Compare commits

..

107 Commits

Author SHA1 Message Date
Arnout Vandecappelle
cb857ba4c8 Makefile: Update for 2026.05.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-07-15 21:31:30 +02:00
Arnout Vandecappelle
e70f8f2ae1 CHANGES: Update for 2026.05.1
Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>
2026-07-15 21:18:49 +02:00
Thomas Devoogdt
afc0ca1723 package/webkitgtk: security bump to version 2.52.4
Release notes:

https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html

Fixes the following security issues:

https://webkitgtk.org/security/WSA-2026-0003.html

Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.

Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.

Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 013612b496)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:02:02 +02:00
Bernd Kuhls
21c79df9be package/{rust, rust-bin}: security bump to version 1.96.1
https://blog.rust-lang.org/2026/06/30/Rust-1.96.1/

Fixes CVE-2025-15661, CVE-2026-55199 & CVE-2026-55200.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 6021eda8a7)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:01:30 +02:00
Vincent Stehlé
ae90e07002 DEVELOPERS: add Vincent Stehlé for aarch64-efi files
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit bff9d7181f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:01:05 +02:00
Bernd Kuhls
28ae0cac6f package/gnupg2: security bump version to 2.5.21
https://lists.gnupg.org/pipermail/gnupg-announce/2026q3/000506.html

Fixes CVE-2026-34182.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit be70e1b9f3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:00:39 +02:00
Thomas Perale
780f60dc14 package/cups-filters: upstream patch CVE-2025-64503
This fixes the following vulnerability:

- CVE-2025-64503:
    cups-filters contains backends, filters, and other software required
    to get the cups printing service working on operating systems other
    than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
    with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
    `pdftoraster` tool to write beyond the bounds of an array. First, a
    PDF with a large `MediaBox` width value causes `header.cupsWidth` to
    become large.  Next, the calculation of `bytesPerLine =
    (header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
    resulting in a small value. Then, `lineBuf` is allocated with the
    small `bytesPerLine` size. Finally, `convertLineChunked` calls
    `writePixel8`, which attempts to write to `lineBuf` outside of its
    buffer size (out of bounds write). In libcupsfilters, the maintainers
    found the same `bytesPerLine` multiplication without overflow check,
    but the provided test case does not cause an overflow there, because
    the values are different. Commit
    50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
    incorporated into cups-filters version 1.28.18.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2025-64503
  - 50d94ca0f2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit def2405f39)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:00:29 +02:00
Thomas Perale
0c43d7a15f package/avahi: upstream patch for CVE-2026-34933
This fixes the following vulnerability:

- CVE-2026-34933:
    Avahi is a system which facilitates service discovery on a local
    network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
    any unprivileged local user can crash avahi-daemon by sending a single
    D-Bus method call with conflicting publish flags. This issue has been
    patched in version 0.9-rc4.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-34933
  - 0be89b6bb5

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 88f3b8366b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 15:00:02 +02:00
Bernd Kuhls
af91dcfe1c package/hwdata: bump version to 0.409
https://github.com/vcrhonek/hwdata/releases/tag/v0.409
https://github.com/vcrhonek/hwdata/releases/tag/v0.408
https://github.com/vcrhonek/hwdata/releases/tag/v0.407

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a34e6a1938)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:59:36 +02:00
Bernd Kuhls
d31b2b495d package/tiff: security bump version to 4.7.2
https://gitlab.com/libtiff/libtiff/-/releases/v4.7.2

Fixes CVE-2026-36849: https://seclists.org/oss-sec/2026/q2/952

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 85a98f8148)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:57:55 +02:00
Bernd Kuhls
b8deb2b794 package/clamav: security bump version to 1.5.3
https://blog.clamav.net/2026/07/clamav-153-and-145-security-patch.html

Fixes CVE-2026-20213, CVE-2026-20214, CVE-2026-20215, CVE-2026-20216,
CVE-2026-20217, CVE-2026-20243 & CVE-2026-20244.

"Upgraded the Rust tar dependency to resolve the RUSTSEC-2026-0067 and
 RUSTSEC-2026-0068 advisories, and upgraded the Rust openssl dependency
 to resolve CVE-2026-41676."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 31cd41c84b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:56:11 +02:00
Bernd Kuhls
c7f0268cd1 package/openvpn: security bump version to 2.7.5
https://github.com/OpenVPN/openvpn/blob/v2.7.5/Changes.rst

Fixes CVE-2026-11771, CVE-2026-12932, CVE-2026-12996, CVE-2026-13117,
CVE-2026-13122, CVE-2026-13379 & CVE-2026-13698.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 56940f0620)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:55:19 +02:00
Bernd Kuhls
0f22ac88ac package/libevent: security bump version to 2.1.13
https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable

https://seclists.org/oss-sec/2026/q3/7
"[None of the GHSA's list CVE id's at this time.  -alan-]"

Switched to sha256 tarball hash provided by Github, drop sha1 hash.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit e224289c14)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:54:50 +02:00
Bernd Kuhls
57216f1a90 package/{glibc, localedef}: security bump to version 2.43-45-gdae425b554207f7c4599c7fac707ad4c08545674
Removed patch which is included in this bump.

Fixes CVE-2026-5435, CVE-2026-6238 & CVE-2026-6791.

git shortlog  4070d808bea1c077eb7e7d52b52b91cae98205d5..

Adhemerval Zanella (3):
      math: Fix fma alignment when exponent difference is exactly 64 (BZ 34183)
      arm: Save/restore VFP registers in PLT trampolines (BZ 34144, BZ 15792)
      posix: Fix stack overflow in wordexp tilde expansion (BZ 34091, CVE-2026-6791)

Florian Weimer (8):
      iconv: Suppress intermediate errors with //TRANSLIT (bug 34236)
      resolv: Declare __p_class_syms, __p_type_syms for internal use
      resolv: Fix ns_sprintrrf formatting of class, type values (bug 34289)
      resolv: Improve formatting of unknown records in ns_sprintrrf
      resolv: Check for inet_ntop failure in ns_sprintrrf
      resolv: More types as unknown in ns_sprintrrf (CVE-2026-5435)
      resolv: Fix buffer overreads in ns_sprintrrf (CVE-2026-6238)
      resolv: Add test case tst-ns_sprintrr (bug 34033, bug 34069)

Jakub Jelinek (1):
      Rename __unused fields to __glibc_reserved.

John David Anglin (1):
      hppa: Fix missing call to __feraiseexcept (BZ 34306)

Pino Toscano (1):
      Hurd: comment PF_LINK/AF_LINK defines

Sam James (1):
      elf: don't clobber ld.so.conf in tst-glibc-hwcaps-prepend-cache [BZ #34210]

Samuel Thibault (3):
      Hurd: comment PF_ROUTE/AF_ROUTE defines
      Hurd: comment ioctls which cannot currently compile
      Hurd: restore some SIOC ioctls

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 42d63edf4c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:54:17 +02:00
Bernd Kuhls
190ea0849b package/php: security bump version to 8.5.8
https://www.php.net/ChangeLog-8.php#8.5.8
https://news-web.php.net/php.announce/498
https://github.com/php/php-src/blob/php-8.5.8/NEWS

Fixes CVE-2026-14355.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit beb6be6b06)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:53:26 +02:00
Thomas Perale
023a2fffa5 package/wolfssl: security bump to v5.9.2
For more information about the release, see:

- https://github.com/wolfSSL/wolfssl/releases/tag/v5.9.2-stable

Fixes the following vulnerabilities:

- CVE-2026-6091: https://www.cve.org/CVERecord?id=CVE-2026-6091

- CVE-2026-6092: https://www.cve.org/CVERecord?id=CVE-2026-6092

- CVE-2026-6094: https://www.cve.org/CVERecord?id=CVE-2026-6094

- CVE-2026-6291: https://www.cve.org/CVERecord?id=CVE-2026-6291

- CVE-2026-6325: https://www.cve.org/CVERecord?id=CVE-2026-6325

- CVE-2026-6329: https://www.cve.org/CVERecord?id=CVE-2026-6329

- CVE-2026-6330: https://www.cve.org/CVERecord?id=CVE-2026-6330

- CVE-2026-6331: https://www.cve.org/CVERecord?id=CVE-2026-6331

- CVE-2026-6412: https://www.cve.org/CVERecord?id=CVE-2026-6412

- CVE-2026-6450: https://www.cve.org/CVERecord?id=CVE-2026-6450

- CVE-2026-6678: https://www.cve.org/CVERecord?id=CVE-2026-6678

- CVE-2026-6681: https://www.cve.org/CVERecord?id=CVE-2026-6681

- CVE-2026-6731: https://www.cve.org/CVERecord?id=CVE-2026-6731

- CVE-2026-7511: https://www.cve.org/CVERecord?id=CVE-2026-7511

- CVE-2026-7531: https://www.cve.org/CVERecord?id=CVE-2026-7531

- CVE-2026-7532: https://www.cve.org/CVERecord?id=CVE-2026-7532

- CVE-2026-8720: https://www.cve.org/CVERecord?id=CVE-2026-8720

- CVE-2026-10097: https://www.cve.org/CVERecord?id=CVE-2026-10097

- CVE-2026-10098: https://www.cve.org/CVERecord?id=CVE-2026-10098

- CVE-2026-10512: https://www.cve.org/CVERecord?id=CVE-2026-10512

- CVE-2026-10592: https://www.cve.org/CVERecord?id=CVE-2026-10592

- CVE-2026-11310: https://www.cve.org/CVERecord?id=CVE-2026-11310

- CVE-2026-11703: https://www.cve.org/CVERecord?id=CVE-2026-11703

- CVE-2026-11999: https://www.cve.org/CVERecord?id=CVE-2026-11999

- CVE-2026-12340: https://www.cve.org/CVERecord?id=CVE-2026-12340

- CVE-2026-55958: https://www.cve.org/CVERecord?id=CVE-2026-55958

- CVE-2026-55960: https://www.cve.org/CVERecord?id=CVE-2026-55960

- CVE-2026-55961: https://www.cve.org/CVERecord?id=CVE-2026-55961

- CVE-2026-55962: https://www.cve.org/CVERecord?id=CVE-2026-55962

- CVE-2026-55964: https://www.cve.org/CVERecord?id=CVE-2026-55964

- CVE-2026-55967: https://www.cve.org/CVERecord?id=CVE-2026-55967

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 45a0ce557d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:32:03 +02:00
Thomas Perale
15aaee1e0b package/strongswan: fix build w/ wolfssl 5.9.2
The 'mlkem.h' header is no longer present in wolfssl v5.9.2 [1] and the
content was merged in the 'wc_mlkem.h' header.

[1] 7a2cf5b655

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 275faf6d61)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:31:55 +02:00
Waldemar Brodkorb
c27982162e package/nginx: security bump to 1.30.3
Changes with nginx 1.30.3

    *) Security: a heap memory buffer overflow might occur in a worker
       process when using a configuration with "ignore_invalid_headers off;"
       and "large_client_header_buffers" with large configured values when
       proxying a specially crafted request to HTTP/2 or gRPC backend,
       allowing an attacker to cause worker process memory corruption or
       segmentation fault in a worker process (CVE-2026-42055).
       Thanks to Mufeed VH of Winfunc Research.

    *) Security: a heap memory buffer overread might occur in a worker
       process while handling a specially sent response with decoding from
       UTF-8 via the "charset_map" directive, allowing an attacker to cause
       a limited disclosure of worker process memory or segmentation fault
       in a worker process (CVE-2026-48142).
       Thanks to Han Yan of Xiaomi and p4p3r of CYBERONE.

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9b8c65a6c1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:31:25 +02:00
Waldemar Brodkorb
17d604e3e4 package/ruby: security bump to 4.0.5
See changes here:
https://github.com/ruby/ruby/releases/tag/v4.0.5
https://github.com/ruby/ruby/releases/tag/v4.0.4

Security fix for:
CVE-2026-46727: Use-after-free in pthread-based getaddrinfo timeout handler

See here for details:
https://www.ruby-lang.org/en/news/2026/05/20/getaddrinfo-cve-2026-46727/

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 515b3b3eeb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:29:44 +02:00
Waldemar Brodkorb
d10430adb6 package/asterisk: security bump to 22.10.1
See here for a complete Changelog:
https://downloads.asterisk.org/pub/telephony/asterisk/ChangeLog-22-current.html

Security Fixes:
    GHSA-3g56-cgrh-95p5: chan_unistim DIALPAGE digit handling can overflow phone_number and crash Asterisk
    GHSA-3rhj-hhw7-m6fw: NULL Pointer Dereference in HTTP AMI Digest Authentication
    GHSA-4pgv-j3mr-3rcp: Reflected XSS in Phone Provisioning HTTP Error Pages
    GHSA-589g-qgf8-m6mx: Stack buffer overflow in MWI NOTIFY Message-Account parsing
    GHSA-746q-794h-cc7f: Out-of-Bounds Read in Q.931 Information Element Parser (H.323 Addon)
    GHSA-8jhw-m2hg-vp3h: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
    GHSA-8jw3-ccr9-xrmf: Buffer over-read in Asterisk PJSIP MWI body parser
    GHSA-g8q2-p36q-94f6: Heap-use-after-free in Asterisk PJSIP TCP/SDP handling when TCP connection closes during SDP processing
    GHSA-h5hv-jmgj-92q2: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser
    GHSA-j2mm-57pq-jh94: Possible RED T.140 Generation Accumulation OOB Write
    GHSA-mxgm-8c6f-5p8f: Stack buffer overflow in res_xmpp XMPP namespace prefix handling
    GHSA-ph27-3m5q-mj5m: SQL Injection in cel_pgsql and cel_tds via CELGenUserEvent eventtype Field
    GHSA-q9fr-m7g8-6ph5: Asterisk app_sms.c copies externally controlled SMS lengths into fixed in-struct buffers
    GHSA-qf8j-jp7h-c5hx: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Count Mismatch
    GHSA-r6c2-hwc2-j4mp: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)
    GHSA-vfhr-r9x9-c687: Possible RED T.140 Heap Buffer Overflow
    GHSA-vrfp-mg3q-3959: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
    GHSA-wcvv-g26m-wx5c: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
    GHSA-x348-j6c9-77f3: Stack Buffer Overflow in H.323 ooTrace() via Unbounded vsprintf into Fixed 2048-byte Buffer
    GHSA-xgj6-2gc5-5x9c: ast_loggrabber executes python script in world writable directory(/tmp) leading to potential privilege escalation And RCE

Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 7f48325de6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 14:28:18 +02:00
Thomas Perale
e0f6f17ca8 package/jq: security bump to v1.8.2
For more information about the release, see:
 - https://github.com/jqlang/jq/releases/tag/jq-1.8.2

All the CVEs were addressed by a patch but non-CVEs security fixes such
as GHSA-gf4g-95wj-4q4r or GHSA-hj52-j2c9-r8r4 are fixed by this release.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d67a214c37)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:52:18 +02:00
Thomas Perale
1526d90b3d package/jq: patch various CVEs
Fixes the following vulnerabilities by importing upstream patches:

- CVE-2026-39979: 2f09060afa

- CVE-2026-33948: 6374ae0bcd

- CVE-2026-33947: fb59f14910

- CVE-2026-32316: e47e56d226

- CVE-2026-40164: 0c7d133c3c

- CVE-2026-40612: d1a12569d9

- CVE-2026-41256: 5a015deae3

- CVE-2026-41257: 01b3cded76

- CVE-2026-43894: 9761ceb7d6

- CVE-2026-43895: 9d223f153c

- CVE-2026-43896: 532ccea608

- CVE-2026-44777: f58787c418

- CVE-2026-47770: 7122866869

- CVE-2026-49839: e987df0d46

- CVE-2026-54679: 46d1da3094

Tests were stripped out of the patches.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e8191c3e17)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:52:07 +02:00
Bernd Kuhls
8bb9d83070 package/tor: security bump version to 0.4.9.11
https://gitlab.torproject.org/tpo/core/tor/-/blob/tor-0.4.9.11/ReleaseNotes

Fixes TROVE-2026-025 & TROVE-2026-026.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 48dd3eedc4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:51:40 +02:00
Thomas Perale
8eb22ee91f package/imagemagick: security bump to v7.1.2-26
See the changelog:

- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-24---2026-05-26
- https://github.com/ImageMagick/Website/blob/main/ChangeLog.md#712-25---2026-06-04
- https://github.com/ImageMagick/ImageMagick/compare/7.1.2-25...7.1.2-26

The bump to the v7.1.2-25 fixes the following vulnerabilities:

- CVE-2026-53465
- CVE-2026-53464
- CVE-2026-53463
- CVE-2026-53462
- CVE-2026-53461
- CVE-2026-53460

The bump to the v7.1.2-24 fixes the following vulnerabilities:

- CVE-2026-49219
- CVE-2026-49218
- CVE-2026-48994
- CVE-2026-48734
- CVE-2026-48733
- CVE-2026-48724

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6bb532a100)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:51:27 +02:00
Thomas Perale
8e9ce80c94 package/mariadb: security bump to v10.11.18
For more information on the release, see:
  - https://mariadb.com/docs/release-notes/community-server/10.11/10.11.18

It fixes the following vulnerabilities:

- CVE-2026-48163:
    MariaDB server is a community developed fork of MySQL server. From
    versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
    to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST
    the donor node is interpolating parameters that the joiner sent into
    the command line. Not all parameters were properly validated which
    could allow a malicious joiner to execute arbitrary shell commands on
    the donor side via the rsync SST method. This issue has been patched
    in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-48163

- CVE-2026-48165:
    MariaDB server is a community developed fork of MySQL server. From
    versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1
    to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-
    privileged MariaDB user could've used wsrep_sst_receive_address or
    wsrep_sst_donor global system variables to execute shell commands as
    the uid of the mariadbd process on the galera joiner node. This issue
    has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
    12.3.2.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-48165

- CVE-2026-49261:
    MariaDB server is a community developed fork of MySQL server. Versions
    10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through
    11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd`
    enabled would execute shell commands embedded in the name of the
    joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and
    12.3.2. As a workaround, anyone who cannot upgrade now should disable
    `wsrep_notify_cmd`.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-49261

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c69f28ae5c)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:51:15 +02:00
Dowan Gullient via buildroot
055e954cd4 support/testing: test_gnupg2: fix runtime failure
In the precedent patch "support/testing: test_gnupg2.py: use
assertRunNotOk()" [1] a small typo (OK instead of Ok) was introduced
in the test_gnupg2.py file, which caused a runtime failure.

This patch simply replace "self.assertRunNotOK(cmd)" with
"self.assertRunNotOk(cmd)" to correct this typo.

[1] cb791850ad

Signed-off-by: Dowan Gullient <dowan.gullient@smile.fr>
[Fiona: fix commit message formatting]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit cfd7483a26)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:50:34 +02:00
Yann E. MORIN
c833ebb3e8 package/shadow: needs host-pkgconf
Since version 4.14.0 and upstream commit 2a5b8810bb17, shadow has
required pkgconfig to find libbsd.

Add a dependency on host-pkgconf.

Fixes: https://autobuild.buildroot.org/results/90f/90ff13ff4c519b0606888eaa90acbd8cd0c0f73a/

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Raphael Pavlidis <raphael.pavlidis@gmail.com>
[Fiona: fix typo in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 9030c9a81d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:50:19 +02:00
Thomas Perale
6a04d44b07 package/libssh2: backport upstream patch for CVE-2026-55200
- CVE-2026-55200:
    libssh2 through 1.11.1, fixed in commit 97acf3df contains an out-of-
    bounds write vulnerability in ssh2_transport_read() that fails to
    enforce upper bounds on packet_length field. Remote attackers can send
    crafted SSH packets with excessively large packet_length values to
    corrupt heap memory and achieve remote code execution.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-55200
  - 97acf3dfda

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c5aa932745)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:50:02 +02:00
Thomas Perale
3313c4f10e package/libssh2: add upstream patch for CVE-2026-55199
Fixes the following vulnerability:

- CVE-2026-55199:
    libssh2 through 1.11.1, fixed in commit 1762685, contains a pre-
    authentication denial of service vulnerability in the SSH_MSG_EXT_INFO
    handler in src/packet.c that allows a malicious SSH server to cause a
    client CPU exhaustion loop by sending a crafted extension count value.
    A malicious server can set nr_extensions to 0xFFFFFFFF during key
    exchange, causing the client to spin in a tight CPU loop for over 60
    seconds because return values from _libssh2_get_string() are unchecked
    and the session timeout does not apply to CPU-bound loops.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-55199
  - 17626857d2

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 3c8cfad804)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:49:44 +02:00
Thomas Perale
2a0e73dfcb package/sudo: backport patch CVE-2026-35535
This backport is provided thanks to the Debian community [1].

- CVE-2026-35535:
    In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid,
    setgid, or setgroups call, during a privilege drop before running the
    mailer, is not a fatal error and can lead to privilege escalation.

For more information, see:
    https://www.cve.org/CVERecord?id=CVE-2026-35535

[1] https://salsa.debian.org/sudo-team/sudo/-/blob/debian/trixie/debian/patches/0006-exec_mailer-Set-group-as-well-as-uid-when-running-th.patch

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 54de8d26d0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:49:09 +02:00
Thomas Perale
f532ff0fef package/openjpeg: add upstream patch for CVE-2026-6192
- CVE-2026-6192:
    A vulnerability was identified in uclouvain openjpeg up to 2.5.4. This
    impacts the function opj_pi_initialise_encode in the library
    src/lib/openjp2/pi.c. The manipulation leads to integer overflow. The
    attack must be carried out locally. The exploit is publicly available
    and might be used. The identifier of the patch is
    839936aa33eb8899bbbd80fda02796bb65068951. It is suggested to install a
    patch to address this issue.

For more information, see:
  - https://www.cve.org/CVERecord?id=CVE-2026-6192
  - 839936aa33

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 353007cf40)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:48:57 +02:00
Fiona Klute
2723abb9f4 support/testing: TestPythonPy3NetworkmanagerGoi: check we actually get data
The sample script would've passed even if the connections list was
empty. Check that there is at least one connection, and that the
sample script can read loopback device information.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f38f5bb593)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:48:32 +02:00
Romain Naour
68895e6882 package/gcc: add missing 15.3.0 patches
git am failed locally while the patch sent by Bernd looked correct [1].

Fixes: f8f6bcec0f

[1] https://lists.busybox.net/pipermail/buildroot/2026-June/805485.html

Reported-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ad9d4c8351)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:47:58 +02:00
Bernd Kuhls
5414b019bd package/gcc: bump 14.x series to 14.4.0
Announcement:
https://gcc.gnu.org/pipermail/gcc-announce/2026/000192.html

GCC 14.4 is a bug-fix release from the GCC 14 branch
containing important fixes for regressions and serious bugs in
GCC 14.3 with more than 104 bugs fixed since the previous release.

For the list of bugs fixed in this version, see:
https://gcc.gnu.org/gcc-14/changes.html#14.4

Removed patches which are included in this release.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit ab3c1ec3b6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:47:22 +02:00
Bernd Kuhls
1af9ec0567 package/gcc: bump 15.x series to 15.3.0
Announcement:
https://gcc.gnu.org/pipermail/gcc-announce/2026/000191.html

GCC 15.3 is a bug-fix release from the GCC 15 branch
containing important fixes for regressions and serious bugs in
GCC 15.2 with more than 208 bugs fixed since the previous release.

For the list of bugs fixed in this version, see:
https://gcc.gnu.org/gcc-15/changes.html#15.3

Removed patches which are included in this release,
renumbered patch 0003.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit f8f6bcec0f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:41:10 +02:00
Fiona Klute
6358506f52 package/libglib2: drop unused 0001-meson.build-add-girdir-to-gio-2.0.pc-and-glib-2.0.pc.patch
In 11aa1cfa5a the patch was accidentally
moved into a versioned directory with the wrong version (2.82.0
instead of 2.82.4) and thus not applied. However, there have been no
issues reported.

The patch description mentions being needed to fix build errors in
package/atk and package/libnice. It was originally added in
b094f88a4d, and amended for libnice in
2c916b400b. package/atk was removed in
2c3ca7bea1, because atk has been merged
into at-spi2-core. Both at-spi2-core and libnice are Meson packages,
as was atk at the time of its removal.

Both current packages build with the following configuration (tested
using utils/test-pkg):

BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_GOBJECT_INTROSPECTION=y
BR2_PACKAGE_LIBNICE=y
BR2_PACKAGE_AT_SPI2_CORE=y

Evidently the patch is no longer needed, presumably because the
correct search path for GIR files is set by other means, and we can
remove it instead of fixing the version number of the patch directory.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9fabfcb9f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:36:27 +02:00
Fiona Klute
83c68022c2 package/libglib2/libglib2-bootstrap: do not install to target
Libglib2-bootstrap is only used as dependency to build
gobject-introspection and then libglib2 with GOI support. It should
not be installed to target, even if in practice libglib2 should
overwrite anything it has installed.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 866462e8dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-08 13:36:08 +02:00
Bernd Kuhls
5ca85cc299 package/expat: security bump version to 2.8.2
https://github.com/libexpat/libexpat/blob/R_2_8_2/expat/Changes
https://blog.hartwork.org/posts/expat-2-8-2-released/

Fixes the following CVEs:

    CVE-2026-50219 — missing control flow integrity checks
    CVE-2026-56131 — missing control flow integrity checks
    CVE-2026-56132 — out-of-bounds write
    CVE-2026-56403 — integer overflow
    CVE-2026-56404 — integer overflow
    CVE-2026-56405 — integer overflow
    CVE-2026-56406 — integer overflow
    CVE-2026-56407 — integer overflow
    CVE-2026-56408 — integer overflow
    CVE-2026-56409 — integer overflow
    CVE-2026-56410 — integer overflow
    CVE-2026-56411 — integer overflow
    CVE-2026-56412 — missing control flow integrity checks

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 6b1f6f7a48)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:50:04 +02:00
Fiona Klute
bf90aa9989 package/util-linux: add missing UTIL_LINUX_IGNORE_CVES entry for CVE-2026-27456
Patch was added in 9998130bad, but no
ignore entry.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 50cc0d11d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:49:45 +02:00
Bernd Kuhls
4def9390ab package/cpp-httplib: security bump version to 0.48.0
https://github.com/yhirose/cpp-httplib/releases/tag/v0.48.0
- this bump includes a security fix for the Mbed TLS and wolfSSL
  backends which are unused by buildroot
https://github.com/yhirose/cpp-httplib/releases/tag/v0.47.0
- this bump includes a security fix for the Mbed TLS and wolfSSL
  backends which are unused by buildroot
https://github.com/yhirose/cpp-httplib/releases/tag/v0.46.1
https://github.com/yhirose/cpp-httplib/releases/tag/v0.46.0
- this bump includes a security fix
https://github.com/yhirose/cpp-httplib/releases/tag/v0.45.1
https://github.com/yhirose/cpp-httplib/releases/tag/v0.45.0
https://github.com/yhirose/cpp-httplib/releases/tag/v0.44.0
- fixes CVE-2026-45372 & CVE-2026-46527
https://github.com/yhirose/cpp-httplib/releases/tag/v0.43.4
- fixes CVE-2026-45352
https://github.com/yhirose/cpp-httplib/releases/tag/v0.43.3
https://github.com/yhirose/cpp-httplib/releases/tag/v0.43.2

https://github.com/yhirose/cpp-httplib/compare/v0.43.1...v0.48.0

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 614c32d2dd)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:49:31 +02:00
Giulio Benetti
cfe9d0e7cf package/util-linux: fix CVE-2026-27456
As mentioned here[1] we require patch[2] to fix CVE-2026-27456.

[1]: https://lore.kernel.org/util-linux/c2fo4x3lcppsj77k564i4qodmon3wagx47qf4mqwjwdtiplupg@jmaqrlzp273h/T/#u
[2]: https://git.kernel.org/pub/scm/utils/util-linux/util-linux.git/commit/?h=stable/v2.41&id=2dacaf3eea391e3bbf48e7d3ecce02cafe045b6d

Cc: Alexander Dahl <alex@netz39.de>
Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Fiona: add CVE trailer to patch file]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 9998130bad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:36:15 +02:00
Giulio Benetti
c981779d2a package/mongoose: security bump to version 7.22
Release notes:
https://github.com/cesanta/mongoose/releases/tag/7.22

Fixes CVE-2026-37635.

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8fe41d5506)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:33:22 +02:00
Bernd Kuhls
bd47a97aea package/util-linux: allow musl build for login/runuser/su
Buildroot commit f89ca996b6 fixed the
build of linux-pam with musl in 2020 but did not remove the restric-
tions in place for login/runuser/su which were added earlier with
these commits:

login (2015): 25ecd24579
runuser (2017): 09860f354a
su (2017): c6488923fb

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 91d356ee7e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:33:03 +02:00
Giulio Benetti
9b6388b486 package/bind: security bump version to 9.20.24
Release notes:
https://ftp.isc.org/isc/bind9/9.20.24/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.20.24/doc/arm/html/changelog.html

Fixes CVE-2026-3593.

NOTE: Libraries libcap, liburcu are now mandatory.

NOTE 2: the bind version 9.18.x series is marked by upstream as
end-of-life. This commit switches to the current stable release
series 9.20.x. See:
https://kb.isc.org/docs/bind-9-end-of-life-dates
https://www.isc.org/bind/

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
[Julien: add note 2 in commit log]
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 54f96add94)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:32:37 +02:00
Bernd Kuhls
e4079113a6 package/util-linux: lsfd needs headers >= 4.15
Buildroot commit 31af509b4f bumped the
package to 2.41.1 which includes upstream commit
036d72749c
adding a dependency to BPF_OBJ_NAME_LEN for lsfd.

BPF_OBJ_NAME_LEN was added to the kernel headers in version 4.15:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9

so we need to raise the header version dependency for lsfd.

The build error was found by the Gitlab pipelines for the defconfig
bootlin-aarch64-glibc-old.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 1db28a8687)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:32:13 +02:00
Bernd Kuhls
c56adede27 package/ghostscript: security bump to version 10.07.1
https://ghostscript.readthedocs.io/en/gs10.07.1/News.html
"This release addresses a number of potential security issues."

Renumbered patch which was forgotten during the last version bump.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit dd929c3d25)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:31:52 +02:00
Romain Naour
0c67544f04 support/testing: TestIptables: bump kernel to 6.18 LTS
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 92214c922d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:31:40 +02:00
Romain Naour
7d8f9f6c0f support/testing: TestIptables: check for netfilter legacy tables enabled
TestIptables expect netfilter legacy tables enabled in the kernel.

Make sure we use iptables-legacy:

  iptables --version
  iptables v1.8.11 (legacy)

The test would fail if nftables compat (iptables-nft) is enabled.

  iptables --version
  iptables v1.8.11 (nf_tables)

Add the following configuration fragment to enable iptables-nft:

  BR2_PACKAGE_IPTABLES_NFTABLES=y
  BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y

Acked-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 1b2f65bbe9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:31:02 +02:00
Romain Naour
8e913e6c38 package/iptables: improve kernel support for iptables-legacy and iptables-nft
Since kernels 6.17, support for netfilter legacy tables were disabled
by default [1] but iptables package needs Netfilter legacy tables
support enabled in the kernel when nftables compat is not enabled.

Make sure to enable CONFIG_IP_NF_IPTABLES_LEGACY and
CONFIG_NETFILTER_XTABLES_LEGACY for kernels >= 6.17.

Fixes:

  [BRTEST# iptables --flush
  modprobe: module ip_tables not found in modules.dep
  iptables v1.8.11 (legacy): can't initialize iptables table `filter': Table does not exist (do you need to insmod?)
  Perhaps iptables or your kernel needs to be upgraded.

On the other hand, when nftables compat (iptables-nft) is used by
default (BR2_PACKAGE_IPTABLES_NFTABLES_DEFAULT=y) we have to enable
nft protocol support in the kernel.

  iptables --version
  iptables: Failed to initialize nft: Protocol not supported

Enable CONFIG_NF_TABLES and CONFIG_NF_TABLES_INET as for
NFTABLES_LINUX_CONFIG_FIXUPS and complete the list with
CONFIG_NFT_SOCKET needed to pass the TestIptables with
nftables compat (iptables-nft) enabled.

Without CONFIG_NFT_SOCKET:

  iptables --policy INPUT ACCEPT
  iptables v1.8.11 (nf_tables):  TABLE_ADD failed (Operation not supported): table filter

So, enable kernel support for iptables-legacy only if nftables compat
is not enabled by default. Enable iptables-nft support when nftables
compat is enabled, even if not used by default.

[1] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=9fce66583f06c212e95e4b76dd61d8432ffa56b6

Signed-off-by: Romain Naour <romain.naour@smile.fr>
[Fiona: fix typo in commit message]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c57bcf0d43)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:30:34 +02:00
Bernd Kuhls
67b13f3c8d package/libarchive: security bump version to 3.8.8
https://github.com/libarchive/libarchive/releases/tag/v3.8.8
"Libarchive 3.8.8 is a security, bugfix and minor feature release."

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit c384895981)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:30:26 +02:00
Bernd Kuhls
8ecb2fe3fc package/libcurl: security bump to version 8.21.0
https://curl.se/ch/8.21.0.html
https://daniel.haxx.se/blog/2026/06/24/curl-8-21-0/

Fixes the following CVEs:

Severity Medium
    CVE-2026-8925: SASL double-free
    CVE-2026-8927: env-set cross-proxy Digest auth state leak
    CVE-2026-9079: stale proxy password leak
    CVE-2026-11856: cross-origin Digest auth state leak

Severity Low
    CVE-2026-8286: wrong STARTTLS connection reuse
    CVE-2026-8458: wrong reuse for different services
    CVE-2026-8924: trailing dot domain super cookie
    CVE-2026-8926: password leak with netrc and user in URL
    CVE-2026-8932: incomplete mTLS config matching in conn reuse
    CVE-2026-9080: UAF after pause in socket callback
    CVE-2026-9545: exposing HTTP/3 early data
    CVE-2026-9546: sending old referer
    CVE-2026-9547: SSH improper host validation
    CVE-2026-10536: HTTP/2 stream-dependency tree UAF
    CVE-2026-11352: QUIC zero-length UDP datagrams busy-loop
    CVE-2026-11564: Native CA trust persist
    CVE-2026-11586: WS Auto-PONG memory exhaustion
    CVE-2026-12064: proto-default skips SSH verification

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit be2789d084)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:30:10 +02:00
Bernd Kuhls
6001e920fe package/python3: add upstream security patch for CVE-2026-11940
https://seclists.org/oss-sec/2026/q2/1006
https://www.cve.org/CVERecord?id=CVE-2026-11940
https://github.com/python/cpython/pull/151559

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 1a0164ac81)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:28:22 +02:00
Yann E. MORIN
a2d659937b package/mosquitto: requires cmake >= 4.3
With an older cmake version, like the 3.25.1 as available in the docker
reference image, mosquitto fails to build when ccache is enabled:

    [ 98%] Building CXX object lib/cpp/CMakeFiles/mosquittopp.dir/mosquittopp.cpp.o
    In file included from [...]/buildroot/output/build/mosquitto-2.1.2/lib/cpp/mosquittopp.cpp:17:
    [...]/buildroot/output/host/opt/ext-toolchain/i686-buildroot-linux-gnu/include/c++/15.1.0/cstdlib:83:15: fatal error: stdlib.h: No such file or directory
       83 | #include_next <stdlib.h>
          |               ^~~~~~~~~~
    compilation terminated.

Officially, mosquitto only requires cmake 3.18, but that proves to not
be enough, in fact...

We workaround that by requiring cmake 4.3, which is the one version that
could be tested with our host-cmake.

Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit da9dcddff1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:27:26 +02:00
Joseph Kogut
1e06978a0f package/libepoxy: remove gl/egl dependency
Libepoxy is a library for handling OpenGL function pointer management.

It has backends for egl/glx, which may at one point have been mandatory
to enable, but the library now builds with none of the above enabled
features, as seen below.

  libepoxy 1.5.10

    User defined options
      Cross files            : /home/joseph/br-test-pkg/arm-aarch64/build/libepoxy-1.5.10//buildroot-build/cross-compilation.conf
      b_pie                  : false
      b_staticpic            : true
      buildtype              : release
      build.cmake_prefix_path: /home/joseph/br-test-pkg/arm-aarch64/host/lib/cmake
      default_library        : shared
      docs                   : false
      egl                    : no
      glx                    : no
      libdir                 : lib
      build.pkg_config_path  : /home/joseph/br-test-pkg/arm-aarch64/host/lib/pkgconfig
      prefix                 : /usr
      strip                  : false
      tests                  : false
      x11                    : false

Removing these dependencies allows for some applications that require it
as a build dependency, but otherwise can run headless or without GL, to
build and function, using other graphics APIs or display pipelines.

Weston, for example, can still use Vulkan and DRM when linked to
libepoxy without GL/EGL/X11 support.

Acked-by: Arnout Vanecappelle <arnout@rnout.be>
Signed-off-by: Joseph Kogut <joseph.kogut@gmail.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
(cherry picked from commit cd2583ca0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-07-02 21:26:58 +02:00
Peter Korsgaard
6d8efb145e support/testing: test_nftables.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75ae817eb2)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-26 16:52:25 +02:00
Romain Naour
eb8932bdde package/passt: needs headers >= 5.9
Upstream passt only documents runtime dependencies; and they advertise
being able to run on kernel 3.8 or later. However, they do not document
the build dependencies.

Since 2025_06_11.0293c6f, upstream requires kernel headers >= 5.9, as
they make use of linux/close_range.h, only introduced in 5.9.

Add a dependency to kernel headers, and propagate it to podman's passt
backend.

Fixes: 6a192b0d28

Cc: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 113def3696)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:45:14 +02:00
Bernd Kuhls
7059bb9c43 package/fetchmail: security bump version to 6.6.5
https://sourceforge.net/p/fetchmail/mailman/message/59347909/

"## SECURITY BUGFIX
* POP3 with RPA: fix calculation of buffer sizes to avoid buffer
  overflow on long service challenges with long user IDs"

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 183c52448d)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:44:38 +02:00
Peter Korsgaard
4aeeffe166 utils/generate-cyclonedx: fixup scp-style git sites
Commit e8c54ffb3d ("utils/generate-cyclonedx: generate vcs
externalReferences for source repos") added externalReferences to the source
code of packages.

This unfortunately causes issues with packages (in br2-external) fetching
from git using the scp-like syntax, E.G.:

 FOO_SITE_METHOD = git
 FOO_SITE = git@github.com:<project>/<repo>.git

Which ends up in the SBOM as:

[
  {
    "type": "vcs",
    "url": "git@github.com:<project>/<repo>.git",
    "comment": "git repository"
  }
]

This (correctly) causes Dependency track to reject the SBOM import with:

{
  "status": 400,
  "title": "The uploaded BOM is invalid",
  "detail": "Schema validation failed",
  "errors": [
    "$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
    "$.components[2].externalReferences[0].url: does not match the iri-reference pattern must be a valid RFC 3987 IRI-reference",
    "$.components[2].externalReferences[0].url: does not match the regex pattern ^urn:cdx:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/[1-9][0-9]*$",
   ]
}

The CycloneDX spec indeed requires a URI:

The URI (URL or URN) to the external reference.  External references are
URIs and therefore can accept any URL scheme including https (RFC-7230),
mailto (RFC-2368), tel (RFC-3966), and dns (RFC-4501)

https://cyclonedx.org/docs/1.6/json/#metadata_tools_oneOf_i0_components_items_externalReferences_items_url

The user@host:project/repo.git is a git-specific shorthand for a git-over-ssh URL. From man git-clone:

 Git supports ssh, git, http, and https protocols (in addition, ftp and ftps
 can be used for fetching, but this is inefficient and deprecated; do not use
 them).

 The native transport (i.e.  git:// URL) does no authentication and should
 be used with caution on unsecured networks.

 The following syntaxes may be used with them:

 •   ssh://[user@]host.xz[:port]/path/to/repo.git/
 •   git://host.xz[:port]/path/to/repo.git/
 •   http[s]://host.xz[:port]/path/to/repo.git/
 •   ftp[s]://host.xz[:port]/path/to/repo.git/

 An alternative scp-like syntax may also be used with the ssh protocol:

 •   [user@]host.xz:path/to/repo.git/

So convert the scp-like syntax to ssh:// URLs in parse_uris() for spec
compliance.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Acked-By: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ebcfdb8b0a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:42:53 +02:00
Bernd Kuhls
c9b6846a21 package/libgsasl: security bump version to 2.2.4
2.2.3: https://lists.gnu.org/archive/html/help-gsasl/2026-05/msg00001.html
       Fixes CVE-2026-48829: https://www.cvedetails.com/cve/CVE-2026-48829/

2.2.4: https://lists.gnu.org/archive/html/help-gsasl/2026-06/msg00001.html
       https://lists.gnu.org/archive/html/help-gsasl/2026-06/msg00002.html
       "GNU SASL Security Advisory: NTLM client use-of-uninitialized-value"

Upstream does not provide sha1 hashes anymore.

Updated license hash due to copyright year bump:
ec96bad539

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
[Fiona: fix notice about upstream hashes, sha256 is still provided]
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 61056c34b4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:42:37 +02:00
Bernd Kuhls
cfb6bea3ff package/tmux: security bump to version 3.6b
https://raw.githubusercontent.com/tmux/tmux/3.6b/CHANGES
https://github.com/tmux/tmux/issues/5109

Fixes CVE-2026-11623: https://seclists.org/oss-sec/2026/q2/934

Switched to tarball hash provided by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
(cherry picked from commit 28c6fc47b4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:41:35 +02:00
Peter Korsgaard
dbe1e0f6ca support/testing: test_which.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6f39a9ba29)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:41:26 +02:00
Peter Korsgaard
7c110848aa support/testing: test_weston.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8ffa090560)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:41:18 +02:00
Peter Korsgaard
3536c9de39 support/testing: test_usbip.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 6e04f8f21f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:41:08 +02:00
Peter Korsgaard
d7cb451475 support/testing: test_swipl.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 59d15f8ada)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:41:01 +02:00
Peter Korsgaard
31ea7acc54 support/testing: test_screen.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 50ed1540f3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:40:55 +02:00
Peter Korsgaard
6f44e2660c support/testing: test_rasdaemon.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f8cfb55845)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:40:06 +02:00
Peter Korsgaard
aef386b281 support/testing: test_postgresql.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 382146eff4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:39:47 +02:00
Peter Korsgaard
d7204970be support/testing: test_polkit.py: use assertRun{, Not}Ok()
Use the helpers to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a4ef71a592)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:39:41 +02:00
Peter Korsgaard
e9b1a3c0d5 support/testing: test_octave.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e5c017f663)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:39:29 +02:00
Peter Korsgaard
e4c7462766 support/testing: test_mtools.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit ae1ff2d8dc)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:47 +02:00
Peter Korsgaard
e554f9a84e support/testing: test_mariadb.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0853612155)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:42 +02:00
Peter Korsgaard
64f5559e11 support/testing: test_lsof.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit aae70a3ab5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:35 +02:00
Peter Korsgaard
e430365223 support/testing: test_libgpgme.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit a0b5a634f0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:27 +02:00
Peter Korsgaard
35c3d26371 support/testing: test_kmod.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c566e5c645)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:20 +02:00
Peter Korsgaard
3b795d74b9 support/testing: test_jq.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cab36bc293)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:38:14 +02:00
Peter Korsgaard
e2e56f99d2 support/testing: test_iptables.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 75ae191b5f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:37:40 +02:00
Peter Korsgaard
0c7e7d2956 support/testing: test_iproute2.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit f3942975c4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:36:13 +02:00
Peter Korsgaard
00055d4ea0 support/testing: test_gnupg2.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit cb791850ad)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:36:06 +02:00
Peter Korsgaard
288b47d79b support/testing: test_fping.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 9a1d42e5d4)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:36:00 +02:00
Peter Korsgaard
5bccec2779 support/testing: test_dos2unix.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 0b1ea65f3a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:54 +02:00
Peter Korsgaard
170f87572f support/testing: test_ddrescue.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit d7284778a1)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:47 +02:00
Peter Korsgaard
1035f0dfad support/testing: test_cryptsetup.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 69948ba028)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:41 +02:00
Peter Korsgaard
4f342f960d support/testing: test_connman.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 2889d0f052)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:35 +02:00
Peter Korsgaard
21bb39308f support/testing: test_bitcoin.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 830e0f49bb)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:27 +02:00
Peter Korsgaard
45f26d60a9 support/testing: test_audit.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit eb0ef1fd98)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:21 +02:00
Peter Korsgaard
6d480610fa support/testing: test_acl.py: use assertRunNotOk()
Use the helper to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8caecb62a3)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:35:14 +02:00
Peter Korsgaard
566e3a9414 support/testing: test_systemd.py: use assertRun{, Not}Ok()
Use the helpers to simplify the test.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 8c301eed0e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:34:42 +02:00
Peter Korsgaard
d19226ef06 support/testing: infra: add assertRunNotOk()
There are a number of runtime tests that checks that a command fails as
expected, so add an assertRunNotOk() similar to the existing assertRunOk()
to handle that instead of open coding it everywhere.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Reviewed-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 03783de150)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:34:36 +02:00
Bernd Kuhls
75f6dc84a2 package/squid: security bump version to 7.6
https://github.com/squid-cache/squid/blob/SQUID_7_6/ChangeLog
https://seclists.org/oss-sec/2026/q2/896

Fixes CVE-2026-47729 and CVE-2026-50012.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9bbc8c0ac)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:33:30 +02:00
Giulio Benetti
b3289aa1b6 package/bind: security bump to version 9.18.50
Release notes:
https://ftp.isc.org/isc/bind9/9.18.50/doc/arm/html/notes.html

Changelog:
https://ftp.isc.org/isc/bind9/9.18.50/doc/arm/html/changelog.html

Security fix:
GL #5934
https://gitlab.isc.org/isc-projects/bind9/-/issues/5934

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 09a13526b8)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:33:15 +02:00
Giulio Benetti
b60dc41c12 package/util-linux: security bump to 2.41.5
Security fixes:

 CVE-2026-53613 - mount(8) TOCTOU race on target path.
   The SUID mount does not pin the mount target directory, allowing a
   race between path resolution and the actual mount syscall.  A local
   attacker can swap an ancestor directory component between these
   steps to redirect a mount to an arbitrary location.
   Reported-by: Xinyao Hu

 CVE-2026-53612 - mount(8) TOCTOU race on post-mount owner/mode change.
   The X-mount.owner, X-mount.group, and X-mount.mode options use
   path-based lchown()/chmod() after mounting.  An attacker can swap
   the target between mount and the ownership/mode change to gain
   control of arbitrary files.
   Reported-by: Xinyao Hu

 CVE-2026-53614 - mount(8) SUID bypass via LIBMOUNT_FORCE_MOUNT2.
   The environment variable LIBMOUNT_FORCE_MOUNT2 is not filtered
   via safe_getenv() in SUID context.  A local attacker can force
   the legacy mount(2) code path, which uses a two-step bind+remount
   or propagation sequence with a window where security flags (nosuid,
   noexec, ...) are not yet applied.
   Reported-by: Xinyao Hu

Full release notes: https://www.kernel.org/pub/linux/utils/util-linux/v2.41/v2.41.5-ReleaseNotes

Signed-off-by: Giulio Benetti <giulio.benetti@benettiengineering.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 40ce6355c9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:32:53 +02:00
Fiona Klute
b7ab3f2a18 package/openrc/sysv-rcs: fix shellcheck 0.10 warnings
* Explicitly set shell type. Shellcheck doesn't know OpenRC, but the
  script as such is POSIX shell.
* Override warnings not applicable in context.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 3e2cc4e46f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:28:43 +02:00
Fiona Klute
11bcf5f5f6 package/mdnsd/S50mdnsd: rewrite to match current guidelines
With the action function as the last command in the script its return
code automatically becomes that of the script, and without explicit
exit shellcheck does not complain about unused functions.

Also wait for the process to stop in "stop", and simplify restart.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b4884a2937)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:28:32 +02:00
Fiona Klute
1708ca0061 package/mpd/S95mpd: do not wait for exit if sending stop failed
If sending the stop signal failed for whatever reason, waiting for an
existing PID file to disappear is likely to block indefinitely.

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit b2d84525f9)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:28:22 +02:00
Fiona Klute
834c844e3b package/mpd/S95mpd: avoid unnecessary exit
The exit status of the last command automatically becomes the exit
status of the script. And if there is no explicit exit shellcheck
accepts unused functions (here: start/stop/... called via variable).

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Tested-by: Andreas Ziegler <br025@umbiko.net>
Signed-off-by: Marcus Hoffmann <buildroot@bubu1.eu>
(cherry picked from commit 118ffb20b5)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:27:52 +02:00
Bernd Kuhls
207b0a2699 package/python3: security bump version to 3.14.6
https://www.python.org/downloads/release/python-3146/
https://docs.python.org/release/3.14.6/whatsnew/changelog.html

Removed patches which are included in this release.

Fixes CVE-2026-9669:
157a5df8cb
https://seclists.org/oss-sec/2026/q2/846

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 5cd9188c3e)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:26:22 +02:00
Bernd Kuhls
a9014f0c96 linux: select host-openssl for all architectures when building latest CIP version
This is a follow-up for buildroot commit
bba86304b0 to extend the fix to CIP
kernels.

Fixes:
aarch64: https://autobuild.buildroot.net/results/f91/f910c1e0e864055120e2deaf4d56b127cabb89bd/
aarch64_be: https://autobuild.buildroot.net/results/6e6/6e651c586f9b2a1c9b39cafaf5bebc8b501e8369/
arcbe: https://autobuild.buildroot.net/results/9fe/9fe7b4c66ac139926e9a3686bc951af703e78b29/
arm: https://autobuild.buildroot.net/results/288/2888b0b6f5473e9c7ec7c443b02b42e1f5d4c814/
armeb: https://autobuild.buildroot.net/results/d6c/d6cbbfdcbebe985d743232070824779e790aa5a8/
microblazeel: https://autobuild.buildroot.net/results/bf3/bf3b4c61cdaf3527e9e315050bf21456bbb24a48/
mips: https://autobuild.buildroot.net/results/c6b/c6b9c82352be01dd4bab2021a223e72dfaf1f522/
or1k: https://autobuild.buildroot.net/results/231/23144a8108c5837e3a9cf26ad6ac73fa16dc740f/
riscv: https://autobuild.buildroot.net/results/31c/31c3abdb23bfe16e248e094e9b0feafbbb0d6a94/
s390x: https://autobuild.buildroot.net/results/bda/bdaaf6767f8c239bbf22e4619b2d6944ef951b2e/
sparc: https://autobuild.buildroot.net/results/426/42614f77be9fa1b3a596cdcb40cfb81f5496b41b/
sparc64: https://autobuild.buildroot.net/results/1f2/1f226d028d85c085d82f3890e804b39bccd2c2dc/
x86_64: https://autobuild.buildroot.net/results/7be/7be86c261a42e1a16c3d38a640be226b5f51bccb/

Supersedes
https://patchwork.ozlabs.org/project/buildroot/patch/20251101102346.109307-1-bernd@kuhls.net/
and includes Edgar's comment.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 7ee8e9f12a)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:25:12 +02:00
Peter Korsgaard
d5d96d16b2 boot/shim: add patch to fix builds with -O3 / -Ofast
Fixes:
https://autobuild.buildroot.net/results/c6ad52a048ba030bb1adc3ee1aeb69ef880cbdad/
https://autobuild.buildroot.net/results/136d1afc2ecacea6a4e12b915073e3eaf5c8ca01/
https://autobuild.buildroot.net/results/a3f293371f6bd0125dc7baa5afb64373e4383f4f/

Shim contains an embedded copy of OpenSSL.  Depending on the optimization
level, an error is triggered from make_kn():

In function 'make_kn',
    inlined from 'make_kn' at crypto/cmac/cmac.c:81:13,
    inlined from 'CMAC_Init' at crypto/cmac/cmac.c:205:9:
crypto/cmac/cmac.c:92:20: error: writing 1 byte into a region of size 0 [-Werror=stringop-overflow=]
   92 |         k1[bl - 1] ^= bl == 16 ? 0x87 : 0x1b;
      |         ~~~~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
crypto/cmac/cmac.c: In function 'CMAC_Init':
crypto/cmac/cmac.c:69:19: note: at offset 2147483647 into destination object 'k1' of size 32
   69 |     unsigned char k1[EVP_MAX_BLOCK_LENGTH];
      |                   ^~

Fix it by including a patch submitted upstream which backports an upstream
OpenSSL change to workaround this.

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 96408d1313)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:24:14 +02:00
Bernd Kuhls
8dec5402e0 package/kodi-screensaver-rsxs: remove dependencies to gli & glm
Upstream commit
a00a3cce3c
added the code of gli & glm in-tree and removed the usage as external
packages.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 8bcb156d33)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:23:49 +02:00
Bernd Kuhls
1103df599a package/kodi-screensaver-rsxs: fix build with cmake 4.x
Fixes build error not caught by the autobuilders with this defconfig:

BR2_x86_64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_FORCE_HOST_BUILD=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_KODI=y
BR2_PACKAGE_KODI_SCREENSAVER_RSXS=y
BR2_PACKAGE_MESA3D=y
BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SOFTPIPE=y
BR2_PACKAGE_MESA3D_OPENGL_GLX=y
BR2_PACKAGE_MESA3D_OPENGL_EGL=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_PYTHON3_PY_ONLY=y
BR2_PACKAGE_LIBUDEV_ZERO=y

Raised minimum version for all addons as requested by upstream.

Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 09fcae1588)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:23:24 +02:00
Romain Naour
ad3c92ffdb Revert "support/testing/tests/package/test_kexec.py: fix kexec test for qemu 5.2"
Our docker image was finally updated to Debian 12 and now provide Qemu
7.2.15 [1]. We can safely revert this workaround for older Qemu version.

[1] e5bbe020ca

This reverts commit 37e23e0dd7.

Signed-off-by: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 4834f18c69)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-25 16:20:50 +02:00
Thomas Perale
09b4a21c96 package/ntp: ignore CVE-2015-7977
The NVD database schema has the following entry

```
{
  "vulnerable": true,
  "criteria": "cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*",
  "versionEndIncluding": "4.2.8",
},
```

Which make every patch revision of the package ntp match to the
CVE-2015-7977.

This commit ignore this entry.

Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00e4a03348)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:55:13 +02:00
Titouan Christophe
ffc2f56308 package/python-django: security bump to v6.0.6
See the release notes:
https://docs.djangoproject.com/en/6.0/releases/6.0.6/

This fixes the following vulnerabilities:
- CVE-2026-6873 : Signed cookie salt namespace collision
- CVE-2026-7666 : Potential unencrypted email transmission via STARTTLS
                  in the SMTP backend
- CVE-2026-8404 : Potential exposure of private data via case-sensitive
                  Cache-Control directives
- CVE-2026-35193: Potential exposure of private data via missing
                  Vary: Authorization
- CVE-2026-48587: Potential exposure of private data via whitespace padding
                  in Vary header

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 00b9069f46)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:54:02 +02:00
Peter Korsgaard
ec7ca21032 package/libopenssl: security bump to version 3.6.3
Fixes the following security issues:

    Fixed heap use-after-free in PKCS7_verify().
    (CVE-2026-45447)

    Fixed CMS AuthEnvelopedData processing may accept forged messages.
    (CVE-2026-34182)

    Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
    (CVE-2026-34183)

    Fixed double-free when checking OCSP stapled response.
    (CVE-2026-35188)

    Fixed NULL pointer dereference in QUIC server initial packet handling.
    (CVE-2026-42764)

    Fixed AES-OCB IV ignored on EVP_Cipher() path.
    (CVE-2026-45445)

    Fixed possible heap buffer overflow in ASN.1 multibyte string conversion.
    (CVE-2026-7383)

    Fixed out-of-bounds read in CMS password-based decryption.
    (CVE-2026-9076)

    Fixed heap buffer over-read in ASN.1 content parsing.
    (CVE-2026-34180)

    Fixed PKCS#12 files with PBMAC1 are accepted with short HMAC keys.
    (CVE-2026-34181)

    Fixed NULL dereference in certificate verification with OCSP Checking.
    (CVE-2026-42765)

    Fixed possible NULL dereference in password-dased CMS decryption.
    (CVE-2026-42766)

    Fixed NULL pointer dereference in CRMF EncryptedValue decryption.
    (CVE-2026-42767)

    Fixed multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt()
    and PKCS7_decrypt().
    (CVE-2026-42768)

    Fixed trust anchor substitution via cert/issuer typo in CMP
    rootCaKeyUpdate.
    (CVE-2026-42769)

    Fixed FFC-DH peer validation uses attacker-supplied q.
    (CVE-2026-42770)

    Fixed incorrect tag processing for empty messages in AES-GCM-SIV
    and AES-SIV modes.
    (CVE-2026-45446)

For more details, see the release notes and advisory:

https://github.com/openssl/openssl/releases/tag/openssl-3.6.3
https://openssl-library.org/news/secadv/20260609.txt

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit b0ea6e310f)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:45:03 +02:00
Peter Korsgaard
fd9b1c2521 package/rsync: bump version to 3.4.4
Bugfix release containing a number of fixes for regressions introduced in
the 3.4.3 release.

For details, see:
https://download.samba.org/pub/rsync/NEWS#3.4.4

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit a9f7f918e0)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:44:53 +02:00
Peter Korsgaard
9a327dc724 package/apache: security bump to version 2.4.68
Fixes the following security issues:

 *) SECURITY: CVE-2026-49975: mod_http2 denial of service
     (cve.mitre.org)
     Memory Allocation with Excessive Size Value vulnerability in
     Apache HTTP Server's mod_http leads to denial of service via
     malicious HTTP requests.
     This issue affects Apache HTTP Server: from 2.4.17 through
     2.4.67.
     Credits: Quang Luong of Calif.IO in collaboration with OpenAI
     Codex

  *) SECURITY: CVE-2026-48913: mod_http2 memory corruption when file
     handles exhausted (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server module
     mod_http2 when file handles are already exhausted.
     This issue affects Apache HTTP Server: from 2.4.55 through
     2.4.67.
     Credits: Sam Lovejoy, IBM X-Force Offensive Research (XOR)

  *) SECURITY: CVE-2026-44631: Heap Underflow in `ap_regname` via
     Signed Char Overflow (cve.mitre.org)
     Buffer Underwrite vulnerability in Apache HTTP Server on crafted
     regular expressions in the configuration.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44186: Loop in `proxy_ftp_handler` in
     mod_proxy_ftp (cve.mitre.org)
     Loop with Unreachable Exit Condition ('Infinite Loop')
     vulnerability in the mod_proxy_ftp module in Apache HTTP Server
     with an attacker controlled backend FTP server.
     This issue affects undefined: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44185: Stack Buffer Over-Read in mod_ssl OCSP
     `send_request` (cve.mitre.org)
     Buffer Over-read vulnerability in Apache HTTP Server via
     outbound OCSP requests to an attacker controlled OCSP server
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-44119: escalation of privilege through
     expressions in .htaccess in multiple modules (cve.mitre.org)
     Improper Privilege Management vulnerability in Apache HTTP
     Server 2.4.67 and earlier allows local .htaccess authors to read
     files with the privileges of the httpd user.
     This issue affects Apache HTTP Server: from through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Lucian Nitescu

  *) SECURITY: CVE-2026-43951: OOB Read in `merge_response_headers`
     can cause crash (cve.mitre.org)
     Out-of-bounds Read vulnerability in Apache HTTP Server with
     mod_headers and mod_mime and multiple response languages.
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42536: mod_xml2enc heap overflow
     (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     with mod_xml2enc, xml2StartParse, and untrusted content
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-42535: mod_dav_fs protected directory access
     (cve.mitre.org)
     A path handling issue in mod_dav_fs in Apache 2.4.67 and
     earlier allows a WebDAV content author to directly manipulate
     trusted DAV property databases, potentially causing child
     process crashes.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Zhenpeng (Leo) Lin at depthfirst

  *) SECURITY: CVE-2026-34356: ProxyPassReverseCookieMap buffer
     overflow (cve.mitre.org)
     Heap-based Buffer Overflow vulnerability in Apache HTTP Server
     with malicious backend servers and ProxyPassReverseCookie*
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Arkadi Vainbrand

  *) SECURITY: CVE-2026-34355: mod_proxy_html buffer overflow
     (cve.mitre.org)
     A buffer overflow in mod_proxy_html in Apache HTTP Server 2.4.67
     and earlier allows an attack by an untrusted backend.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Elhanan Haenel

  *) SECURITY: CVE-2026-29170: mod_proxy_ftp XSS (cve.mitre.org)
     A cross-site scripting vulnerability exists in mod_proxy_ftp's
     HTML directory list generation in Apache HTTP Server 2.4.67 and
     earlier when listing FTP directory contents either via forward
     or reverse proxy configuration.
     Users are recommended to upgrade to version 2.4.68, which fixes
     this issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

  *) SECURITY: CVE-2026-29167: mod_ldap per-dir use-after-free
     (cve.mitre.org)
     Use After Free vulnerability in Apache HTTP Server with mod_ldap
     in per-directory configuration
     This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67.
     Users are recommended to upgrade to version 2.4.68, which fixes
     the issue.
     Credits: Pavel Kohout, Aisle Research, Aisle.com

For more details, see the CHANGES file:
https://downloads.apache.org/httpd/CHANGES_2.4.68

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 07a690f00b)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:44:45 +02:00
Titouan Christophe
8b916532b3 package/redis: security bump to v8.6.4
See the release notes:
https://github.com/redis/redis/blob/8.6.4/00-RELEASENOTES

This fixes the following vulnerabilities:
- CVE-2026-23479:
    Redis is an in-memory data structure store. In redis-server from 7.2.0
    until 8.6.3, the unblock client flow does not handle an error return
    from `processCommandAndResetClient` when re-executing a blocked
    command. If a blocked client is evicted during this flow, an
    authenticated attacker can trigger a use-after-free that may lead to
    remote code execution. This has been patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23479

- CVE-2026-23631:
    Redis is an in-memory data structure store. In all versions of redis-
    server with Lua scripting, an authenticated attacker can exploit the
    master-replica synchronization mechanism to trigger a use-after-free
    on replicas where replica-read-only is disabled or can be disabled,
    which may lead to remote code execution. A workaround is to prevent
    users from executing Lua scripts or avoid using replicas where
    replica-read-only is disabled. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-23631

- CVE-2026-25243:
    Redis is an in-memory data structure store. In versions of redis-
    server up to 8.6.3, the RESTORE command does not properly validate
    serialized values. An authenticated attacker with permission to
    execute RESTORE can supply a crafted serialized payload that triggers
    invalid memory access and may lead to remote code execution. A
    workaround is to restrict access to the RESTORE command with ACL
    rules. This is patched in version 8.6.3.
    https://www.cve.org/CVERecord?id=CVE-2026-25243

- CVE-2026-25588:
    RedisTimeSeries is a time-series module for Redis. In all versions
    before 1.12.14 of RedisTimeSeries, the module does not properly
    validate serialized values processed through the Redis RESTORE
    command. An authenticated attacker with permission to execute RESTORE
    on a server with the RedisTimeSeries module loaded can supply a
    crafted serialized payload that triggers invalid memory access and may
    lead to remote code execution. A workaround is to restrict access to
    the RESTORE command with ACL rules. This has been patched in version
    1.12.14.
    https://www.cve.org/CVERecord?id=CVE-2026-25588

- CVE-2026-25589:
    RedisBloom is a probabilistic data structures module for Redis. In all
    versions of RedisBloom before 2.8.20, the module does not properly
    validate serialized values processed through the Redis RESTORE
    command. An authenticated attacker with permission to execute RESTORE
    on a server with the RedisBloom module loaded can supply a crafted
    serialized payload that triggers invalid memory access and may lead to
    remote code execution. A workaround is to restrict access to the
    RESTORE command with ACL rules. This issue is fixed in version 2.8.20.
    https://www.cve.org/CVERecord?id=CVE-2026-25589

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit be7b7821c6)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
2026-06-18 14:38:26 +02:00
1297 changed files with 16519 additions and 9533 deletions

View File

@@ -52,6 +52,7 @@ board/stmicroelectronics/stm32f429-disco/flash.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_sd.sh Shellcheck
board/stmicroelectronics/stm32f469-disco/flash_xip.sh Shellcheck
board/synopsys/axs10x/post-build.sh Shellcheck
board/technologic/ts4900/post-image.sh Shellcheck
board/udoo/common/post-build.sh Shellcheck
boot/afboot-stm32/0003-Makefile-disable-stack-protector.patch lib_patch.Upstream
boot/optee-os/3.13.0/0001-core-zlib-fix-build-warning-when-_LFS64_LARGEFILE-is.patch lib_patch.Upstream
@@ -128,6 +129,9 @@ configs/olpc_xo175_defconfig lib_defconfig.ForceCheckHash
configs/olpc_xo1_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_pc2_defconfig lib_defconfig.ForceCheckHash
configs/orangepi_zero_plus_defconfig lib_defconfig.ForceCheckHash
configs/pine64_defconfig lib_defconfig.ForceCheckHash
configs/pine64_pinecube_defconfig lib_defconfig.ForceCheckHash
configs/s6lx9_microboard_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_lichee_rv_dock_defconfig lib_defconfig.ForceCheckHash
configs/sipeed_licheepi_nano_defconfig lib_defconfig.ForceCheckHash
@@ -148,6 +152,8 @@ configs/solidrun_clearfog_gt_8k_defconfig lib_defconfig.ForceCheckHash
configs/solidrun_macchiatobin_defconfig lib_defconfig.ForceCheckHash
configs/stm32mp157c_odyssey_defconfig lib_defconfig.ForceCheckHash
configs/terasic_de10nano_cyclone5_defconfig lib_defconfig.ForceCheckHash
configs/ts4900_defconfig lib_defconfig.ForceCheckHash
configs/ts5500_defconfig lib_defconfig.ForceCheckHash
configs/uevm5432_defconfig lib_defconfig.ForceCheckHash
configs/visionfive_defconfig lib_defconfig.ForceCheckHash
configs/wandboard_defconfig lib_defconfig.ForceCheckHash
@@ -185,6 +191,7 @@ package/at/0001-Makefile.in-fix-make-install-for-non-root-don-t-stri.patch lib_p
package/at/S99at lib_sysv.Indent lib_sysv.Variables
package/attr/0001-build-with-older-GCCs.patch lib_patch.Upstream
package/aumix/0001-fix-incorrect-makefile-am.patch lib_patch.Upstream
package/autoconf/0001-dont-add-dirty-to-version.patch lib_patch.Upstream
package/automake/0001-noman.patch lib_patch.Upstream
package/avahi/S05avahi-setup.sh lib_sysv.Indent lib_sysv.Variables
package/avahi/S50avahi-daemon lib_sysv.Indent lib_sysv.Variables
@@ -345,13 +352,22 @@ package/fstrcmp/0001-disable-rpath.patch lib_patch.Upstream
package/ftop/0001-overflow.patch lib_patch.Upstream
package/fxdiv/0001-CMake-don-t-enable-CXX-unless-building-tests-benchma.patch lib_patch.Upstream
package/fxload/0001-fix-static-build.patch lib_patch.Upstream
package/gcc/13.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/14.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/15.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/16.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gcc/8.4.0/0001-xtensa-fix-PR-target-91880.patch lib_patch.Upstream
package/gcc/8.4.0/0002-Revert-re-PR-target-92095-internal-error-with-O1-mcp.patch lib_patch.Upstream
package/gcc/8.4.0/0003-libsanitizer-Remove-cyclades-from-libsanitizer.patch lib_patch.Upstream
package/gcc/8.4.0/0004-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
package/gdb/14.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/14.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/14.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/14.2/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/14.2/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/14.2/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/14.2/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/14.2/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/14.2/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/15.2/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/15.2/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/15.2/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
@@ -370,15 +386,6 @@ package/gdb/16.3/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.U
package/gdb/16.3/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/16.3/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/16.3/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/gdb/17.1/0001-ppc-ptrace-Define-pt_regs-uapi_pt_regs-on-GLIBC-syst.patch lib_patch.Upstream
package/gdb/17.1/0002-sh-ptrace-Define-pt_-dsp-regs-uapi_pt_-dsp-regs-on-G.patch lib_patch.Upstream
package/gdb/17.1/0003-use-asm-sgidefs.h.patch lib_patch.Upstream
package/gdb/17.1/0004-gdbserver-fix-build-for-m68k.patch lib_patch.Upstream
package/gdb/17.1/0005-nat-fork-inferior-include-linux-ptrace.h.patch lib_patch.Upstream
package/gdb/17.1/0006-Fix-getrandom-compile-for-uclibc-v1.0.35.patch lib_patch.Upstream
package/gdb/17.1/0007-fix-musl-build-on-riscv.patch lib_patch.Upstream
package/gdb/17.1/0008-gdbserver-Makefile.in-fix-NLS-build.patch lib_patch.Upstream
package/gdb/17.1/0009-gdb-Fix-native-build-on-xtensa.patch lib_patch.Upstream
package/genpart/0001-fix-return-code.patch lib_patch.Upstream
package/gensio/0001-Fix-missing-EVP_PKEY_ED25519-build-error-on-libressl.patch lib_patch.Upstream
package/gerbera/S99gerbera lib_sysv.Indent
@@ -394,6 +401,7 @@ package/gpsd/S50gpsd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/gptfdisk/0001-gptcurses-partially-revert-Tweaks-for-building-on-th.patch lib_patch.Upstream
package/gstreamer1/gstd/0001-Don-t-require-gstd-check-user-xenv.sh-for-systemd-se.patch lib_patch.Upstream
package/guile/0001-calculate-csqrt_manually.patch lib_patch.Upstream
package/guile/0002-Makefile.am-fix-build-without-makeinfo.patch lib_patch.Upstream
package/gutenprint/0001-use-pregen-xmli18n-header.patch lib_patch.Upstream
package/gutenprint/0002-cups-support-replaces-static-with-static-libtool-lib.patch lib_patch.Upstream
package/harfbuzz/0001-meson.build-check-for-pthread.h.patch lib_patch.Upstream
@@ -553,10 +561,12 @@ package/lirc-tools/0002-configure-add-disable-doc-option.patch lib_patch.Upstrea
package/lirc-tools/S25lircd lib_sysv.Indent lib_sysv.Variables
package/live555/0001-Add-a-pkg-config-file-for-the-shared-libraries.patch lib_patch.Upstream
package/lldpd/S60lldpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/lm-sensors/0001-no-host-ldconfig.patch lib_patch.Upstream
package/lm-sensors/0001-static-build.patch lib_patch.Upstream
package/lm-sensors/0002-no-host-ldconfig.patch lib_patch.Upstream
package/lmbench/0001-scripts-build-use-bin-bash-as-shell.patch lib_patch.Upstream
package/lmbench/0002-src-Makefile-add-lmbench-to-list-of-executables.patch lib_patch.Upstream
package/lmbench/0003-TOO_LONG-100-usec-to-prevent-memsize-from-timingout-.patch lib_patch.Upstream
package/localedef/0002-relax-dependency-on-GCC-to-4.8-and-binutils-to-2.24.patch lib_patch.Upstream
package/lockfile-progs/0001-sus3v-legacy.patch lib_patch.Sob lib_patch.Upstream
package/lshw/0001-solve-Compile-error-when-g-version-is-less-than-5.patch lib_patch.Upstream
package/ltrace/0001-arm-plt.patch lib_patch.Upstream
@@ -604,6 +614,7 @@ package/meson/0001-Prefer-ext-static-libs-when-default-library-static.patch lib_
package/meson/0002-mesonbuild-dependencies-base.py-add-pkg_config_stati.patch lib_patch.Upstream
package/mfgtools/0001-lnx_def.h-fix-conflicting-declaration-of-__time64_t.patch lib_patch.Upstream
package/mii-diag/0001-strchr.patch lib_patch.Sob lib_patch.Upstream
package/mini-snmpd/0001-linux.c-fix-musl-build.patch lib_patch.Upstream
package/minidlna/S60minidlnad Shellcheck lib_sysv.Indent lib_sysv.Variables
package/minissdpd/S50minissdpd Shellcheck lib_sysv.Indent lib_sysv.Variables
package/modem-manager/S44modem-manager Shellcheck lib_sysv.Variables
@@ -676,9 +687,8 @@ package/olsr/0006-build-patch-for-gpsd-3-25.patch lib_patch.Upstream
package/olsr/S50olsr Shellcheck lib_sysv.Indent lib_sysv.Variables
package/open-plc-utils/0001-Remove-OWNER-and-GROUPS-parameters-to-install.patch lib_patch.Upstream
package/open2300/0001-fix-makefile.patch lib_patch.Upstream
package/openjdk/17.0.18+8/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.10+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/25.0.2+10/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/17.0.12+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openjdk/21.0.4+7/0001-Add-ARCv2-ISA-processors-support-to-Zero.patch lib_patch.Upstream
package/openldap/0001-fix-bignum.patch lib_patch.Upstream
package/openldap/0002-disable-docs.patch lib_patch.Upstream
package/openntpd/S49ntp Shellcheck lib_sysv.Variables
@@ -766,7 +776,11 @@ package/qextserialport/0001-Create-a-main-include-file-QExtSerialPort.patch lib_
package/qextserialport/0002-Tell-qmake-to-add-a-pkgconfig-file-to-ease-usage-wit.patch lib_patch.Upstream
package/qt5/qt5base/0001-qtbase-Fix-build-error-when-using-EGL.patch lib_patch.Upstream
package/qt5/qt5base/0002-double-conversion-enable-for-microblaze.patch lib_patch.Upstream
package/qt5/qt5base/0003-double-conversion-enable-for-nios2.patch lib_patch.Upstream
package/qt5/qt5base/0004-double-conversion-enable-for-xtensa.patch lib_patch.Upstream
package/qt5/qt5base/0005-eglfs-avoid-breaking-compilation-for-obscure-EGLNativeDisplayType-types.patch lib_patch.Upstream
package/qt5/qt5base/0006-Fix-build-on-riscv32.patch lib_patch.Upstream
package/qt5/qt5base/0007-src-corelib-configure.json-fix-atomicfptr-detection.patch lib_patch.Upstream
package/qt5/qt5base/0008-eglconvenience-add-missing-QList-include.patch lib_patch.Upstream
package/qt5/qt5declarative/0001-qsgtexture-fix-debug-build-with-uclibc.patch lib_patch.Upstream
package/qt5/qt5declarative/0002-qv4regexp_p-needs-c-limits-include-instead-of-plain-.patch lib_patch.Upstream
@@ -774,8 +788,10 @@ package/qt5/qt5enginio/0001-Do-not-use-deprecated-QLinkedList.patch lib_patch.Up
package/qt5/qt5location/0001-3rdparty-mapbox-gl-native-fix-musl-compile-pthread_g.patch lib_patch.Upstream
package/qt5/qt5script/0001-Detect-32-bits-armv8-a-architecture.patch lib_patch.Upstream
package/qt5/qt5tools/0001-Disable-designer-tool-fixes-configure-error.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0001-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webengine-chromium/0002-Don-t-rebase-sysroot-path.patch lib_patch.Upstream
package/qt5/qt5webengine/0001-gn.pro-don-t-link-statically-with-libstc.patch lib_patch.Upstream
package/qt5/qt5webengine/0002-Add-python3-build-support.patch lib_patch.Upstream
package/qt5/qt5webkit/0001-WinCairo-PlayStation-ICU-68.1-no-longer-exposes-FALS.patch lib_patch.Upstream
package/qt5/qt5webkit/0002-Fix-compilation-with-Python-3.9-avoid-passing-encodi.patch lib_patch.Upstream
package/qt5/qt5webkit/0003-Let-Bison-generate-the-header-directly-to-fix-build-.patch lib_patch.Upstream
@@ -795,6 +811,7 @@ package/restorecond/S02restorecond Shellcheck
package/ripgrep/0001-puts-jemalloc-allocator-behind-a-cargo-feature-flag.patch lib_patch.Upstream
package/riscv-isa-sim/0001-riscv-disable-precompiled-headers.patch lib_patch.Upstream
package/rng-tools/S21rngd Shellcheck lib_sysv.Variables
package/rocksdb/0001-build_tools-build_detect_platform-fix-C-tests.patch lib_patch.Upstream
package/rpcbind/0001-Remove-yellow-pages-support.patch lib_patch.Upstream
package/rpcbind/S30rpcbind lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
package/rt-tests/0001-Fix-a-build-issue-with-uClibc-ng.patch lib_patch.Upstream
@@ -867,6 +884,7 @@ package/ti-sgx-um/0001-Makefile-do-not-install-init-script.patch lib_patch.Upstr
package/ti-sgx-um/S80ti-sgx lib_sysv.Variables
package/ti-utils/0001-plt.h-fix-build-with-gcc-10.patch lib_patch.Upstream
package/tinyalsa/0001-include-time.h-before-asound.h.patch lib_patch.Upstream
package/tinycompress/0001-wave-add-time.h-missing-header-inclusion.patch lib_patch.Upstream
package/tinydtls/0001-sha2-sha2.c-fix-build-on-big-endian.patch lib_patch.Upstream
package/transmission/S92transmission Shellcheck lib_sysv.ConsecutiveEmptyLines lib_sysv.Indent lib_sysv.Variables
package/triggerhappy/S10triggerhappy Shellcheck lib_sysv.Indent lib_sysv.Variables
@@ -955,7 +973,6 @@ package/x11r7/xdriver_xf86-video-mach64/0001-cross-compile.patch lib_patch.Upstr
package/x11r7/xdriver_xf86-video-tdfx/0001-cross.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/x11r7/xserver_xorg-server/S40xorg Shellcheck lib_sysv.Variables
package/x11r7/xwayland/0001-include-misc.h-fix-uClibc-build.patch lib_patch.Upstream
package/xl2tp/xl2tpd lib_shellscript.TrailingSpace
package/yajl/0001-Let-the-shared-and-the-static-library-have-the-same-.patch lib_patch.Upstream
package/yajl/0002-cmake-disable-shared-library-build-when-BUILD_SHARED.patch lib_patch.Upstream

361
CHANGES
View File

@@ -105,6 +105,7 @@
rsync, ruby, rust, shadow, shim, squid, strongswan, sudo, tiff, tmux,
tor, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2026.05, released June 8th, 2026
Various fixes.
@@ -218,129 +219,6 @@
Removed packages: cegui, openswan, pcre, rubix, snort,
spinxbase
2026.02.3, released June 16, 2026
Important / security related fixes:
asterisk: GHSA-8fj4-fv9f-hjpc, GHSA-g88q-c2hm-q7p7,
GHSA-j29p-pvh2-pvqp, GHSA-x5pq-qrp4-fmrj
bind: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950
capnproto: CVE-2026-322, CVE-2026-32239, CVE-2026-32240
cups-filters: CVE-2025-64524
dnsmasq: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893, CVE-2026-5172
docker-engine: CVE-2025-54388
dropbear: CVE-2019-6111, CVE-2026-35385
exim: (no CVE assigned), CVE-2026-48840
expat: CVE-2026-45186
freeipmi: CVE-2026-50031
glibc: CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5450,
CVE-2026-5928
gnupg2: (no CVE assigned)
haveged: CVE-2026-41054
imagemagick: CVE-2026-42326, CVE-2026-45031, CVE-2026-45358,
CVE-2026-45359, CVE-2026-45624, CVE-2026-45664, CVE-2026-46520,
CVE-2026-46521, CVE-2026-46522, CVE-2026-46523, CVE-2026-46557,
CVE-2026-46559
intel-microcode: CVE-2025-35979
libde265: CVE-2026-45382, CVE-2026-45383, GHSA-ccfw-29x7-rrx3,
GHSA-j2qq-x2xq-g9wr
libgpg-error: T8239
libheif: CVE-2026-32738, CVE-2026-32739, CVE-2026-32740,
CVE-2026-32741, CVE-2026-32814, CVE-2026-32882, CVE-2026-3949,
CVE-2026-41069, CVE-2026-41071, CVE-2026-47178, CVE-2026-47247,
CVE-2026-47251, CVE-2026-47254, CVE-2026-47709, CVE-2026-47714,
GHSA-5hqq-636x-r3cr, GHSA-6x5f-qchq-cxqv, GHSA-jvmp-j3cw-84mh,
GHSA-r7qj-cg5r-r6vf
libmad: CVE-2017-837, CVE-2017-8372, CVE-2017-8373, CVE-2017-8374
libmodsecurity: CVE-2026-30923, CVE-2026-42268
libssh2: CVE-2026-7598
liburiparser: CVE-2026-44927, CVE-2026-44928
libusb: CVE-2026-23679, CVE-2026-47104
libvncserver: CVE-2026-3285, CVE-2026-32853, CVE-2026-32854
mariadb: CVE-2026-34303, CVE-2026-3494, CVE-2026-44168, CVE-2026-44169,
CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173
memcached: (no CVE assigned)
nginx: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934,
CVE-2026-42945, CVE-2026-42946, CVE-2026-9256
php: CVE-2026-44927, CVE-2026-44928
postgresql: CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638
privoxy: OVE-20260515-0001, OVE-20260515-0002
putty: (no CVE assigned)
python-urllib3: CVE-2026-44431, CVE-2026-44432
python3: CVE-2026-3276, CVE-2026-7774, CVE-2026-8328, gh-146211,
gh-146333, gh-148169, gh-148178, gh-148395, gh-149017, gh-149254,
gh-90309
radvd: CVE-2026-48715
rsync: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620, CVE-2026-45232
runc: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
samba4: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480
sdl2_image: CVE-2026-35444
sed: CVE-2026-5958
sshfs: CVE-2026-47187, CVE-2026-48711
tor: TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021, TROVE-2026-022
unbound: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944,
CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
unzip: CVE-2021-4217
xserver_xorg-server: (no CVE assigned)
xwayland: (no CVE assigned)
Toolchain:
- linux-headers: bump to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91,
6.18.33
Infrastructure updates/fixes:
- cve-check: fix vulnerabilities with different analysis
- generate-cyclonedx: add hashes from .hash files to externalReferences
- generate-cyclonedx: hint at missing Buildroot host package on a
specific error
- bump-stable-kernel-versions: update for split hash file
- kconfig: fix compiler warnings
- cve-check: add indication how to run
- Remove /usr/share/info/dir from target
- generate-cyclonedx: remove indirect dependencies from root component
- replicate IGNORE_CVES to host packages
- cve-check: remove 'bom-ref' for vulnerabilities
- generate-cyclonedx: generate externalReferences with
source-distribution
- cve-check: fix vulnerability timestamp to RFC 3339
- generate-cyclonedx: generate vcs externalReferences for source repos
- gitlab-ci: use larger shared runners where necessary
- add 'make show-info-all'
- dependencies.sh: reject buggy uutils "install" on Ubuntu 26.04
Updated defconfigs: arcturus_ucp1020, at91sam9x5ek*
Updated / fixed packages: kexec, zsh, cups-filters, python-cbor2,
haveged, lrzsz, ustream-ssl, expat, xwayland, libvncserver, liburing,
sysrepo, qt53d, collectd, mariadb, gstreamer1, jemalloc, libks,
lua-sdl2, util-linux, vlc, xfsprogs, kodi, bind, libde265,
docker-cli, libabseil-cpp, wpewebkit, libpthsem, heirloom-mailx, icu,
libheif, podman, unbound, dropbear, vorbis-tools, crucible, unzip,
libssh2, python3, imagemagick, libbpf, gdb, capnproto, esp-hosted,
freeipmi, asterisk, wireless-regdb, intel-microcode, weston,
util-linux-libs, linux-headers, qt6base, zlib-ng, libgphoto2, hplip,
bpftrace, postgresql, babeld, sed, libdrm, lrzip, odhcp6c, linux,
efl, libusb, jq, sane-airscan, libmad, faad2, dnsmasq, privoxy,
libgit2, mrp, putty, sshfs, gcc-bare-metal, graphene, mongoose,
rsync, redis, hiredis, cairo, zic, dos2unix, libargon2,
docker-engine, sane-backends, arm-trusted-firmware, libnss, openscap,
opencv4, liburiparser, libdill, radvd, poppler, tzdata,
gst1-plugins-bad, python-ecdsa, php, stellarium, python-aiodns,
nginx, gnupg2, tor, xerces, gst1-plugins-good, libmodsecurity,
sdl2_image, readline, libgpg-error, samba4, runc,
xserver_xorg-server, glibc, memcached, libmicrohttpd, supertux, exim,
python-urllib3, qt5webengine-chromium
2026.02.2, released May 20, 2026
Changes with potentially large impact:
@@ -1573,243 +1451,6 @@
- netsnmp: unexpected header length in /proc/net/snmp...
https://gitlab.com/buildroot.org/buildroot/-/issues/110
2025.02.16, released July 15, 2026
Important / security related fixes:
apache: CVE-2026-29167, CVE-2026-29170, CVE-2026-34355, CVE-2026-34356,
CVE-2026-42535, CVE-2026-42536, CVE-2026-43951, CVE-2026-44119,
CVE-2026-44185, CVE-2026-44186, CVE-2026-44631, CVE-2026-48913,
CVE-2026-49975
asterisk: GHSA-3g56-cgrh-95p5, GHSA-3rhj-hhw7-m6fw,
GHSA-4pgv-j3mr-3rcp, GHSA-589g-qgf8-m6mx, GHSA-746q-794h-cc7f,
GHSA-8jhw-m2hg-vp3h, GHSA-8jw3-ccr9-xrmf, GHSA-g8q2-p36q-94f6,
GHSA-h5hv-jmgj-92q2, GHSA-j2mm-57pq-jh94, GHSA-mxgm-8c6f-5p8f,
GHSA-ph27-3m5q-mj5m, GHSA-q9fr-m7g8-6ph5, GHSA-qf8j-jp7h-c5hx,
GHSA-r6c2-hwc2-j4mp, GHSA-vfhr-r9x9-c687, GHSA-vrfp-mg3q-3959,
GHSA-wcvv-g26m-wx5c, GHSA-x348-j6c9-77f3, GHSA-xgj6-2gc5-5x9c
avahi: CVE-2026-34933
bind: (no CVE assigned), CVE-2026-3593
cpp-httplib: CVE-2026-45352, CVE-2026-45372, CVE-2026-46527
cups-filters: CVE-2025-64503
expat: CVE-2026-50219, CVE-2026-56131, CVE-2026-56132, CVE-2026-56403,
CVE-2026-56404, CVE-2026-56405, CVE-2026-56406, CVE-2026-56407,
CVE-2026-56408, CVE-2026-56409, CVE-2026-56410, CVE-2026-56411,
CVE-2026-56412
ghostscript: (no CVE assigned)
glibc: CVE-2026-5450, CVE-2026-5928
icu: CVE-2025-5222
imagemagick: CVE-2026-48724, CVE-2026-48733, CVE-2026-48734,
CVE-2026-48994, CVE-2026-49218, CVE-2026-49219, CVE-2026-53460,
CVE-2026-53461, CVE-2026-53462, CVE-2026-53463, CVE-2026-53464,
CVE-2026-53465
jq: CVE-2026-32316, CVE-2026-33947, CVE-2026-33948, CVE-2026-39979,
CVE-2026-40164, CVE-2026-40612, CVE-2026-41256, CVE-2026-41257,
CVE-2026-43894, CVE-2026-43896, CVE-2026-44777, CVE-2026-49839,
CVE-2026-54679
libarchive: (no CVE assigned)
libcurl: CVE-2026-10536, CVE-2026-11352, CVE-2026-11564,
CVE-2026-11586, CVE-2026-11856, CVE-2026-12064, CVE-2026-8286,
CVE-2026-8458, CVE-2026-8924, CVE-2026-8925, CVE-2026-8926,
CVE-2026-8927, CVE-2026-8932, CVE-2026-9079, CVE-2026-9080,
CVE-2026-9545, CVE-2026-9546, CVE-2026-9547
libevent: (no CVE assigned)
libglib2: CVE-2025-14087
libgsasl: CVE-2026-48829
libinput: CVE-2026-50292
libopenssl: CVE-2026-34180, CVE-2026-34181, CVE-2026-34182,
CVE-2026-34183, CVE-2026-42764, CVE-2026-42766, CVE-2026-42767,
CVE-2026-42768, CVE-2026-42769, CVE-2026-42770, CVE-2026-45445,
CVE-2026-45446, CVE-2026-45447, CVE-2026-7383, CVE-2026-9076
libssh2: CVE-2026-55199, CVE-2026-55200
mariadb: CVE-2026-48163, CVE-2026-48165, CVE-2026-49261
mesa3d: CVE-2026-40393
mongoose: (no CVE assigned yet)
nginx: CVE-2026-42055, CVE-2026-48142
openjpeg: CVE-2026-6192
openvpn: CVE-2026-11771, CVE-2026-12932, CVE-2026-12996,
CVE-2026-13117, CVE-2026-13122, CVE-2026-13698
php: CVE-2026-12184, CVE-2026-14355
python-django: CVE-2026-35192, CVE-2026-35193, CVE-2026-48587,
CVE-2026-5766, CVE-2026-6873, CVE-2026-6907, CVE-2026-7666,
CVE-2026-8404
python3: CVE-2026-11940, CVE-2026-9669
redis: CVE-2026-23479, CVE-2026-23631, CVE-2026-25243
squid: CVE-2026-33515, CVE-2026-33526, CVE-2026-47729, CVE-2026-50012
sudo: CVE-2026-35535
swupdate: CVE-2026-28525
tiff: CVE-2026-36849
tor: TROVE-2026-025, TROVE-2026-026.
util-linux: CVE-2025-14104, CVE-2026-27456, CVE-2026-53612,
CVE-2026-53613, CVE-2026-53614
webkitgtk: CVE-2026-28847, CVE-2026-28883, CVE-2026-28901,
CVE-2026-28902, CVE-2026-28903, CVE-2026-28904, CVE-2026-28905,
CVE-2026-28907, CVE-2026-28942, CVE-2026-28946, CVE-2026-28947,
CVE-2026-28953, CVE-2026-28955, CVE-2026-28958, CVE-2026-43658,
CVE-2026-43660
wolfssl: CVE-2026-10097, CVE-2026-10098, CVE-2026-10512,
CVE-2026-10592, CVE-2026-11310, CVE-2026-11703, CVE-2026-11999,
CVE-2026-12340, CVE-2026-55958, CVE-2026-55960, CVE-2026-55961,
CVE-2026-55962, CVE-2026-55964, CVE-2026-55967, CVE-2026-6091,
CVE-2026-6092, CVE-2026-6094, CVE-2026-6291, CVE-2026-6325,
CVE-2026-6329, CVE-2026-6330, CVE-2026-6331, CVE-2026-6412,
CVE-2026-6450, CVE-2026-6678, CVE-2026-6681, CVE-2026-6731,
CVE-2026-7511, CVE-2026-7531, CVE-2026-7532, CVE-2026-8720
Toolchain:
- gcc: bump 14.x series to 14.4.0
- glibc, localedef: security bump to version 2.41-143-gfc7a48bc9
Infrastructure updates/fixes:
- support/testing Improve TestPythonPy3NetworkmanagerGoi
- generate-cyclonedx: fixup scp-style git sites
- support/testing: Fix test_gnupg2
- support/testing: various internal refactorings
Updated / fixed packages: apache, asterisk, avahi, bind, bind,
cpp-httplib, cpp-httplib, cups-filters, expat, gcc:, ghostscript,
glibc, hwdata, icu, imagemagick, jq, kodi-screensaver-rsxs,
libarchive, libcurl, libepoxy, libevent, libglib2, libglib2,
libglib2-bootstrap, libgsasl, libgsasl, libinput, libopenssl,
libssh2, libssh2, linux, mariadb, mdnsd, mesa3d, mongoose, mpd,
nginx, ntp, openjpeg, openrc, openvpn, php, python-django, python3,
python3, qt5, redis, rsync, ruby, shadow, shim, squid, squid, squid,
squid, strongswan, sudo, swupdate, tiff, tor, util-linux, util-linux,
util-linux, util-linux, util-linux, util-linux, webkitgtk, wolfssl
2025.02.15, released June 16, 2026
Important / security related fixes:
asterisk: GHSA-8fj4-fv9f-hjpc, GHSA-g88q-c2hm-q7p7,
GHSA-j29p-pvh2-pvqp, GHSA-x5pq-qrp4-fmrj
bind: CVE-2026-3039, CVE-2026-3592, CVE-2026-5946, CVE-2026-5950
capnproto: CVE-2026-322, CVE-2026-32239, CVE-2026-32240
cups-filters: CVE-2025-64524
dnsmasq: CVE-2026-2291, CVE-2026-4890, CVE-2026-4891, CVE-2026-4892,
CVE-2026-4893, CVE-2026-5172
dropbear: CVE-2019-6111, CVE-2026-35385
exim: (no CVE assigned), CVE-2026-48840
expat: CVE-2026-45186
freeipmi: CVE-2026-50031
glibc: CVE-2026-4046, CVE-2026-4437, CVE-2026-4438, CVE-2026-5450,
CVE-2026-5928
go: (no CVE assigned), CVE-2025-61726, CVE-2025-61728, CVE-2025-61730,
CVE-2025-61731, CVE-2025-61732, CVE-2025-68121, CVE-2025-68121,
CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139,
CVE-2026-27140, CVE-2026-27142, CVE-2026-27143, CVE-2026-27144,
CVE-2026-32280, CVE-2026-32281, CVE-2026-32283, CVE-2026-32288,
CVE-2026-32289, CVE-2026-33810, CVE-2026-33811, CVE-2026-33814,
CVE-2026-39817, CVE-2026-39819, CVE-2026-39820, CVE-2026-39823,
CVE-2026-39825, CVE-2026-39826, CVE-2026-39836, CVE-2026-42499,
CVE-2026-42501
go-bootstrap-stage5: CVE-2026-33811, CVE-2026-33814, CVE-2026-39817,
CVE-2026-39819, CVE-2026-39820, CVE-2026-39823, CVE-2026-39825,
CVE-2026-39826, CVE-2026-39836, CVE-2026-42499, CVE-2026-42501
haveged: CVE-2026-41054
imagemagick: CVE-2026-42326, CVE-2026-45031, CVE-2026-45358,
CVE-2026-45359, CVE-2026-45624, CVE-2026-45664, CVE-2026-46520,
CVE-2026-46521, CVE-2026-46522, CVE-2026-46523, CVE-2026-46557,
CVE-2026-46559
intel-microcode: CVE-2025-35979
libde265: CVE-2026-45382, CVE-2026-45383, GHSA-ccfw-29x7-rrx3,
GHSA-j2qq-x2xq-g9wr
libgpg-error: T8239
libheif: CVE-2026-32738, CVE-2026-32739, CVE-2026-32740,
CVE-2026-32741, CVE-2026-32814, CVE-2026-32882, CVE-2026-3949,
CVE-2026-41069, CVE-2026-41071, CVE-2026-47178, CVE-2026-47247,
CVE-2026-47251, CVE-2026-47254, CVE-2026-47709, CVE-2026-47714,
GHSA-5hqq-636x-r3cr, GHSA-6x5f-qchq-cxqv, GHSA-jvmp-j3cw-84mh,
GHSA-r7qj-cg5r-r6vf
libmad: CVE-2017-837, CVE-2017-8372, CVE-2017-8373, CVE-2017-8374
libmodsecurity: CVE-2026-30923, CVE-2026-42268
libssh2: CVE-2026-7598
liburiparser: CVE-2026-44927, CVE-2026-44928
libusb: CVE-2026-23679, CVE-2026-47104
libvncserver: CVE-2026-3285, CVE-2026-32853, CVE-2026-32854
linux-pam: CVE-2025-6020
mariadb: CVE-2026-34303, CVE-2026-3494, CVE-2026-44168, CVE-2026-44169,
CVE-2026-44170, CVE-2026-44171, CVE-2026-44172, CVE-2026-44173
memcached: (no CVE assigned)
nginx: CVE-2026-40460, CVE-2026-40701, CVE-2026-42926, CVE-2026-42934,
CVE-2026-42945, CVE-2026-42946, CVE-2026-9256
openssh: CVE-2025-61984, CVE-2025-61985, CVE-2026-35385,
CVE-2026-35386, CVE-2026-35387, CVE-2026-35388, CVE-2026-35414
php: CVE-2025-14179, CVE-2026-6722, CVE-2026-6735, CVE-2026-7258,
CVE-2026-7259, CVE-2026-7261, CVE-2026-7262, CVE-2026-7568
postgresql: CVE-2026-6472, CVE-2026-6473, CVE-2026-6474, CVE-2026-6475,
CVE-2026-6476, CVE-2026-6477, CVE-2026-6478, CVE-2026-6479,
CVE-2026-6575, CVE-2026-6637, CVE-2026-6638
putty: CVE-2026-48850, CVE-2026-48851, CVE-2026-48852
python-urllib3: CVE-2026-44431, CVE-2026-44432
python3: CVE-2026-3276, CVE-2026-7774, CVE-2026-8328
radvd: CVE-2026-48715
rsync: CVE-2026-29518, CVE-2026-43617, CVE-2026-43618, CVE-2026-43619,
CVE-2026-43620, CVE-2026-45232
runc: CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
samba4: CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480
sdl2_image: CVE-2026-35444
sed: CVE-2026-5958
sshfs: CVE-2026-47187, CVE-2026-48711
tor: TROVE-2026-013, TROVE-2026-014, TROVE-2026-015, TROVE-2026-016,
TROVE-2026-017, TROVE-2026-018, TROVE-2026-019, TROVE-2026-020,
TROVE-2026-021, TROVE-2026-022
unbound: CVE-2026-32792, CVE-2026-33278, CVE-2026-40622,
CVE-2026-41292, CVE-2026-42534, CVE-2026-42923, CVE-2026-42944,
CVE-2026-42959, CVE-2026-42960, CVE-2026-44390, CVE-2026-44608
unzip: CVE-2021-4217
xserver_xorg-server: (no CVE assigned)
xwayland: (no CVE assigned)
Toolchain:
- linux-headers:: bump to 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91
Infrastructure updates/fixes:
- generate-cyclonedx: generate externalReferences with
source-distribution
- Remove /usr/share/info/dir from target
- bump-stable-kernel-versions: update for split hash file
- cve-check: fix vulnerability timestamp to RFC 3339
- cve-check: remove 'bom-ref' for vulnerabilities
- generate-cyclonedx: add hashes from .hash files to externalReferences
- dependencies.sh: reject buggy uutils "install" on Ubuntu 26.04
- add 'make show-info-all'
- cve-check: fix vulnerabilities with different analysis
- kconfig: fix compiler warnings
- generate-cyclonedx: remove indirect dependencies from root component
- cve-check: add indication how to run
- generate-cyclonedx: generate vcs externalReferences for source repos
- gitlab-ci: use larger shared runners where necessary
- replicate IGNORE_CVES to host packages
- generate-cyclonedx: hint at missing Buildroot host package on a
specific error
Updated defconfigs: at91sam9x5ek*
Updated / fixed packages: libmicrohttpd, qt53d, crucible, libgit2, php,
esp-hosted, tzdata, libabseil-cpp, collectd, redis, swupdate,
libdill, zsh, samba4, haveged, arm-trusted-firmware, weston,
wireless-regdb, libssh2, go-bootstrap-stage5, jq, kodi, unbound,
lrzip, libgpg-error, hplip, expat, heimdal, glibc, go, imagemagick,
kexec, libnss, putty, libmad, vorbis-tools, libvncserver, rsync,
mongoose, intel-microcode, freeipmi, openssh, dos2unix, liburiparser,
zic, cups-filters, libks, odhcp6c, libmodsecurity, memcached,
graphene, vlc, capnproto, faad2, gcc-bare-metal, mariadb, qt6base,
python-ecdsa, runc, heirloom-mailx, icu, systemd, unzip, dnsmasq,
gst1-plugins-bad, cairo, dropbear, libusb, asterisk, hiredis,
linux-pam, sed, gstreamer1, xfsprogs, python-urllib3, radvd,
qt5webengine-chromium, sshfs, gdb, python3, sane-backends,
linux-headers:, zlib-ng, libheif, supertux, postgresql,
gst1-plugins-good, libde265, libdrm, exim, linux, lrzsz, babeld,
bind, nginx, stellarium, sdl2_image, tor, libpthsem, wpewebkit,
libargon2, xwayland, python-cbor2, xserver_xorg-server, poppler,
jemalloc
2025.02.14, released May 20, 2026
Changes with potentially large impact:

View File

@@ -101,6 +101,11 @@ config BR2_HOST_GCC_AT_LEAST_15
# When adding new entries above, be sure to update
# the HOSTCC_MAX_VERSION variable in the Makefile.
# Hidden boolean selected by packages in need of Java in order to build
# (example: kodi)
config BR2_NEEDS_HOST_JAVA
bool
# Hidden boolean selected by pre-built packages for x86, when they
# need to run on x86-64 machines (example: pre-built external
# toolchains, binary tools, etc.).

View File

@@ -144,63 +144,6 @@ endif
###############################################################################
comment "Legacy options removed in 2026.08"
config BR2_PACKAGE_TS4900_FPGA
bool "ts4900-fpga removed"
select BR2_LEGACY
help
The ts4900 defconfig was removed, so ts4900-fpga package
has been dropped.
config BR2_GDB_VERSION_14
bool "gdb 14.x has been removed"
select BR2_LEGACY
help
GDB 14.x support has been removed, a newer version should be
used instead.
config BR2_PACKAGE_ARGPARSE
bool "argparse has been removed"
select BR2_LEGACY
select BR2_PACKAGE_LUA_ARGPARSE
help
Package argparse duplicates the package lua-argparse.
config BR2_KERNEL_HEADERS_7_0
bool "kernel headers version 7.0.x are no longer supported"
select BR2_LEGACY
help
Version 7.0.x of the Linux kernel headers are no longer
maintained upstream and are now removed.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_SAP
bool "bluez sap plugin removed"
select BR2_LEGACY
help
Build plugin for SAP profile.
config BR2_PACKAGE_BLUEZ5_UTILS_PLUGINS_HEALTH
bool "bluez health plugin removed"
select BR2_LEGACY
help
Build plugin for health profiles.
config BR2_GCC_VERSION_13_X
bool "gcc 13.x support removed"
select BR2_LEGACY
help
Support for building a toolchain based on GCC 13.x has been
removed, chose a newer GCC version instead.
config BR2_PACKAGE_QEMU_TARGET_MICROBLAZEEL
bool "qemu target microblazeel removed"
select BR2_PACKAGE_QEMU_TARGET_MICROBLAZE
select BR2_LEGACY
help
Version 11.0.0 of qemu folded microblazeel support into
the microblaze target.
comment "Legacy options removed in 2026.05"
config BR2_PACKAGE_PTPD2

View File

@@ -158,8 +158,6 @@ N: Alexis Lothoré <alexis.lothore@bootlin.com>
F: package/libxmlsec1/
F: package/openscap/
F: package/python-scp/
F: support/testing/tests/package/test_libldns.py
F: support/testing/tests/package/test_python_scp.py
N: Alistair Francis <alistair@alistair23.me>
F: board/sifive/
@@ -168,9 +166,6 @@ F: configs/hifive_unleashed_defconfig
F: package/libspdm/
F: package/xen/
N: Alsey Coleman Miller <alseycmiller@gmail.com>
F: package/liblc3/
N: Alvaro G. M <alvaro.gamez@hazent.com>
F: package/dcron/
F: package/libxmlrpc/
@@ -191,7 +186,6 @@ F: package/wine/
N: Andrea Ricchi <andrea.ricchi@amarulasolutions.com>
F: package/cutekeyboard/
F: package/libcppconnman/
N: Andreas Klinger <ak@it-klinger.de>
F: package/ply/
@@ -249,7 +243,6 @@ F: package/python-pillow/
F: package/python-pydal/
F: package/python-spidev/
F: package/python-web2py/
F: package/qpdf/
F: package/qt5/qt5coap/
F: package/qt5/qt5knx/
F: package/qt5/qt5mqtt/
@@ -452,7 +445,6 @@ F: package/libsidplay2/
F: package/libsilk/
F: package/libsndfile/
F: package/libsoundtouch/
F: package/libudev-zero/
F: package/libudfread/
F: package/libunibreak/
F: package/liburiparser/
@@ -521,7 +513,6 @@ F: package/python-pyicu/
F: package/python-pylru/
F: package/python-requests-oauthlib/
F: package/python-slob/
F: package/qt6/qt6positioning/
F: package/rrdtool/
F: package/rsync/
F: package/rtmpdump/
@@ -539,7 +530,6 @@ F: package/unixodbc/
F: package/utfcpp/
F: package/vlc/
F: package/wget/
F: package/wget2/
F: package/wireless-regdb/
F: package/wireless_tools/
F: package/x264/
@@ -712,9 +702,6 @@ F: package/perl-sys-mmap/
F: package/perl-time-parsedate/
F: package/perl-x10/
N: Christopher Obbard <obbardc@gmail.com>
F: package/dtui/
N: Colin Foster <colin.foster@in-advantage.com>
F: package/python-tftpy/
F: package/rauc-hawkbit-updater/
@@ -822,7 +809,6 @@ F: package/babeld/
F: package/bc/
F: package/cmocka/
F: package/connman/
F: package/drogon/
F: package/empty/
F: package/iana-assignments/
F: package/inih/
@@ -1152,7 +1138,6 @@ F: package/cpulimit/
N: Florian Larysch <fl@n621.de>
F: package/casync-nano/
F: package/sigsum-c/
F: package/sigsum-go/
N: Floris Bos <bos@je-eigen-domein.nl>
@@ -1177,7 +1162,7 @@ F: board/visionfive2/
F: configs/sipeed_licheepi_nano_defconfig
F: configs/visionfive2_defconfig
N: Francois Perrad <francois.perrad.86@gmail.com>
N: Francois Perrad <francois.perrad@gadz.org>
F: board/olimex/a20_olinuxino
F: board/olimex/imx233_olinuxino/
F: board/olimex/stmp1_olinuxino/
@@ -1191,9 +1176,7 @@ F: package/copas/
F: package/coxpcall/
F: package/dado/
F: package/ficl/
F: package/hare*
F: package/janet/
F: package/qbe/
F: package/libtomcrypt/
F: package/libtommath/
F: package/linenoise/
@@ -1209,12 +1192,10 @@ F: package/lzlib/
F: package/moarvm/
F: package/opendoas/
F: package/perl*
F: package/pkg-hare.mk
F: package/pkg-perl.mk
F: package/pkg-luarocks.mk
F: package/quickjs/
F: package/rings/
F: package/scdoc/
F: package/wsapi/
F: package/wsapi-fcgi/
F: package/wsapi-xavante/
@@ -1676,7 +1657,6 @@ F: package/ssdp-responder/
F: package/sysklogd/
F: package/uredir/
F: package/watchdogd/
F: support/testing/tests/package/test_mdnsd.py
N: Jochen Baltes <jochen.baltes@gmail.com>
F: package/altera-stapl
@@ -1765,7 +1745,6 @@ F: package/llama-cpp/
F: package/llvm-project/clang/
F: package/llvm-project/lld/
F: package/llvm-project/llvm/
F: package/mesa3d/
F: package/python-cython/
F: package/python-pycups/
F: package/python-raven/
@@ -1776,8 +1755,6 @@ F: package/python-xlib/
F: package/sentry-cli/
F: package/sentry-native/
F: package/unclutter-xfixes/
F: package/virglrenderer/
F: support/testing/tests/package/test_virglrenderer.py
N: Joshua Henderson <joshua.henderson@microchip.com>
F: package/qt5/qt5wayland/
@@ -1867,7 +1844,6 @@ F: support/testing/tests/package/sample_python_midiutil.py
F: support/testing/tests/package/sample_python_ml_dtypes.py
F: support/testing/tests/package/sample_python_mpmath.py
F: support/testing/tests/package/sample_python_pyalsa.py
F: support/testing/tests/package/sample_python_pydal.py
F: support/testing/tests/package/sample_python_spake2.py
F: support/testing/tests/package/sample_python_sympy.py
F: support/testing/tests/package/test_4th.py
@@ -1926,8 +1902,6 @@ F: support/testing/tests/package/test_gnuradio/
F: support/testing/tests/package/test_gpsd.py
F: support/testing/tests/package/test_gpsd/
F: support/testing/tests/package/test_gstreamer1.py
F: support/testing/tests/package/test_guile.py
F: support/testing/tests/package/test_guile/
F: support/testing/tests/package/test_gzip.py
F: support/testing/tests/package/test_highway.py
F: support/testing/tests/package/test_hwloc.py
@@ -1955,8 +1929,6 @@ F: support/testing/tests/package/test_libcamera.py
F: support/testing/tests/package/test_libcamera/
F: support/testing/tests/package/test_libcurl.py
F: support/testing/tests/package/test_libgpgme.py
F: support/testing/tests/package/test_libgpiod2.py
F: support/testing/tests/package/test_libgpiod2/
F: support/testing/tests/package/test_libjxl.py
F: support/testing/tests/package/test_lighttpd.py
F: support/testing/tests/package/test_links.py
@@ -2006,8 +1978,6 @@ F: support/testing/tests/package/test_patch.py
F: support/testing/tests/package/test_patch/
F: support/testing/tests/package/test_pciutils.py
F: support/testing/tests/package/test_perftest.py
F: support/testing/tests/package/test_php.py
F: support/testing/tests/package/test_php/
F: support/testing/tests/package/test_pigz.py
F: support/testing/tests/package/test_postgresql.py
F: support/testing/tests/package/test_pppd.py
@@ -2023,7 +1993,6 @@ F: support/testing/tests/package/test_python_midiutil.py
F: support/testing/tests/package/test_python_ml_dtypes.py
F: support/testing/tests/package/test_python_mpmath.py
F: support/testing/tests/package/test_python_pyalsa.py
F: support/testing/tests/package/test_python_pydal.py
F: support/testing/tests/package/test_python_pyqt5.py
F: support/testing/tests/package/test_python_pyqt5/
F: support/testing/tests/package/test_python_spake2.py
@@ -2266,10 +2235,10 @@ F: board/orangepi/orangepi-zero3/
F: configs/grinn_*
F: configs/orangepi_zero_plus_defconfig
F: configs/orangepi_zero3_defconfig
F: package/argparse/
F: package/dt-utils/
F: package/easydbus/
F: package/gitlab-runner/
F: package/lua-argparse/
F: package/lua-flu/
F: package/lua-stdlib/
F: package/luaossl/
@@ -2293,8 +2262,6 @@ F: support/testing/tests/package/sample_python_dbus_fast.py
F: support/testing/tests/package/sample_python_dbus_next.py
F: support/testing/tests/package/sample_python_pytest.py
F: support/testing/tests/package/sample_python_pytest_asyncio.py
F: support/testing/tests/package/test_easydbus.py
F: support/testing/tests/package/test_easydbus/
F: support/testing/tests/package/test_netdata.py
F: support/testing/tests/package/test_python_dbus_next.py
F: support/testing/tests/package/test_python_pytest.py
@@ -2429,10 +2396,6 @@ F: configs/arcturus_ucls1012a_defconfig
N: Michael Fischer <mf@go-sys.de>
F: package/gnuplot/
F: package/sdl2/
F: package/sdl3/
F: package/sdl3_gfx/
F: package/sdl3_image/
F: package/sdl3_ttf/
N: Michael Nosthoff <buildroot@heine.tech>
F: package/boost/
@@ -2525,8 +2488,6 @@ F: package/binutils-bare-metal/
F: package/bootgen/
F: package/gcc-bare-metal/
F: package/newlib-bare-metal/
F: package/qemu-xen/
F: package/xen/
F: package/xilinx-fpgautil/
F: toolchain/toolchain-bare-metal-buildroot/
@@ -2678,7 +2639,6 @@ F: configs/orangepi_pc_defconfig
F: configs/orangepi_r1_defconfig
F: configs/sheevaplug_defconfig
F: configs/visionfive_defconfig
F: package/agec/
F: package/bats-core/
F: package/dfu-programmer/
F: package/docker-compose/
@@ -2713,7 +2673,6 @@ F: package/triggerhappy/
F: package/ugetty/
F: package/wireguard-linux-compat/
F: package/wireguard-tools/
F: support/testing/tests/package/test_agec.py
F: support/testing/tests/package/test_docker_compose.py
F: support/testing/tests/package/test_python_hid.py
@@ -2804,6 +2763,10 @@ F: package/synergy/
N: Qais Yousef <qais.yousef@arm.com>
F: package/bpftrace/
N: Rafal Susz <rafal.susz@gmail.com>
F: board/avnet/s6lx9_microboard/
F: configs/s6lx9_microboard_defconfig
N: Rafał Miłecki <rafal@milecki.pl>
F: board/broadcom/northstar/
F: configs/broadcom_northstar_defconfig
@@ -3058,10 +3021,8 @@ F: package/wolfssl/
N: Shubham Chakraborty <chakrabortyshubham66@gmail.com>
F: package/ccache/
F: package/dos2unix/
F: package/font-awesome/
F: package/htop/
F: package/hyperfine/
F: package/libenca/
F: package/pv/
F: package/unrar/
F: package/xterm/
@@ -3294,7 +3255,6 @@ F: support/testing/tests/package/sample_python_augeas.py
F: support/testing/tests/package/sample_python_flask.py
F: support/testing/tests/package/sample_python_flask_expects_json.py
F: support/testing/tests/package/sample_python_git.py
F: support/testing/tests/package/sample_python_pyudev.py
F: support/testing/tests/package/sample_python_unittest_xml_reporting.py
F: support/testing/tests/package/test_nodejs.py
F: support/testing/tests/package/test_python_augeas.py
@@ -3304,7 +3264,6 @@ F: support/testing/tests/package/test_python_flask_expects_json.py
F: support/testing/tests/package/test_python_fs.py
F: support/testing/tests/package/test_python_git.py
F: support/testing/tests/package/test_python_pyfatfs.py
F: support/testing/tests/package/test_python_pyudev.py
F: support/testing/tests/package/test_python_pyusb.py
F: support/testing/tests/package/test_python_serial.py
F: support/testing/tests/package/test_snagboot.py
@@ -3377,8 +3336,6 @@ F: package/dpdk/
F: package/libecoli/
F: package/libnss-ato/
F: package/libyang-cpp/
F: package/python-libyang/
F: package/python-sysv-ipc/
F: package/sysrepo-cpp/
N: Vincent Prince <vincent.prince.fr@gmail.com>
@@ -3427,6 +3384,10 @@ F: support/testing/tests/package/test_zerofree.py
N: Vinicius Tinti <viniciustinti@gmail.com>
F: package/python-thrift/
N: Vivien Didelot <vivien.didelot@gmail.com>
F: board/technologic/ts5500/
F: configs/ts5500_defconfig
N: Vladimir Oltean <olteanv@gmail.com>
F: package/qoriq-ddr-phy-binary/
F: package/qoriq-firmware-inphi/
@@ -3451,11 +3412,6 @@ F: package/evilwm/
F: package/fbv/
F: package/libpam-pkcs11/
F: package/mksh/
F: package/perl-cgi/
F: package/perl-cgi-session/
F: package/perl-log-message/
F: package/perl-log-message-simple/
F: package/perl-switch/
F: package/ruby/
F: package/uclibc/
F: package/uclibc-ng-test/
@@ -3515,9 +3471,6 @@ F: package/tpm2-pkcs11/
N: Yann E. MORIN <yann.morin@orange.com>
F: .editorconfig
F: package/amazon-ecr-credential-helper/
F: package/docker-credential-acr-env/
F: package/docker-credential-gcr/
F: package/gpsd/
F: package/mosquitto/
F: package/python-humanfriendly/

View File

@@ -92,9 +92,9 @@ all:
.PHONY: all
# Set and export the version string
export BR2_VERSION := 2026.08-git
export BR2_VERSION := 2026.05.1
# Actual time the release is cut (for reproducible builds)
BR2_VERSION_EPOCH = 1780950000
BR2_VERSION_EPOCH = 1784143900
# Save running make version since it's clobbered by the make package
RUNNING_MAKE_VERSION := $(MAKE_VERSION)

View File

@@ -344,10 +344,6 @@ config BR2_ARCH_NEEDS_GCC_AT_LEAST_16
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
config BR2_ARCH_NEEDS_GCC_AT_LEAST_17
bool
select BR2_ARCH_NEEDS_GCC_AT_LEAST_16
# The following string values are defined by the individual
# Config.in.$ARCH files
config BR2_ARCH

View File

@@ -23,11 +23,6 @@ choice
help
Specific CPU variant to use
config BR2_m68k_68000
bool "68000"
select BR2_m68k_m68k
select BR2_SOFT_FLOAT
config BR2_m68k_68030
bool "68030"
select BR2_m68k_m68k
@@ -46,7 +41,6 @@ config BR2_m68k_cf5208
endchoice
config BR2_GCC_TARGET_CPU
default "68000" if BR2_m68k_68000
default "68030" if BR2_m68k_68030
default "68040" if BR2_m68k_68040
default "5208" if BR2_m68k_cf5208

View File

@@ -144,16 +144,6 @@ config BR2_powerpc_power9
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_6
config BR2_powerpc_power10
bool "power10"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
config BR2_powerpc_power11
bool "power11"
select BR2_POWERPC_CPU_HAS_ALTIVEC
select BR2_POWERPC_CPU_HAS_VSX
select BR2_ARCH_NEEDS_GCC_AT_LEAST_15
endchoice
config BR2_POWERPC_SOFT_FLOAT
@@ -217,8 +207,6 @@ config BR2_GCC_TARGET_CPU
default "power7" if BR2_powerpc_power7
default "power8" if BR2_powerpc_power8
default "power9" if BR2_powerpc_power9
default "power10" if BR2_powerpc_power10
default "power11" if BR2_powerpc_power11
config BR2_READELF_ARCH_NAME
default "PowerPC" if BR2_powerpc

View File

@@ -1,3 +0,0 @@
CONFIG_BLK_DEV_PMEM=y
CONFIG_LIBNVDIMM=y
CONFIG_OF_PMEM=y

View File

@@ -48,17 +48,6 @@ alternative to QEMU_EFI.fd. You will also need to change the machine
specification to "-M virt,secure=on" on qemu command line, to enable TrustZone
support, and you will need to increase the memory with "-m 1024".
HTTP boot
---------
Some U-Boot and Devicetree based firmwares are capable of booting with UEFI from
HTTP(s). [4]
The aarch64_efi_defconfig has appropriate persistent memory support compiled in
the Linux kernel to support this scenario. [5]
[1]: https://github.com/ARM-software/ebbr
[2]: https://developer.arm.com/architectures/system-architectures/arm-systemready
[3]: https://github.com/glikely/u-boot-tfa-build
[4]: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack
[5]: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 3712fc1ec839e4daac981176c8518912e8f452650aaedfe4381da4419613a431 linux-6.18.40.tar.xz
sha256 37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff linux-6.18.8.tar.xz

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Aria G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file at91-ariag25.dtb {
image = "at91-ariag25.dtb"
}
file boot.bin {
image = "at91sam9x5_aria-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,44 @@
Acme Systems Aria G25
Build instructions
==================
To build an image for the Aria G25 choose the configuration
corresponding to the Aria variant.
For 128MB RAM variant type:
$ make acmesystems_aria_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_aria_g25_256mb_defconfig
To customize the configuration choosed type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called
"sdcard.img" in the output/images/ directory.
Write the bootable SD card image "sdcard.img" onto an SD card with
"dd" command:
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Assuming your Aria G25 baseboard has a MicroSD socket, for example
with the Terra baseboard, insert the microSD card into the baseboard
slot and power it.
To get the kernel log messages you can use a DPI cable
(http://www.acmesystems.it/DPI)
You can find additional informations, tutorials and a very
comprehensive documentation on http://www.acmesystems.it/aria.

View File

@@ -0,0 +1,36 @@
# Minimal SD card image for the Acmesystems Arietta G25
image boot.vfat {
vfat {
file zImage {
image = "zImage"
}
file acme-arietta.dtb {
image = "at91-ariettag25.dtb"
}
file boot.bin {
image = "at91sam9x5_arietta-sdcardboot-linux-zimage-dt-3.10.3.bin"
}
}
size = 16M
}
image sdcard.img {
hdimage {
}
partition boot {
partition-type = 0xC
bootable = "true"
image = "boot.vfat"
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext4"
size = 512M
}
}

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 5ea2a8fed1ba0024229c6f6d77176679e1b24791bdbce8e285634013d4a93551 at91bootstrap3-v3.10.3-git4.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 6c5e4d3c87feadbfdb9f7d2e46f3f120b00286ba380491c5956708e0b94232c8 linux-4.19.315.tar.xz

View File

@@ -0,0 +1,49 @@
Acme Systems Arietta G25
Intro
=====
This default configuration will allow you to start experimenting with the
buildroot environment for the Arietta G25. With the current configuration
it will bring-up the board, and allow access through the serial console.
You can find additional informations, tutorials and a very comprehensive
documentation on http://www.acmesystems.it/arietta.
Build instructions
==================
To build an image for the Arietta G25 choose the configuration
corresponding to the Arietta variant.
For 128MB RAM variant type:
$ make acmesystems_arietta_g25_128mb_defconfig
else for 256MB RAM variant type:
$ make acmesystems_arietta_g25_256mb_defconfig
To customize the configuration chosen type:
$ make menuconfig
When you are ready to start building Buildroot type:
$ make
How to write the microSD card
=============================
Once the build process is finished you will have an image called "sdcard.img"
in the output/images/ directory.
Copy the bootable "sdcard.img" onto an SD card with "dd":
$ sudo dd if=output/images/sdcard.img of=/dev/sdX
Insert the microSD card into the Arietta slot and power it.
The image just built is fairly basic and the only output
you will get is on serial console, please consider to use a DPI
cable (http://www.acmesystems.it/DPI)

View File

@@ -0,0 +1,247 @@
/*
* Device Tree Generator version: 1.3
*
* (C) Copyright 2007-2008 Xilinx, Inc.
* (C) Copyright 2007-2009 Michal Simek
*
* Michal SIMEK <monstr@monstr.eu>
*
* This program is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License as
* published by the Free Software Foundation; either version 2 of
* the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; if not, write to the Free Software
* Foundation, Inc., 59 Temple Place, Suite 330, Boston,
* MA 02111-1307 USA
*
* CAUTION: This file is automatically generated by libgen.
* Version: Xilinx EDK 13.2 EDK_O.61xd
*
* XPS project directory: device-tree_bsp_230-orig
*/
/dts-v1/;
/ {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,microblaze";
model = "testing";
MCB3_LPDDR: memory@80000000 {
device_type = "memory";
reg = < 0x80000000 0x4000000 >;
} ;
aliases {
ethernet0 = &Ethernet_MAC;
serial0 = &USB_Uart;
} ;
chosen {
bootargs = "console=ttyUL0";
linux,stdout-path = "/axi@0/serial@40600000";
} ;
cpus {
#address-cells = <1>;
#cpus = <0x1>;
#size-cells = <0>;
microblaze_0: cpu@0 {
clock-frequency = <66666667>;
compatible = "xlnx,microblaze-8.20.a";
d-cache-baseaddr = <0x80000000>;
d-cache-highaddr = <0x83ffffff>;
d-cache-line-size = <0x10>;
d-cache-size = <0x2000>;
device_type = "cpu";
i-cache-baseaddr = <0x80000000>;
i-cache-highaddr = <0x83ffffff>;
i-cache-line-size = <0x10>;
i-cache-size = <0x2000>;
model = "microblaze,8.20.a";
reg = <0>;
timebase-frequency = <66666667>;
xlnx,addr-tag-bits = <0xd>;
xlnx,allow-dcache-wr = <0x1>;
xlnx,allow-icache-wr = <0x1>;
xlnx,area-optimized = <0x0>;
xlnx,avoid-primitives = <0x0>;
xlnx,branch-target-cache-size = <0x0>;
xlnx,cache-byte-size = <0x2000>;
xlnx,d-axi = <0x1>;
xlnx,d-lmb = <0x1>;
xlnx,d-plb = <0x0>;
xlnx,data-size = <0x20>;
xlnx,dcache-addr-tag = <0xd>;
xlnx,dcache-always-used = <0x1>;
xlnx,dcache-byte-size = <0x2000>;
xlnx,dcache-data-width = <0x0>;
xlnx,dcache-force-tag-lutram = <0x0>;
xlnx,dcache-interface = <0x0>;
xlnx,dcache-line-len = <0x4>;
xlnx,dcache-use-fsl = <0x0>;
xlnx,dcache-use-writeback = <0x0>;
xlnx,dcache-victims = <0x0>;
xlnx,debug-enabled = <0x1>;
xlnx,div-zero-exception = <0x0>;
xlnx,dynamic-bus-sizing = <0x1>;
xlnx,ecc-use-ce-exception = <0x0>;
xlnx,edge-is-positive = <0x1>;
xlnx,endianness = <0x1>;
xlnx,family = "spartan6";
xlnx,fault-tolerant = <0x0>;
xlnx,fpu-exception = <0x0>;
xlnx,freq = <0x3f940ab>;
xlnx,fsl-data-size = <0x20>;
xlnx,fsl-exception = <0x0>;
xlnx,fsl-links = <0x0>;
xlnx,i-axi = <0x0>;
xlnx,i-lmb = <0x1>;
xlnx,i-plb = <0x0>;
xlnx,icache-always-used = <0x1>;
xlnx,icache-data-width = <0x0>;
xlnx,icache-force-tag-lutram = <0x0>;
xlnx,icache-interface = <0x0>;
xlnx,icache-line-len = <0x4>;
xlnx,icache-streams = <0x0>;
xlnx,icache-use-fsl = <0x0>;
xlnx,icache-victims = <0x0>;
xlnx,ill-opcode-exception = <0x0>;
xlnx,instance = "microblaze_0";
xlnx,interconnect = <0x2>;
xlnx,interconnect-m-axi-dc-aw-register = <0x0>;
xlnx,interconnect-m-axi-dc-read-issuing = <0x2>;
xlnx,interconnect-m-axi-dc-w-register = <0x0>;
xlnx,interconnect-m-axi-dc-write-issuing = <0x20>;
xlnx,interconnect-m-axi-dp-read-issuing = <0x1>;
xlnx,interconnect-m-axi-dp-write-issuing = <0x1>;
xlnx,interconnect-m-axi-ic-read-issuing = <0x2>;
xlnx,interconnect-m-axi-ip-read-issuing = <0x1>;
xlnx,interrupt-is-edge = <0x0>;
xlnx,lockstep-slave = <0x0>;
xlnx,mmu-dtlb-size = <0x1>;
xlnx,mmu-itlb-size = <0x1>;
xlnx,mmu-privileged-instr = <0x0>;
xlnx,mmu-tlb-access = <0x3>;
xlnx,mmu-zones = <0x2>;
xlnx,number-of-pc-brk = <0x1>;
xlnx,number-of-rd-addr-brk = <0x0>;
xlnx,number-of-wr-addr-brk = <0x0>;
xlnx,opcode-0x0-illegal = <0x0>;
xlnx,optimization = <0x0>;
xlnx,pvr = <0x0>;
xlnx,pvr-user1 = <0x0>;
xlnx,pvr-user2 = <0x0>;
xlnx,reset-msr = <0x0>;
xlnx,sco = <0x0>;
xlnx,stream-interconnect = <0x0>;
xlnx,unaligned-exceptions = <0x0>;
xlnx,use-barrel = <0x1>;
xlnx,use-branch-target-cache = <0x0>;
xlnx,use-dcache = <0x1>;
xlnx,use-div = <0x0>;
xlnx,use-ext-brk = <0x1>;
xlnx,use-ext-nm-brk = <0x1>;
xlnx,use-extended-fsl-instr = <0x0>;
xlnx,use-fpu = <0x0>;
xlnx,use-hw-mul = <0x1>;
xlnx,use-icache = <0x1>;
xlnx,use-interrupt = <0x1>;
xlnx,use-mmu = <0x3>;
xlnx,use-msr-instr = <0x1>;
xlnx,use-pcmp-instr = <0x0>;
xlnx,use-stack-protection = <0x0>;
} ;
} ;
axi4lite_0: axi@0 {
#address-cells = <1>;
#size-cells = <1>;
compatible = "xlnx,axi-interconnect-1.03.a", "simple-bus";
ranges ;
Ethernet_MAC: ethernet@40e00000 {
compatible = "xlnx,axi-ethernetlite-1.00.a", "xlnx,xps-ethernetlite-1.00.a";
device_type = "network";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 2 0 >;
local-mac-address = [ 00 0a 35 aa de 00 ];
// phy-handle = <&phy0>;
reg = < 0x40e00000 0x10000 >;
xlnx,duplex = <0x1>;
xlnx,family = "spartan6";
xlnx,include-global-buffers = <0x0>;
xlnx,include-internal-loopback = <0x0>;
xlnx,include-mdio = <0x1>;
xlnx,include-phy-constraints = <0x1>;
xlnx,interconnect-s-axi-read-acceptance = <0x1>;
xlnx,interconnect-s-axi-write-acceptance = <0x1>;
xlnx,rx-ping-pong = <0x0>;
xlnx,s-axi-aclk-period-ps = <0x3a98>;
xlnx,s-axi-id-width = <0x1>;
xlnx,s-axi-supports-narrow-burst = <0x0>;
xlnx,tx-ping-pong = <0x0>;
/*
mdio {
#address-cells = <1>;
#size-cells = <0>;
phy0: phy@7 {
compatible = "marvell,88e1111";
device_type = "ethernet-phy";
reg = <7>;
} ;
} ;
*/
} ;
SPI_FLASH: spi@40a00000 {
compatible = "xlnx,axi-spi-1.01.a", "xlnx,xps-spi-2.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 1 2 >;
reg = < 0x40a00000 0x10000 >;
xlnx,family = "spartan6";
xlnx,fifo-exist = <0x1>;
xlnx,num-ss-bits = <0x1>;
xlnx,num-transfer-bits = <0x8>;
xlnx,sck-ratio = <0x4>;
} ;
USB_Uart: serial@40600000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-uartlite-1.02.a", "xlnx,xps-uartlite-1.00.a";
current-speed = <115200>;
device_type = "serial";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 3 0 >;
port-number = <0>;
reg = < 0x40600000 0x10000 >;
xlnx,baudrate = <0x1c200>;
xlnx,data-bits = <0x8>;
xlnx,family = "spartan6";
xlnx,odd-parity = <0x1>;
xlnx,s-axi-aclk-freq-hz = <0x3f940ab>;
xlnx,use-parity = <0x0>;
} ;
microblaze_0_intc: interrupt-controller@41200000 {
#interrupt-cells = <0x2>;
compatible = "xlnx,axi-intc-1.01.a", "xlnx,xps-intc-1.00.a";
interrupt-controller ;
reg = < 0x41200000 0x10000 >;
xlnx,kind-of-intr = <0xc>;
xlnx,num-intr-inputs = <0x4>;
} ;
system_timer: timer@41c00000 {
clock-frequency = <66666667>;
compatible = "xlnx,axi-timer-1.02.a", "xlnx,xps-timer-1.00.a";
interrupt-parent = <&microblaze_0_intc>;
interrupts = < 0 2 >;
reg = < 0x41c00000 0x10000 >;
xlnx,count-width = <0x20>;
xlnx,family = "spartan6";
xlnx,gen0-assert = <0x1>;
xlnx,gen1-assert = <0x1>;
xlnx,one-timer-only = <0x0>;
xlnx,trig0-assert = <0x1>;
xlnx,trig1-assert = <0x1>;
} ;
} ;
} ;

View File

@@ -0,0 +1,68 @@
CONFIG_EXPERIMENTAL=y
CONFIG_SYSVIPC=y
CONFIG_IKCONFIG=y
CONFIG_IKCONFIG_PROC=y
CONFIG_BLK_DEV_INITRD=y
CONFIG_INITRAMFS_SOURCE="rootfs.cpio"
CONFIG_INITRAMFS_COMPRESSION_GZIP=y
# CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
CONFIG_EXPERT=y
CONFIG_KALLSYMS_ALL=y
CONFIG_KALLSYMS_EXTRA_PASS=y
# CONFIG_HOTPLUG is not set
# CONFIG_BASE_FULL is not set
# CONFIG_FUTEX is not set
# CONFIG_EPOLL is not set
# CONFIG_SIGNALFD is not set
# CONFIG_SHMEM is not set
CONFIG_SLAB=y
CONFIG_MODULES=y
CONFIG_MODULE_UNLOAD=y
# CONFIG_BLK_DEV_BSG is not set
# CONFIG_OPT_LIB_ASM is not set
CONFIG_KERNEL_BASE_ADDR=0x80000000
CONFIG_XILINX_MICROBLAZE0_FAMILY="spartan6"
CONFIG_XILINX_MICROBLAZE0_USE_MSR_INSTR=1
# CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR is not set
CONFIG_XILINX_MICROBLAZE0_USE_BARREL=1
CONFIG_XILINX_MICROBLAZE0_USE_HW_MUL=1
CONFIG_XILINX_MICROBLAZE0_HW_VER="8.20.a"
CONFIG_HZ_100=y
CONFIG_MMU=y
CONFIG_CMDLINE_BOOL=y
CONFIG_CMDLINE_FORCE=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_INET=y
# CONFIG_INET_LRO is not set
# CONFIG_IPV6 is not set
CONFIG_PROC_DEVICETREE=y
CONFIG_BLK_DEV_RAM=y
CONFIG_BLK_DEV_RAM_SIZE=8192
CONFIG_NETDEVICES=y
CONFIG_NET_ETHERNET=y
CONFIG_XILINX_EMACLITE=y
# CONFIG_INPUT is not set
# CONFIG_SERIO is not set
# CONFIG_VT is not set
CONFIG_SERIAL_UARTLITE=y
CONFIG_SERIAL_UARTLITE_CONSOLE=y
# CONFIG_HW_RANDOM is not set
# CONFIG_HWMON is not set
# CONFIG_USB_SUPPORT is not set
CONFIG_EXT2_FS=y
# CONFIG_DNOTIFY is not set
CONFIG_NFS_FS=y
CONFIG_NFS_V3=y
CONFIG_CIFS=y
CONFIG_CIFS_STATS=y
CONFIG_CIFS_STATS2=y
CONFIG_PARTITION_ADVANCED=y
CONFIG_DEBUG_KERNEL=y
CONFIG_DETECT_HUNG_TASK=y
CONFIG_DEBUG_SLAB=y
CONFIG_DEBUG_SPINLOCK=y
CONFIG_DEBUG_INFO=y
CONFIG_EARLY_PRINTK=y
# CONFIG_CRYPTO_ANSI_CPRNG is not set

View File

@@ -0,0 +1,70 @@
This is the buildroot board support for the Avnet Spartan6 LX9 MicroBoard.
The Avnet S6LX9 Microboard is a small USB-Stick sized module containing
a Spartan6 FPGA capable of running the Microblaze softcore processor
together with RAM and FLASH memory.
The board can be bought from Avnet (avnet.com) or from Trenz Electronic
(www.trenz-electronic.de) for a low price.
To run the Linux built with buildroot you have to install the FPGA bitfile
and u-boot as described in the tutorial AvtS6LX9MicroBoard_SW302_PetaLinux
available on http://www.em.avnet.com/s6microboard
On this site also is a forum containing information on how to build your own
Microblaze processor for the Microboard.
The image file (default name is simpleImage.lx9_mmu.ub) has to be copied
to your tftp folder (often /tftpboot/) or can be programmed into the
board's SPI flash.
Sample session:
$ make s6lx9_microboard_defconfig
$ make
$ cp build/linux-<version>/arch/microblaze/boot/simpleImage.lx9_mmu.ub /tftpboot/br12.2a.ub
$ minicom
<hit the reset button on the S6LX9 Microboard>
Icache:ON
Dcache:ON
U-Boot Start:0x83f00000
SF: Got idcode 20 ba 18 10 01
*** Warning - bad CRC, using default environment
Net: Xilinx_Emaclite
MAC: 00:0a:35:00:63:37
U-BOOT for Avnet-LX9-Microboard-AXI-tiny-13.1
BOOTP broadcast 1
DHCP client bound to address 192.168.11.122
Hit any key to stop autoboot: 0
U-Boot-PetaLinux> tftp br12.2a.ub
Using Xilinx_Emaclite device
TFTP from server 192.168.11.10; our IP address is 192.168.11.122
Filename 'br12.2a.ub'.
Load address: 0x80002000
Loading: #################################################################
#################################################################
#################################################################
#################################################################
#################################################################
##############################
done
Bytes transferred = 5207724 (4f76ac hex)
U-Boot-PetaLinux> bootm
## Booting kernel from Legacy Image at 80002000 ...
Image Name: Linux-3.1.0
Image Type: MicroBlaze Linux Kernel Image (uncompressed)
Data Size: 5207660 Bytes = 5 MB
Load Address: 80000000
Entry Point: 80000000
Verifying Checksum ... OK
Loading Kernel Image ... OK
OK
## Transferring control to Linux (at address 80000000), 0x80000000 ramdisk 0x00000000, FDT 0x00000000...
Early console on uartlite at 0x40600000
..... boot log skipped
Welcome to Microblaze Buildroot
Microblaze login:

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 ac26e508abd56e9f8b89872b6e10c49fc823bcc70d8068a5d8504c1a7c4ff045 linux-6.18.38.tar.xz
sha256 1c38214fb137bae85b82b82537b5987358621b915ab2a8e4f09e60697c19474f linux-6.18.21.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://cdn.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 c92591d896e79ecddbc3319136f0c2f855e832b397de7593f013ad7590a43e53 linux-6.12.80.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 7d2e1b5d5ab36b3a01856e71782dad2a54e634fb2b37c0a42998def3bbf957c1 linux-6.12.96.tar.xz
sha256 c92591d896e79ecddbc3319136f0c2f855e832b397de7593f013ad7590a43e53 linux-6.12.80.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4d9f3ff73214f68c0194ef02db9ca4b7ba713253ac1045441d4e9f352bc22e14 linux-6.19.6.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# From https://www.kernel.org/pub/linux/kernel/v7.x/sha256sums.asc
sha256 be41c068e88f5242a19bccdbffbe077b18c47b45f627e2325504b4fab79dd1dc linux-7.1.3.tar.xz
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 4d9f3ff73214f68c0194ef02db9ca4b7ba713253ac1045441d4e9f352bc22e14 linux-6.19.6.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 b60d5865cefdbc75da8da4156c56c458e00de75a49b80c1a2e58a96e30ad0d54 u-boot-2026.01.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3f5017e85ba6c490be597670033a7eaba14e3c34af4e53d24dc3762c3deece83 linux-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 f7d9a6e99825926d0bc597e0fdfeafffcc76ad6267f1d4e9aae1fe9a8d400c22 uboot-imx-lf-6.6.36-2.1.0-imx91frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 d7813f4ad5431edb162d6be2775bc021f9007b9c6934e977330291168523a507 imx-atf-lf-6.18.20-2.0.0.tar.gz
sha256 8cfe0afc903ebbc03f27e4874aa9ce82be78843a8b42ed4c906871e7f311b510 imx-atf-lf-6.6.36-2.1.0.tar.gz

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a8f55764fd1418db8adfd2711c0abb7d5464a8ee1cbfd0f6878f1059ecfa1316 linux-imx-lf-6.18.20-2.0.0.tar.gz
sha256 3244dc3c62c990d9de90e1c7193aa3099e0e74e720de5c9c13edfbfdd802f596 linux-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 96942f8c49736b7d40277891bf0a34cfdd0afb59390f79b65b2b33b3bbd19f61 uboot-imx-lf-6.18.20-2.0.0.tar.gz
sha256 bced4334363199d5465532d221d06dc3a5b49271067d74408019c825ed2ca715 uboot-imx-lf-6.6.36-2.1.0-imx93frdm.tar.gz

View File

@@ -1 +0,0 @@
# CONFIG_EFI_CAPSULE_AUTHENTICATE is not set

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,11 +21,11 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- cadence-dp-firmware (blob), 8.16
- linux (fork), lf-6.18.20-2.0.0
- linux (fork), lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -12,7 +12,7 @@ For more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -22,13 +22,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 658af40a90fd8e2460d364775a0c37e0507201e49de7f69c8a22d61e179f81e1 atf-lf-6.18.20-2.0.0.tar.gz
sha256 2d3f9c52e16766c290bdc0bc130d634e4c326a5b236dfb2f2ca3f0fa457e82d4 atf-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 206f997d41bb958099bf7a89a02a6889942b118984f81f9a45bec9907f60708f linux-lf-6.18.20-2.0.0.tar.gz
sha256 27a1987ca0a5802d3ebb296b8134ec66d813ad86cf2a60779b45092735bbb23b linux-lf-6.12.34-2.1.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally computed
sha256 04aed627132db7b656117c7a35fb29d314172319fa3a297ea6748eebac2b5ce3 u-boot-lf-6.18.20-2.0.0.tar.gz
sha256 2f25cde388b2f83ff7a8e3afe25aafb1db48dafb0fa3bf1e4f9fef603f3b4785 u-boot-lf-6.12.34-2.1.0.tar.gz

View File

@@ -11,7 +11,7 @@ for more details about the board and the QorIQ Layerscape SoC, see the following
Layerscape platforms are officially supported by NXP under the Layerscape
Debian Linux SDK (LDLSDK). This uses components from Linux Factory (project
common with i.MX), but has a slower release cadence than LF. The currently used
tag is lf-6.18.20-2.0.0, which is in line with the latest LF tag. Generally, in
tag is lf-6.12.34-2.1.0, which is in line with the latest LF tag. Generally, in
Buildroot, the latest Linux Factory release tag is always used, which may be
considered pre-release software, as it may contain features which are not yet
documented, and it generally undergoes less testing.
@@ -21,13 +21,13 @@ For the software Layerscape Debian Linux SDK User Guide, see:
- https://www.nxp.com/docs/en/user-guide/UG10143.pdf
The components from NXP are:
- rcw, lf-6.18.20-2.0.0
- atf (fork), lf-6.18.20-2.0.0
- uboot (fork), lf-6.18.20-2.0.0
- qoriq-fm-ucode (blob), lf-6.18.20-2.0.0
- linux (fork), lf-6.18.20-2.0.0
- fmlib, lf-6.18.20-2.0.0
- fmc, lf-6.18.20-2.0.0
- rcw, lf-6.12.34-2.1.0
- atf (fork), lf-6.12.34-2.1.0
- uboot (fork), lf-6.12.34-2.1.0
- qoriq-fm-ucode (blob), lf-6.12.34-2.1.0
- linux (fork), lf-6.12.34-2.1.0
- fmlib, lf-6.12.34-2.1.0
- fmc, lf-6.12.34-2.1.0
Build
=====

View File

@@ -5,7 +5,6 @@ CONFIG_SMP=y
CONFIG_HYPERVISOR_GUEST=y
CONFIG_PARAVIRT=y
CONFIG_EFI=y
CONFIG_EFI_STUB=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y

View File

@@ -1,3 +0,0 @@
# Locally calculated
sha256 3ab7e90d6fc3364815ad7770d7aa7af9cfd68edde43da7123f5f38f80e034c44 arm-trusted-firmware-lts-v2.12.1-git4.tar.gz
sha256 b2c79635797bafcde84c6edadadde290b9d5e05deb3ea16a847210fd2ca83669 docs/license.rst

View File

@@ -1,7 +0,0 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 067dadd445578284ea6158f312f7970d8940fed3e094dbe49cff66d188d3bda4 linux-6.18.32.tar.xz
# Locally calculated
sha256 fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0 COPYING
sha256 8780e78a1a737e127f25a65f6d95269bffd36158dc261114de7859b490bfc5aa LICENSES/preferred/GPL-2.0
sha256 8e378ab93586eb55135d3bc119cce787f7324f48394777d00c34fa3d0be3303f LICENSES/exceptions/Linux-syscall-note

View File

@@ -1,3 +0,0 @@
# Locally calculated
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2
sha256 8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643 Licenses/gpl-2.0.txt

View File

@@ -1,2 +0,0 @@
# From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
sha256 6f16ff302599f6fe34742890322cf0775703105fbd8767449682fca6af0fb782 linux-6.18.33.tar.xz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,5 +1,5 @@
CONFIG_SYS_TEXT_BASE=0x60000000
CONFIG_BOOTCOMMAND="load hostfs - ${kernel_addr_r} zImage && load hostfs - ${ramdisk_addr_r} rootfs.cpio.uboot && setenv bootargs console=ttyAMA0,115200 earlyprintk=serial,ttyAMA0,115200 && bootz ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr}"
CONFIG_BOOTCOMMAND="smhload zImage ${kernel_addr_r} && smhload rootfs.cpio.uboot ${ramdisk_addr_r} && setenv bootargs console=ttyAMA0,115200 earlyprintk=serial,ttyAMA0,115200 && bootz ${kernel_addr_r} ${ramdisk_addr_r} ${fdt_addr}"
CONFIG_SEMIHOSTING=y
# Drop flash accesses
CONFIG_ENV_IS_IN_FLASH=n

View File

@@ -1,3 +1,3 @@
# Locally calculated
sha256 68e065413926778e276ec3abd28bb32fa82abaa4a6898d570c1f48fbdb08bcd0 u-boot-2022.04.tar.bz2
sha256 b99611f1ed237bf3541bdc8434b68c96a6e05967061f992443cb30aabebef5b3 u-boot-2024.01.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,14 +0,0 @@
Run the emulation with:
qemu-system-ppc64 \
-M powernv10 \
-kernel output/images/vmlinux \
-append "console=hvc0 rootwait root=/dev/nvme0n1" \
-device nvme,bus=pcie.3,addr=0x0,drive=drive0,serial=1234 \
-drive file=output/images/rootfs.ext2,if=none,id=drive0,format=raw,cache=none \
-device e1000e,netdev=net0,mac=C0:FF:EE:00:01:03,bus=pcie.1,addr=0x0 \
-netdev user,id=net0 \
-serial mon:stdio \
-nographic # qemu_ppc64le_powernv10_defconfig
The login prompt will appear in the terminal window.

View File

@@ -1,14 +0,0 @@
Run the emulation with:
qemu-system-ppc64 \
-M powernv11 \
-kernel output/images/vmlinux \
-append "console=hvc0 rootwait root=/dev/nvme0n1" \
-device nvme,bus=pcie.3,addr=0x0,drive=drive0,serial=1234 \
-drive file=output/images/rootfs.ext2,if=none,id=drive0,format=raw,cache=none \
-device e1000e,netdev=net0,mac=C0:FF:EE:00:01:03,bus=pcie.1,addr=0x0 \
-netdev user,id=net0 \
-serial mon:stdio \
-nographic # qemu_ppc64le_powernv11_defconfig
The login prompt will appear in the terminal window.

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a9e8c51fcb1e695d1d35dde5886cba579cb6f29c9646c5889f39d63841d4b9f6 linux-6.12.95.tar.xz
sha256 c92591d896e79ecddbc3319136f0c2f855e832b397de7593f013ad7590a43e53 linux-6.12.80.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 2ef152f25b682e59c3684d6d73d7c5a138495615f6b045e95266eb3d0bc0d04e optee-client-4.9.0.tar.gz
sha256 a9a91bdb433df795c87a6d15198effbd648e3671ae611f2a3f8b41229d61cce0 optee-client-4.3.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 9400e16c45bfa45f15585b2c933b86c449e7de05def0ecaaa62a4f38973a3a45 optee-os-4.9.0.tar.gz
sha256 390b271905c828d6def9fa6a77bbaa425f3b434d733c8eb18f582ccbc6896096 optee-os-4.3.0.tar.gz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 f6529bfe1a457adab69156fb7fa2232cc203eb63f5e46210f9953d6fc9f70a30 linux-6.1.177.tar.xz
sha256 2818053c07976ba4ed5f44deb0f5dc7ae7b0975d7918c313d48d8fe7c4e598cb linux-6.1.167.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 beb954e53617928b751944a89b6670bf9a9c7177c641b24c5dba504e46f1d961 linux-5.15.211.tar.xz
sha256 0bc1bdf74957e276793691865ffb71505809706d9243a42e9704aad0f128cdd4 linux-5.15.202.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 beb954e53617928b751944a89b6670bf9a9c7177c641b24c5dba504e46f1d961 linux-5.15.211.tar.xz
sha256 0bc1bdf74957e276793691865ffb71505809706d9243a42e9704aad0f128cdd4 linux-5.15.202.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 beb954e53617928b751944a89b6670bf9a9c7177c641b24c5dba504e46f1d961 linux-5.15.211.tar.xz
sha256 0bc1bdf74957e276793691865ffb71505809706d9243a42e9704aad0f128cdd4 linux-5.15.202.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a7a7e3d2ae9d95e74197223a8d4eb5f6be7aac21b6e6de27e9685d001c1f8cb0 linux-6.18.39.tar.xz
sha256 1c38214fb137bae85b82b82537b5987358621b915ab2a8e4f09e60697c19474f linux-6.18.21.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -0,0 +1,10 @@
image sdcard.img {
hdimage {
}
partition rootfs {
partition-type = 0x83
image = "rootfs.ext2"
size = 256M
}
}

View File

@@ -0,0 +1,17 @@
#!/bin/bash
#
# Copyright (C) 2015-2016 Savoir-Faire Linux
# Post image generation script.
BOARD_DIR="$(dirname $0)"
GENIMAGE_CFG=$BOARD_DIR/genimage.cfg
GENIMAGE_TMP=$BUILD_DIR/.genimage_tmp
rm -rf $GENIMAGE_TMP
${HOST_DIR}/bin/genimage \
--config ${GENIMAGE_CFG} \
--rootpath $TARGET_DIR \
--tmppath $GENIMAGE_TMP \
--inputpath $BINARIES_DIR \
--outputpath $BINARIES_DIR

View File

@@ -0,0 +1,52 @@
Technologic Systems TS-4900
===========================
This document explains how to set up a basic Buildroot system for the
Technologic Systems TS-4900 System on Module.
The TS-4900 is a TS-SOCKET macrocontroller board based on the
Freescale i.MX6 Single or Quad Core ARM Cortex-A9 CPU clocked at
1GHz. The TS-4900 features Gigabit Ethernet, SATA II Port, PCI Express
Bus, high speed USB host and device (OTG), and microSD card.
More details on the board here:
https://docs.embeddedTS.com/TS-4900
The TS-4900 is not currently supported by mainline Linux, so a
Technologic Systems Linux is used based on Linux 4.1.
The default U-boot configuration flashed scans the SD card to find the
0x83 partition type, corresponding to the rootfs. Then it will load
both uImage and dts from the /boot directory.
To build the default configuration you only have to:
$ make ts4900_defconfig
$ make
The output looks like:
output/images/
├── imx6q-ts4900.dtb
├── rootfs.ext2
├── rootfs.tar
├── sdcard.img
└── uImage
Since both the uImage and the dts are contained in the /boot
directory, the provided post-image script generates an image file
containing only one partition for the rootfs:
$ fdisk output/images/sdcard.img
Device Boot Start End Blocks Id System
output/images/sdcard.img1 1 524288 262144 83 Linux
This image can be directly written to an SD card.
$ sudo dd if=output/images/sdcard.img of=/dev/mmcblk0
In order to test the image on TS-4900 board, a TS baseboard, such as
the TS-9xxx series, is needed to provide power, console header, RJ45
connector etc.
The bootloader comes pre-flashed on the board on an SPI flash. Since
updating the bootloader is risky and not trivial, it is not included
in the Buildroot defconfig. Refer to
https://docs.embeddedTS.com/TS-4900#U-Boot for details on which
U-Boot config to use and how to flash it.

View File

@@ -0,0 +1,9 @@
SERIAL 1 115200
CONSOLE 0
DEFAULT linux
LABEL linux
SAY Now booting the kernel from SYSLINUX...
LINUX /boot/bzImage
APPEND console=ttyS1,115200n8 root=/dev/sda1 rootfstype=ext4 rw

View File

@@ -0,0 +1,111 @@
# CONFIG_CROSS_MEMORY_ATTACH is not set
CONFIG_PARTITION_ADVANCED=y
# CONFIG_X86_EXTENDED_PLATFORM is not set
CONFIG_MELAN=y
CONFIG_X86_GENERIC=y
CONFIG_X86_REBOOTFIXUPS=y
CONFIG_NOHIGHMEM=y
# CONFIG_COMPACTION is not set
# CONFIG_BOUNCE is not set
# CONFIG_RELOCATABLE is not set
# CONFIG_SUSPEND is not set
# CONFIG_ACPI is not set
CONFIG_CPU_IDLE=y
CONFIG_TS5500=y
CONFIG_NET=y
CONFIG_PACKET=y
CONFIG_UNIX=y
CONFIG_INET=y
# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
# CONFIG_INET_XFRM_MODE_TUNNEL is not set
# CONFIG_INET_XFRM_MODE_BEET is not set
# CONFIG_INET_DIAG is not set
# CONFIG_IPV6 is not set
# CONFIG_WIRELESS is not set
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
# CONFIG_BLK_DEV is not set
CONFIG_BLK_DEV_SD=y
# CONFIG_SCSI_LOWLEVEL is not set
CONFIG_ATA=y
# CONFIG_ATA_VERBOSE_ERROR is not set
# CONFIG_SATA_PMP is not set
CONFIG_ATA_GENERIC=y
CONFIG_PATA_LEGACY=y
CONFIG_NETDEVICES=y
# CONFIG_NET_CORE is not set
# CONFIG_NET_VENDOR_3COM is not set
# CONFIG_NET_VENDOR_ADAPTEC is not set
# CONFIG_NET_VENDOR_ALTEON is not set
# CONFIG_NET_VENDOR_AMD is not set
# CONFIG_NET_VENDOR_ARC is not set
# CONFIG_NET_VENDOR_ATHEROS is not set
# CONFIG_NET_VENDOR_BROADCOM is not set
# CONFIG_NET_VENDOR_BROCADE is not set
# CONFIG_NET_VENDOR_CHELSIO is not set
# CONFIG_NET_VENDOR_CISCO is not set
CONFIG_NET_TULIP=y
CONFIG_DM9102=y
# CONFIG_NET_VENDOR_DLINK is not set
# CONFIG_NET_VENDOR_EMULEX is not set
# CONFIG_NET_VENDOR_EXAR is not set
# CONFIG_NET_VENDOR_HP is not set
# CONFIG_NET_VENDOR_INTEL is not set
# CONFIG_NET_VENDOR_MARVELL is not set
# CONFIG_NET_VENDOR_MELLANOX is not set
# CONFIG_NET_VENDOR_MICREL is not set
# CONFIG_NET_VENDOR_MYRI is not set
# CONFIG_NET_VENDOR_NATSEMI is not set
# CONFIG_NET_VENDOR_NVIDIA is not set
# CONFIG_NET_VENDOR_OKI is not set
# CONFIG_NET_PACKET_ENGINE is not set
# CONFIG_NET_VENDOR_QLOGIC is not set
# CONFIG_NET_VENDOR_REALTEK is not set
# CONFIG_NET_VENDOR_RDC is not set
# CONFIG_NET_VENDOR_SEEQ is not set
# CONFIG_NET_VENDOR_SILAN is not set
# CONFIG_NET_VENDOR_SIS is not set
# CONFIG_NET_VENDOR_SMSC is not set
# CONFIG_NET_VENDOR_STMICRO is not set
# CONFIG_NET_VENDOR_SUN is not set
# CONFIG_NET_VENDOR_TEHUTI is not set
# CONFIG_NET_VENDOR_TI is not set
# CONFIG_NET_VENDOR_VIA is not set
# CONFIG_NET_VENDOR_WIZNET is not set
CONFIG_PHYLIB=y
CONFIG_DAVICOM_PHY=y
# CONFIG_WLAN is not set
# CONFIG_INPUT_KEYBOARD is not set
# CONFIG_INPUT_MOUSE is not set
# CONFIG_SERIO is not set
CONFIG_SERIAL_8250=y
# CONFIG_SERIAL_8250_DEPRECATED_OPTIONS is not set
CONFIG_SERIAL_8250_CONSOLE=y
# CONFIG_HW_RANDOM is not set
CONFIG_GPIOLIB=y
CONFIG_GPIO_TS5500=y
CONFIG_SENSORS_MAX197=y
CONFIG_WATCHDOG=y
CONFIG_SC520_WDT=y
CONFIG_USB=y
CONFIG_USB_OHCI_HCD=y
CONFIG_USB_SERIAL=y
CONFIG_USB_SERIAL_FTDI_SIO=y
CONFIG_USB_SERIAL_PL2303=y
# CONFIG_X86_PLATFORM_DEVICES is not set
# CONFIG_IOMMU_SUPPORT is not set
# CONFIG_DMIID is not set
CONFIG_EXT4_FS=y
# CONFIG_DNOTIFY is not set
# CONFIG_INOTIFY_USER is not set
CONFIG_VFAT_FS=y
CONFIG_TMPFS=y
# CONFIG_MISC_FILESYSTEMS is not set
# CONFIG_NETWORK_FILESYSTEMS is not set
CONFIG_NLS_CODEPAGE_437=y
CONFIG_NLS_CODEPAGE_850=y
CONFIG_NLS_ISO8859_1=y
CONFIG_NLS_ISO8859_15=y
CONFIG_NLS_UTF8=y
# CONFIG_VIRTUALIZATION is not set
CONFIG_XZ_DEC=y

View File

@@ -0,0 +1,52 @@
Technologic Systems TS-5x00 SBCs
================================
This document explains how to set up a basic Buildroot system for the
Technologic Systems TS-5x00 serie of x86-based Single Board Computers.
TS-5x00 Single Board Computers are based on the AMD Elan520 processor. For more
information please have a look at https://docs.embeddedTS.com/Documentation_Home#AMD
The kernel configuration works for any AMD Elan520-based SBCs, but the support
is enhanced for the TS-5500 and TS-5400 models (on-board devices registration
and additional sysfs attributes under /sys/devices/platform/).
To build the default configuration you only have to:
$ make ts5500_defconfig
$ make
You will need a Compact Flash card of sufficient size and the first or only
partition configured as Linux type, with the bootable flag.
You can transfer the system on the partition then optionally resize it with:
# dd if=output/images/rootfs.ext4 of=/dev/sdX1
# resize2fs /dev/sdX1
Or you can just extract the root filesystem to the partition with:
# mount /dev/sdX1 /mnt
# tar -pxf output/images/rootfs.tar -C /mnt
# umount /mnt
To install the bootloader, you will need to copy the MBR:
# cat output/images/syslinux/mbr.bin > /dev/sdX
Then install SYSLINUX in the mounted partition:
# mount /dev/sdX1 /mnt
# output/host/sbin/extlinux --install /mnt/boot/syslinux
# umount /mnt
IMPORTANT: In order for the board to boot the Compact Flash with a recent
config, the BIOS must use Logical Block Addressing (LBA). You can do it by
choosing "Ide 0: AUTOCONFIG, LBA" under "IDE DRIVE GEOMETRY" in the "Basic CMOS
Configuration" screen. Also, don't forget to set the 'active' (or 'bootable')
flag on partition 1. For details about the CMOS setup, please see:
https://docs.embeddedts.com/TS-5500#System_BIOS_Setup_Screens
Connect a terminal program to the rs232 connector marked "COM2"
with baudrate set to 115200, insert the Compact Flash card into the socket,
power up the board, and enjoy.

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 a9e8c51fcb1e695d1d35dde5886cba579cb6f29c9646c5889f39d63841d4b9f6 linux-6.12.95.tar.xz
sha256 c92591d896e79ecddbc3319136f0c2f855e832b397de7593f013ad7590a43e53 linux-6.12.80.tar.xz

View File

@@ -1,2 +1,2 @@
# Locally calculated
sha256 78e8bfc382fe388f9b55aa1daf8c563522a037779b5d4c349d1415e381f1243e u-boot-2026.07.tar.bz2
sha256 ac7c04b8b7004923b00a4e5d6699c5df4d21233bac9fda690d8cfbc209fff2fd u-boot-2026.04.tar.bz2

View File

@@ -0,0 +1,5 @@
# Locally calculated
sha256 ea59fbfb702857a24f96ee8e9cf04f997942db1de98f8406b7daf9dcc8f4e9ea xlnx_rebase_v2.12_2025.2.tar.gz
# Locally calculated
sha256 b2c79635797bafcde84c6edadadde290b9d5e05deb3ea16a847210fd2ca83669 docs/license.rst

View File

@@ -0,0 +1 @@
../linux/linux.hash

View File

@@ -1,7 +1,7 @@
# Locally calculated
sha256 23c9cf18f5f419dfaafe5c3d3eda4812eb71bf1f2fbf3b35470478bbaa3d96bb xlnx_rebase_v6.18_LTS_2026.1.tar.gz
sha256 002fa6c617d3d3eaf1e16219079f4e4303b84ea472b2b3c5d47f766a106a79c7 xlnx_rebase_v6.12_LTS_merge_6.12.70.tar.gz
# Locally calculated
sha256 fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0 COPYING
sha256 8780e78a1a737e127f25a65f6d95269bffd36158dc261114de7859b490bfc5aa LICENSES/preferred/GPL-2.0
sha256 f6b78c087c3ebdf0f3c13415070dd480a3f35d8fc76f3d02180a407c1c812f79 LICENSES/preferred/GPL-2.0
sha256 8e378ab93586eb55135d3bc119cce787f7324f48394777d00c34fa3d0be3303f LICENSES/exceptions/Linux-syscall-note

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 3b8969a25815a0be84f34033827e5eb557e10f0f13ebabaee339461f8520ec72 xlnx_rebase_v4.5.0_2025.2.tar.gz

View File

@@ -0,0 +1,2 @@
# Locally calculated
sha256 8819cbebda739436d5d2fbdef578ec3c9b902f7edbe0ce4ed6f0ddf254fcf2a7 xlnx_rebase_v2025.01_2025.2.tar.gz

View File

@@ -1,5 +0,0 @@
# Locally calculated
sha256 6047af5f352fa7aaacd988a3fe0d018627dcc200dfdf93de0c0dc8072adef828 xlnx-rebase-v2.14_2026.1.tar.gz
# Locally calculated
sha256 dbc8c4c1042f833ac961730cda41f87b6845068d9b5be2c90726504cfc82382e docs/license.rst

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 0d33919008db24241580ac54c355d5c7efb18b089c2a7248704676a769790380 xlnx-rebase-v4.9.0_2026.1.tar.gz

View File

@@ -1,2 +0,0 @@
# Locally calculated
sha256 bc42689fffa878f9852120b167b871d8294697441cdd9f8347506a30d4024e8c xlnx-rebase-v2026.01_2026.1.tar.gz

Some files were not shown because too many files have changed in this diff Show More