Update for 2020.08-rc3

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/glibc: security bump for additional post-2.31.x fixes
2020-08-28 23:10:20 +02:00 · 2020-08-28 22:57:25 +02:00 · 2020-08-28 22:56:49 +02:00 · 2020-08-28 22:36:49 +02:00 · 2020-08-28 22:35:15 +02:00 · 2020-08-28 22:09:52 +02:00
65 changed files with 862 additions and 287 deletions
@@ -1,3 +1,23 @@
+2020.08-rc3, released August 28th, 2020
+
+	Fixes all over the tree.
+
+	Infrastructure: Ensure RPATH entries thay may be needed for
+	dlopen() are not dropped by patchelf.
+
+	Toolchain: Drop old GCC 6 based external Sourcery AMD64
+	toolchain.
+
+	Updated/fixed packages: assimp, davfs2, dillo, glibc,
+	gnuradio, hostapd, ibm-sw-tpm2, ipmitool, json-c, libroxml,
+	linux, mender, netopeer2, openal, openjpeg, python-matplotlib,
+	ripgrep, shadowsocks-libev, trousers, xlib_libX11,
+	xserver_xorg-server
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#13141: Target-finalize fail with "depmod: ERROR: Bad version passed"
+
 2020.08-rc2, released August 24th, 2020

 	Fixes all over the tree, including a number of fixes for
@@ -146,29 +146,16 @@ endif

 comment "Legacy options removed in 2020.08"

-config BR2_PACKAGE_PHP_EXT_HASH
-	bool "php hash extension is mandatory"
+config BR2_TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64
+	bool "toolchain-external-codesourcery-amd64 removed"
 	select BR2_LEGACY
 	help
-	  Since php 7.4.0, hash extension can't be disabled.
-
-config BR2_PACKAGE_EFL_GIF
-	bool "efl evas gif loader is mandatory"
-	select BR2_LEGACY
-	help
-	  Since efl 1.23.x, the evas gif loader can't be disabled.
-
-config BR2_PACKAGE_EFL_PNG
-	bool "efl evas png loader is mandatory"
-	select BR2_LEGACY
-	help
-	  Since efl 1.23.x, the evas png loader can't be disabled.
-
-config BR2_PACKAGE_EFL_ELPUT
-	bool "efl elput is enabled by efl drm option"
-	select BR2_LEGACY
-	help
-	  Since efl 1.23.x, the drm option enable the elput library.
+	  The CodeSourcery toolchain for AMD64, in version 2016.11 was
+	  dropped, due to it using a too old gcc 6.2.0 compiler which
+	  caused issues compiling a number of recent packages
+	  (e.g. Boost). CodeSourcery has stopped making newer versions
+	  of this toolchain publicly available, so it was not possible
+	  to update it.

 config BR2_KERNEL_HEADERS_5_6
 	bool "kernel headers version 5.6.x are no longer supported"
@@ -1096,8 +1096,10 @@ F:	package/python-remi/
 F:	package/python-sip/

 N:	Heiko Thiery <heiko.thiery@gmail.com>
+F:	package/ipmitool/
 F:	package/libnetconf2/
 F:	package/libyang/
+F:	package/linuxptp/
 F:	package/netopeer2/
 F:	package/sysrepo/

@@ -92,9 +92,9 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2020.08-rc2
+export BR2_VERSION := 2020.08-rc3
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1598278000
+BR2_VERSION_EPOCH = 1598649000

 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -76,37 +76,37 @@
 	</div>
      </div>

-      <h3 style="text-align: center;">Latest release candidate: <b>2020.08-rc2</b></h3>
+      <h3 style="text-align: center;">Latest release candidate: <b>2020.08-rc3</b></h3>
      <div class="row mt centered">
 	<div class="col-sm-6">
 	  <div class="flip-container center-block" ontouchstart="this.classList.toggle('hover');">
 	    <div class="flipper">
 	      <div class="front">
-		<a href="/downloads/buildroot-2020.08-rc2.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2020.08-rc3.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
 	      </div>
 	      <div class="back">
-		<a href="/downloads/buildroot-2020.08-rc2.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2020.08-rc3.tar.gz"><img src="images/zip.png" width="180" alt=""></a>
 	      </div>
 	    </div>
 	  </div>

-	  <h3><a href="/downloads/buildroot-2020.08-rc2.tar.gz">buildroot-2020.08-rc2.tar.gz</a></h3>
-	  <p><a href="/downloads/buildroot-2020.08-rc2.tar.gz.sign">PGP signature</a></p>
+	  <h3><a href="/downloads/buildroot-2020.08-rc3.tar.gz">buildroot-2020.08-rc3.tar.gz</a></h3>
+	  <p><a href="/downloads/buildroot-2020.08-rc3.tar.gz.sign">PGP signature</a></p>
 	</div>
 	<div class="col-sm-6">
 	  <div class="flip-container center-block" ontouchstart="this.classList.toggle('hover');">
 	    <div class="flipper">
 	      <div class="front">
-		<a href="/downloads/buildroot-2020.08-rc2.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2020.08-rc3.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
 	      </div>
 	      <div class="back">
-		<a href="/downloads/buildroot-2020.08-rc2.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
+		<a href="/downloads/buildroot-2020.08-rc3.tar.bz2"><img src="images/package.png" width="180" alt=""></a>
 	      </div>
 	    </div>
 	  </div>

-	  <h3><a href="/downloads/buildroot-2020.08-rc2.tar.bz2">buildroot-2020.08-rc2.tar.bz2</a></h3>
-	  <p><a href="/downloads/buildroot-2020.08-rc2.tar.bz2.sign">PGP signature</a></p>
+	  <h3><a href="/downloads/buildroot-2020.08-rc3.tar.bz2">buildroot-2020.08-rc3.tar.bz2</a></h3>
+	  <p><a href="/downloads/buildroot-2020.08-rc3.tar.bz2.sign">PGP signature</a></p>
 	</div>
      </div>

@@ -10,6 +10,27 @@
 <ul class="timeline">

  <li>
+    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
+    <div class="timeline-panel">
+      <div class="timeline-heading">
+	<h4 class="timeline-title">2020.08-rc3 released</h4>
+	<p><small class="text-muted"><i class="glyphicon glyphicon-time"></i>28 August 2020</small></p>
+      </div>
+      <div class="timeline-body">
+        <p>Another week, another release candidate with more cleanups and build fixes. See the
+	  <a href="http://git.buildroot.net/buildroot/plain/CHANGES?id=2020.08-rc3">CHANGES</a>
+	  file for details.</p>
+
+	<p>Head to the <a href="/downloads/">downloads page</a> to pick up the
+	  <a href="/downloads/buildroot-2020.08-rc3.tar.bz2">2020.08-rc3
+	  release candidate</a>, and report any problems found to the
+	  <a href="support.html">mailing list</a> or
+	  <a href="https://bugs.buildroot.org">bug tracker</a>.</p>
+      </div>
+    </div>
+  </li>
+
+  <li class="timeline-inverted">
    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
    <div class="timeline-panel">
      <div class="timeline-heading">
@@ -30,7 +51,7 @@
    </div>
  </li>

-  <li class="timeline">
+  <li>
    <div class="timeline-badge"><i class="glyphicon glyphicon-thumbs-up"></i></div>
    <div class="timeline-panel">
      <div class="timeline-heading">
@@ -124,7 +124,7 @@ endif

 config BR2_LINUX_KERNEL_VERSION
 	string
-	default "5.7.17" if BR2_LINUX_KERNEL_LATEST_VERSION
+	default "5.7.19" if BR2_LINUX_KERNEL_LATEST_VERSION
 	default "4.19.132-cip30" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
 	default "4.19.132-cip30-rt12" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
@@ -1,11 +1,11 @@
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-sha256  cc8c3611c9bdcd29266b2606ab6c3a07a32fb64fd7f1cd731100e4eddb565225  linux-5.7.17.tar.xz
-sha256  add2ab2385c40fc9a3dfebe403e56da8500b633dc7dc42cf0c670c61d151a223  linux-5.4.60.tar.xz
+sha256  419c6248b9ae4dfead4599787aecbfd202e88bc4124523adfa6dd2d642b99fe7  linux-5.7.19.tar.xz
+sha256  86f13d050f6389c5a1727fa81510ee8eceac795297bc584f443354609617fea4  linux-5.4.61.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
-sha256  97e689dd083d780bf7bacdc17c0a9ec9e9be118507dccedf4b77eef9666ce7fc  linux-4.4.233.tar.xz
-sha256  2a6dcab0652ab181820d56b6014235a125cf933e0edf5bdbc038160fa9e7aca5  linux-4.9.233.tar.xz
-sha256  3ea4d0221a071d58703cd346a8a6ef1582a32a8c4565a4919578817444d4fae0  linux-4.14.194.tar.xz
-sha256  a4421dea5333beeaaef81312c6f415330b9e4fda6027f399a1c55f97d3da2114  linux-4.19.141.tar.xz
+sha256  6994dda988e9fb7f5661cf80ff42039016cb0044acd39f830937ba0220296388  linux-4.4.234.tar.xz
+sha256  756f8544d261e8117716c911261690e4fb5491e14c1f4612c83e0986453782e3  linux-4.9.234.tar.xz
+sha256  394f28798670240baacd9e2cce521fbd79f8da5e1fc191695b0e11381445a021  linux-4.14.195.tar.xz
+sha256  6912db1c242d72ce9c8d4ff71982ac935d97690822af5c1c6ec22412b31667a4  linux-4.19.142.tar.xz
 # Locally computed
 sha256  c20f9014b89ea3e27f55f1d407aa5a4724ed38ac520c197291e9d644f164c43a  linux-cip-4.19.132-cip30.tar.gz
 sha256  81dd791d9ad6c3fddaeaffc6d7d8df0e13831283a5fe494c437ac7820d79ca39  linux-cip-4.19.132-cip30-rt12.tar.gz
@@ -160,7 +160,8 @@ endif

 # Get the real Linux version, which tells us where kernel modules are
 # going to be installed in the target filesystem.
-LINUX_VERSION_PROBED = `$(MAKE) $(LINUX_MAKE_FLAGS) -C $(LINUX_DIR) --no-print-directory -s kernelrelease 2>/dev/null`
+# Filter out 'w' from MAKEFLAGS, to workaround a bug in make 4.1 (#13141)
+LINUX_VERSION_PROBED = `MAKEFLAGS='$(filter-out w,$(MAKEFLAGS))' $(MAKE) $(LINUX_MAKE_FLAGS) -C $(LINUX_DIR) --no-print-directory -s kernelrelease 2>/dev/null`

 LINUX_DTS_NAME += $(call qstrip,$(BR2_LINUX_KERNEL_INTREE_DTS_NAME))

@@ -10,8 +10,17 @@ ASSIMP_LICENSE = BSD-3-Clause
 ASSIMP_LICENSE_FILES = LICENSE
 ASSIMP_INSTALL_STAGING = YES

-# relocation truncated to fit: R_68K_GOT16O
+# relocation truncated to fit: R_68K_GOT16O. We also need to disable
+# optimizations to not run into "Error: value -43420 out of range"
+# assembler issues.
 ifeq ($(BR2_m68k),y)
+ASSIMP_CXXFLAGS += -mxgot -O0
+endif
+
+# just like m68k coldfire, mips64 also has some limitations on the GOT
+# size for large libraries, which can be overcome by passing
+# -mxgot. Solves "relocation truncated to fit: R_MIPS_CALL16" issues.
+ifeq ($(BR2_mips64)$(BR2_mips64el),y)
 ASSIMP_CXXFLAGS += -mxgot
 endif

@@ -1,4 +1,4 @@
 # Locally calculated
-sha256 417476cdcfd53966b2dcfaf12455b54f315959b488a89255ab4b44586153d801  davfs2-1.5.6.tar.gz
+sha256  2e6b675685bd917772be60f0999ae098c80f79ff20dc131e8fec4547cbb63b50  davfs2-1.6.0.tar.gz
 # License file, locally calculated
-sha256 0ae0485a5bd37a63e63603596417e4eb0e653334fa6c7f932ca3a0e85d4af227  COPYING
+sha256  0ae0485a5bd37a63e63603596417e4eb0e653334fa6c7f932ca3a0e85d4af227  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-DAVFS2_VERSION = 1.5.6
+DAVFS2_VERSION = 1.6.0
 DAVFS2_SITE = http://download.savannah.nongnu.org/releases/davfs2
 DAVFS2_LICENSE = GPL-3.0+
 DAVFS2_LICENSE_FILES = COPYING
@@ -0,0 +1,124 @@
+fix build with gcc 10
+
+gcc 10 is now defaulting to -fno-common resulting in the following build
+failures:
+
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/bin/arm-buildroot-linux-gnueabihf-gcc  -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -Os -g2 -D_FORTIFY_SOURCE=1 -DENABLE_IPV6 -DD_DNS_THREADED -D_REENTRANT -D_THREAD_SAFE -Wall -W -Wno-unused-parameter -Waggregate-return   -o dpid dpi.o dpi_socket_dir.o dpid.o dpid_common.o main.o misc_new.o ../dpip/libDpip.a ../dlib/libDlib.a 
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: dpi_socket_dir.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: multiple definition of `dpi_errno'; dpi.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: multiple definition of `dpi_errno'; dpi.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: dpid_common.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: multiple definition of `dpi_errno'; dpi.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:64: multiple definition of `sock_set'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:64: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:61: multiple definition of `services_list'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:61: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:58: multiple definition of `dpi_attr_list'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:58: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:55: multiple definition of `numsocks'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:55: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:52: multiple definition of `numdpis'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:52: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:31: multiple definition of `srs_fd'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:31: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:28: multiple definition of `srs_name'; dpid.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid.h:28: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: main.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: multiple definition of `dpi_errno'; dpi.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: first defined here
+/nvme/rc-buildroot-test/scripts/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: misc_new.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: multiple definition of `dpi_errno'; dpi.o:/nvme/rc-buildroot-test/scripts/instance-0/output-1/build/dillo-3.0.5/dpid/dpid_common.h:44: first defined here
+
+So add missing extern for srs_fd, numdpis, numsocks, dpi_attr_list,
+services_list and sock_set
+
+Also remove srs_name which is never used and give a name to dpi_errno
+enum
+
+Fixes:
+ - http://autobuild.buildroot.org/results/9c777af97fe50143c6a68f0170fc86c87d8ead3f
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: sent to jcid@dillo.org]
+
+diff -r f60d55c02567 dpid/dpid.c
+--- a/dpid/dpid.c	Fri Oct 05 22:05:08 2018 +0200
+++ b/dpid/dpid.c	Thu Aug 27 18:16:50 2020 +0200
+@@ -38,6 +38,12 @@
+ 
+ #define QUEUE 5
+ 
+int srs_fd;
+int numdpis;
+int numsocks;
+struct dp *dpi_attr_list;
+Dlist *services_list;
+fd_set sock_set;
+ volatile sig_atomic_t caught_sigchld = 0;
+ char *SharedKey = NULL;
+ 
+diff -r f60d55c02567 dpid/dpid.h
+--- a/dpid/dpid.h	Fri Oct 05 22:05:08 2018 +0200
+++ b/dpid/dpid.h	Thu Aug 27 18:16:50 2020 +0200
+@@ -25,10 +25,9 @@
+ 
+ /*! \TODO: Should read this from dillorc */
+ #define SRS_NAME "dpid.srs"
+-char *srs_name;
+ 
+ /*! dpid's service request socket file descriptor */
+-int srs_fd;
+extern int srs_fd;
+ 
+ /*! plugin state information
+  */
+@@ -49,19 +48,19 @@
+ };
+ 
+ /*! Number of available plugins */
+-int numdpis;
+extern int numdpis;
+ 
+ /*! Number of sockets being watched */
+-int numsocks;
+extern int numsocks;
+ 
+ /*! State information for each plugin. */
+-struct dp *dpi_attr_list;
+extern struct dp *dpi_attr_list;
+ 
+ /*! service served for each plugin  */
+-Dlist *services_list;
+extern Dlist *services_list;
+ 
+ /*! Set of sockets watched for connections */
+-fd_set sock_set;
+extern fd_set sock_set;
+ 
+ /*! Set to 1 by the SIGCHLD handler dpi_sigchld */
+ extern volatile sig_atomic_t caught_sigchld;
+diff -r f60d55c02567 dpid/dpid_common.h
+--- a/dpid/dpid_common.h	Fri Oct 05 22:05:08 2018 +0200
+++ b/dpid/dpid_common.h	Thu Aug 27 18:16:50 2020 +0200
+@@ -37,10 +37,10 @@
+ 
+ 
+ /*! Error codes for dpid */
+-enum {
+enum dpi_errno {
+    no_errors,
+    dpid_srs_addrinuse /* dpid service request socket address already in use */
+-} dpi_errno;
+};
+ 
+ /*! Intended for identifying dillo plugins
+  * and related files
+diff -r f60d55c02567 dpid/main.c
+--- a/dpid/main.c	Fri Oct 05 22:05:08 2018 +0200
+++ b/dpid/main.c	Thu Aug 27 18:16:50 2020 +0200
+@@ -231,7 +231,7 @@
+    /* this sleep used to unmask a race condition */
+    // sleep(2);
+ 
+-   dpi_errno = no_errors;
+   enum dpi_errno error_code = no_errors;
+ 
+    /* Get list of available dpis */
+    numdpis = register_all(&dpi_attr_list);
+@@ -254,7 +254,7 @@
+ 
+    /* Initialise sockets */
+    if ((numsocks = init_ids_srs_socket()) == -1) {
+-      switch (dpi_errno) {
+      switch (error_code) {
+       case dpid_srs_addrinuse:
+          MSG_ERR("dpid refuses to start, possibly because:\n");
+          MSG_ERR("\t1) An instance of dpid is already running.\n");
@@ -1,5 +1,5 @@
 # Locally calculated (fetched from Github)
-sha256  a105837271b66e92f1ed4a5f10f3bb9e993842d592f67d352c6637126bd3d58c  glibc-2.31-49-g6f3459f9859a7b506c64fa1823769ab631072c6e.tar.gz
+sha256  e1f2c9b424a4e0c00e7ad123a4204f7bc8afd3c504aeb8c79b1086509fd67176  glibc-2.31-54-g6fdf971c9dbf7dac9bea552113fe4694015bbc4d.tar.gz

 # Hashes for license files
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING
@@ -17,7 +17,7 @@ else
 # Generate version string using:
 #   git describe --match 'glibc-*' --abbrev=40 origin/release/MAJOR.MINOR/master | cut -d '-' -f 2-
 # When updating the version, please also update localedef
-GLIBC_VERSION = 2.31-49-g6f3459f9859a7b506c64fa1823769ab631072c6e
+GLIBC_VERSION = 2.31-54-g6fdf971c9dbf7dac9bea552113fe4694015bbc4d
 # Upstream doesn't officially provide an https download link.
 # There is one (https://sourceware.org/git/glibc.git) but it's not reliable,
 # sometimes the connection times out. So use an unofficial github mirror.
@@ -0,0 +1,57 @@
+From 84dea8284c521f08508bb2dcbc99db3b5d3438fd Mon Sep 17 00:00:00 2001
+From: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
+Date: Thu, 27 Aug 2020 17:32:09 +0200
+Subject: [PATCH] gnuradio-runtime_pmt: dont hardcode
+ INTERFACE_INCLUDE_DIRECTORIES
+
+gnuradio-runtimeTargets.cmake and gnuradio-pmtTargets.cmake are filled
+using CMAKE_INSTALL_PREFIX for INSTALL_INTERFACE.
+
+Since CMAKE_INSTALL_PREFIX, in buildroot, is set to /usr, these files contains
+path to host system.
+
+With BR2_COMPILER_PARANOID_UNSAFE_PATH package using gnuradio fails with:
+arm-linux-gnueabihf-g++: ERROR: unsafe header/library path used in cross-compilation: '-isystem' '/usr/include'
+
+By simply providing 'include', produced .cmake contains:
+INTERFACE_INCLUDE_DIRECTORIES "${_IMPORT_PREFIX}/include"
+instead of
+INTERFACE_INCLUDE_DIRECTORIES "/usr/include"
+
+[Upstream status: https://github.com/gnuradio/gnuradio/pull/3737]
+
+Signed-off-by: Gwenhael Goavec-Merou <gwenhael.goavec-merou@trabucayre.com>
+---
+ gnuradio-runtime/lib/CMakeLists.txt     | 2 +-
+ gnuradio-runtime/lib/pmt/CMakeLists.txt | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/gnuradio-runtime/lib/CMakeLists.txt b/gnuradio-runtime/lib/CMakeLists.txt
+index 5aa90a5e1..fc32f473b 100644
+--- a/gnuradio-runtime/lib/CMakeLists.txt
+++ b/gnuradio-runtime/lib/CMakeLists.txt
+@@ -214,7 +214,7 @@ target_link_libraries(gnuradio-runtime PUBLIC
+ 
+ target_include_directories(gnuradio-runtime
+   PUBLIC
+-    $<INSTALL_INTERFACE:${CMAKE_INSTALL_PREFIX}/include>
+    $<INSTALL_INTERFACE:include>
+     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../include>
+     $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}/../include>
+   PRIVATE
+diff --git a/gnuradio-runtime/lib/pmt/CMakeLists.txt b/gnuradio-runtime/lib/pmt/CMakeLists.txt
+index 9fb98d0fc..6dfcd945c 100644
+--- a/gnuradio-runtime/lib/pmt/CMakeLists.txt
+++ b/gnuradio-runtime/lib/pmt/CMakeLists.txt
+@@ -33,7 +33,7 @@ target_link_libraries(gnuradio-pmt
+ 
+ target_include_directories(gnuradio-pmt
+   PUBLIC
+-  $<INSTALL_INTERFACE:${CMAKE_INSTALL_PREFIX}/include>
+  $<INSTALL_INTERFACE:include>
+   $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/../../include>
+   PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/
+   )
+-- 
+2.26.2
+
@@ -491,16 +491,16 @@ config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_NEON
 config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_OPENAL
 	bool "openal"
 	depends on BR2_INSTALL_LIBSTDCPP
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_7
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
 	depends on BR2_PAKCAGE_OPENAL_ARCH_SUPPORTS
 	select BR2_PACKAGE_OPENAL

-comment "openal plugin needs a toolchain w/ NPTL, C++, gcc >= 4.7"
+comment "openal plugin needs a toolchain w/ NPTL, C++, gcc >= 4.9"
 	depends on BR2_PAKCAGE_OPENAL_ARCH_SUPPORTS
 	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL \
 		|| !BR2_INSTALL_LIBSTDCPP \
-		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_7
+		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9

 config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_OPENH264
 	bool "openh264"
@@ -1,3 +1,6 @@
 # Locally calculated
 sha256  881d7d6a90b2428479288d64233151448f8990ab4958e0ecaca7eeb3c9db2bd7  hostapd-2.9.tar.gz
+sha256  2d9a5b9d616f1b4aa4a22b967cee866e2f69b798b0b46803a7928c8559842bd7  0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
+sha256  49feb35a5276279b465f6836d6fa2c6b34d94dc979e8b840d1918865c04260de  0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch
+sha256  a8212a2d89a5bab2824d22b6047e7740553df163114fcec94832bfa9c5c5d78a  0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
 sha256  9da5dd0776da266b180b915e460ff75c6ff729aca1196ab396529510f24f3761  README
@@ -8,6 +8,10 @@ HOSTAPD_VERSION = 2.9
 HOSTAPD_SITE = http://w1.fi/releases
 HOSTAPD_SUBDIR = hostapd
 HOSTAPD_CONFIG = $(HOSTAPD_DIR)/$(HOSTAPD_SUBDIR)/.config
+HOSTAPD_PATCH = \
+	https://w1.fi/security/2020-1/0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch \
+	https://w1.fi/security/2020-1/0002-WPS-UPnP-Fix-event-message-generation-using-a-long-U.patch \
+	https://w1.fi/security/2020-1/0003-WPS-UPnP-Handle-HTTP-initiation-failures-for-events-.patch
 HOSTAPD_DEPENDENCIES = host-pkgconf
 HOSTAPD_CFLAGS = $(TARGET_CFLAGS)
 HOSTAPD_LICENSE = BSD-3-Clause
@@ -16,6 +20,9 @@ HOSTAPD_LICENSE_FILES = README
 # 0001-AP-Silently-ignore-management-frame-from-unexpected-.patch
 HOSTAPD_IGNORE_CVES += CVE-2019-16275

+# 0001-WPS-UPnP-Do-not-allow-event-subscriptions-with-URLs-.patch
+HOSTAPD_IGNORE_CVES += CVE-2020-12695
+
 HOSTAPD_CONFIG_SET =

 HOSTAPD_CONFIG_ENABLE = \
@@ -1,4 +1,4 @@
-From 7c32c58f4ce802d2682038f73bb8c8f850237f89 Mon Sep 17 00:00:00 2001
+From 5aeb25abf13de43b9e497f6509209911dd1386b8 Mon Sep 17 00:00:00 2001
 From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 Date: Sun, 26 Apr 2020 15:33:39 +0200
 Subject: [PATCH] Use LONG_BIT to define RADIX_BITS
@@ -6,14 +6,17 @@ Subject: [PATCH] Use LONG_BIT to define RADIX_BITS
 This allows to avoid having to support each CPU architecture
 individually.

-Also, add the necessary defines in the makefile to expose LONG_BIT
+Also, add the necessary defines in the makefile to expose
+LONG_BIT. Adding those defines end up requiring using <sys/select.h>
+as we're now using >= POSIX.1-2001 definitions of fd_set and friends.

 Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
 Signed-off-by: Vincent Fazio <vfazio@gmail.com>
 ---
- src/LibSupport.h | 17 +++--------------
- src/makefile     |  2 ++
- 2 files changed, 5 insertions(+), 14 deletions(-)
+ src/LibSupport.h     | 17 +++--------------
+ src/TcpServerPosix.c |  1 +
+ src/makefile         |  2 ++
+ 3 files changed, 6 insertions(+), 14 deletions(-)

 diff --git a/src/LibSupport.h b/src/LibSupport.h
 index b2e6a51..0b59d18 100644
@@ -43,8 +46,20 @@ index b2e6a51..0b59d18 100644
 
 // These macros use the selected libraries to the proper include files.
 #define LIB_QUOTE(_STRING_) #_STRING_
+diff --git a/src/TcpServerPosix.c b/src/TcpServerPosix.c
+index 20fcb29..bdac7aa 100644
+--- a/src/TcpServerPosix.c
+++ b/src/TcpServerPosix.c
+@@ -66,6 +66,7 @@
+ 
+ #include <stdio.h>
+ /* FIXME need Posix TCP socket code */
+#include <sys/select.h>
+ #include <unistd.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
 diff --git a/src/makefile b/src/makefile
-index f124e78..9af1e51 100644
+index f124e78..6ee128e 100644
 --- a/src/makefile
 +++ b/src/makefile
@@ -46,6 +46,8 @@ CCFLAGS = -Wall  			\
@@ -52,10 +67,10 @@ index f124e78..9af1e51 100644
 	-DTPM_POSIX			\
 	-D_POSIX_			\
 +	-D_DEFAULT_SOURCE		\
-+	-D_XOPEN_SOURCE			\
+	-D_XOPEN_SOURCE=500		\
 	-DTPM_NUVOTON
 
 # add this line for big endian platforms
 -- 
-2.28.0
+2.26.2

@@ -0,0 +1,40 @@
+From c3939dac2c060651361fc71516806f9ab8c38901 Mon Sep 17 00:00:00 2001
+From: Vaclav Dolezal <vdolezal@redhat.com>
+Date: Thu, 23 Jan 2020 11:26:32 +0100
+Subject: [PATCH] hpmfwupg: move variable definition to .c file
+
+Signed-off-by: Vaclav Dolezal <vdolezal@redhat.com>
+[Retrieved from:
+https://github.com/ipmitool/ipmitool/commit/c3939dac2c060651361fc71516806f9ab8c38901]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ include/ipmitool/ipmi_hpmfwupg.h | 2 +-
+ lib/ipmi_hpmfwupg.c              | 2 ++
+ 2 files changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/include/ipmitool/ipmi_hpmfwupg.h b/include/ipmitool/ipmi_hpmfwupg.h
+index de65292b..07f597be 100644
+--- a/include/ipmitool/ipmi_hpmfwupg.h
+++ b/include/ipmitool/ipmi_hpmfwupg.h
+@@ -800,7 +800,7 @@ typedef struct _VERSIONINFO {
+ 	char descString[HPMFWUPG_DESC_STRING_LENGTH + 1];
+ }VERSIONINFO, *PVERSIONINFO;
+ 
+-VERSIONINFO gVersionInfo[HPMFWUPG_COMPONENT_ID_MAX];
+extern VERSIONINFO gVersionInfo[HPMFWUPG_COMPONENT_ID_MAX];
+ 
+ #define TARGET_VER (0x01)
+ #define ROLLBACK_VER (0x02)
+diff --git a/lib/ipmi_hpmfwupg.c b/lib/ipmi_hpmfwupg.c
+index 4aa8cecd..d63d2c15 100644
+--- a/lib/ipmi_hpmfwupg.c
+++ b/lib/ipmi_hpmfwupg.c
+@@ -50,6 +50,8 @@
+ 
+ extern int verbose;
+ 
+VERSIONINFO gVersionInfo[HPMFWUPG_COMPONENT_ID_MAX];
+
+ int HpmfwupgUpgrade(struct ipmi_intf *intf, char *imageFilename,
+ 		int activate, int, int);
+ int HpmfwupgValidateImageIntegrity(struct HpmfwupgUpgradeCtx *pFwupgCtx);
@@ -1,4 +1,4 @@
 # From https://github.com/json-c/json-c/wiki
-sha256 b377de08c9b23ca3b37d9a9828107dff1de5ce208ff4ebb35005a794f30c6870  json-c-0.14.tar.gz
+sha256  b8d80a1ddb718b3ba7492916237bbf86609e9709fb007e7f7d4322f02341a4c6  json-c-0.15.tar.gz
 # Locally calculated
-sha256 74c1e6ca5eba76b54d0ad00d4815c8315c1b3bc45ff99de61d103dc92486284c  COPYING
+sha256  74c1e6ca5eba76b54d0ad00d4815c8315c1b3bc45ff99de61d103dc92486284c  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-JSON_C_VERSION = 0.14
+JSON_C_VERSION = 0.15
 JSON_C_SITE = https://s3.amazonaws.com/json-c_releases/releases
 JSON_C_INSTALL_STAGING = YES
 JSON_C_LICENSE = MIT
@@ -0,0 +1,37 @@
+From b16f6813011519ce247b0af9a4b78486daefad54 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Wed, 26 Aug 2020 22:54:50 +0200
+Subject: [PATCH] src/roxml_mem.h: add missing extern
+
+Add missing extern to head_cell otherwise the build with gcc 10 (with
+-fno-common being default) will fail on:
+
+/bin/bash ./libtool  --tag=CC   --mode=link /home/peko/autobuild/instance-0/output-1/host/bin/arm-buildroot-linux-gnueabihf-gcc -DIGNORE_EMPTY_TEXT_NODES -DCONFIG_XML_CONTENT -DCONFIG_XML_NAV -DCONFIG_XML_BUFF  -DCONFIG_XML_COMMIT -DCONFIG_XML_EDIT -DCONFIG_XML_FILE -DCONFIG_XML_XPATH -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -O2   -pthread -version-info 0:0:0  -o libroxml.la -rpath /usr/lib src/libroxml_la-roxml_core.lo src/libroxml_la-roxml_parser.lo src/libroxml_la-roxml_buff.lo src/libroxml_la-roxml_nav.lo src/libroxml_la-roxml_content.lo src/libroxml_la-roxml_mem.lo src/libroxml_la-roxml_stub.lo src/libroxml_la-roxml_commit.lo src/libroxml_la-roxml_edit.lo src/libroxml_la-roxml_file.lo src/libroxml_la-roxml_xpath.lo  -pthread
+libtool: link: /home/peko/autobuild/instance-0/output-1/host/bin/arm-buildroot-linux-gnueabihf-gcc -shared  -fPIC -DPIC  src/.libs/libroxml_la-roxml_core.o src/.libs/libroxml_la-roxml_parser.o src/.libs/libroxml_la-roxml_buff.o src/.libs/libroxml_la-roxml_nav.o src/.libs/libroxml_la-roxml_content.o src/.libs/libroxml_la-roxml_mem.o src/.libs/libroxml_la-roxml_stub.o src/.libs/libroxml_la-roxml_commit.o src/.libs/libroxml_la-roxml_edit.o src/.libs/libroxml_la-roxml_file.o src/.libs/libroxml_la-roxml_xpath.o    -O2 -pthread -pthread   -pthread -Wl,-soname -Wl,libroxml.so.0 -o .libs/libroxml.so.0.0.0
+/home/peko/autobuild/instance-0/output-1/host/lib/gcc/arm-buildroot-linux-gnueabihf/10.2.0/../../../../arm-buildroot-linux-gnueabihf/bin/ld: src/.libs/libroxml_la-roxml_mem.o:(.data+0x0): multiple definition of `head_cell'; src/.libs/libroxml_la-roxml_content.o:(.bss+0x0): first defined here
+
+Fixes:
+ - http://autobuild.buildroot.org/results/b6ac3664d61ad826515b57c4d057b6f001b5167d
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://github.com/blunderer/libroxml/pull/79]
+---
+ src/roxml_mem.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/roxml_mem.h b/src/roxml_mem.h
+index aff6137..34a5070 100644
+--- a/src/roxml_mem.h
+++ b/src/roxml_mem.h
+@@ -14,7 +14,7 @@
+ 
+ #include "roxml_internal.h"
+ 
+-memory_cell_t head_cell;
+extern memory_cell_t head_cell;
+ 
+ /** \brief alloc memory function
+  *
+-- 
+2.28.0
+
@@ -334,12 +334,12 @@ endchoice

 config BR2_DEFAULT_KERNEL_HEADERS
 	string
-	default "4.4.233"	if BR2_KERNEL_HEADERS_4_4
-	default "4.9.233"	if BR2_KERNEL_HEADERS_4_9
-	default "4.14.194"	if BR2_KERNEL_HEADERS_4_14
-	default "4.19.141"	if BR2_KERNEL_HEADERS_4_19
-	default "5.4.60"	if BR2_KERNEL_HEADERS_5_4
-	default "5.7.17"	if BR2_KERNEL_HEADERS_5_7
+	default "4.4.234"	if BR2_KERNEL_HEADERS_4_4
+	default "4.9.234"	if BR2_KERNEL_HEADERS_4_9
+	default "4.14.195"	if BR2_KERNEL_HEADERS_4_14
+	default "4.19.142"	if BR2_KERNEL_HEADERS_4_19
+	default "5.4.61"	if BR2_KERNEL_HEADERS_5_4
+	default "5.7.19"	if BR2_KERNEL_HEADERS_5_7
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION
 	default "custom"	if BR2_KERNEL_HEADERS_CUSTOM_TARBALL
 	default BR2_KERNEL_HEADERS_CUSTOM_REPO_VERSION \
@@ -4,7 +4,7 @@ config BR2_PACKAGE_LUGARU
 	depends on BR2_PACKAGE_HAS_LIBGL # libglu
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
 	depends on BR2_PACKAGE_XORG7 # SDL2 OpenGL (GLX)
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_7 # C++11
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # openal
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # openal
 	depends on BR2_USE_MMU # SDL2 OpenGL (GLX)
 	depends on !BR2_STATIC_LIBS # SDL2
@@ -29,10 +29,10 @@ config BR2_PACKAGE_LUGARU

 	  https://osslugaru.gitlab.io/

-comment "lugaru needs X11 and a toolchain w/ C++, OpenGL backend, gcc >= 4.7, NPTL, dynamic library"
+comment "lugaru needs X11 and a toolchain w/ C++, OpenGL backend, gcc >= 4.9, NPTL, dynamic library"
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
 	depends on BR2_PACKAGE_XORG7
 	depends on BR2_USE_MMU
 	depends on !BR2_INSTALL_LIBSTDCPP || !BR2_PACKAGE_HAS_LIBGL || \
-		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_7 || !BR2_TOOLCHAIN_HAS_THREADS_NPTL || \
+		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 || !BR2_TOOLCHAIN_HAS_THREADS_NPTL || \
 		BR2_STATIC_LIBS
@@ -77,8 +77,8 @@ endef
 MENDER_POST_INSTALL_TARGET_HOOKS += MENDER_INSTALL_CONFIG_FILES

 define MENDER_INSTALL_INIT_SYSTEMD
-	$(INSTALL) -D -m 0644 $(MENDER_PKGDIR)/mender.service \
-		$(TARGET_DIR)/usr/lib/systemd/system/mender.service
+	$(INSTALL) -D -m 0644 $(MENDER_PKGDIR)/mender-client.service \
+		$(TARGET_DIR)/usr/lib/systemd/system/mender-client.service
 endef

 define MENDER_INSTALL_INIT_SYSV
@@ -0,0 +1,98 @@
+From 36ee1f33bceb0c2a7899e28d75c0d05408b561f1 Mon Sep 17 00:00:00 2001
+From: Michal Vasko <mvasko@cesnet.cz>
+Date: Mon, 24 Aug 2020 13:47:40 +0200
+Subject: [PATCH] scripts FEATURE support using current user for SR modules
+
+Mostly for special cases user/group configuration
+when the user/group cannot be retrieved normally.
+
+Fixes #701
+
+Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
+[patch taken from upstream:
+https://github.com/CESNET/netopeer2/commit/12a82701e10651fbdedb1524b27edf3bb2377488]
+Signed-off-by: Heiko Thiery <heiko.thiery@gmail.com>
+---
+ CMakeLists.txt   | 10 +++++-----
+ scripts/setup.sh | 23 +++++++++++++++++++----
+ 2 files changed, 24 insertions(+), 9 deletions(-)
+
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 2d4175e..95e7e61 100755
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -68,19 +68,19 @@ if(NOT MODULES_OWNER)
+     OUTPUT_VARIABLE MODULES_OWNER OUTPUT_STRIP_TRAILING_WHITESPACE
+     ERROR_VARIABLE ERROR_STR OUTPUT_STRIP_TRAILING_WHITESPACE)
+     if(RET)
+-        message(FATAL_ERROR "Learning server module user failed: ${ERROR_STR}")
+        message(WARNING "Learning server module user failed (${ERROR_STR}), the current user will be used.")
+     endif()
+ endif()
+-set(MODULES_OWNER "${MODULES_OWNER}" CACHE STRING "System user that will become the owner of server modules")
+-if(NOT MODULES_GROUP)
+set(MODULES_OWNER "${MODULES_OWNER}" CACHE STRING "System user that will become the owner of server modules, empty means the current user")
+if(NOT MODULES_GROUP AND MODULES_OWNER)
+     execute_process(COMMAND id -gn ${MODULES_OWNER} RESULT_VARIABLE RET
+     OUTPUT_VARIABLE MODULES_GROUP OUTPUT_STRIP_TRAILING_WHITESPACE
+     ERROR_VARIABLE ERROR_STR OUTPUT_STRIP_TRAILING_WHITESPACE)
+     if(RET)
+-        message(FATAL_ERROR "Learning server module group failed: ${ERROR_STR}")
+        message(WARNING "Learning server module group failed (${ERROR_STR}), the current user group will be used.")
+     endif()
+ endif()
+-set(MODULES_GROUP "${MODULES_GROUP}" CACHE STRING "System group that the server modules will belong to")
+set(MODULES_GROUP "${MODULES_GROUP}" CACHE STRING "System group that the server modules will belong to, empty means the current user group")
+ 
+ # set prefix for the PID file
+ if(NOT PIDFILE_PREFIX)
+diff --git a/scripts/setup.sh b/scripts/setup.sh
+index 7175bc4..b5d1406 100755
+--- a/scripts/setup.sh
+++ b/scripts/setup.sh
+@@ -1,7 +1,8 @@
+ #!/bin/bash
+ 
+-# env variables NP2_MODULE_DIR, NP2_MODULE_PERMS, NP2_MODULE_OWNER, NP2_MODULE_GROUP must be defined when executing this script!
+-if [ -z "$NP2_MODULE_DIR" -o -z "$NP2_MODULE_PERMS" -o -z "$NP2_MODULE_OWNER" -o -z "$NP2_MODULE_GROUP" ]; then
+# env variables NP2_MODULE_DIR, NP2_MODULE_PERMS must be defined and NP2_MODULE_OWNER, NP2_MODULE_GROUP will be used if
+# defined when executing this script!
+if [ -z "$NP2_MODULE_DIR" -o -z "$NP2_MODULE_PERMS" ]; then
+     echo "Required environment variables not defined!"
+     exit 1
+ fi
+@@ -33,7 +34,14 @@ MODULES=(
+ 
+ # functions
+ INSTALL_MODULE() {
+-    $SYSREPOCTL -a -i $MODDIR/$1 -s $MODDIR -p $PERMS -o $OWNER -g $GROUP -v2
+    CMD="'$SYSREPOCTL' -a -i $MODDIR/$1 -s '$MODDIR' -p '$PERMS' -v2"
+    if [ ! -z ${OWNER} ]; then
+        CMD="$CMD -o '$OWNER'"
+    fi
+    if [ ! -z ${GROUP} ]; then
+        CMD="$CMD -g '$GROUP'"
+    fi
+    eval $CMD
+     local rc=$?
+     if [ $rc -ne 0 ]; then
+         exit $rc
+@@ -41,7 +49,14 @@ INSTALL_MODULE() {
+ }
+ 
+ UPDATE_MODULE() {
+-    $SYSREPOCTL -a -U $MODDIR/$1 -s $MODDIR -p $PERMS -o $OWNER -g $GROUP -v2
+    CMD="'$SYSREPOCTL' -a -U $MODDIR/$1 -s '$MODDIR' -p '$PERMS' -v2"
+    if [ ! -z ${OWNER} ]; then
+        CMD="$CMD -o '$OWNER'"
+    fi
+    if [ ! -z ${GROUP} ]; then
+        CMD="$CMD -g '$GROUP'"
+    fi
+    eval $CMD
+     local rc=$?
+     if [ $rc -ne 0 ]; then
+         exit $rc
+-- 
+2.20.1
+
@@ -16,7 +16,7 @@ config BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
 config BR2_PACKAGE_OPENAL
 	bool "openal"
 	depends on BR2_INSTALL_LIBSTDCPP
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_7 # C++11
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # C++11 PR56019
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
 	help
@@ -27,8 +27,8 @@ config BR2_PACKAGE_OPENAL

 	  http://kcat.strangesoft.net/openal.html

-comment "openal needs a toolchain w/ NPTL, C++, gcc >= 4.7"
+comment "openal needs a toolchain w/ NPTL, C++, gcc >= 4.9"
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
 	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL \
 		|| !BR2_INSTALL_LIBSTDCPP \
-		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_7
+		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9
@@ -0,0 +1,43 @@
+From e8e258ab049240c2dd1f1051b4e773b21e2d3dc0 Mon Sep 17 00:00:00 2001
+From: Even Rouault <even.rouault@spatialys.com>
+Date: Sun, 28 Jun 2020 14:19:59 +0200
+Subject: [PATCH] opj_decompress: fix double-free on input directory with mix
+ of valid and invalid images (CVE-2020-15389)
+
+Fixes #1261
+
+Credits to @Ruia-ruia for reporting and analysis.
+
+[Retrieved from:
+https://github.com/uclouvain/openjpeg/commit/e8e258ab049240c2dd1f1051b4e773b21e2d3dc0]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ src/bin/jp2/opj_decompress.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/src/bin/jp2/opj_decompress.c b/src/bin/jp2/opj_decompress.c
+index 7eeb0952f..2634907f0 100644
+--- a/src/bin/jp2/opj_decompress.c
+++ b/src/bin/jp2/opj_decompress.c
+@@ -1316,10 +1316,6 @@ static opj_image_t* upsample_image_components(opj_image_t* original)
+ int main(int argc, char **argv)
+ {
+     opj_decompress_parameters parameters;           /* decompression parameters */
+-    opj_image_t* image = NULL;
+-    opj_stream_t *l_stream = NULL;              /* Stream */
+-    opj_codec_t* l_codec = NULL;                /* Handle to a decompressor */
+-    opj_codestream_index_t* cstr_index = NULL;
+ 
+     OPJ_INT32 num_images, imageno;
+     img_fol_t img_fol;
+@@ -1393,6 +1389,10 @@ int main(int argc, char **argv)
+ 
+     /*Decoding image one by one*/
+     for (imageno = 0; imageno < num_images ; imageno++)  {
+        opj_image_t* image = NULL;
+        opj_stream_t *l_stream = NULL;              /* Stream */
+        opj_codec_t* l_codec = NULL;                /* Handle to a decompressor */
+        opj_codestream_index_t* cstr_index = NULL;
+ 
+         if (!parameters.quiet) {
+             fprintf(stderr, "\n");
@@ -20,6 +20,9 @@ OPENJPEG_IGNORE_CVES += CVE-2020-6851
 # 0007-opj_tcd_init_tile-avoid-integer-overflow.patch
 OPENJPEG_IGNORE_CVES += CVE-2020-8112

+# 0008-opj_decompress-fix-double-free-on-input-directory-with-mix-of-valid.patch
+OPENJPEG_IGNORE_CVES += CVE-2020-15389
+
 OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_ZLIB),zlib)
 OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_LIBPNG),libpng)
 OPENJPEG_DEPENDENCIES += $(if $(BR2_PACKAGE_TIFF),tiff)
@@ -167,7 +167,7 @@ index 1d9a772..35b4a33 100644
     if (op == rpShrink && !rpath) {
         debug("no RPATH to shrink\n");
         return;
-@@ -1120,26 +1196,86 @@ void ElfFile<ElfFileParamNames>::modifyRPath(RPathOp op, string newRPath)
+@@ -1120,26 +1196,80 @@ void ElfFile<ElfFileParamNames>::modifyRPath(RPathOp op, string newRPath)
                 continue;
             }
 
@@ -250,12 +250,6 @@ index 1d9a772..35b4a33 100644
 +                }
 +            }
 +
-+            if (!libFoundInRPath(canonicalPath, neededLibs, neededLibFound)) {
-+                debug("removing directory '%s' from RPATH because it does not contain needed libs\n",
-+                      dirName.c_str());
-+                continue;
-+            }
-+
 +            /* Finally make "canonicalPath" relative to "filedir" in "rootDir" */
 +            if (relativeToFile)
 +                concatToRPath(newRPath, makePathRelative(canonicalPath, fileDir));
@@ -268,7 +262,7 @@ index 1d9a772..35b4a33 100644
     if (op == rpRemove) {
         if (!rpath) {
             debug("no RPATH to delete\n");
-@@ -1413,7 +1549,9 @@ static bool shrinkRPath = false;
+@@ -1413,7 +1543,9 @@ static bool shrinkRPath = false;
 static bool removeRPath = false;
 static bool setRPath = false;
 static bool printRPath = false;
@@ -278,7 +272,7 @@ index 1d9a772..35b4a33 100644
 static set<string> neededLibsToRemove;
 static map<string, string> neededLibsToReplace;
 static set<string> neededLibsToAdd;
-@@ -1438,14 +1576,16 @@ static void patchElf2(ElfFile & elfFile)
+@@ -1438,14 +1570,16 @@ static void patchElf2(ElfFile & elfFile)
         elfFile.setInterpreter(newInterpreter);
 
     if (printRPath)
@@ -299,7 +293,7 @@ index 1d9a772..35b4a33 100644
 
     if (printNeeded) elfFile.printNeededLibs();
 
-@@ -1508,6 +1648,9 @@ void showHelp(const string & progName)
+@@ -1508,6 +1642,9 @@ void showHelp(const string & progName)
   [--set-rpath RPATH]\n\
   [--remove-rpath]\n\
   [--shrink-rpath]\n\
@@ -309,7 +303,7 @@ index 1d9a772..35b4a33 100644
   [--print-rpath]\n\
   [--force-rpath]\n\
   [--add-needed LIBRARY]\n\
-@@ -1564,6 +1707,17 @@ int main(int argc, char * * argv)
+@@ -1564,6 +1701,17 @@ int main(int argc, char * * argv)
             setRPath = true;
             newRPath = argv[i];
         }
@@ -0,0 +1,170 @@
+From 923ce72409f184bd8e8c61b196260891036ba87e Mon Sep 17 00:00:00 2001
+From: Antony Lee <anntzer.lee@gmail.com>
+Date: Thu, 30 Aug 2018 15:27:55 +0200
+Subject: [PATCH] Simplify version checks for freetype and libpng.
+
+Currently, setupext.py replicates a lot of work done by the compiler to
+check whether header files are present, and whether freetype and libpng
+have sufficiently recent versions.
+
+Instead, we can just add a small stub source file at the top of the
+extension sources which just tries to include the header and checks the
+version macros.  If the header is not found, compilation will
+immediately abort with `foo.h: No such file or directory`; if the
+version is too old, we can emit an appropriate error message (`#pragma
+message` is supported by all major compilers and allows expanding of
+macros in the error message).
+
+[Retrieved from:
+https://github.com/matplotlib/matplotlib/commit/d1060a885309ec7ac19ca912d3011a5eb1673bd5]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ setupext.py              | 83 +++++-----------------------------------
+ src/checkdep_freetype2.c | 13 +++++++
+ src/checkdep_libpng.c    |  5 +++
+ 3 files changed, 28 insertions(+), 73 deletions(-)
+ create mode 100644 src/checkdep_freetype2.c
+ create mode 100644 src/checkdep_libpng.c
+
+diff --git a/setupext.py b/setupext.py
+index d5f4b81f562..a5163e39288 100644
+--- a/setupext.py
+++ b/setupext.py
+@@ -814,6 +814,13 @@ def add_flags(self, ext, add_sources=True):
+                                for x in agg_sources)
+ 
+ 
+# For FreeType2 and libpng, we add a separate checkdep_foo.c source to at the
+# top of the extension sources.  This file is compiled first and immediately
+# aborts the compilation either with "foo.h: No such file or directory" if the
+# header is not found, or an appropriate error message if the header indicates
+# a too-old version.
+
+
+ class FreeType(SetupPackage):
+     name = "freetype"
+     pkg_names = {
+@@ -825,59 +832,8 @@ class FreeType(SetupPackage):
+         "windows_url": "http://gnuwin32.sourceforge.net/packages/freetype.htm"
+         }
+ 
+-    def check(self):
+-        if options.get('local_freetype'):
+-            return "Using local version for testing"
+-
+-        if sys.platform == 'win32':
+-            try:
+-                check_include_file(get_include_dirs(), 'ft2build.h', 'freetype')
+-            except CheckFailed:
+-                check_include_file(get_include_dirs(), os.path.join('freetype2', 'ft2build.h'), 'freetype')
+-            return 'Using unknown version found on system.'
+-
+-        status, output = subprocess.getstatusoutput(
+-            "freetype-config --ftversion")
+-        if status == 0:
+-            version = output
+-        else:
+-            version = None
+-
+-        # Early versions of freetype grep badly inside freetype-config,
+-        # so catch those cases. (tested with 2.5.3).
+-        if version is None or 'No such file or directory\ngrep:' in version:
+-            version = self.version_from_header()
+-
+-        # pkg_config returns the libtool version rather than the
+-        # freetype version so we need to explicitly pass the version
+-        # to _check_for_pkg_config
+-        return self._check_for_pkg_config(
+-            'freetype2', 'ft2build.h',
+-            min_version='2.3', version=version)
+-
+-    def version_from_header(self):
+-        version = 'unknown'
+-        ext = self.get_extension()
+-        if ext is None:
+-            return version
+-        # Return the first version found in the include dirs.
+-        for include_dir in ext.include_dirs:
+-            header_fname = os.path.join(include_dir, 'freetype.h')
+-            if os.path.exists(header_fname):
+-                major, minor, patch = 0, 0, 0
+-                with open(header_fname, 'r') as fh:
+-                    for line in fh:
+-                        if line.startswith('#define FREETYPE_'):
+-                            value = line.rsplit(' ', 1)[1].strip()
+-                            if 'MAJOR' in line:
+-                                major = value
+-                            elif 'MINOR' in line:
+-                                minor = value
+-                            else:
+-                                patch = value
+-                return '.'.join([major, minor, patch])
+-
+     def add_flags(self, ext):
+        ext.sources.insert(0, 'src/checkdep_freetype2.c')
+         if options.get('local_freetype'):
+             src_path = os.path.join(
+                 'build', 'freetype-{0}'.format(LOCAL_FREETYPE_VERSION))
+@@ -1058,30 +1014,11 @@ class Png(SetupPackage):
+         "windows_url": "http://gnuwin32.sourceforge.net/packages/libpng.htm"
+         }
+ 
+-    def check(self):
+-        if sys.platform == 'win32':
+-            check_include_file(get_include_dirs(), 'png.h', 'png')
+-            return 'Using unknown version found on system.'
+-
+-        status, output = subprocess.getstatusoutput("libpng-config --version")
+-        if status == 0:
+-            version = output
+-        else:
+-            version = None
+-
+-        try:
+-            return self._check_for_pkg_config(
+-                'libpng', 'png.h',
+-                min_version='1.2', version=version)
+-        except CheckFailed as e:
+-            if has_include_file(get_include_dirs(), 'png.h'):
+-                return str(e) + ' Using unknown version found on system.'
+-            raise
+-
+     def get_extension(self):
+         sources = [
+            'src/checkdep_libpng.c',
+             'src/_png.cpp',
+-            'src/mplutils.cpp'
+            'src/mplutils.cpp',
+             ]
+         ext = make_extension('matplotlib._png', sources)
+         pkg_config.setup_extension(
+diff --git a/src/checkdep_freetype2.c b/src/checkdep_freetype2.c
+new file mode 100644
+index 00000000000..bf9a8c94e38
+--- /dev/null
+++ b/src/checkdep_freetype2.c
+@@ -0,0 +1,13 @@
+#include <ft2build.h>
+#include FT_FREETYPE_H
+
+#define XSTR(x) STR(x)
+#define STR(x) #x
+
+#pragma message("Compiling with FreeType version " \
+  XSTR(FREETYPE_MAJOR) "." XSTR(FREETYPE_MINOR) "." XSTR(FREETYPE_PATCH) ".")
+#if FREETYPE_MAJOR << 16 + FREETYPE_MINOR << 8 + FREETYPE_PATCH < 0x020300
+    #error "FreeType version 2.3 or higher is required." \
+      "Consider setting the MPLLOCALFREETYPE environment variable to 1."
+  #error
+#endif
+diff --git a/src/checkdep_libpng.c b/src/checkdep_libpng.c
+new file mode 100644
+index 00000000000..5ebe5cbe4d7
+--- /dev/null
+++ b/src/checkdep_libpng.c
+@@ -0,0 +1,5 @@
+#include <png.h>
+#pragma message("Compiling with libpng version " PNG_LIBPNG_VER_STRING ".")
+#if PNG_LIBPNG_VER < 10200
+  #error "libpng version 1.2 or higher is required."
+#endif
@@ -12,13 +12,19 @@ RIPGREP_LICENSE_FILES = LICENSE-MIT
 RIPGREP_DEPENDENCIES = host-rustc
 RIPGREP_CARGO_ENV = CARGO_HOME=$(HOST_DIR)/share/cargo

-RIPGREP_BIN_DIR = target/$(RUSTC_TARGET_NAME)/$(RIPGREP_CARGO_MODE)
+RIPGREP_BIN_DIR = target/$(RUSTC_TARGET_NAME)/$(RIPGREP_CARGO_BIN_SUBDIR)

 RIPGREP_CARGO_OPTS = \
-	$(if $(BR2_ENABLE_DEBUG),,--release) \
 	--target=$(RUSTC_TARGET_NAME) \
 	--manifest-path=$(@D)/Cargo.toml

+ifeq ($(BR2_ENABLE_DEBUG),y)
+RIPGREP_CARGO_BIN_SUBDIR = debug
+else
+RIPGREP_CARGO_OPTS += --release
+RIPGREP_CARGO_BIN_SUBDIR = release
+endif
+
 define RIPGREP_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(RIPGREP_CARGO_ENV) \
 		cargo build $(RIPGREP_CARGO_OPTS)
@@ -1,7 +1,7 @@
 # Locally computed
-sha256 677356a5ed6b5ae9e32a898061db2587158ff27e245db03f4bde9b006ef12dc9 shadowsocks-libev-3.3.3.tar.gz
+sha256  fce47a956fad0c30def9c71821bcec450a40d3f881548e31e66cedf262b89eb1  shadowsocks-libev-3.3.4.tar.gz

 # License files, locally calculated
-sha256 736883f97d44dbec288bb82819f18f4f86d02ae3192f6a9abefa00db76bace41  COPYING
-sha256 c41a4bc2c4c43e4daa3051e77e31b2d5c8500498afaeac6d831d55a4bb8de3fb  libbloom/LICENSE
-sha256 4fa2ada54f8c0410ec243265378242ffe862386d5ac517f8dd30a1911d25ae93  libcork/COPYING
+sha256  736883f97d44dbec288bb82819f18f4f86d02ae3192f6a9abefa00db76bace41  COPYING
+sha256  c41a4bc2c4c43e4daa3051e77e31b2d5c8500498afaeac6d831d55a4bb8de3fb  libbloom/LICENSE
+sha256  4fa2ada54f8c0410ec243265378242ffe862386d5ac517f8dd30a1911d25ae93  libcork/COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-SHADOWSOCKS_LIBEV_VERSION = 3.3.3
+SHADOWSOCKS_LIBEV_VERSION = 3.3.4
 SHADOWSOCKS_LIBEV_SITE = https://github.com/shadowsocks/shadowsocks-libev/releases/download/v$(SHADOWSOCKS_LIBEV_VERSION)
 SHADOWSOCKS_LIBEV_LICENSE = GPL-3.0+, BSD-2-Clause (libbloom), BSD-3-Clause (libcork, libipset)
 SHADOWSOCKS_LIBEV_LICENSE_FILES = COPYING libbloom/LICENSE libcork/COPYING
@@ -3,7 +3,7 @@ config BR2_PACKAGE_SOLARUS
 	depends on BR2_INSTALL_LIBSTDCPP
 	depends on BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # C++11
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # openal
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # openal
 	depends on !BR2_STATIC_LIBS # SDL2
 	depends on BR2_PACKAGE_HAS_LIBGL
@@ -25,9 +25,9 @@ config BR2_PACKAGE_SOLARUS
 	  http://www.solarus-games.org
 	  https://github.com/solarus-games/solarus

-comment "solarus needs OpenGL and a toolchain w/ C++, gcc >= 4.8, NPTL, dynamic library, and luajit or lua 5.1"
+comment "solarus needs OpenGL and a toolchain w/ C++, gcc >= 4.9, NPTL, dynamic library, and luajit or lua 5.1"
 	depends on !BR2_PACKAGE_LUAINTERPRETER_ABI_VERSION_5_1
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS
-	depends on !BR2_INSTALL_LIBSTDCPP || !BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 \
+	depends on !BR2_INSTALL_LIBSTDCPP || !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 \
 		|| !BR2_TOOLCHAIN_HAS_THREADS_NPTL || BR2_STATIC_LIBS \
 		|| !BR2_PACKAGE_HAS_LIBGL
@@ -4,7 +4,7 @@ config BR2_PACKAGE_SUPERTUXKART
 	depends on BR2_i386 || BR2_x86_64
 	depends on BR2_USE_MMU # fork()
 	depends on BR2_INSTALL_LIBSTDCPP # openal
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_7 # openal
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 # openal
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # openal
 	depends on BR2_PACKAGE_OPENAL_ARCH_SUPPORTS # openal
 	depends on BR2_PACKAGE_HAS_LIBGL
@@ -33,7 +33,7 @@ config BR2_PACKAGE_SUPERTUXKART

 	  http://supertuxkart.sourceforge.net/Main_Page

-comment "supertuxkart needs an OpenGL backend, a uClibc or glibc toolchain w/ NPTL, C++, gcc >= 4.7"
+comment "supertuxkart needs an OpenGL backend, a uClibc or glibc toolchain w/ NPTL, C++, gcc >= 4.9"
 	depends on BR2_HOSTARCH = "x86_64" || BR2_HOSTARCH = "x86"
 	depends on BR2_i386 || BR2_x86_64
 	depends on BR2_USE_MMU
@@ -41,6 +41,6 @@ comment "supertuxkart needs an OpenGL backend, a uClibc or glibc toolchain w/ NP
 	depends on BR2_PACKAGE_XORG7
 	depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL \
 		|| !BR2_INSTALL_LIBSTDCPP \
-		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_7 \
+		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_9 \
 		|| !BR2_PACKAGE_HAS_LIBGL \
 		|| BR2_TOOLCHAIN_USES_MUSL
@@ -0,0 +1,90 @@
+From e74dd1d96753b0538192143adf58d04fcd3b242b Mon Sep 17 00:00:00 2001
+From: Matthias Gerstner <mgerstner@suse.de>
+Date: Fri, 14 Aug 2020 22:14:36 -0700
+Subject: [PATCH] Correct multiple security issues that are present if the tcsd
+ is started by root instead of the tss user.
+
+Patch fixes the following 3 CVEs:
+
+CVE-2020-24332
+If the tcsd daemon is started with root privileges,
+the creation of the system.data file is prone to symlink attacks
+
+CVE-2020-24330
+If the tcsd daemon is started with root privileges,
+it fails to drop the root gid after it is no longer needed
+
+CVE-2020-24331
+If the tcsd daemon is started with root privileges,
+the tss user has read and write access to the /etc/tcsd.conf file
+
+Authored-by: Matthias Gerstner <mgerstner@suse.de>
+Signed-off-by: Debora Velarde Babb <debora@linux.ibm.com>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ src/tcs/ps/tcsps.c   |  2 +-
+ src/tcsd/svrside.c   |  1 +
+ src/tcsd/tcsd_conf.c | 10 +++++-----
+ 3 files changed, 7 insertions(+), 6 deletions(-)
+
+diff --git a/src/tcs/ps/tcsps.c b/src/tcs/ps/tcsps.c
+index e47154b..85d45a9 100644
+--- a/src/tcs/ps/tcsps.c
+++ b/src/tcs/ps/tcsps.c
+@@ -72,7 +72,7 @@ get_file()
+ 	}
+ 
+ 	/* open and lock the file */
+-	system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR, 0600);
+	system_ps_fd = open(tcsd_options.system_ps_file, O_CREAT|O_RDWR|O_NOFOLLOW, 0600);
+ 	if (system_ps_fd < 0) {
+ 		LogError("system PS: open() of %s failed: %s",
+ 				tcsd_options.system_ps_file, strerror(errno));
+diff --git a/src/tcsd/svrside.c b/src/tcsd/svrside.c
+index 1ae1636..1c12ff3 100644
+--- a/src/tcsd/svrside.c
+++ b/src/tcsd/svrside.c
+@@ -473,6 +473,7 @@ main(int argc, char **argv)
+ 		}
+ 		return TCSERR(TSS_E_INTERNAL_ERROR);
+ 	}
+	setgid(pwd->pw_gid);
+ 	setuid(pwd->pw_uid);
+ #endif
+ #endif
+diff --git a/src/tcsd/tcsd_conf.c b/src/tcsd/tcsd_conf.c
+index a31503d..ea8ea13 100644
+--- a/src/tcsd/tcsd_conf.c
+++ b/src/tcsd/tcsd_conf.c
+@@ -743,7 +743,7 @@ conf_file_init(struct tcsd_config *conf)
+ #ifndef SOLARIS
+ 	struct group *grp;
+ 	struct passwd *pw;
+-	mode_t mode = (S_IRUSR|S_IWUSR);
+	mode_t mode = (S_IRUSR|S_IWUSR|S_IRGRP);
+ #endif /* SOLARIS */
+ 	TSS_RESULT result;
+ 
+@@ -798,15 +798,15 @@ conf_file_init(struct tcsd_config *conf)
+ 	}
+ 
+ 	/* make sure user/group TSS owns the conf file */
+-	if (pw->pw_uid != stat_buf.st_uid || grp->gr_gid != stat_buf.st_gid) {
+	if (stat_buf.st_uid != 0 || grp->gr_gid != stat_buf.st_gid) {
+ 		LogError("TCSD config file (%s) must be user/group %s/%s", tcsd_config_file,
+-				TSS_USER_NAME, TSS_GROUP_NAME);
+				"root", TSS_GROUP_NAME);
+ 		return TCSERR(TSS_E_INTERNAL_ERROR);
+ 	}
+ 
+-	/* make sure only the tss user can manipulate the config file */
+	/* make sure only the tss user can read (but not manipulate) the config file */
+ 	if (((stat_buf.st_mode & 0777) ^ mode) != 0) {
+-		LogError("TCSD config file (%s) must be mode 0600", tcsd_config_file);
+		LogError("TCSD config file (%s) must be mode 0640", tcsd_config_file);
+ 		return TCSERR(TSS_E_INTERNAL_ERROR);
+ 	}
+ #endif /* SOLARIS */
+-- 
+2.20.1
+
@@ -13,6 +13,9 @@ TROUSERS_INSTALL_STAGING = YES
 TROUSERS_AUTORECONF = YES
 TROUSERS_DEPENDENCIES = host-pkgconf openssl

+# 0003-Correct-multiple-security-issues-that-are-present-if.patch
+TROUSERS_IGNORE_CVES += CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
+
 ifeq ($(BR2_PACKAGE_LIBICONV),y)
 TROUSERS_DEPENDENCIES += libiconv
 endif
@@ -1,6 +1,6 @@
-# From https://lists.x.org/archives/xorg-announce/2020-August/003053.html
-sha256  b1cc4b802058be7e3fb438ee2490f66fcc52ac3b2a14f47a22cbf77638e33606  libX11-1.6.11.tar.bz2
-sha512  2cb4e215c1e3ccb327e02586844f8c426068536a0f472a39f12191feace607f61a6a08586f03758248199678c2f6897a984b0f1222bc0d68fd2e02702f4ce0bf  libX11-1.6.11.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2020-August/003057.html
+sha256  f108227469419ac04d196df0f3b80ce1f7f65059bb54c0de811f4d8e03fd6ec7  libX11-1.6.12.tar.bz2
+sha512  79df7d61d9009b0dd3b65f67a62189aa0a43799c01026b3d2d534092596a0b67f246af5e398a89eb1ccc61a27335f81be8262b8a39768a76f62d862cd7415a47  libX11-1.6.12.tar.bz2

 # Locally computed
 sha256  2daec087a88e7c9b8082557cdeebad5bbb8155a4137472f0b22e269cd99d0c1e  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-XLIB_LIBX11_VERSION = 1.6.11
+XLIB_LIBX11_VERSION = 1.6.12
 XLIB_LIBX11_SOURCE = libX11-$(XLIB_LIBX11_VERSION).tar.bz2
 XLIB_LIBX11_SITE = https://xorg.freedesktop.org/archive/individual/lib
 XLIB_LIBX11_LICENSE = MIT
@@ -1,66 +0,0 @@
-Discover monotonic clock using compile-time check
-
-monotonic clock check does not work when cross-compiling.
-
-Upstream-Status: Denied [Does not work on OpenBSD]
-Signed-off-by: Jussi Kukkonen <jussi.kukkonen@intel.com>
-
-
-
-Original patch follows:
-
-When xorg-xserver is being cross-compiled, there is currently no way
-for us to detect whether the monotonic clock is available on the
-target system, because we aren't able to run a test program on the host
-system. Currently, in this situation, we default to not use the
-monotonic clock. One problem with this situation is that the user will
-be treated as idle when the date is updated.
-
-To fix this situation, we now use a compile-time check to detect whether the
-monotonic clock is available. This check can run just fine when we are
-cross-compiling.
-
-Signed-off-by: David James <davidjames at google.com>
-
-Downloaded from
-https://github.com/openembedded/openembedded-core/blob/master/meta/recipes-graphics/xorg-xserver/xserver-xorg/0001-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch
-
-Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
---
- configure.ac | 17 +++++++----------
- 1 file changed, 7 insertions(+), 10 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index f7ab48c..26e85cd 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -1048,19 +1048,16 @@ if ! test "x$have_clock_gettime" = xno; then
-         CPPFLAGS="$CPPFLAGS -D_POSIX_C_SOURCE=200112L"
-     fi
- 
-    AC_RUN_IFELSE([AC_LANG_SOURCE([
-+    AC_COMPILE_IFELSE([AC_LANG_SOURCE([[
- #include <time.h>
-
-int main(int argc, char *argv[[]]) {
-    struct timespec tp;
-
-    if (clock_gettime(CLOCK_MONOTONIC, &tp) == 0)
-+#include <unistd.h>
-+int main() {
-+#if !(defined(_POSIX_MONOTONIC_CLOCK) && _POSIX_MONOTONIC_CLOCK >= 0 && defined(CLOCK_MONOTONIC))
-+        #error No monotonic clock
-+#endif
-         return 0;
-    else
-        return 1;
- }
-    ])], [MONOTONIC_CLOCK=yes], [MONOTONIC_CLOCK=no],
-       [MONOTONIC_CLOCK="cross compiling"])
-+]])],[MONOTONIC_CLOCK=yes], [MONOTONIC_CLOCK=no])
- 
-     LIBS="$LIBS_SAVE"
-     CPPFLAGS="$CPPFLAGS_SAVE"
-- 
-2.1.4
-
@@ -1,36 +0,0 @@
-From aac28e162e5108510065ad4c323affd6deffd816 Mon Sep 17 00:00:00 2001
-From: Matthieu Herrb <matthieu@herrb.eu>
-Date: Sat, 25 Jul 2020 19:33:50 +0200
-Subject: [PATCH] fix for ZDI-11426
-
-Avoid leaking un-initalized memory to clients by zeroing the
-whole pixmap on initial allocation.
-
-This vulnerability was discovered by:
-Jan-Niklas Sohn working with Trend Micro Zero Day Initiative
-
-Signed-off-by: Matthieu Herrb <matthieu@herrb.eu>
-Reviewed-by: Alan Coopersmith <alan.coopersmith@oracle.com>
-Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
-[downloaded from upstream commit
- https://gitlab.freedesktop.org/xorg/xserver/-/commit/aac28e162e5108510065ad4c323affd6deffd816]
---
- dix/pixmap.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/dix/pixmap.c b/dix/pixmap.c
-index 1186d7dbbf..5a0146bbb6 100644
--- a/dix/pixmap.c
-+++ b/dix/pixmap.c
-@@ -116,7 +116,7 @@ AllocatePixmap(ScreenPtr pScreen, int pixDataSize)
-     if (pScreen->totalPixmapSize > ((size_t) - 1) - pixDataSize)
-         return NullPixmap;
- 
-    pPixmap = malloc(pScreen->totalPixmapSize + pixDataSize);
-+    pPixmap = calloc(1, pScreen->totalPixmapSize + pixDataSize);
-     if (!pPixmap)
-         return NullPixmap;
- 
-- 
-GitLab
-
@@ -9,7 +9,7 @@ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
 diff -uNr xorg-server-1.17.2.org/configure.ac xorg-server-1.17.2/configure.ac
 --- xorg-server-1.17.2.org/configure.ac	2015-06-16 17:42:40.000000000 +0200
 +++ xorg-server-1.17.2/configure.ac	2015-08-08 10:44:59.702382624 +0200
-@@ -2036,7 +2036,7 @@
+@@ -1962,7 +1962,7 @@
 	        XORG_SYS_LIBS="$XORG_SYS_LIBS $XORG_MODULES_LIBS"
 	fi
 
@@ -38,7 +38,7 @@ index 884a71c..be76498 100644
     for (i = 0; i < MAX_FUNCS; i++) {
         if (!xf86SigIOFuncs[i].f) {
             if (xf86IsPipe(fd))
-@@ -256,9 +253,6 @@ xf86RemoveSIGIOHandler(int fd)
+@@ -257,9 +256,6 @@ xf86RemoveSIGIOHandler(int fd)
     int max;
     int ret;
 
@@ -32,8 +32,8 @@ diff --git a/hw/xfree86/common/xf86Init.c b/hw/xfree86/common/xf86Init.c
 index 0631c7237..e6fb11398 100644
 --- a/hw/xfree86/common/xf86Init.c
 +++ b/hw/xfree86/common/xf86Init.c
-@@ -74,7 +74,6 @@
- #include "xf86Crtc.h"
+@@ -78,7 +78,6 @@
+ #include "xf86InPriv.h"
 #include "picturestr.h"
 #include "randrstr.h"
 -#include "glxvndabi.h"
@@ -61,7 +61,7 @@ choice
 	bool "X Window System server version"

 config BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_20
-	bool "1.20.8"
+	bool "1.20.9"
 	select BR2_PACKAGE_XSERVER_XORG_SERVER_VIDEODRV_ABI_24
 	select BR2_PACKAGE_XLIB_LIBXFONT2

@@ -79,7 +79,7 @@ endchoice

 config BR2_PACKAGE_XSERVER_XORG_SERVER_VERSION
 	string
-	default "1.20.8" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_20
+	default "1.20.9" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_20
 	default "1.17.4" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_17
 	default "1.14.7" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_14

@@ -1,11 +1,11 @@
 # From http://lists.x.org/archives/xorg-announce/2014-June/002440.html
-sha1   7a95765e56b124758fcd7b609589e65b8870880b                                xorg-server-1.14.7.tar.bz2
-sha256 fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f        xorg-server-1.14.7.tar.bz2
+sha1  7a95765e56b124758fcd7b609589e65b8870880b  xorg-server-1.14.7.tar.bz2
+sha256  fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f  xorg-server-1.14.7.tar.bz2
 # From https://lists.x.org/archives/xorg-announce/2015-October/002650.html
-sha256 0c4b45c116a812a996eb432d8508cf26c2ec8c3916ff2a50781796882f8d6457        xorg-server-1.17.4.tar.bz2
-# From https://lists.x.org/archives/xorg-announce/2020-March/003041.html
-sha256 d17b646bee4ba0fb7850c1cc55b18e3e8513ed5c02bdf38da7e107f84e2d0146  xorg-server-1.20.8.tar.bz2
-sha512 ab0ec0fcbf490c61558b9297f61b58fd2dedb676c78bef6431dc9166054743b43a0091b88a8b3f4e81d1f539909440ee7e188a298cefabe13ea89159639cd805  xorg-server-1.20.8.tar.bz2
+sha256  0c4b45c116a812a996eb432d8508cf26c2ec8c3916ff2a50781796882f8d6457  xorg-server-1.17.4.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2020-August/003059.html
+sha256  e219f2e0dfe455467939149d7cd2ee53b79b512cc1d2094ae4f5c9ed9ccd3571  xorg-server-1.20.9.tar.bz2
+sha512  d9b5f93e1b9763a89187d8b272aa7d4ce9709641b8539f4536708af153310e5a4931bffd4229c51a3b0e3b12da7838750aa71b635751fb4c0bb27438cce4e5e6  xorg-server-1.20.9.tar.bz2

 # Locally calculated
-sha256 4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f  COPYING
+sha256  4cc0447a22635c7b2f1a93fec4aa94f1970fadeb72a063de006b51cf4963a06f  COPYING
@@ -38,11 +38,6 @@ XSERVER_XORG_SERVER_DEPENDENCIES = \
 	mcookie \
 	host-pkgconf

-ifeq ($(BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_20),y)
-# 1.20.8/0007-fix-for-ZDI-11426.patch
-XSERVER_XORG_SERVER_IGNORE_CVES += CVE-2020-14347
-endif
-
 # We force -O2 regardless of the optimization level chosen by the
 # user, as the X.org server is known to trigger some compiler bugs at
 # -Os on several architectures.
@@ -0,0 +1,15 @@
+BR2_x86_64=y
+BR2_x86_corei7=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_CUSTOM=y
+BR2_TOOLCHAIN_EXTERNAL_DOWNLOAD=y
+BR2_TOOLCHAIN_EXTERNAL_URL="http://toolchains.bootlin.com/downloads/releases/toolchains/x86-64-core-i7/tarballs/x86-64-core-i7--glibc--bleeding-edge-2020.02-2.tar.bz2"
+BR2_TOOLCHAIN_EXTERNAL_GCC_9=y
+BR2_TOOLCHAIN_EXTERNAL_HEADERS_4_19=y
+# BR2_TOOLCHAIN_EXTERNAL_LOCALE is not set
+BR2_TOOLCHAIN_EXTERNAL_CXX=y
+BR2_TOOLCHAIN_EXTERNAL_HAS_SSP=y
+BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_DEBUG=y
+BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS=y
+BR2_TOOLCHAIN_EXTERNAL_HAS_THREADS_NPTL=y
+BR2_TOOLCHAIN_EXTERNAL_CUSTOM_GLIBC=y
@@ -1,4 +0,0 @@
-BR2_x86_64=y
-BR2_x86_steamroller=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64=y
@@ -24,6 +24,7 @@ support/config-fragments/autobuild/sourcery-arm.config,x86
 # Toolchains used by test-pkg only when the '-a' option is passed:
 support/config-fragments/autobuild/andes-nds32.config,x86
 support/config-fragments/autobuild/arm-aarch64.config,x86_64
+support/config-fragments/autobuild/bootlin-x86-64-glibc.config,x86_64
 support/config-fragments/autobuild/br-aarch64-glibc.config,x86_64
 support/config-fragments/autobuild/br-arc-full-internal.config,any
 support/config-fragments/autobuild/br-arc-internal-glibc.config,any
@@ -69,4 +70,3 @@ support/config-fragments/autobuild/sourcery-arm-thumb2.config,x86
 support/config-fragments/autobuild/sourcery-mips64.config,x86
 support/config-fragments/autobuild/sourcery-mips.config,x86
 support/config-fragments/autobuild/sourcery-nios2.config,x86
-support/config-fragments/autobuild/sourcery-x86-64.config,x86
@@ -383,7 +383,6 @@ class CVE:
                        continue
                    try:
                        affected = pkg_version <= cve_affected_version
-                        break
                    except TypeError:
                        return CVE_UNKNOWN
                    if affected:
@@ -42,9 +42,6 @@ source "toolchain/toolchain-external/toolchain-external-codescape-mti-mips/Confi
 # NIOSII
 source "toolchain/toolchain-external/toolchain-external-codesourcery-niosII/Config.in"

-# x86_64
-source "toolchain/toolchain-external/toolchain-external-codesourcery-amd64/Config.in"
-
 # Kept last, so it remains the non-default choice, unless there isn't
 # any available toolchain profile for the currently selected
 # architecture, but before toolchains from br2-external trees.
@@ -149,9 +146,6 @@ source "toolchain/toolchain-external/toolchain-external-codescape-mti-mips/Confi
 # NIOSII
 source "toolchain/toolchain-external/toolchain-external-codesourcery-niosII/Config.in.options"

-# x86_64
-source "toolchain/toolchain-external/toolchain-external-codesourcery-amd64/Config.in.options"
-
 # Custom toolchains
 source "toolchain/toolchain-external/toolchain-external-custom/Config.in.options"

@@ -1,28 +0,0 @@
-config BR2_TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64
-	bool "Sourcery CodeBench AMD64 2016.11"
-	depends on BR2_x86_64
-	depends on !BR2_ARCH_NEEDS_GCC_AT_LEAST_7
-	depends on BR2_HOSTARCH = "x86_64" || BR2_HOSTARCH = "x86"
-	depends on !BR2_STATIC_LIBS
-	depends on BR2_x86_jaguar || BR2_x86_steamroller
-	select BR2_TOOLCHAIN_EXTERNAL_GLIBC
-	select BR2_TOOLCHAIN_HAS_SSP
-	select BR2_TOOLCHAIN_HAS_NATIVE_RPC
-	select BR2_TOOLCHAIN_HAS_OPENMP
-	select BR2_INSTALL_LIBSTDCPP
-	select BR2_HOSTARCH_NEEDS_IA32_LIBS
-	select BR2_TOOLCHAIN_HEADERS_AT_LEAST_4_7
-	select BR2_TOOLCHAIN_GCC_AT_LEAST_6
-	select BR2_TOOLCHAIN_HAS_BINUTILS_BUG_19615 # based-on binutils-2.26
-	select BR2_TOOLCHAIN_HAS_BINUTILS_BUG_20006 # based-on binutils-2.26
-	help
-	  Sourcery CodeBench toolchain for the amd64 (x86_64)
-	  architectures, from Mentor Graphics. It uses gcc 6.2,
-	  binutils 2.26, glibc 2.24, gdb 7.11 and kernel headers
-	  4.7. It has support for the following variants:
-	    - AMD Puma/Jaguar (family 16h), glibc
-	    Default for x86_64, nothing special to do.
-	    - AMD Steamroller (family 15h), glibc
-	    Select a steamroller core.
-	  No other architecture variants are supported since glibc
-	  is optimized for one of these two baselines.
@@ -1,9 +0,0 @@
-if BR2_TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64
-
-config BR2_TOOLCHAIN_EXTERNAL_PREFIX
-	default "x86_64-amd-linux-gnu"
-
-config BR2_PACKAGE_PROVIDES_TOOLCHAIN_EXTERNAL
-	default "toolchain-external-codesourcery-amd64"
-
-endif
@@ -1,3 +0,0 @@
-# Locally calculated
-sha256 a6c23837dd45a33866c60a2fd8d7af40520cd84ff1059abda797952d7ee0fafd  amd-2016.11-19-x86_64-amd-linux-gnu-i686-pc-linux-gnu.tar.bz2
-sha256 d61ce0b5648ad63cca16fe233c82e7eaa6a3212a549d69a527e7a2d5350f7b4a  amd-2016.11-19-x86_64-amd-linux-gnu.src.tar.bz2
@@ -1,12 +0,0 @@
-################################################################################
-#
-# toolchain-external-codesourcery-amd64
-#
-################################################################################
-
-TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_SITE = https://sourcery.mentor.com/public/gnu_toolchain/$(TOOLCHAIN_EXTERNAL_PREFIX)
-TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_VERSION = 2016.11-19
-TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_SOURCE = amd-$(TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_VERSION)-$(TOOLCHAIN_EXTERNAL_PREFIX)-i686-pc-linux-gnu.tar.bz2
-TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_ACTUAL_SOURCE_TARBALL = amd-$(TOOLCHAIN_EXTERNAL_CODESOURCERY_AMD64_VERSION)-$(TOOLCHAIN_EXTERNAL_PREFIX).src.tar.bz2
-
-$(eval $(toolchain-external-package))