Update for 2024.02.8

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Revert "package/libpng: bump version to 1.6.44"
2024-11-14 17:25:26 +01:00 · 2024-11-14 16:55:19 +01:00 · 2024-11-14 16:51:22 +01:00 · 2024-11-13 17:26:22 +01:00 · 2024-11-13 17:17:15 +01:00 · 2024-11-13 17:16:27 +01:00
80 changed files with 1108 additions and 158 deletions
@@ -889,8 +889,7 @@ package/norm/0001-protolib-drop-linux-version-check.patch Upstream
 package/norm/0002-Use-print-as-function-call-for-Python3-compatibility.patch Upstream
 package/norm/0003-Fix-mixed-tabs-spaces-in-protolib-wscript.patch Upstream
 package/nss-pam-ldapd/S45nslcd EmptyLastLine Indent Shellcheck Variables
-package/ntp/0001-nano.patch Upstream
-package/ntp/0002-ntp-syscalls-fallback.patch Upstream
+package/ntp/0001-ntp-syscalls-fallback.patch Upstream
 package/ntp/S49ntp.in Variables
 package/ntpsec/0001-wscript-remove-checks-for-bsd-string.h-fixes-host-co.patch Upstream
 package/numactl/0001-link-with-latomic-if-needed-again.patch Upstream
@@ -1,3 +1,16 @@
+2024.02.8, released November 14th, 2024
+
+	Important / security related fixes.
+
+	Updated/fixed packages: apache, asterisk, bind, bootgen, criu,
+	file, fluidsynth, ghostscript, heimdal, intel-microcode,
+	jailhouse, jsoncpp, libarchive, libcurl, libldns, liblinear,
+	libmdbx, libopenh264, ltrace, lightning, nghttp2, ntp, php,
+	postgresql, procps-ng, python-pyqt5, ruby, sysvinit, tor,
+	wpebackend-fdo
+
+	New packages: python-pyqt5-sip
+
 2024.02.7, released October 21th, 2024

 	Important / security related fixes.
@@ -224,11 +224,6 @@ F:	package/sysdig/
 N:	Andy Shevchenko <andy.shevchenko@gmail.com>
 F:	package/fb-test-app/

-N:	Anisse Astier <anisse@astier.eu>
-F:	package/go/
-F:	package/nghttp2/
-F:	package/pkg-golang.mk
-
 N:	Anthony Viallard <viallard@syscom-instruments.com>
 F:	package/gnuplot/

@@ -401,7 +396,6 @@ F:	package/libfreeglut/
 F:	package/libfribidi/
 F:	package/libg7221/
 F:	package/libglew/
-F:	package/libglfw/
 F:	package/libglu/
 F:	package/libhdhomerun/
 F:	package/libheif/
@@ -881,18 +875,6 @@ N:	Eric Limpens <limpens@gmail.com>
 F:	package/pifmrds/
 F:	package/ympd/

-N:	Erico Nunes <nunes.erico@gmail.com>
-F:	board/aarch64-efi/
-F:	configs/aarch64_efi_defconfig
-F:	package/acpica/
-F:	package/acpitool/
-F:	package/efibootmgr/
-F:	package/efivar/
-F:	package/fwts/
-F:	package/spi-tools/
-F:	package/xdotool/
-F:	configs/pc_x86_64_*
-
 N:	Erik Larsson <karl.erik.larsson@gmail.com>
 F:	package/imx-mkimage/

@@ -1812,6 +1794,7 @@ F:	support/testing/tests/package/test_iperf.py
 F:	support/testing/tests/package/test_iperf3.py
 F:	support/testing/tests/package/test_iproute2.py
 F:	support/testing/tests/package/test_iptables.py
+F:	support/testing/tests/package/test_iputils.py
 F:	support/testing/tests/package/test_jailhouse.py
 F:	support/testing/tests/package/test_jq.py
 F:	support/testing/tests/package/test_jq/
@@ -1876,6 +1859,8 @@ F:	support/testing/tests/package/test_python_magic_wormhole.py
 F:	support/testing/tests/package/test_python_midiutil.py
 F:	support/testing/tests/package/test_python_ml_dtypes.py
 F:	support/testing/tests/package/test_python_pyalsa.py
+F:	support/testing/tests/package/test_python_pyqt5.py
+F:	support/testing/tests/package/test_python_pyqt5/
 F:	support/testing/tests/package/test_python_spake2.py
 F:	support/testing/tests/package/test_rdma_core.py
 F:	support/testing/tests/package/test_rdma_core/
@@ -1893,6 +1878,8 @@ F:	support/testing/tests/package/test_tesseract_ocr.py
 F:	support/testing/tests/package/test_thttpd.py
 F:	support/testing/tests/package/test_trace_cmd.py
 F:	support/testing/tests/package/test_trace_cmd/
+F:	support/testing/tests/package/test_unbound.py
+F:	support/testing/tests/package/test_unbound/
 F:	support/testing/tests/package/test_usbutils.py
 F:	support/testing/tests/package/test_usbutils/
 F:	support/testing/tests/package/test_weston.py
@@ -2622,6 +2609,9 @@ F:	package/gupnp-av/
 F:	package/let-me-create/
 F:	package/nanomsg/

+N:	Ralf Dragon <hypnotoad@lindra.de>
+F:	package/python-pyqt5-sip/
+
 N:	Ramon Fried <rfried.dev@gmail.com>
 F:	package/bitwise/

@@ -90,9 +90,9 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2024.02.7
+export BR2_VERSION := 2024.02.8
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1729494000
+BR2_VERSION_EPOCH = 1731601000

 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -3,7 +3,7 @@ config BR2_TARGET_UBOOT
 	help
 	  Build "Das U-Boot" Boot Monitor

-	  https://www.denx.de/wiki/U-Boot
+	  https://docs.u-boot.org/en/latest/

 if BR2_TARGET_UBOOT
 choice
@@ -64,6 +64,19 @@ The tool can also be used for packages in a br2-external:
 $ check-package -b /path/to/br2-ext-tree/package/my-package/*
 ----

+The +check-package+ script requires you install +shellcheck+ and the
+Python PyPi packages +flake8+ and +python-magic+. The Buildroot code
+base is currently tested against version 0.7.1 of ShellCheck. If you
+use a different version of ShellCheck, you may see additional,
+unfixed, warnings.
+
+If you have Docker or Podman you can run +check-package+ without
+installing dependencies:
+
+----
+$ ./utils/docker-run ./utils/check-package
+----
+
 [[testing-package]]
 ==== How to test your package

@@ -53,7 +53,7 @@
 		    page</a>.  Only subscribers to the Buildroot
 		    mailing list are allowed to post to this
 		    list. Archives are available
-		    from <a href="/lists/buildroot/">Mailman</a>
+		    from <a href="https://lists.buildroot.org/pipermail/buildroot/">Mailman</a>
 		    and <a href="https://lore.kernel.org/buildroot/">lore.kernel.org</a>.

 		  <h4>Search the List Archives</h4>
@@ -128,7 +128,7 @@ endif

 config BR2_LINUX_KERNEL_VERSION
 	string
-	default "6.6.51" if BR2_LINUX_KERNEL_LATEST_VERSION
+	default "6.6.58" if BR2_LINUX_KERNEL_LATEST_VERSION
 	default "5.10.162-cip24" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
 	default "5.10.162-cip24-rt10" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
@@ -1,9 +1,9 @@
 # From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
-sha256  1c0c9a14650879c4913efdbac428ba31a540c3d987155ddf34d33e11eca008b3  linux-6.6.51.tar.xz
-sha256  9ebe34b4742f8c9104678f32a6bc20e91299ebac2ae607ff2ed137d928df8f6a  linux-6.1.110.tar.xz
+sha256  e7df81e588d70fab5ec3ec3bb04ac53d51f0860fc3b1ec45e0a4167a026899db  linux-6.6.58.tar.xz
+sha256  2286e4a02ea2fbe65023dbf779f20aa994ba2b8d37ed559049378089451aa256  linux-6.1.114.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-sha256  b1751f18ece3df08d502dd87a9ab1a317dc0f9486355bf8ee62ba6af0b35da30  linux-5.15.167.tar.xz
-sha256  f6a19a64785965b9fcac0bcb6fd2412b45ca449495bb03592d46f9a50be51ca6  linux-5.10.226.tar.xz
+sha256  e618c6d845fd1bc89477508e8d084bbe791fc88bf7623adee2deb6ecb2275370  linux-5.15.169.tar.xz
+sha256  76cc8d7f1528f87902e38697229661d0617a7d6ab86166be9f3ef9a613b17b72  linux-5.10.228.tar.xz
 sha256  77221ab9aebeac746915c755ec3b7d320f85cd219c63d9c501820fbca1e3b32b  linux-5.4.284.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
 sha256  4e27cdf999359876a0ff489bff6ece7ba5798ff37c2289db0c9e9422a9014162  linux-4.19.322.tar.xz
@@ -641,6 +641,10 @@ $(error No kernel device tree source specified, check your \
 	BR2_LINUX_KERNEL_INTREE_DTS_NAME / BR2_LINUX_KERNEL_CUSTOM_DTS_PATH settings)
 endif

+ifeq ($(BR2_LINUX_KERNEL_IMAGE_TARGET_CUSTOM):$(call qstrip,$(BR2_LINUX_KERNEL_IMAGE_TARGET_NAME)),y:)
+$(error No image name specified in BR2_LINUX_KERNEL_IMAGE_TARGET_NAME despite BR2_LINUX_KERNEL_IMAGE_TARGET_CUSTOM=y)
+endif
+
 endif # BR_BUILDING

 $(eval $(kconfig-package))
@@ -1279,6 +1279,7 @@ menu "External python modules"
 	source "package/python-pypng/Config.in"
 	source "package/python-pyqrcode/Config.in"
 	source "package/python-pyqt5/Config.in"
+	source "package/python-pyqt5-sip/Config.in"
 	source "package/python-pyratemp/Config.in"
 	source "package/python-pyroute2/Config.in"
 	source "package/python-pyrsistent/Config.in"
@@ -0,0 +1,40 @@
+From f7a85d0d2b76db75dc976e8dfa1101c954ea1a74 Mon Sep 17 00:00:00 2001
+From: Bernd Kuhls <bernd@kuhls.net>
+Date: Mon, 28 Oct 2024 23:13:05 +0100
+Subject: [PATCH] ap_log_error: Include ap_config_auto.h to define
+ _GNU_SOURCE
+
+gettid() needs _GNU_SOURCE defined which is provided by ap_config_auto.h
+
+Fixes buildroot error:
+http://autobuild.buildroot.net/results/2f6/2f6b7bbb4c97e4c91b3abd6bb205e237e57045fa//build-end.log
+
+log.c: In function 'log_tid':
+log.c:637:21: error: implicit declaration of function 'gettid'; did you mean 'getgid'? [-Wimplicit-function-declaration]
+  637 |         pid_t tid = gettid();
+
+Upstream: https://github.com/apache/httpd/pull/496
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ server/log.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/server/log.c b/server/log.c
+index 91dcf2c3eb..e709288858 100644
+--- a/server/log.c
+++ b/server/log.c
+@@ -21,6 +21,10 @@
+  *
+  */
+ 
+#if !defined(WIN32) && !defined(NETWARE)
+#include "ap_config_auto.h"
+#endif
+
+ #include "apr.h"
+ #include "apr_general.h"        /* for signal stuff */
+ #include "apr_strings.h"
+-- 
+2.39.5
+
@@ -1,5 +1,5 @@
 # Locally computed
-sha256  a15099a5c776045e96b0da2534606c8dbd13bc1ffcbe325f7cfd74dc1d29decb  asterisk-20.9.3.tar.gz
+sha256  a8162085b7d16f10d5cd16fc2e2cb8399dbe42bd1c321b14eec229fc0ed12570  asterisk-20.10.0.tar.gz

 # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases
 # sha256 locally computed
@@ -4,7 +4,7 @@
 #
 ################################################################################

-ASTERISK_VERSION = 20.9.3
+ASTERISK_VERSION = 20.10.0
 # Use the github mirror: it's an official mirror maintained by Digium, and
 # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
 ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
@@ -1,4 +1,4 @@
-# Verified from https://ftp.isc.org/isc/bind9/9.18.28/bind-9.18.28.tar.xz.asc
+# Verified from https://ftp.isc.org/isc/bind9/9.18.31/bind-9.18.31.tar.xz.asc
 # with key 706B6C28620E76F91D11F7DF510A642A06C52CEC
-sha256  e7cce9a165f7b619eefc4832f0a8dc16b005d29e3890aed6008c506ea286a5e7  bind-9.18.28.tar.xz
+sha256  51b258969275c5206ef745a5aac03dbe98f1c8031fefed378d53597e7987b1b3  bind-9.18.31.tar.xz
 sha256  9734825d67a3ac967b2c2f7c9a83c9e5db1c2474dbe9599157c3a4188749ebd4  COPYRIGHT
@@ -4,7 +4,7 @@
 #
 ################################################################################

-BIND_VERSION = 9.18.28
+BIND_VERSION = 9.18.31
 BIND_SOURCE= bind-$(BIND_VERSION).tar.xz
 BIND_SITE = https://ftp.isc.org/isc/bind9/$(BIND_VERSION)
 # bind does not support parallel builds.
@@ -33,6 +33,7 @@ BIND_CONF_OPTS = \
 	--enable-epoll \
 	--disable-doh \
 	--disable-backtrace \
+	--disable-static \
 	--with-openssl=$(STAGING_DIR)/usr

 BIND_DEPENDENCIES = host-pkgconf libuv openssl
@@ -0,0 +1,50 @@
+From f7825edbd1c85380cfb5ef0cf2c16c910954f57c Mon Sep 17 00:00:00 2001
+From: Charlie Johnston <charlie.johnston@loftorbital.com>
+Date: Mon, 5 Aug 2024 13:07:25 -0700
+Subject: [PATCH] verifyimage: Fix segmentation fault that occurs during
+ verifyimage.
+
+In commit d02322b, the behavior of ReadBinaryFile was changed such
+that it no longer populated iHT. This caused VerifyAuthentication
+to access a null iHT value resulting a segmentation fault.
+
+This fix changes VerifyAuthentication to call ReadHeaderTableDetails
+instead, where the old functionality of ReadBinaryFile now lives.
+
+Signed-off-by: Charlie Johnston <charlie.johnston@loftorbital.com>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+Upstream: https://github.com/Xilinx/bootgen/pull/36
+---
+ verifyimage-versal.cpp | 2 +-
+ verifyimage-zynqmp.cpp | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/verifyimage-versal.cpp b/verifyimage-versal.cpp
+index 5490663..5656e50 100755
+--- a/verifyimage-versal.cpp
+++ b/verifyimage-versal.cpp
+@@ -34,7 +34,7 @@
+ /*******************************************************************************/
+ void VersalReadImage::VerifyAuthentication(bool verifyImageOption)
+ {
+-    ReadBinaryFile();
+    ReadHeaderTableDetails();
+ 
+     if (iHT->headerAuthCertificateWordOffset != 0)
+     {
+diff --git a/verifyimage-zynqmp.cpp b/verifyimage-zynqmp.cpp
+index d4812e6..d73272c 100755
+--- a/verifyimage-zynqmp.cpp
+++ b/verifyimage-zynqmp.cpp
+@@ -50,7 +50,7 @@ static void RearrangeEndianess(uint8_t *array, uint32_t size)
+ /*******************************************************************************/
+ void ZynqMpReadImage::VerifyAuthentication(bool verifyImageOption)
+ {
+-    ReadBinaryFile();
+    ReadHeaderTableDetails();
+ 
+     if (iHT->headerAuthCertificateWordOffset != 0)
+     {
+-- 
+2.39.5
+
@@ -50,4 +50,4 @@ comment "criu needs a glibc or musl toolchain w/ threads, host gcc >= 7, gcc >=
 		|| !BR2_TOOLCHAIN_HEADERS_AT_LEAST_4_18 \
 		|| BR2_TOOLCHAIN_USES_UCLIBC || !BR2_INSTALL_LIBSTDCPP \
 		|| BR2_STATIC_LIBS || !BR2_USE_WCHAR \
-		|| BR2_HOST_GCC_AT_LEAST_7
+		|| !BR2_HOST_GCC_AT_LEAST_7
@@ -0,0 +1,32 @@
+From 8c13923a8e17a02be0989649b2edc20124816729 Mon Sep 17 00:00:00 2001
+From: Mike Gilbert <floppym@gentoo.org>
+Date: Tue, 15 Jun 2021 16:08:22 -0400
+Subject: [PATCH] seccomp: undef fstatat64 to avoid build failure on musl
+
+sys/stat.h in musl does this:
+
+  #define fstatat64 fstatat
+
+Counteract this with an #undef.
+
+Bug: https://bugs.gentoo.org/789336
+Bug: https://bugs.astron.com/view.php?id=473
+Signed-off-by: Mike Gilbert <floppym@gentoo.org>
+Signed-off-by: Waldemar Brodkorb <wbx@openadk.org>
+Upstream: N/A under discussion
+---
+ src/seccomp.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/seccomp.c b/src/seccomp.c
+index 5a39ee45..d2a1139a 100644
+--- a/src/seccomp.c
+++ b/src/seccomp.c
+@@ -205,6 +205,7 @@ enable_sandbox_full(void)
+ #endif
+  	ALLOW_RULE(fstat64);
+ #ifdef __NR_fstatat64
+#undef fstatat64
+ 	ALLOW_RULE(fstatat64);
+ #endif
+ 	ALLOW_RULE(futex);
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  3340d73286b28fe6e5150fbe12648d4640e86c64c228878b572773bd08cac531  fluidsynth-2.3.6.tar.gz
+sha256  38d1d910783ab67c07a4d859d1aa95525979ff352b927e25b1ae894c774bb4c4  fluidsynth-2.3.7.tar.gz
 sha256  9b872a8a070b8ad329c4bd380fb1bf0000f564c75023ec8e1e6803f15364b9e9  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-FLUIDSYNTH_VERSION = 2.3.6
+FLUIDSYNTH_VERSION = 2.3.7
 FLUIDSYNTH_SITE = $(call github,FluidSynth,fluidsynth,v$(FLUIDSYNTH_VERSION))
 FLUIDSYNTH_LICENSE = LGPL-2.1+
 FLUIDSYNTH_LICENSE_FILES = LICENSE
@@ -1,5 +1,5 @@
-# From https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs10031/SHA512SUMS
-sha512  59e071cd23aed246b51317d3cccd9ccf8e1e84c4ecf9b22fb938e561eff42cec61915b0bdd96a313a3ea27750579c54ca0d0862b65edd306a621731c0063ffd3  ghostscript-10.03.1.tar.xz
+# From https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs10040/SHA512SUMS
+sha512  2e711f8ba86491570684f13851190f41e6eee87dcfacce0a4adfd09a4523abf2e0b6727f0958ee2683834218f5705675b531fd2419cb7fc314ed4becf51f3ce3  ghostscript-10.04.0.tar.xz

 # Hash for license file:
 sha256  8ce064f423b7c24a011b6ebf9431b8bf9861a5255e47c84bfb23fc526d030a8b  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-GHOSTSCRIPT_VERSION = 10.03.1
+GHOSTSCRIPT_VERSION = 10.04.0
 GHOSTSCRIPT_SOURCE = ghostscript-$(GHOSTSCRIPT_VERSION).tar.xz
 GHOSTSCRIPT_SITE = https://github.com/ArtifexSoftware/ghostpdl-downloads/releases/download/gs$(subst .,,$(GHOSTSCRIPT_VERSION))
 GHOSTSCRIPT_LICENSE = AGPL-3.0
@@ -0,0 +1,27 @@
+From 1b57b62d82a478c1fade350f0fb1d57031a8734e Mon Sep 17 00:00:00 2001
+From: Bernd Kuhls <bernd@kuhls.net>
+Date: Sat, 10 Feb 2024 09:33:48 +0100
+Subject: [PATCH] cf/largefile.m4: Fix build with autoconf-2.72
+
+Fixes https://github.com/heimdal/heimdal/issues/1201
+
+Upstream: https://github.com/heimdal/heimdal/commit/1b57b62d82a478c1fade350f0fb1d57031a8734e
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ cf/largefile.m4 | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cf/largefile.m4 b/cf/largefile.m4
+index 5c54897be4..cdbbc55431 100644
+--- a/cf/largefile.m4
+++ b/cf/largefile.m4
+@@ -10,7 +10,7 @@ dnl with generated code, such as lex
+ if test "$enable_largefile" != no -a "$ac_cv_sys_large_files" != no; then
+ 	CPPFLAGS="$CPPFLAGS -D_LARGE_FILES=$ac_cv_sys_large_files"
+ fi
+-if test "$enable_largefile" != no -a "$ac_cv_sys_file_offset_bits" != no; then
+if test "$enable_largefile" != no -a "$ac_cv_sys_file_offset_bits" != no && test -n "$ac_cv_sys_file_offset_bits"; then
+ 	CPPFLAGS="$CPPFLAGS -D_FILE_OFFSET_BITS=$ac_cv_sys_file_offset_bits"
+ fi
+ ])
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  c29eb35fdbd39e3ed8587e6f0b1275cc03265f230c2fcaf88e2a1556451e773f  intel-microcode-20240531.tar.gz
+sha256  8b7582eac7e9a691356e18b3bdcbc7b2db09494e040ec980a4a5fb6d0da261bf  intel-microcode-20240910.tar.gz
 sha256  03efb1491c7e899feb2665fa299363e64035e5444c1b8bc1f6ebed30de964e12  license
@@ -4,7 +4,7 @@
 #
 ################################################################################

-INTEL_MICROCODE_VERSION = 20240531
+INTEL_MICROCODE_VERSION = 20240910
 INTEL_MICROCODE_SITE = $(call github,intel,Intel-Linux-Processor-Microcode-Data-Files,microcode-$(INTEL_MICROCODE_VERSION))
 INTEL_MICROCODE_LICENSE = PROPRIETARY
 INTEL_MICROCODE_LICENSE_FILES = license
@@ -21,7 +21,8 @@ JAILHOUSE_MAKE_OPTS = \
 ifeq ($(BR2_PACKAGE_JAILHOUSE_HELPER_SCRIPTS),y)
 JAILHOUSE_DEPENDENCIES += \
 	host-python-mako \
-	host-python-setuptools
+	host-python-setuptools \
+	python3
 JAILHOUSE_MAKE_OPTS += \
 	HAS_PYTHON_MAKO="yes" \
 	PYTHON_PIP_USABLE="yes"
@@ -44,7 +45,7 @@ define JAILHOUSE_INSTALL_HELPER_SCRIPTS
 	$(HOST_DIR)/bin/python setup.py \
 		install --no-compile \
 		$(PKG_PYTHON_SETUPTOOLS_INSTALL_OPTS) \
-		--root=$(TARGET_DIR))
+		--root=$(TARGET_DIR)
 endef
 endif

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  f409856e5920c18d0c2fb85276e24ee607d2a09b5e7d5f0a371368903c275da2  jsoncpp-1.9.5.tar.gz
+sha256  f93b6dd7ce796b13d02c108bc9f79812245a82e577581c4c9aabe57075c90ea2  jsoncpp-1.9.6.tar.gz
 sha256  cec0db5f6d7ed6b3a72647bd50aed02e13c3377fd44382b96dc2915534c042ad  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-JSONCPP_VERSION = 1.9.5
+JSONCPP_VERSION = 1.9.6
 JSONCPP_SITE = $(call github,open-source-parsers,jsoncpp,$(JSONCPP_VERSION))
 JSONCPP_LICENSE = Public Domain or MIT
 JSONCPP_LICENSE_FILES = LICENSE
@@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac
 index 93f7af94..204a4e69 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -449,9 +449,7 @@ if test "x$with_iconv" != "xno"; then
+@@ -455,9 +455,7 @@ if test "x$with_iconv" != "xno"; then
     AC_CHECK_HEADERS([localcharset.h])
     am_save_LIBS="$LIBS"
     LIBS="${LIBS} ${LIBICONV}"
@@ -17,7 +17,7 @@ diff --git a/configure.ac b/configure.ac
 index 99bff20d1..f245d0c55 100644
 --- a/configure.ac
 +++ b/configure.ac
-@@ -449,7 +449,6 @@ if test "x$with_iconv" != "xno"; then
+@@ -455,7 +455,6 @@ if test "x$with_iconv" != "xno"; then
     AC_CHECK_HEADERS([localcharset.h])
     am_save_LIBS="$LIBS"
     LIBS="${LIBS} ${LIBICONV}"
@@ -1,4 +1,4 @@
 # From https://www.libarchive.de/downloads/sha256sums
-sha256  0a2efdcb185da2eb1e7cd8421434cb9a6119f72417a13335cca378d476fd3ba0  libarchive-3.7.6.tar.xz
+sha256  879acd83c3399c7caaee73fe5f7418e06087ab2aaf40af3e99b9e29beb29faee  libarchive-3.7.7.tar.xz
 # Locally computed:
 sha256  b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBARCHIVE_VERSION = 3.7.6
+LIBARCHIVE_VERSION = 3.7.7
 LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz
 LIBARCHIVE_SITE = https://www.libarchive.de/downloads
 LIBARCHIVE_INSTALL_STAGING = YES
@@ -32,6 +32,10 @@ LIBCURL_CONF_OPTS = \
 	--disable-ldap \
 	--disable-ldaps

+# Only affects Nest products.
+# https://nvd.nist.gov/vuln/detail/CVE-2024-32928
+LIBCURL_IGNORE_CVES += CVE-2024-32928
+
 ifeq ($(BR2_TOOLCHAIN_HAS_THREADS),y)
 LIBCURL_CONF_OPTS += --enable-threaded-resolver
 else
@@ -1,7 +1,7 @@
-# From http://www.nlnetlabs.nl/downloads/ldns/ldns-1.8.3.tar.gz.sha1
-sha1  2796cc49636f68260c9662b60d5a7c9e6eed195c  ldns-1.8.3.tar.gz
-# From http://www.nlnetlabs.nl/downloads/ldns/ldns-1.8.3.tar.gz.sha256
-sha256  c3f72dd1036b2907e3a56e6acf9dfb2e551256b3c1bbd9787942deeeb70e7860  ldns-1.8.3.tar.gz
+# From https://www.nlnetlabs.nl/downloads/ldns/ldns-1.8.4-rc.1.tar.gz.sha1
+sha1  43d013b904e6df5ac5e28001cdc91bef537f3f6f  ldns-1.8.4.tar.gz
+# From https://www.nlnetlabs.nl/downloads/ldns/ldns-1.8.4.tar.gz.sha256
+sha256  838b907594baaff1cd767e95466a7745998ae64bc74be038dccc62e2de2e4247  ldns-1.8.4.tar.gz

 # Hash for license file:
 sha256  9e0b1505c358d1a7c79555ee8bd1acbe2985dbc74dd81f3697cebf2161e922e6  LICENSE
@@ -4,9 +4,9 @@
 #
 ################################################################################

-LIBLDNS_VERSION = 1.8.3
+LIBLDNS_VERSION = 1.8.4
 LIBLDNS_SOURCE = ldns-$(LIBLDNS_VERSION).tar.gz
-LIBLDNS_SITE = http://www.nlnetlabs.nl/downloads/ldns
+LIBLDNS_SITE = https://www.nlnetlabs.nl/downloads/ldns
 LIBLDNS_LICENSE = BSD-3-Clause
 LIBLDNS_LICENSE_FILES = LICENSE
 LIBLDNS_CPE_ID_VENDOR = nlnetlabs
@@ -5,7 +5,7 @@ config BR2_PACKAGE_LIBLINEAR
 	  liblinear is a linear classifier for data with millions of
 	  instances and features.

-	  http://www.csie.ntu.edu.tw/~cjlin/liblinear/
+	  https://www.csie.ntu.edu.tw/~cjlin/liblinear/

 comment "liblinear needs a toolchain w/ C++"
 	depends on !BR2_INSTALL_LIBSTDCPP
@@ -5,7 +5,7 @@
 ################################################################################

 LIBLINEAR_VERSION = 2.45
-LIBLINEAR_SITE = http://www.csie.ntu.edu.tw/~cjlin/liblinear
+LIBLINEAR_SITE = https://www.csie.ntu.edu.tw/~cjlin/liblinear/oldfiles
 LIBLINEAR_LICENSE = BSD-3-Clause
 LIBLINEAR_LICENSE_FILES = COPYRIGHT
 LIBLINEAR_INSTALL_STAGING = YES
@@ -1,5 +1,5 @@
 # Hashes from: https://libmdbx.dqdkfa.ru/release/SHA256SUMS
-sha256  4637e06768a9a8fc7577e6e458e045ad1f9a8baee74996a3c88bc0ad64cbcf67  libmdbx-amalgamated-0.12.10.tar.xz
+sha256  19c0eb33e1ed43ca2a94dceb06dd31946432d16f30a9751d3701c67efa22eb1a  libmdbx-amalgamated-0.12.12.tar.xz

 # Locally calculated
 sha256  310fe25c858a9515fc8c8d7d1f24a67c9496f84a91e0a0e41ea9975b1371e569  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBMDBX_VERSION = 0.12.10
+LIBMDBX_VERSION = 0.12.12
 LIBMDBX_SOURCE = libmdbx-amalgamated-$(LIBMDBX_VERSION).tar.xz
 LIBMDBX_SITE = https://libmdbx.dqdkfa.ru/release
 LIBMDBX_SUPPORTS_IN_SOURCE_BUILD = NO
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  a44d1ccc348a790f9a272bba2d1c2eb9a9bbd0302e4e9b655d709e1c32f92691  libopenh264-2.4.0.tar.gz
+sha256  8ffbe944e74043d0d3fb53d4a2a14c94de71f58dbea6a06d0dc92369542958ea  libopenh264-2.4.1.tar.gz
 sha256  dd5c1c9668512530fa5a96e4c29ac4033d70a7eeb0eed7a42fddb6dd794ebdbb  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBOPENH264_VERSION = 2.4.0
+LIBOPENH264_VERSION = 2.4.1
 LIBOPENH264_SITE = $(call github,cisco,openh264,v$(LIBOPENH264_VERSION))
 LIBOPENH264_LICENSE = BSD-2-Clause
 LIBOPENH264_LICENSE_FILES = LICENSE
@@ -0,0 +1,133 @@
+From 66a9a994c03d65fc37d701a60b26506bede49ae1 Mon Sep 17 00:00:00 2001
+From: Paul Cercueil <paul@crapouillou.net>
+Date: Sun, 2 Jun 2024 22:35:24 +0200
+Subject: [PATCH] mips: Fix build on MIPS64 with n32 ABI
+
+The build on MIPS64 with n32 ABI was broken for a few reasons.
+
+- The _movi_d_w() functions had a different prototype in jit_mips-fpu.c
+  than in lightning.c;
+- The movi_d_w() was still provided by lightning.c even though
+  jit_mips-fpu.c provides its own version;
+- The "ww" opcodes were allowed, which was probably not meant to happen.
+
+Fixes a build issue reported by Buildroot:
+http://autobuild.buildroot.net/results/27123bf0ddc84599bceb02ac987327817d498659/
+
+Signed-off-by: Paul Cercueil <paul@crapouillou.net>
+Upstream: http://git.savannah.gnu.org/cgit/lightning.git/commit/?id=778d326740f9893c398f959b419629935b613099
+---
+ lib/jit_mips-fpu.c |  4 ++--
+ lib/jit_mips.c     |  3 +--
+ lib/lightning.c    | 43 +++++++++++++++++++++----------------------
+ 3 files changed, 24 insertions(+), 26 deletions(-)
+
+diff --git a/lib/jit_mips-fpu.c b/lib/jit_mips-fpu.c
+index 61db30e..8ad97e9 100644
+--- a/lib/jit_mips-fpu.c
+++ b/lib/jit_mips-fpu.c
+@@ -349,7 +349,7 @@ static void _movi_f(jit_state_t*,jit_int32_t,jit_float32_t*);
+ #    define movi64(r0, i0)		_movi64(_jit, r0, i0)
+ static void _movi64(jit_state_t*,jit_int32_t,jit_int64_t);
+ #    define movi_d_w(r0, i0)		_movi_d_w(_jit, r0, i0)
+-static void _movi_d_w(jit_state_t*,jit_int32_t,jit_int64_t);
+static void _movi_d_w(jit_state_t*,jit_int32_t,jit_float64_t);
+ #  elif __WORDSIZE == 64
+ #    define movi64(r0, i0)		movi(r0, i0)
+ #  endif
+@@ -1152,7 +1152,7 @@ _movi64(jit_state_t *_jit, jit_int32_t r0, jit_int64_t i0)
+ }
+ 
+ static void
+-_movi_d_w(jit_state_t *_jit, jit_int32_t r0, jit_int64_t i0)
+_movi_d_w(jit_state_t *_jit, jit_int32_t r0, jit_float64_t i0)
+ {
+     union {
+ 	jit_int64_t	l;
+diff --git a/lib/jit_mips.c b/lib/jit_mips.c
+index 4fb6c34..6eb41a0 100644
+--- a/lib/jit_mips.c
+++ b/lib/jit_mips.c
+@@ -2184,8 +2184,7 @@ _emit_code(jit_state_t *_jit)
+ 	    case jit_code_movi_w_d:
+ 		movi_w_d(rn(node->u.w), node->v.w);
+ 		break;
+-#endif
+-#if __WORDSIZE == 32
+#else
+ 	    case jit_code_movr_ww_d:
+ 		movr_ww_d(rn(node->u.w), rn(node->v.w), rn(node->w.w));
+ 		break;
+diff --git a/lib/lightning.c b/lib/lightning.c
+index b40d35b..2c10928 100644
+--- a/lib/lightning.c
+++ b/lib/lightning.c
+@@ -4331,12 +4331,12 @@ static void _htoni_ul(jit_state_t*, jit_int32_t, jit_word_t);
+ #endif
+ #  define movi_f_w(r0, i0)		_movi_f_w(_jit, r0, i0)
+ static void _movi_f_w(jit_state_t*, jit_int32_t, jit_float32_t);
+-#if __WORDSIZE == 32 && !(defined(__mips__) && NEW_ABI)
+-#  define movi_d_ww(r0, r1, i0)		_movi_d_ww(_jit, r0, r1, i0)
+-static void _movi_d_ww(jit_state_t*, jit_int32_t, jit_int32_t, jit_float64_t);
+-#else
+#if __WORDSIZE == 64
+ #  define movi_d_w(r0, i0)		_movi_d_w(_jit, r0, i0)
+ static void _movi_d_w(jit_state_t*, jit_int32_t, jit_float64_t);
+#elif !(defined(__mips__) && NEW_ABI)
+#  define movi_d_ww(r0, r1, i0)		_movi_d_ww(_jit, r0, r1, i0)
+static void _movi_d_ww(jit_state_t*, jit_int32_t, jit_int32_t, jit_float64_t);
+ #endif
+ #define cloi(r0, i0)			_cloi(_jit, r0, i0)
+ static void _cloi(jit_state_t*, jit_int32_t, jit_word_t);
+@@ -4803,7 +4803,23 @@ _movi_f_w(jit_state_t *_jit, jit_int32_t r0, jit_float32_t i0)
+     movi(r0, data.i);
+ }
+ 
+-#if __WORDSIZE == 32 && !(defined(__mips__) && NEW_ABI)
+#if __WORDSIZE == 64
+static void
+_movi_d_w(jit_state_t *_jit, jit_int32_t r0, jit_float64_t i0)
+{
+    union {
+	jit_int64_t	l;
+	jit_float64_t	d;
+    } data;
+    data.d = i0;
+#  if defined(__ia64__)
+    /* Should be used only in this case (with out0 == 120) */
+    if (r0 >= 120)
+	r0 = _jitc->rout + (r0 - 120);
+#  endif
+    movi(r0, data.l);
+}
+#elif !(defined(__mips__) && NEW_ABI)
+ static void
+ _movi_d_ww(jit_state_t *_jit, jit_int32_t r0, jit_int32_t r1, jit_float64_t i0)
+ {
+@@ -4821,23 +4837,6 @@ _movi_d_ww(jit_state_t *_jit, jit_int32_t r0, jit_int32_t r1, jit_float64_t i0)
+     movi(r0, data.i[1]);
+ #  endif
+ }
+-
+-#else
+-static void
+-_movi_d_w(jit_state_t *_jit, jit_int32_t r0, jit_float64_t i0)
+-{
+-    union {
+-	jit_int64_t	l;
+-	jit_float64_t	d;
+-    } data;
+-    data.d = i0;
+-#  if defined(__ia64__)
+-    /* Should be used only in this case (with out0 == 120) */
+-    if (r0 >= 120)
+-	r0 = _jitc->rout + (r0 - 120);
+-#  endif
+-    movi(r0, data.l);
+-}
+ #endif
+ 
+  void
+-- 
+2.43.0
+
@@ -405,10 +405,10 @@ config BR2_DEFAULT_KERNEL_HEADERS
 	string
 	default "4.19.322"	if BR2_KERNEL_HEADERS_4_19
 	default "5.4.284"	if BR2_KERNEL_HEADERS_5_4
-	default "5.10.226"	if BR2_KERNEL_HEADERS_5_10
-	default "5.15.167"	if BR2_KERNEL_HEADERS_5_15
-	default "6.1.110"	if BR2_KERNEL_HEADERS_6_1
-	default "6.6.51"	if BR2_KERNEL_HEADERS_6_6
+	default "5.10.228"	if BR2_KERNEL_HEADERS_5_10
+	default "5.15.169"	if BR2_KERNEL_HEADERS_5_15
+	default "6.1.114"	if BR2_KERNEL_HEADERS_6_1
+	default "6.6.58"	if BR2_KERNEL_HEADERS_6_6
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION
 	default "custom"	if BR2_KERNEL_HEADERS_CUSTOM_TARBALL
 	default BR2_KERNEL_HEADERS_CUSTOM_REPO_VERSION \
@@ -15,6 +15,7 @@ config BR2_PACKAGE_LTRACE
 	depends on BR2_USE_WCHAR # elfutils
 	depends on !BR2_STATIC_LIBS # elfutils
 	depends on BR2_TOOLCHAIN_HAS_THREADS # elfutils
+	depends on BR2_TOOLCHAIN_USES_UCLIBC || BR2_TOOLCHAIN_USES_GLIBC
 	depends on BR2_PACKAGE_LTRACE_ARCH_SUPPORTS
 	select BR2_PACKAGE_ELFUTILS
 	help
@@ -25,7 +26,8 @@ config BR2_PACKAGE_LTRACE

 	  http://ltrace.org

-comment "ltrace needs a toolchain w/ wchar, dynamic library, threads"
+comment "ltrace needs a uClibc or glibc toolchain w/ wchar, dynamic library, threads"
 	depends on BR2_PACKAGE_LTRACE_ARCH_SUPPORTS
 	depends on !BR2_USE_WCHAR || BR2_STATIC_LIBS \
-		|| !BR2_TOOLCHAIN_HAS_THREADS
+		|| !BR2_TOOLCHAIN_HAS_THREADS \
+		|| !(BR2_TOOLCHAIN_USES_UCLIBC || BR2_TOOLCHAIN_USES_GLIBC)
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  4a68a3040da92fd9872c056d0f6b0cd60de8410de10b578f8ade9ecc14d297e0  nghttp2-1.58.0.tar.xz
+sha256  88bb94c9e4fd1c499967f83dece36a78122af7d5fb40da2019c56b9ccc6eb9dd  nghttp2-1.64.0.tar.xz
 sha256  6b94f3abc1aabd0c72a7c7d92a77f79dda7c8a0cb3df839a97890b4116a2de2a  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-NGHTTP2_VERSION = 1.58.0
+NGHTTP2_VERSION = 1.64.0
 NGHTTP2_SOURCE =  nghttp2-$(NGHTTP2_VERSION).tar.xz
 NGHTTP2_SITE = https://github.com/nghttp2/nghttp2/releases/download/v$(NGHTTP2_VERSION)
 NGHTTP2_LICENSE = MIT
@@ -1,28 +0,0 @@
-Fixes issues with glibc header files, see
-http://bugs.gentoo.org/show_bug.cgi?id=270483
-
-Signed-off-by: Gustavo Zacarias <gustavo@zacarias.com.ar>
-
-Rebase to apply cleanly.
-
-Signed-off-by: Danomi Manchego <danomimanchego123@gmail.com>
-
-
-diff -purN a/include/ntp_syscall.h b/include/ntp_syscall.h
--- a/include/ntp_syscall.h	2015-02-11 08:42:37.794576469 -0500
-+++ b/include/ntp_syscall.h	2015-02-11 08:43:03.216957279 -0500
-@@ -10,6 +10,14 @@
- # include <sys/timex.h>
- #endif
- 
-+#if defined(ADJ_NANO) && !defined(MOD_NANO)
-+#define MOD_NANO ADJ_NANO
-+#endif
-+
-+#if defined(ADJ_TAI) && !defined(MOD_TAI)
-+#define MOD_TAI ADJ_TAI
-+#endif
-+
- #ifndef NTP_SYSCALLS_LIBC
- # ifdef NTP_SYSCALLS_STD
- #  define ntp_adjtime(t)	syscall(SYS_ntp_adjtime, (t))
@@ -8,10 +8,11 @@ Signed-off-by: James Knight <james.knight@rockwellcollins.com>
 configure.ac | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-diff --git a/configure.ac b/configure.ac
--- a/configure.ac
-+++ b/configure.ac
-@@ -1523,11 +1523,11 @@ AC_CACHE_CHECK(
+Index: ntp-4.2.8p17/configure.ac
+===================================================================
+--- ntp-4.2.8p17.orig/configure.ac
+++ ntp-4.2.8p17/configure.ac
+@@ -1472,11 +1472,11 @@ AC_CACHE_CHECK(
     [ntp_cv_var_ntp_syscalls],
     [
 	ntp_cv_var_ntp_syscalls=no
@@ -0,0 +1,26 @@
+fix pthread_detach check
+
+Upstream: https://bugs.ntp.org/show_bug.cgi?id=3926
+
+Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
+---
+ sntp/m4/openldap-thread-check.m4 |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+Index: ntp-4.2.8p17/sntp/m4/openldap-thread-check.m4
+===================================================================
+--- ntp-4.2.8p17.orig/sntp/m4/openldap-thread-check.m4
+++ ntp-4.2.8p17/sntp/m4/openldap-thread-check.m4
+@@ -262,10 +262,8 @@ pthread_rwlock_t rwlock;
+ 				dnl save the flags
+ 				AC_LINK_IFELSE([AC_LANG_PROGRAM([[
+ #include <pthread.h>
+-#ifndef NULL
+-#define NULL (void*)0
+-#endif
+-]], [[pthread_detach(NULL);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
+pthread_t thread;
+]], [[pthread_detach(thread);]])],[ol_cv_func_pthread_detach=yes],[ol_cv_func_pthread_detach=no])
+ 			])
+
+ 			if test $ol_cv_func_pthread_detach = no ; then
@@ -0,0 +1,209 @@
+Fix build with -Wincompatible-pointer-types -Werror
+
+Upstream: https://people.nwtime.org/hart/ntp-stable-3928-29.tar.gz
+
+Ported fix from updated tarball provided by upstream:
+https://bugs.ntp.org/show_bug.cgi?id=3929#c9
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+
+diff -uNr ntp-4.2.8p18.orig/include/ntp_md5.h ntp-4.2.8p18/include/ntp_md5.h
+--- ntp-4.2.8p18.orig/include/ntp_md5.h	2024-05-07 13:21:16.000000000 +0200
+++ ntp-4.2.8p18/include/ntp_md5.h	2024-07-24 01:26:46.000000000 +0200
+@@ -1,56 +1,73 @@
+ /*
+  * ntp_md5.h: deal with md5.h headers
+  *
+- * Use the system MD5 if available, otherwise libisc's.
+ * Use the system MD5 if available, otherwise use libisc's.
+ * Yes, MD5 has been deprecated.  Nevertheless, ntpd IPv6 refid
+ * calculation uses MD5 to derive a 32-bit refid from a 128-bit
+ * IPv6 address.  This use is retained to avoid breaking loop
+ * detection that would be triggered by such change, and because
+ * we are not depending on cryptographic strength for such use.
+  */
+ #ifndef NTP_MD5_H
+ #define NTP_MD5_H
+ 
+ /* Use the system MD5 or fall back on libisc's */
+-# if defined HAVE_MD5_H && defined HAVE_MD5INIT
+-#  include <md5.h>
+-# else
+-#  include "isc/md5.h"
+-   typedef isc_md5_t		MD5_CTX;
+-#  define MD5_DIGEST_LENGTH	ISC_MD5_DIGESTLENGTH
+-#  define MD5Init(c)		isc_md5_init(c)
+-#  define MD5Update(c, p, s)	isc_md5_update(c, (const void *)p, s)
+-#  define MD5Final(d, c)	isc_md5_final((c), (d))	/* swapped */
+-# endif
+-
+-# define KEY_TYPE_MD5			NID_md5
+#if defined HAVE_MD5_H && defined HAVE_MD5INIT
+# include <md5.h>
+# define ntp_md5_init(c)		MD5Init(c)
+# define ntp_md5_update(c, p, s)	MD5Update(c, (const void *)(p), s)
+# define ntp_md5_final(d, c)		MD5Final(d, c)
+#else
+# include "isc/md5.h"
+typedef isc_md5_t			MD5_CTX;
+# define MD5_DIGEST_LENGTH		ISC_MD5_DIGESTLENGTH
+# define ntp_md5_init(c)		isc_md5_init(c)
+# define ntp_md5_update(c, p, s)	isc_md5_update(c, (const void *)(p), s)
+# define ntp_md5_final(d, c)		isc_md5_final((c), (d))	/* swapped */
+#endif
+ 
+ #ifdef OPENSSL
+ # include <openssl/evp.h>
+ # include "libssl_compat.h"
+ # ifdef HAVE_OPENSSL_CMAC_H
+ #  include <openssl/cmac.h>
+-#  define CMAC                  "AES128CMAC"
+-#  define AES_128_KEY_SIZE      16
+-# endif /*HAVE_OPENSSL_CMAC_H*/
+#  define CMAC			"AES128CMAC"
+#  define AES_128_KEY_SIZE	16
+# endif
+ #else	/* !OPENSSL follows */
+ /*
+- * Provide OpenSSL-alike MD5 API if we're not using OpenSSL
+ * Provide OpenSSL-alike MD5 API if we're not using OpenSSL.  Most of this
+ * is used only by sntp when building it --without-crypto.
+  */
+ 
+-  typedef MD5_CTX			EVP_MD_CTX;
+typedef MD5_CTX				EVP_MD_CTX;
+ 
+ # define NID_md5			4	/* from openssl/objects.h */
+ # define EVP_MAX_MD_SIZE		MD5_DIGEST_LENGTH
+
+/*
+ * The following is used only by sntp configured --without-crypto as ntpd
+ * now uses explicit MD5 functions for MD5 uses which remain even where MD5
+ * is unavailable in OpenSSL, such as FIPS OpenSSL.  Note that FIPS may be
+ * available in the build environment but not at runtime, as is the case
+ * with packaged NTP binaries.
+ * The remaining uses of MD5 are IPv6 refids and mode 6 nonces.  ntpd does
+ * go through OpenSSL when using MD5 for symmetric authentication.
+ */
+ # define EVP_MD_CTX_free(c)		free(c)
+ # define EVP_MD_CTX_new()		calloc(1, sizeof(MD5_CTX))
+ # define EVP_get_digestbynid(t)		NULL
+ # define EVP_md5()			NULL
+ # define EVP_MD_CTX_init(c)
+ # define EVP_MD_CTX_set_flags(c, f)
+-# define EVP_DigestInit(c, dt)		(MD5Init(c), 1)
+-# define EVP_DigestInit_ex(c, dt, i)	(MD5Init(c), 1)
+-# define EVP_DigestUpdate(c, p, s)	MD5Update(c, (const void *)(p), \
+-						  s)
+-# define EVP_DigestFinal(c, d, pdl)	\
+-	do {				\
+-		MD5Final((d), (c));	\
+-		*(pdl) = MD5_LENGTH;	\
+-	} while (0)
+-# endif	/* !OPENSSL */
+# define EVP_DigestInit(c, dt)		(ntp_md5_init(c), 1)
+# define EVP_DigestUpdate(c, p, s)	ntp_md5_update(c, p, s)
+# define EVP_DigestFinal(c, d, pdl)		\
+	do {					\
+		ntp_md5_final((d), (c));	\
+		*(pdl) = MD5_LENGTH;		\
+	} while (FALSE)
+
+#endif	/* OPENSSL */
+
+ #endif	/* NTP_MD5_H */
+diff -uNr ntp-4.2.8p18.orig/libntp/a_md5encrypt.c ntp-4.2.8p18/libntp/a_md5encrypt.c
+--- ntp-4.2.8p18.orig/libntp/a_md5encrypt.c	2024-05-07 13:21:31.000000000 +0200
+++ ntp-4.2.8p18/libntp/a_md5encrypt.c	2024-07-24 01:26:46.000000000 +0200
+@@ -56,7 +56,7 @@
+ 	static MD5_CTX	md5_ctx;
+ 
+ 	DEBUG_INSIST(NID_md5 == nid);
+-	MD5Init(&md5_ctx);
+	ntp_md5_init(&md5_ctx);
+ 
+ 	return &md5_ctx;
+ #else
+@@ -171,10 +171,10 @@
+ 		if (digest->len < MD5_LENGTH) {
+ 			msyslog(LOG_ERR, "%s", "MAC encrypt: MAC md5 buf too small.");
+ 		} else {
+-			MD5Init(ctx);
+-			MD5Update(ctx, (const void *)key->buf, key->len);
+-			MD5Update(ctx, (const void *)msg->buf, msg->len);
+-			MD5Final(digest->buf, ctx);
+			ntp_md5_init(ctx);
+			ntp_md5_update(ctx, key->buf, key->len);
+			ntp_md5_update(ctx, msg->buf, msg->len);
+			ntp_md5_final(digest->buf, ctx);
+ 			retlen = MD5_LENGTH;
+ 		}
+ 	} else {
+@@ -279,9 +279,9 @@
+ 		return (NSRCADR(addr));
+ 	}
+ 	/* MD5 is not used for authentication here. */
+-	MD5Init(&md5_ctx);
+-	MD5Update(&md5_ctx, (void *)&SOCK_ADDR6(addr), sizeof(SOCK_ADDR6(addr)));
+-	MD5Final(u.digest, &md5_ctx);
+	ntp_md5_init(&md5_ctx);
+	ntp_md5_update(&md5_ctx, &SOCK_ADDR6(addr), sizeof(SOCK_ADDR6(addr)));
+	ntp_md5_final(u.digest, &md5_ctx);
+ #ifdef WORDS_BIGENDIAN
+ 	u.addr_refid = BYTESWAP32(u.addr_refid);
+ #endif
+diff -uNr ntp-4.2.8p18.orig/libntp/authreadkeys.c ntp-4.2.8p18/libntp/authreadkeys.c
+--- ntp-4.2.8p18.orig/libntp/authreadkeys.c	2024-05-07 13:21:20.000000000 +0200
+++ ntp-4.2.8p18/libntp/authreadkeys.c	2024-07-24 01:26:46.000000000 +0200
+@@ -240,7 +240,7 @@
+ 				  keyno);
+ 			keytype = 0;
+ 		} else {
+-			keytype = KEY_TYPE_MD5;
+			keytype = NID_md5;
+ 		}
+ #endif	/* !OPENSSL */
+ 
+diff -uNr ntp-4.2.8p18.orig/ntpd/ntp_control.c ntp-4.2.8p18/ntpd/ntp_control.c
+--- ntp-4.2.8p18.orig/ntpd/ntp_control.c	2024-05-07 13:21:15.000000000 +0200
+++ ntp-4.2.8p18/ntpd/ntp_control.c	2024-07-24 01:26:46.000000000 +0200
+@@ -3663,18 +3663,18 @@
+ 		last_salt_update = current_time;
+ 	}
+ 
+-	MD5Init(&ctx);
+-	MD5Update(&ctx, salt, sizeof(salt));
+-	MD5Update(&ctx, &ts_i, sizeof(ts_i));
+-	MD5Update(&ctx, &ts_f, sizeof(ts_f));
+	ntp_md5_init(&ctx);
+	ntp_md5_update(&ctx, salt, sizeof(salt));
+	ntp_md5_update(&ctx, &ts_i, sizeof(ts_i));
+	ntp_md5_update(&ctx, &ts_f, sizeof(ts_f));
+ 	if (IS_IPV4(addr)) {
+-		MD5Update(&ctx, &SOCK_ADDR4(addr), sizeof(SOCK_ADDR4(addr)));
+		ntp_md5_update(&ctx, &SOCK_ADDR4(addr), sizeof(SOCK_ADDR4(addr)));
+ 	} else {
+-		MD5Update(&ctx, &SOCK_ADDR6(addr), sizeof(SOCK_ADDR6(addr)));
+		ntp_md5_update(&ctx, &SOCK_ADDR6(addr), sizeof(SOCK_ADDR6(addr)));
+ 	}
+-	MD5Update(&ctx, &NSRCPORT(addr), sizeof(NSRCPORT(addr)));
+-	MD5Update(&ctx, salt, sizeof(salt));
+-	MD5Final(d.digest, &ctx);
+	ntp_md5_update(&ctx, &NSRCPORT(addr), sizeof(NSRCPORT(addr)));
+	ntp_md5_update(&ctx, salt, sizeof(salt));
+	ntp_md5_final(d.digest, &ctx);
+ 
+ 	return d.extract;
+ }
+diff -uNr ntp-4.2.8p18.orig/ntpd/ntp_crypto.c ntp-4.2.8p18/ntpd/ntp_crypto.c
+--- ntp-4.2.8p18.orig/ntpd/ntp_crypto.c	2024-05-07 13:21:32.000000000 +0200
+++ ntp-4.2.8p18/ntpd/ntp_crypto.c	2024-07-24 01:26:46.000000000 +0200
+@@ -150,7 +150,7 @@
+  * Global cryptodata in host byte order
+  */
+ u_int32	crypto_flags = 0x0;	/* status word */
+-int	crypto_nid = KEY_TYPE_MD5; /* digest nid */
+int	crypto_nid = NID_md5; /* digest nid */
+ char	*sys_hostname = NULL;
+ char	*sys_groupname = NULL;
+ static char *host_filename = NULL;	/* host file name */
@@ -148,7 +148,7 @@ config BR2_PACKAGE_OPENJDK_JVM_VARIANT_ZERO
 	select BR2_PACKAGE_LIBFFI
 	help
 	  A non-assembler variant with wide arch support, however
-	  performance is less then client/server.
+	  performance is less than client/server.

 	  http://openjdk.java.net/projects/zero

@@ -1,5 +1,5 @@
 # From https://www.php.net/downloads.php
-sha256  80a5225746a9eb484475b312d4c626c63a88a037d8e56d214f30205e1ba1411a  php-8.2.24.tar.xz
+sha256  330b54876ea1d05ade12ee9726167332058bccd58dffa1d4e12117f6b4f616b9  php-8.2.25.tar.xz

 # License file
 sha256  b42e4df5e50e6ecda1047d503d6d91d71032d09ed1027ba1ef29eed26f890c5a  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-PHP_VERSION = 8.2.24
+PHP_VERSION = 8.2.25
 PHP_SITE = https://www.php.net/distributions
 PHP_SOURCE = php-$(PHP_VERSION).tar.xz
 PHP_INSTALL_STAGING = YES
@@ -0,0 +1,87 @@
+From 6c71182dde4d37fd70ee8015f61935254ae6f9a6 Mon Sep 17 00:00:00 2001
+From: Maxim Kochetkov <fido_max@inbox.ru>
+Date: Thu, 19 Sep 2024 10:04:05 +0300
+Subject: [PATCH] Fix compile without threads
+
+All mutexes should be wrapped by #ifdef ENABLE_THREAD_SAFETY.
+
+Fixes: https://git.postgresql.org/gitweb/?p=postgresql.git;a=commit;h=52afe563206e753f4c45c014fee2459ad0855826
+Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru>
+Signed-off-by: Maxim Kochetkov <m.kochetkov@yadro.com>
+Upstream: N/A, as --disable-thread-safety will disappear in PostgreSQL 17.
+---
+ src/interfaces/ecpg/ecpglib/misc.c | 6 ++++++
+ src/interfaces/libpq/fe-misc.c     | 6 ++++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/src/interfaces/ecpg/ecpglib/misc.c b/src/interfaces/ecpg/ecpglib/misc.c
+index 4b54322926..5a4d2e847e 100644
+--- a/src/interfaces/ecpg/ecpglib/misc.c
+++ b/src/interfaces/ecpg/ecpglib/misc.c
+@@ -538,7 +538,9 @@ ecpg_gettext(const char *msgid)
+ 	 * might as well do it the same way everywhere.
+ 	 */
+ 	static volatile bool already_bound = false;
+#ifdef ENABLE_THREAD_SAFETY
+ 	static pthread_mutex_t binddomain_mutex = PTHREAD_MUTEX_INITIALIZER;
+#endif
+ 
+ 	if (!already_bound)
+ 	{
+@@ -549,7 +551,9 @@ ecpg_gettext(const char *msgid)
+ 		int			save_errno = errno;
+ #endif
+ 
+#ifdef ENABLE_THREAD_SAFETY
+ 		(void) pthread_mutex_lock(&binddomain_mutex);
+#endif
+ 
+ 		if (!already_bound)
+ 		{
+@@ -566,7 +570,9 @@ ecpg_gettext(const char *msgid)
+ 			already_bound = true;
+ 		}
+ 
+#ifdef ENABLE_THREAD_SAFETY
+ 		(void) pthread_mutex_unlock(&binddomain_mutex);
+#endif
+ 
+ #ifdef WIN32
+ 		SetLastError(save_errno);
+diff --git a/src/interfaces/libpq/fe-misc.c b/src/interfaces/libpq/fe-misc.c
+index 488f7d6e55..2185e0ba7a 100644
+--- a/src/interfaces/libpq/fe-misc.c
+++ b/src/interfaces/libpq/fe-misc.c
+@@ -1232,7 +1232,9 @@ libpq_binddomain(void)
+ 	 * might as well do it the same way everywhere.
+ 	 */
+ 	static volatile bool already_bound = false;
+#ifdef ENABLE_THREAD_SAFETY
+ 	static pthread_mutex_t binddomain_mutex = PTHREAD_MUTEX_INITIALIZER;
+#endif
+ 
+ 	if (!already_bound)
+ 	{
+@@ -1243,7 +1245,9 @@ libpq_binddomain(void)
+ 		int			save_errno = errno;
+ #endif
+ 
+#ifdef ENABLE_THREAD_SAFETY
+ 		(void) pthread_mutex_lock(&binddomain_mutex);
+#endif
+ 
+ 		if (!already_bound)
+ 		{
+@@ -1260,7 +1264,9 @@ libpq_binddomain(void)
+ 			already_bound = true;
+ 		}
+ 
+#ifdef ENABLE_THREAD_SAFETY
+ 		(void) pthread_mutex_unlock(&binddomain_mutex);
+#endif
+ 
+ #ifdef WIN32
+ 		SetLastError(save_errno);
+-- 
+2.45.2
+
@@ -0,0 +1,55 @@
+From 263fe04f9ed6f3f40fdb7ce249221e03dc926c9b Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Wed, 24 Jul 2024 09:51:00 +0200
+Subject: [PATCH] fix ncurses.h include
+
+Commit 58559a5b64a3634460536d6397ca382a54b599f0 was not backported from
+3.3.17 to 4.0.0 resulting in the following build failure when ncursesw
+headers are not installed in ../usr/include/ncursesw/..:
+
+src/watch.c:56:11: fatal error: ncursesw/ncurses.h: No such file or directory
+   56 | # include <ncursesw/ncurses.h>
+      |           ^~~~~~~~~~~~~~~~~~~~
+
+Fixes:
+ - http://autobuild.buildroot.org/results/b7573be2e78f3d224f48cb3f52087e3d227d58e3
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+
+Upstream: https://gitlab.com/procps-ng/procps/-/commit/263fe04f9ed6f3f40fdb7ce249221e03dc926c9b
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+[Bernd: backported to version 4.0.4]
+---
+ configure.ac | 2 +-
+ src/watch.c  | 5 ++++-
+ 2 files changed, 5 insertions(+), 2 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index d433901f..38350aaf 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -64,7 +64,7 @@ PROCPS_PROG_PO4A
+ 
+ # Checks for header files.
+ AC_HEADER_MAJOR
+-AC_CHECK_HEADERS([arpa/inet.h fcntl.h float.h langinfo.h libintl.h limits.h locale.h stdint.h stdio_ext.h stdlib.h string.h sys/file.h sys/ioctl.h sys/param.h sys/time.h termios.h unistd.h utmp.h utmpx.h values.h wchar.h wctype.h])
+AC_CHECK_HEADERS([arpa/inet.h fcntl.h float.h langinfo.h libintl.h limits.h locale.h ncursesw/ncurses.h stdint.h stdio_ext.h stdlib.h string.h sys/file.h sys/ioctl.h sys/param.h sys/time.h termios.h unistd.h utmp.h utmpx.h values.h wchar.h wctype.h])
+ 
+ # Checks for typedefs, structures, and compiler characteristics.
+ AC_CHECK_HEADER_STDBOOL
+diff --git a/src/watch.c b/src/watch.c
+index ef638e00..7ec634b6 100644
+--- a/src/watch.c
+++ b/src/watch.c
+@@ -53,6 +53,8 @@
+ # define _XOPEN_SOURCE_EXTENDED 1
+ # include <wchar.h>
+ # include <wctype.h>
+#endif
+#ifdef HAVE_NCURSESW_NCURSES_H
+ # include <ncursesw/ncurses.h>
+ #else
+ # include <ncurses.h>
+-- 
+GitLab
@@ -15,6 +15,7 @@ PROCPS_NG_DEPENDENCIES = ncurses host-pkgconf $(TARGET_NLS_DEPENDENCIES)
 PROCPS_NG_CONF_OPTS = LIBS=$(TARGET_NLS_LIBS)

 # Applying 0001-build-sys-Add-systemd-elogind-to-w.patch touches Makefile.am
+# Applying 0002-fix-ncurses-h-include.patch touches configure.ac
 PROCPS_NG_AUTORECONF = YES

 ifeq ($(BR2_PACKAGE_SYSTEMD),y)
@@ -0,0 +1,7 @@
+config BR2_PACKAGE_PYTHON_PYQT5_SIP
+	bool "python-pyqt5-sip"
+	help
+	  This is the PyQt5.sip module which is needed at runtime for
+	  the PyQt5 module from package python-pyqt5.
+
+	  https://pypi.org/project/PyQt5-sip/
@@ -0,0 +1,7 @@
+# from https://pypi.org/project/PyQt5-sip/12.30.0
+sha256  7f321daf84b9c9dbca61b80e1ef37bdaffc0e93312edae2cd7da25b953971d91  PyQt5_sip-12.13.0.tar.gz
+
+# Hash for license files:
+md5  9cd437778ebd1c056a76b4ded73b3a6d  LICENSE
+md5  e91355d8a6f8bd8f7c699d62863c7303  LICENSE-GPL2
+md5  7ea41d866d6638e430db5287a3f66090  LICENSE-GPL3
@@ -0,0 +1,14 @@
+################################################################################
+#
+# python-SIP-QT5
+#
+################################################################################
+
+PYTHON_PYQT5_SIP_VERSION = 12.13.0
+PYTHON_PYQT5_SIP_SITE = https://files.pythonhosted.org/packages/ee/81/fce2a475aa56c1f49707d9306b930695b6ff078c2242c9f2fd72a3214e1f
+PYTHON_PYQT5_SIP_SOURCE = PyQt5_sip-$(PYTHON_PYQT5_SIP_VERSION).tar.gz
+PYTHON_PYQT5_SIP_LICENSE = SIP license or GPL-2.0 or GPL-3.0
+PYTHON_PYQT5_SIP_LICENSE_FILES = LICENSE LICENSE-GPL2 LICENSE-GPL3
+PYTHON_PYQT5_SIP_SETUP_TYPE = setuptools
+
+$(eval $(python-package))
@@ -5,6 +5,7 @@ config BR2_PACKAGE_PYTHON_PYQT5
 	bool "python-pyqt5"
 	depends on BR2_PACKAGE_QT5
 	select BR2_PACKAGE_PYTHON_SIP
+	select BR2_PACKAGE_PYTHON_PYQT5_SIP # runtime
 	select BR2_PACKAGE_QT5BASE_GUI
 	help
 	  Python bindings for Qt 5
@@ -1,5 +1,5 @@
-# https://www.ruby-lang.org/en/news/2024/07/09/ruby-3-3-4-released/
-sha512  b26461a13ff82a08a282f10108028bb2a2e4a28da6182a291062fc54089c6655d79c22cc69d59156f9b11cb10a17fe8c69d489343fbae123a45f03361b95c9eb  ruby-3.3.4.tar.xz
+# https://www.ruby-lang.org/en/news/2024/09/03/3-3-5-released/
+sha512  dd5c6a7f74854e143e0ca46b9d7c0d1983fc4886f5f733cd108345dbf4b21f61ad978ad6806e05a57b7af28fd9216dd38d7145808188bbb3695a7f3a4eda3883  ruby-3.3.5.tar.xz

 # License files, Locally calculated
 sha256  e849b28d324423e636a3e6bc5d583cdaf4bd046c2b20872c53886b612d01a4a1  LEGAL
@@ -5,7 +5,7 @@
 ################################################################################

 RUBY_VERSION_MAJOR = 3.3
-RUBY_VERSION = $(RUBY_VERSION_MAJOR).4
+RUBY_VERSION = $(RUBY_VERSION_MAJOR).5
 RUBY_VERSION_EXT = 3.3.0
 RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR)
 RUBY_SOURCE = ruby-$(RUBY_VERSION).tar.xz
@@ -11,7 +11,7 @@ SYSVINIT_LICENSE = GPL-2.0+
 SYSVINIT_LICENSE_FILES = COPYING
 SYSVINIT_CPE_ID_VALID = YES

-SYSVINIT_MAKE_OPTS = SYSROOT=$(STAGING_DIR)
+SYSVINIT_MAKE_OPTS = SYSROOT=$(STAGING_DIR) VERSION=$(SYSVINIT_VERSION)

 ifeq ($(BR2_PACKAGE_LIBSELINUX),y)
 SYSVINIT_DEPENDENCIES += libselinux
@@ -1,4 +1,4 @@
-# From https://dist.torproject.org/tor-0.4.8.12.tar.gz.sha256sum
-sha256  ca7cc735d98e3747b58f2f3cc14f804dd789fa0fb333a84dcb6bd70adbb8c874  tor-0.4.8.12.tar.gz
+# From https://dist.torproject.org/tor-0.4.8.13.tar.gz.sha256sum
+sha256  9baf26c387a2820b3942da572146e6eb77c2bc66862af6297cd02a074e6fba28  tor-0.4.8.13.tar.gz
 # Locally computed
 sha256  47b54ed17e8fdcab3c44729a1789a09b208f9a63a845a7e50def9df729eebad0  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-TOR_VERSION = 0.4.8.12
+TOR_VERSION = 0.4.8.13
 TOR_SITE = https://dist.torproject.org
 TOR_LICENSE = BSD-3-Clause
 TOR_LICENSE_FILES = LICENSE
@@ -1,36 +0,0 @@
-From e56a2597eb66c2221b004aa3356b06c1b071b5b5 Mon Sep 17 00:00:00 2001
-From: Adrian Perez de Castro <aperez@igalia.com>
-Date: Wed, 14 Aug 2024 00:51:26 +0300
-Subject: [PATCH] Cast to EGLNativeWindowType explicitly
-
-In order to avoid off build failures due to mismatching (but
-compatible) declarations of wl_egl_window and EGLNativeWindowType,
-add an explicit cast to EGLNativeWindowType inside the
-TargetWayland::nativeWindow() function.
-
-Solves the following build issue found by the Buildroot autobuilders:
-
-  http://autobuild.buildroot.net/results/92c5cc3134e92c263a0cbb4c05ef8956569e434b/
-
-Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
-Upstream: https://github.com/Igalia/WPEBackend-fdo/commit/e56a2597eb66c2221b004aa3356b06c1b071b5b5
---
- src/egl-client-wayland.cpp | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/src/egl-client-wayland.cpp b/src/egl-client-wayland.cpp
-index 10e02f0..22bb212 100644
--- a/src/egl-client-wayland.cpp
-+++ b/src/egl-client-wayland.cpp
-@@ -63,7 +63,7 @@ TargetWayland::~TargetWayland()
- 
- EGLNativeWindowType TargetWayland::nativeWindow() const
- {
-    return m_egl.window;
-+    return (EGLNativeWindowType) m_egl.window;
- }
- 
- void TargetWayland::resize(uint32_t width, uint32_t height)
-- 
-2.46.0
-
@@ -1,6 +1,7 @@
-# From https://wpewebkit.org/releases/wpebackend-fdo-1.14.2.tar.xz.sums
-sha1  f453f8d77e93f4ac6ac81c1874d4d6bdcb45c253  wpebackend-fdo-1.14.2.tar.xz
-sha256  93c9766ae9864eeaeaee2b0a74f22cbca08df42c1a1bdb55b086f2528e380d38  wpebackend-fdo-1.14.2.tar.xz
+# From https://wpewebkit.org/releases/wpebackend-fdo-1.14.3.tar.xz.sums
+md5  ab73398b1e35495977e50bee103969d2  wpebackend-fdo-1.14.3.tar.xz
+sha1  2d2945df15cc1efa957657fa727f3bc4c6f580bb  wpebackend-fdo-1.14.3.tar.xz
+sha256  10121842595a850291db3e82f3db0b9984df079022d386ce42c2b8508159dc6c  wpebackend-fdo-1.14.3.tar.xz

 # Hashes for license files:
 sha256  c9f6803371047fad3e72200ec6cd226329a5ee08ac61104c8211c2761fb46825  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-WPEBACKEND_FDO_VERSION = 1.14.2
+WPEBACKEND_FDO_VERSION = 1.14.3
 WPEBACKEND_FDO_SITE = https://wpewebkit.org/releases
 WPEBACKEND_FDO_SOURCE = wpebackend-fdo-$(WPEBACKEND_FDO_VERSION).tar.xz
 WPEBACKEND_FDO_INSTALL_STAGING = YES
@@ -5,7 +5,7 @@
 ################################################################################

 # Buildroot version to use
-RELEASE='2024.02.7'
+RELEASE='2024.02.8'

 ### Change here for more memory/cores ###
 VM_MEMORY=2048
@@ -1043,7 +1043,8 @@ def dump_html_pkg(f, pkg):
    data_field_id = f'cves__{pkg_css_class}'
    div_class = ["centered cves data"]
    div_class.append(f'_{pkg_css_class}')
-    if len(pkg.cves) > 10:
+    cve_total = len(pkg.cves) + len(pkg.unsure_cves)
+    if cve_total > 10:
        div_class.append("collapse")
    if pkg.is_status_ok("cve"):
        div_class.append("cve-ok")
@@ -1054,8 +1055,7 @@ def dump_html_pkg(f, pkg):
    else:
        div_class.append("cve-unknown")
    f.write(f'  <div id="{data_field_id}" class="{" ".join(div_class)}">\n')
-    if len(pkg.cves) > 10:
-        cve_total = len(pkg.cves) + 1
+    if cve_total > 10:
        f.write(f' <div onclick="expandField(\'{data_field_id}\')" \
        class="see-more centered cve_ignored">see all ({cve_total}) &#9662;</div>\n')
    if pkg.is_status_error("cve"):
@@ -130,7 +130,7 @@ class TestBitcoin(infra.basetest.BRTest):
        # #1. We should receive the 50 BTC reward at this address.
        cmd = self.cli_cmd
        cmd += f" generatetoaddress {req_blk_count} {btc_addr1}"
-        self.assertRunOk(cmd)
+        self.assertRunOk(cmd, timeout=30)

        # We should now see the previously created blocks.
        cur_blk_cnt = self.get_block_count()
@@ -169,7 +169,7 @@ class TestBitcoin(infra.basetest.BRTest):
        # the previous transaction (but this will not give the 50 BTC
        # reward).
        cmd = f"{self.cli_cmd} generatetoaddress 1 {btc_addr2}"
-        self.assertRunOk(cmd)
+        self.assertRunOk(cmd, timeout=30)

        # We should see one more block.
        cur_blk_cnt = self.get_block_count()
@@ -0,0 +1,48 @@
+import os
+
+import infra.basetest
+
+
+class TestIputils(infra.basetest.BRTest):
+    config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+        """
+        BR2_PACKAGE_IPUTILS=y
+        BR2_SYSTEM_DHCP="eth0"
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(arch="armv7",
+                           kernel="builtin",
+                           options=["-initrd", cpio_file])
+        self.emulator.login()
+
+        # We check all the main programs of iputils can execute and
+        # report their version. Note the "-V" option is not accepted
+        # and fails if the "ping" applet of BusyBox is used instead.
+        iputils_progs = ["arping", "clockdiff", "ping", "tracepath"]
+        for prog in iputils_progs:
+            self.assertRunOk(f"{prog} -V")
+
+        # Qemu host IP, See:
+        # https://wiki.qemu.org/Documentation/Networking#User_Networking_(SLIRP)
+        qemu_host = "10.0.2.2"
+
+        # We test the "arping" program, with 3 pings.
+        self.assertRunOk(f"arping -c 3 {qemu_host}", timeout=10)
+
+        # We test the "ping" program. We use the option "-D" which
+        # shows a timestamp and is also not supported by the "ping"
+        # BusyBox applet.
+        self.assertRunOk(f"ping -D -c 3 {qemu_host}", timeout=10)
+
+        # We test the "tracepath" program. We set the max hops to 2,
+        # since there is no intermediate routers.
+        self.assertRunOk(f"tracepath -m 2 {qemu_host}", timeout=10)
+
+        # We test the "clockdiff" program. We cannot use the Qemu host
+        # IP for this program as the ICMP TIMESTAMP is used and is not
+        # responded. We use the local host instead.
+        self.assertRunOk("clockdiff 127.0.0.1", timeout=10)
@@ -0,0 +1,79 @@
+import os
+
+import infra.basetest
+
+
+class TestPythonPyQt5(infra.basetest.BRTest):
+    # We use a specific configuration for:
+    # - using Aarch64, to have more than 256MB memory,
+    # - using a kernel config fragment, to enable VKMS,
+    # - to have an ext4 rootfs image exposed as a virtio storage
+    #   (rather than cpio initrd). This will save some memory, as the
+    #   rootfs image is big.
+    kernel_fragment = \
+        infra.filepath("tests/package/test_python_pyqt5/linux-vkms.fragment")
+    rootfs_overlay = \
+        infra.filepath("tests/package/test_python_pyqt5/rootfs-overlay")
+    config = \
+        f"""
+        BR2_aarch64=y
+        BR2_TOOLCHAIN_EXTERNAL=y
+        BR2_TARGET_GENERIC_GETTY_PORT="ttyAMA0"
+        BR2_LINUX_KERNEL=y
+        BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+        BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.1.81"
+        BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
+        BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="board/qemu/aarch64-virt/linux.config"
+        BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="{kernel_fragment}"
+        BR2_PACKAGE_DEJAVU=y
+        BR2_PACKAGE_LIBDRM=y
+        BR2_PACKAGE_MESA3D=y
+        BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST=y
+        BR2_PACKAGE_MESA3D_LLVM=y
+        BR2_PACKAGE_MESA3D_OPENGL_EGL=y
+        BR2_PACKAGE_MESA3D_OPENGL_ES=y
+        BR2_PACKAGE_PYTHON3=y
+        BR2_PACKAGE_PYTHON_PYQT5=y
+        BR2_PACKAGE_QT5=y
+        BR2_PACKAGE_QT5BASE_EGLFS=y
+        BR2_PACKAGE_QT5BASE_FONTCONFIG=y
+        BR2_PACKAGE_QT5BASE_WIDGETS=y
+        BR2_ROOTFS_OVERLAY="{rootfs_overlay}"
+        BR2_TARGET_ROOTFS_EXT2=y
+        BR2_TARGET_ROOTFS_EXT2_4=y
+        BR2_TARGET_ROOTFS_EXT2_SIZE="256M"
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """
+
+    def test_run(self):
+        drive = os.path.join(self.builddir, "images", "rootfs.ext4")
+        kern = os.path.join(self.builddir, "images", "Image")
+        self.emulator.boot(arch="aarch64",
+                           kernel=kern,
+                           kernel_cmdline=["root=/dev/vda console=ttyAMA0"],
+                           options=["-M", "virt", "-cpu", "cortex-a57", "-m", "512M",
+                                    "-drive", f"file={drive},if=virtio,format=raw"])
+        self.emulator.login()
+
+        # We run the test application with a customized message.
+        # NOTE: to manually debug this test, a Qemu emulator with
+        # virtio-gpu can be used by starting it the command line from
+        # the run log generated by this test, and by adding the
+        # arguments "-device virtio-gpu -display gtk". With this, the
+        # test application will be observable on the Qemu window. Once
+        # logged, we can use the "card1" DRM/KMS device (virtio-gpu,
+        # instead of card0, which is vkms on "card0") by using the
+        # command:
+        #     echo '{"device":"/dev/dri/card1"}' > cfg.json
+        #     export QT_QPA_EGLFS_KMS_CONFIG="$PWD/cfg.json"
+        # The Qt debug can also be enabled with the command:
+        #     export QT_LOGGING_RULES=*=true
+        # Then, run the /root/pyqt5test.py application.
+        msg = "Hello Buildroot."
+        cmd = f'/root/pyqt5test.py "{msg}"'
+        self.assertRunOk(cmd, timeout=30)
+
+        # We check the test message is present in the file created by
+        # the previous application execution.
+        cmd = f'grep -F "{msg}" /root/message.txt'
+        self.assertRunOk(cmd)
@@ -0,0 +1 @@
+CONFIG_DRM_VKMS=y
@@ -0,0 +1,60 @@
+#! /usr/bin/env python3
+#
+# This is a test application for PyQt5. It is showing a text label and
+# a "quit" button. The text of the label can be set with the first
+# (non-Qt) command line argument. A timer will send a click signal to
+# the quit button after 3 seconds. When quitting, the text of the
+# label is saved in a "message.txt" file in the current working
+# directory.
+
+import sys
+
+from PyQt5.QtCore import PYQT_VERSION_STR, QFile, QIODevice, QT_VERSION_STR, QTextStream, QTimer, Qt
+from PyQt5.QtWidgets import QApplication, QLabel, QPushButton, QVBoxLayout, QWidget
+
+
+class TestApp(QWidget):
+
+    def __init__(self, message, parent=None):
+        super(TestApp, self).__init__(parent)
+
+        self.label = QLabel(message)
+        self.label.setAlignment(Qt.AlignCenter)
+
+        self.button = QPushButton("Quit")
+        self.button.clicked.connect(self.on_button_clicked)
+
+        self.layout = QVBoxLayout()
+        self.layout.addWidget(self.label)
+        self.layout.addWidget(self.button)
+
+        self.setLayout(self.layout)
+
+        self.timer = QTimer()
+        self.timer.timeout.connect(self.button.click)
+
+    def on_button_clicked(self):
+        self.save_message()
+        app.quit()
+
+    def save_message(self):
+        f = QFile("message.txt")
+        if f.open(QIODevice.WriteOnly):
+            QTextStream(f) << (self.label.text() + '\n')
+        f.close()
+
+
+if __name__ == "__main__":
+    print("PyQt5 test for Buildroot")
+    print(f"Qt version {QT_VERSION_STR}")
+    print(f"PyQt version {PYQT_VERSION_STR}")
+
+    msg = "Hello World"
+    app = QApplication(sys.argv)
+    args = app.arguments()
+    if len(args) > 1:
+        msg = args[1]
+    testApp = TestApp(message=msg)
+    testApp.show()
+    testApp.timer.start(3000)
+    sys.exit(app.exec())
@@ -0,0 +1,79 @@
+import os
+
+import infra.basetest
+
+
+class TestUnbound(infra.basetest.BRTest):
+    rootfs_overlay = \
+        infra.filepath("tests/package/test_unbound/rootfs-overlay")
+    config = infra.basetest.BASIC_TOOLCHAIN_CONFIG + \
+        f"""
+        BR2_PACKAGE_UNBOUND=y
+        BR2_ROOTFS_OVERLAY="{rootfs_overlay}"
+        BR2_TARGET_ROOTFS_CPIO=y
+        # BR2_TARGET_ROOTFS_TAR is not set
+        """
+
+    def test_run(self):
+        cpio_file = os.path.join(self.builddir, "images", "rootfs.cpio")
+        self.emulator.boot(arch="armv5",
+                           kernel="builtin",
+                           options=["-initrd", cpio_file])
+        self.emulator.login()
+
+        # Check the program can execute.
+        self.assertRunOk("unbound -V")
+
+        # Verify that the configuration checker validates our file.
+        self.assertRunOk("unbound-checkconf")
+
+        # Our test configuration enabled the unbound remote
+        # control. The unbound server is supposed to be started by the
+        # sysv initscript. We should see the already running server.
+        out, ret = self.emulator.run("unbound-control status")
+        self.assertEqual(ret, 0)
+        self.assertRegex("\n".join(out), r"unbound \(pid \d+\) is running")
+
+        # We check the "unbound-host" program is working with a simple
+        # query. Note: this local query succeed even if the unbound
+        # server is not running. We are only testing this program
+        # here. The server side will be tested with the BusyBox
+        # "nslookup" applet.
+        out, ret = self.emulator.run("unbound-host -t A localhost.")
+        self.assertEqual(ret, 0)
+        self.assertEqual(out[0], "localhost. has address 127.0.0.1")
+
+        # We test few other "unbound-control" commands.
+        self.assertRunOk("unbound-control stats")
+        self.assertRunOk("unbound-control list_local_zones")
+
+        # We check we see our test IPv4 address record.
+        cmd = "nslookup -type=A somehost.buildroot.test."
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        self.assertIn("Address: 10.20.30.40", out)
+
+        # We also check we see our reverse record.
+        cmd = "nslookup 10.20.30.40"
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        expected = "40.30.20.10.in-addr.arpa\tname = somehost.buildroot.test"
+        self.assertIn(expected, out)
+
+        # We check we see our test text record.
+        cmd = "nslookup -type=TXT sometext.buildroot.test."
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        expected = "sometext.buildroot.test\ttext = \"Hello Buildroot TXT\""
+        self.assertIn(expected, out)
+
+        # We add a new record with unbound-control.
+        record_data = "someotherhost.buildroot.test. IN A 10.99.99.99"
+        cmd = f"unbound-control local_data \"{record_data}\""
+        self.assertRunOk(cmd)
+
+        # We check we see our new IPv4 address record.
+        cmd = "nslookup -type=A someotherhost.buildroot.test."
+        out, ret = self.emulator.run(cmd)
+        self.assertEqual(ret, 0)
+        self.assertIn("Address: 10.99.99.99", out)
@@ -0,0 +1,17 @@
+#
+# Unbound configuration file for Buildroot runtime test.
+#
+
+server:
+	do-ip6: no
+	local-zone: "test." nodefault
+	local-zone: "10.in-addr.arpa." nodefault
+	private-domain: "buildroot.test"
+	local-zone: "buildroot.test" static
+	local-data: "somehost.buildroot.test. IN A 10.20.30.40"
+	local-data: 'sometext.buildroot.test. TXT "Hello Buildroot TXT"'
+	local-data-ptr: "10.20.30.40 somehost.buildroot.test"
+
+remote-control:
+	control-enable: yes
+	control-use-cert: no
@@ -1,5 +1,12 @@
 #!/usr/bin/env python3
 # See utils/checkpackagelib/readme.txt before editing this file.
+# /// script
+# requires-python = ">=3.9"
+# dependencies = [
+#     "flake8",
+#     "python-magic",
+# ]
+# ///

 import argparse
 import inspect
@@ -241,6 +241,10 @@ async def fixup_config(sysinfo, configfile):
            configlines.remove('BR2_LINUX_KERNEL_SIMPLEIMAGE=y\n')
            configlines.append('BR2_LINUX_KERNEL_VMLINUX=y\n')

+    if 'BR2_LINUX_KERNEL=y\n' in configlines and \
+       'BR2_LINUX_KERNEL_IMAGE_TARGET_CUSTOM=y\n' in configlines:
+        configlines.remove('BR2_LINUX_KERNEL_IMAGE_TARGET_CUSTOM=y')
+
    if 'BR2_LINUX_KERNEL_EXT_AUFS=y\n' in configlines and \
       'BR2_LINUX_KERNEL_EXT_AUFS_VERSION=""\n' in configlines:
        configlines.remove('BR2_LINUX_KERNEL_EXT_AUFS=y\n')