyclonedx`
script doesn't include buildroot's virtual packages in its 'components'
list, unless using the `--virtual` argument.
References to virtual packages present in the 'show-info' output are
filtered out in the resulting dependencies.
This patch fix the default CycloneDX dependencies generation
without virtual packages to reference the packages that provide the
virtual package instead of just dropping the virtual package itself.
If we use the package `lbase64` that depends on the virtual package
`luainterpreter` as an example. The 'dependency' entry looks like the
following:
```
{
"ref": "lbase64",
"dependsOn": [
"host-skeleton",
"skeleton-init-common",
"skeleton-init-sysv",
"toolchain-external-bootlin"
]
}
```
The `luainterpreter` dependency is missing.
After applying this patch, package that provides the `luainterpreter` is
present:
```
{
"ref": "lbase64",
"dependsOn": [
"host-skeleton",
"lua",
"skeleton-custom",
"skeleton-init-sysv"
]
}
```
In the case of a virtual package provided by multiple packages all those
packages will be listed. This happens when generating an SBOM on the
entire Buildroot packages.
[1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since the introduction of the `generate-cyclonedx` script in [1] the
dependencies were 'recursive'. This means that the dependencies of a
package dependency were included.
The CycloneDX spec [2] states that only direct dependencies needs to be
included.
This patch drop the recursive dependencies.
[1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] https://cyclonedx.org/docs/1.6/json/#dependencies
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The definition of the project name & version is stored under the
`metadata:component` CycloneDX property.
Since the introduction of the `generate-cyclonedx` script [1] a
'buildroot' dependency entry that depends on every components has been
part of the generated SBOM.
Tools such as 'DependencyTrack' relies on such entry to create graph of
the entire project.
With the commit [2] that introduced the option to pass a custom project
name and version, this dependency reference was not updated to match the
custom 'bom-ref'.
This patch fixes the reference to match the custom project name.
[1] dbab39e2d9 support/scripts/generate-cyclonedx.py: add script to generate CycloneDX-style SBOM
[2] 9cbbc47762 utils/generate-cyclonedx: add project name and version options
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Brings additional optimizations and bugfixes:
Fix to heap buffer overflow in vp9_deblock, vp9_post_proc_frame, and
vp9_pack_bitstream.
Fix to integer overflow in vp9_highbd_post_proc, vp9_rc_regulate_q,
tiny_ssim, and vp9_calc_pframe_target_size_one_pass_cbr.
Fix to use-of-uninitialized-value in vp9_highbd_post_proc, mfqe, and
vp8_datarate_test.
Fix to out-of-bounds in log_tile_cols_from_picsize_level.
Fix to double free on initialization failure in vpx_codec_enc_init_multi.
Fix to division-by-zero crash in vpxenc with 0 FPS numerator input.
Fix to various build failures for Arm/SVE2, macOS cross-compilation, and
Xcode 16.
https://chromium.googlesource.com/webm/libvpx/+/refs/tags/v1.16.0
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch bumps the Linux kernel to version 6.18.8 and U-Boot to version 2026.01.
Tested on FriendlyElec NanoPi R3S.
Signed-off-by: Patrik Olsson <johan.patrik.olsson@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This patch bumps the Linux kernel to version 6.18.8 and U-Boot to version 2026.01.
Tested on Radxa ROCK 4SE.
Signed-off-by: Patrik Olsson <johan.patrik.olsson@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Update all qemu defconfigs to the latest Kernel LTS version.
configs/qemu_ppc_*defconfig now requires host-libelf, so this commit
selects BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF for those.
This commit also enables zstd-compressed modules support in
qemu_loongarch64_virt_efi_defconfig, due to upstream commit [1] which
added CONFIG_MODULE_COMPRESS_ZSTD=y in its arch defconfig.
This commit also updates the custom hash file comment to add the
upstream link.
All updated defconfigs were tested (compiled and booted).
[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3c272a7551af1c10f6dbba0e71add7dccc7733fa
Signed-off-by: Julien Olivain <ju.o@free.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
https://github.com/nodejs/node/blob/v22.22.0/doc/changelogs/CHANGELOG_V22.md
List of security fixes:
22.22.0:
(CVE-2025-59465) add TLSSocket default error handler
(CVE-2025-55132) disable futimes when permission model is enabled lib,
permission:
(CVE-2025-55130) require full read and write to symlink APIs src:
(CVE-2025-59466) rethrow stack overflow exceptions in async_hooks src,
lib:
(CVE-2025-55131) refactor unsafe buffer creation to remove zero-fill
toggle tls:
(CVE-2026-21637) route callback exceptions through error handlers
22.17.1:
(CVE-2025-27210) Windows Device Names (CON, PRN, AUX) Bypass Path
Traversal Protection in path.normalize()
Version 22.18.0 includes
a2d2d36bb1
which fixes build errors with python 3.14
"ImportError: cannot import name 'FancyURLopener' from 'urllib.request'"
introduced by buildroot commit a0a6abc8b1.
Updated license hash due to upstream commits:
ec60473ab10b5613f9fe0edf17198f
Switched _SITE to https.
Fixes:
https://autobuild.buildroot.net/results/da8/da82dc03cf0d42463fff1b5d9bf7a3c18cbf44dd/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
