Something happened to the tarball logic on github, changing the hash of the 1.5.11 release:
6a289406c1c0583763e5a9754e31a1eced55cd5f162a7bc2a3a315d5eb05c7a1 old/containerd-1.5.11.tar.gz
02b79d5e2b07b5e64cd28f1fe84395ee11eef95fc49fd923a9ab93022b148be6 new/containerd-1.5.11.tar.gz
-rw-r--r-- 1 peko peko 7494478 Apr 11 20:53 old/containerd-1.5.11.tar.gz
-rw-r--r-- 1 peko peko 7494477 Apr 5 20:39 new/containerd-1.5.11.tar.gz
Extracting and comparing them gives:
--- a/containerd-1.5.11/vendor/k8s.io/client-go/pkg/version/base.go 2022-03-24 01:09:42.000000000 +0100
+++ b/containerd-1.5.11/vendor/k8s.io/client-go/pkg/version/base.go 2022-03-24 01:09:42.000000000 +0100
@@ -55,7 +55,7 @@ var (
// NOTE: The $Format strings are replaced during 'git archive' thanks to the
// companion .gitattributes file containing 'export-subst' in this same
// directory. See also https://git-scm.com/docs/gitattributes
- gitVersion string = "v0.0.0-master+3df54a85234"
+ gitVersion string = "v0.0.0-master+3df54a8523"
gitCommit string = "3df54a852345ae127d1fa3092b95168e4a88e2f8" // sha1 from git, output of $(git rev-parse HEAD)
gitTreeState string = "" // state of git tree, either "clean" or "dirty"
The file in the repo uses $Format:%H$ and set the export-subst git attribute:
gitVersion string = "v0.0.0-master+$Format:%H$"
gitCommit string = "$Format:%H$" // sha1 from git, output of $(git rev-parse HEAD)
https://github.com/containerd/containerd/blob/main/vendor/k8s.io/client-go/pkg/version/base.go
So presumably it is related to that. In any case, update the hash to match
what Github is now serving to fix the build.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
- The rules for acceptance of records into the cache have been tightened to
prevent the possibility of poisoning if forwarders send records outside
the configured bailiwick. (CVE-2021-25220)
- TCP connections with keep-response-order enabled could leave the TCP
sockets in the CLOSE_WAIT state when the client did not properly shut down
the connection. (CVE-2022-0396)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 1fe5029122)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with BR2_SHARED_STATIC_LIBS:
CMake Error at src/CMakeLists.txt:56 (add_library):
add_library cannot create target "belr" because another target with the
same name already exists. The existing target is a static library created
in source directory
Fixes:
- http://autobuild.buildroot.org/results/d1ef96c8f370b5a522985c37f1681dd10bbc15bb
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
[Peter: simplify/add comment explaining why]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c9bee083e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with libressl > 2.7.0:
/nvmedata/autobuild/instance-21/output-1/host/opt/ext-toolchain/bin/../lib/gcc/microblaze-buildroot-linux-musl/11.2.0/../../../../microblaze-buildroot-linux-musl/bin/ld: /nvmedata/autobuild/instance-21/output-1/host/microblaze-buildroot-linux-musl/sysroot/usr/lib/libcrypto.a(x509_lu.c.o): in function `X509_OBJECT_get0_X509_CRL':
(.text+0xc3c): multiple definition of `X509_OBJECT_get0_X509_CRL'; /nvmedata/autobuild/instance-21/output-1/build/lftp-4.9.2/src/.libs/liblftp-network.a(liblftp_network_la-lftp_ssl.o):(.text+0x894): first defined here
Fixes:
- http://autobuild.buildroot.org/results/7fd1dfd5bc750ae5a3278ca950c838ae90704b23
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit e8394943e8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-1154: Use after free in utf_ptr2char in GitHub repository
vim/vim prior to 8.2.4646.
Fix CVE-2022-1160: heap buffer overflow in get_one_sourceline in GitHub
repository vim/vim prior to 8.2.4647.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit c96d6925f2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
gst1-plugins-bad needs C++ since switch to meson-package in commit
5d6c408e95:
The following exception(s) were encountered:
Running "/home/autobuild/autobuild/instance-8/output-1/host/bin/microblaze-buildroot-linux-musl-g++ --version" gave "[Errno 2] No such file or directory: '/home/autobuild/autobuild/instance-8/output-1/host/bin/microblaze-buildroot-linux-musl-g++'"
Rewriting the meson.build so it only requires C++ for the modules that
are actually written in C++ is quite complicated, so just let the whole
package depend on C++. Hopefully however this is going to be fixed in
some future release. Therefore, the dependencies for individual modules
are kept as well (even though they're redundant now).
Fixes:
- http://autobuild.buildroot.org/results/8f924cebeb8a1ed73e57103bf3073fb8f8d8752e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 129922140e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure without C++ raised since bump to version
1.18.0 in commit 15dc48ca9b:
The following exception(s) were encountered:
Running "/nvmedata/autobuild/instance-9/output-1/host/bin/or1k-buildroot-linux-musl-g++ --version" gave "[Errno 2] No such file or directory: '/nvmedata/autobuild/instance-9/output-1/host/bin/or1k-buildroot-linux-musl-g++'"
Fixes:
- http://autobuild.buildroot.org/results/8ac0ba5eaaf7571857b4d8cfabf1488d640dc59a
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 80a9e9057d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Update the qemu_xtensa_lx60_nommu_defconfig to use the
busybox-minimal.config.
After commit 3de486f8b0 ("package/busybox: fix udhcpc options in minimal
config"), this has the benefit of fixing the following network
initialization failure:
udhcpc: invalid option -- b
With the full busybox config, the -b option would still be passed and
udhcpc would fail to start for the reason above.
Note that on NOMMU, udhcpc backgrounds unconditionally (unless the -f
option is given), so it still behaves properly. The -b option in fact
only backgrounds after the lease is obtained; on NOMMU, backgrounding is
done before the lease is even requested. So the behaviour is more or
less the same, except that on MMU systems, networking can be considered
either up or not available after S20network, but on NOMMU there is no
such guarantee.
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Cc: Romain Naour <romain.naour@gmail.com>
Cc: Gerome Burlats <gerome.burlats@smile.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8f3cfe4196)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes:
http://autobuild.buildroot.net/results/194/1941e194e1f5ad0bc4982ad39c3e34d266bc49c6/
opus requires that it is configured with --enable-float-approx when
-ffast-math (BR2_OPTIMIZE_FAST) is used, otherwise it errors out at build
time:
celt/arch.h:198:2: error: #error Cannot build libopus with -ffast-math
unless FLOAT_APPROX is defined. This could result in crashes on extreme
(e.g. NaN) input
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 43e859d47a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with libressl raised since the addition
of the package in commit 3621918d1b:
/home/autobuild/autobuild/instance-10/output-1/build/ace-7.0.6/ace/SSL/SSL_Asynch_BIO.cpp:174:7: error: 'BIO_get_init' was not declared in this scope; did you mean 'BIO_set_init'?
174 | if (BIO_get_init(pBIO) == 0 || p_stream == 0 || buf == 0 || len <= 0)
| ^~~~~~~~~~~~
| BIO_set_init
Fixes:
- http://autobuild.buildroot.org/results/386afa88ac9e5e3bb65dddeabf610bb1e9bc4285
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 7da45d9b63)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
glib-networking raises the following build failure with libressl:
../tls/openssl/gtlsconnection-openssl.c: In function 'g_tls_connection_openssl_handshake_thread_request_rehandshake':
../tls/openssl/gtlsconnection-openssl.c:419:27: error: 'TLS1_3_VERSION' undeclared (first use in this function); did you mean 'TLS1_2_VERSION'?
419 | if (SSL_version(ssl) >= TLS1_3_VERSION)
| ^~~~~~~~~~~~~~
| TLS1_2_VERSION
../tls/openssl/gtlsconnection-openssl.c:419:27: note: each undeclared identifier is reported only once for each function it appears in
../tls/openssl/gtlsconnection-openssl.c:420:11: error: implicit declaration of function 'SSL_key_update' [-Werror=implicit-function-declaration]
420 | ret = SSL_key_update (ssl, SSL_KEY_UPDATE_REQUESTED);
| ^~~~~~~~~~~~~~
Since libressl doesn't (intend to) support post-1.0.2 openssl
compatibility, this is only going to get worse. Therefore, require
libopenssl.
Fixes:
- http://autobuild.buildroot.org/results/b8dea5704903c84858c7a339a73ecb713ac2791c
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e02514ad7a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised since the addition of the package
in commit 47acda3a95:
/home/autobuild/autobuild/instance-9/output-1/host/lib/gcc/sparc-buildroot-linux-uclibc/10.3.0/../../../../sparc-buildroot-linux-uclibc/bin/ld: src/libpsl.so.5.3.2.p/psl.c.o: in function `psl_str_to_utf8lower':
psl.c:(.text+0x1584): undefined reference to `libiconv_open'
Fixes:
- http://autobuild.buildroot.org/results/8f012331acd3edb96a69d374436884679add8860
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3239fb5b17)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Disable vsx to avoid the following build failure on ppc64 raised since
bump to version 1.3.3 in commit 89337e4f39
and
cdb030cd37:
In file included from lpc_intrin_vsx.c:46:
/home/autobuild/autobuild/instance-1/output-1/host/lib/gcc/powerpc64-buildroot-linux-gnu/9.4.0/include/altivec.h:34:2: error: #error Use the "-maltivec" flag to enable PowerPC AltiVec support
34 | #error Use the "-maltivec" flag to enable PowerPC AltiVec support
| ^~~~~
lpc_intrin_vsx.c: In function 'FLAC__lpc_compute_autocorrelation_intrin_power8_vsx_lag_16':
lpc_intrin_vsx.c:94:7: warning: implicit declaration of function 'vec_vsx_ld'; did you mean 'vec_vslh'? [-Wimplicit-function-declaration]
94 | d0 = vec_vsx_ld(0, base);
| ^~~~~~~~~~
| vec_vslh
Fixes:
- http://autobuild.buildroot.org/results/a97a0522c58964fa51815236bc39b378e10b5008
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5197ce5ff3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add a dependency on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS to avoid
the following build failure when GO_GOARCH is empty (e.g. on mips32)
which leads to an empty --arch argument in the sloci-image call, raised
since the addition of the package in commmit
ccda2f4bdc:
printf ' rm -rf /home/autobuild/autobuild/instance-6/output-1/images/rootfs-oci\n /home/autobuild/autobuild/instance-6/output-1/host/bin/sloci-image --arch --entrypoint "sh" --author "Buildroot" --user "0" /home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/oci/target /home/autobuild/autobuild/instance-6/output-1/images/rootfs-oci:latest\n' >> /home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/oci/fakeroot
chmod a+x /home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/oci/fakeroot
PATH="/home/autobuild/autobuild/instance-6/output-1/host/bin:/home/autobuild/autobuild/instance-6/output-1/host/sbin:/usr/local/sbin:/usr/local/bin:/usr/bin:/usr/lib/jvm/default/bin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl" FAKEROOTDONTTRYCHOWN=1 /home/autobuild/autobuild/instance-6/output-1/host/bin/fakeroot -- /home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/oci/fakeroot
rootdir=/home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/oci/target
table='/home/autobuild/autobuild/instance-6/output-1/build/buildroot-fs/full_devices_table.txt'
Usage:
sloci-image [options] ROOTFS NAME[:TAG]
sloci-image [-h | -V]
Create a single-layer OCI image with the given rootfs.
Arguments:
ROOTFS Directory or tar.gz archive with rootfs to pack into the image.
Important: Archive will be *moved* to the image, so make a copy if you
need it. Directory will be preserved.
NAME Name of the image.
TAG Tag for the image. Defaults to "latest".
Options:
-m --arch ARCH CPU architecture which the binaries in this image are built to run on.
Defaults to $(uname -m).
--arch-variant Variant of the CPU. This is typically used only for arm (v6, v7, v8).
-a --author NAME Name and/or email address of the person which created the image.
-c --cmd CMD Default arguments to the entrypoint of the container.
--debug Print debug messages (it can be also enabled with env. variable DEBUG).
-C --entrypoint EP Arguments to use as the command to execute when the container starts.
-e --env VAR=VAL Default environment variables for container.
-l --label KEY=VALUE Metadata for the container compliant with OCI annotation rules.
If KEY starts with a dot, it will be prefixed with
"org.opencontainers.image" (e.g. .url -> org.opencontainers.image.url).
--os OS Name of the OS which the image is built to run on. Defaults to "linux".
-p --port PORT[/PROT] Default set of ports to expose from a container running this image in
format: <port>/tcp, <port>/udp, or <port> (same as <port>/tcp).
Aliases: --expose.
-t --tar Pack image in a TAR archive.
-u --user USER The username or UID of user the process run as.
-v --volume PATH Default set of directories describing where the process is likely write
data specific to a container instance.
-w --working-dir DIR Sets the current working directory of the entrypoint process in the
container.
-V --version Print version and exit.
-h --help Print this message and exit.
Please report bugs at <https://github.com/jirutka/sloci-image/issues>.
make: *** [fs/oci/oci.mk:99: /home/autobuild/autobuild/instance-6/output-1/images/rootfs.oci] Error 1
Fixes:
- http://autobuild.buildroot.org/results/44da17a393421dfcb8bbdd63074cb82b436dfa94
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit efe832dbc3)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
ipmiutil depends on dynamic library since commit
670095b473 so test on BR2_STATIC_LIBS
added by commit 9f31cd14d0 is not needed
anymore
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit cdc2a52a0f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
udpcast unconditionally build manpages which will raise the following
build failure without pod2man since at least bump to version 20200328 in
commit 4fb91d8b9d:
sh: line 1: pod2man: command not found
To fix this issue, rework how udpcast is built and installed to always
build and install the sender or the receiver and never build the
manpages. As a side effect, this will also avoid to install the unneeded
rateGovernor.h
Fixes:
- http://autobuild.buildroot.org/results/ce602a09357e950d79794391cd4a852d565914f1
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b49e3da1ab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
An out-of-bounds array read in the apr_time_exp*() functions was fixed
in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix
for this issue was not carried forward to the APR 1.7.x branch, and
hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the
same issue.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 10d80eb39a)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure with uclibc-ng and grpc raised on arm
and ppc:
/home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/buildroot/autobuild/instance-0/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libabsl_random_internal_randen_hwaes.so.2111.0.0: undefined reference to `getauxval'
Strangely enough it seems there is only one autobuilder failure despite
the fact that libabseil-cpp is unconditionally using getauxval since its
addition in commit 93568440ed:
https://github.com/abseil/abseil-cpp/blob/20200225/absl/random/internal/randen_detect.cc
Perhaps this build failure is an unexpected side effect of commit
8251d8c255
Fixes:
- http://autobuild.buildroot.org/results/775f3ca3dedebff29e212b29dfa896b7613b7a02
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1a3de362ae)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Handle WITH_POWER8 to fix the following build failure with powerpc and
libglib2 raised since bump to version 1.9.9-b1 in commit
1f7b12a0b4 and
b81f4ee96d:
/home/autobuild/autobuild/instance-9/output-1/host/lib/gcc/powerpc-buildroot-linux-musl/11.2.0/../../../../powerpc-buildroot-linux-musl/bin/ld: /home/autobuild/autobuild/instance-9/output-1/host/powerpc-buildroot-linux-musl/sysroot/usr/lib/libz.a(adler32_power8.c.o): in function `adler32_power8':
/home/autobuild/autobuild/instance-9/output-1/build/zlib-ng-2.0.6/arch/power/adler32_power8.c:106: undefined reference to `vec_sumsu'
Fixes:
- http://autobuild.buildroot.org/results/f864a0e2307e25342b45c90a5b4fb57a0f5c1c93
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 192dfc68c0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Disable tests which are enabled by default in debug mode since bump to
version 2.0.0 in commit 2a3edc5e00 and
e84f12fc5e
as they will raise the following build failure if cmocka is built before
libyang:
In file included from /home/buildroot/autobuild/instance-0/output-1/host/riscv64-buildroot-linux-musl/sysroot/usr/include/stdint.h:20,
from /home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/lib/gcc/riscv64-buildroot-linux-musl/10.3.0/include/stdint.h:9,
from /home/buildroot/autobuild/instance-0/output-1/build/libyang-2.0.112/src/libyang.h:18,
from /home/buildroot/autobuild/instance-0/output-1/build/libyang-2.0.112/tests/utests/utests.h:30,
from /home/buildroot/autobuild/instance-0/output-1/build/libyang-2.0.112/tests/utests/extensions/test_yangdata.c:15:
/home/buildroot/autobuild/instance-0/output-1/host/riscv64-buildroot-linux-musl/sysroot/usr/include/bits/alltypes.h:53:24: error: conflicting types for 'uintptr_t'
53 | typedef unsigned _Addr uintptr_t;
| ^~~~~~~~~
Fixes:
- http://autobuild.buildroot.org/results/7ae21fbb28b1a69183c5d8ed87cf5f5cbf055026
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ea6cc91be4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Replace the remaining git:// URLs with their https:// equivalents as
this is more secure and also more palatable to corporate firewalls.
Signed-off-by: Markus Mayer <mmayer@broadcom.com>
[yann.morin.1998@free.fr: convert dahdi-linux too]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 6626bf7c5f)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
pkg-stats currently uses the services from support/scripts/cpedb.py to
match the CPE identifiers of packages with the official CPE database.
Unfortunately, the cpedb.py code uses regular ElementTree parsing,
which involves loading the full XML tree into memory. This causes the
pkg-stats process to consume a huge amount of memory:
thomas 1310458 85.2 21.4 3708952 3450164 pts/5 R+ 16:04 0:33 | | \_ python3 ./support/scripts/pkg-stats
So, 3.7 GB of VSZ and 3.4 GB of RSS are used by the pkg-stats
process. This is causing the OOM killer to kick-in on machines with
relatively low memory.
This commit reimplements the XML parsing needed to do the CPE matching
directly in pkg-stats, using the XmlParser functionality of
ElementTree, also called "streaming parsing". Thanks to this, we never
load the entire XML tree in RAM, but only stream it through the
parser, and construct a very simple list of all CPE identifiers. The
max memory consumption of pkg-stats is now:
thomas 1317511 74.2 0.9 381104 152224 pts/5 R+ 16:08 0:17 | | \_ python3 ./support/scripts/pkg-stats
So, 381 MB of VSZ and 152 MB of RSS, which is obviously much better.
The JSON output of pkg-stats for the full package set, before and after
this commit, is exactly identical.
Now, one will probably wonder why this isn't directly changed in
cpedb.py. The reason is simple: cpedb.py is also used by
support/scripts/missing-cpe, which (for now) heavily relies on having
in memory the ElementTree objects, to re-generate a snippet of XML
that allows us to submit to NIST new CPE entries.
So, future work could include one of those two options:
(1) Re-integrate cpedb.py into missing-cpe directly, and live with
two different ways of processing the CPE database.
(2) Rewrite the missing-cpe logic to also be compatible with a
streaming parsing, which would allow this logic to be again
shared between pkg-stats and missing-cpe.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr:
- add missing import of requests
- import CPEDB_URL from cpedb, instead of duplicating it
- fix flake8 errors
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit bd1798ad95)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Some upstream sites are very slow to respond, and the default timeout
of 300 seconds of the aiohttp.ClientSession() is too long. Let's
reduce it to 15 seconds.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 387c496b98)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When libxkbcommon is disabled, QT_CONFIG(xkbcommon) is not defined which
means the variable and function pointer in this patch are compiled out
from the header, but the cpp code actually still made use of it. This
patch fixes the build issue when libxkbcommon package is not to be
built.
This patch was taken from (merged):
https://codereview.qt-project.org/c/qt/qtwayland/+/344916
Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1da911cbde)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
qt5wayland package currently has a bug if the xkbcommon Qt config is not
enabled which highlighted a race issues between qt5base, libxkbcommon
and qt5wayland.
qt5wayland has a dependency on libxkbcommon package if it's enabled.
qt5base only has a dependency on libxkbcommon if xcb support is to be
enabled.
If libxkbcommon package is built before qt5base, qt5base will detect it
during its configure step and enable the Qt config accordingly. This
will make it available to qt5wayland afterwards, even if xcb support is
not enabled in Buildroot Kconfig.
However, if qt5base is built before libxkbcommon is, qt5base will not
advertise support of xbcommon feature to qt5wayland (which will fail its
build because of a bug in the source code).
Since the package build order should not impact the outcome of the
build, let's explicit the dependency if and only if libxkbcommon package
is to be compiled at some point in time so that at least this feature is
not susceptible to races.
Move the xkbcommon entries out of the BR2_PACKAGE_QT5BASE_XCB condition,
instead make them depend on BR2_PACKAGE_LIBXKBCOMMON. Since
BR2_PACKAGE_QT5BASE_XCB selects BR2_PACKAGE_LIBXKBCOMMON they are still
included if xcb is selected.
Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
[Arnout: remove the already existing xkbcommon entries]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit ba8f35eda6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised on uclibc and musl since the
addition of libexecinfo package in commit
eea8ba446c:
/home/peko/autobuild/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: dbus/sigsegv.c.17.o: in function `signal_segv':
sigsegv.c:(.text+0x98): undefined reference to `backtrace'
Fixes:
- http://autobuild.buildroot.org/results/dca49cb9b3e66fac921601560e9358bcce9acffc
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 930db465d9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The busybox-minimal.config, which is used by systems without an MMU, specifies
the "-b" command line option for udhcpc. However, this option is not supported
by BusyBox udhcpc anymore since version 1.27.0 when building for systems
without an MMU.
Remove the "-b" option from busybox-minimal.config to repair network
initialization on systems without an MMU.
This fixes the following network initialization failure:
udhcpc: invalid option -- b
FAIL
Signed-off-by: Vincent Stehlé <vincent.stehle@laposte.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3de486f8b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libsndfile is only needed to build jackrec example client
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 9a78a75613)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libsamplerate is only needed to build the NetJack backend and internal
client
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 05bbdfa382)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure without threads and openvpn raised since
commit 0199dc1617:
/home/giuliobenetti/autobuild/run/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabihf/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabihf/bin/ld: /home/giuliobenetti/autobuild/run/instance-0/output-1/host/arm-buildroot-linux-uclibcgnueabihf/sysroot/usr/lib/libpkcs11-helper.so: undefined reference to `_pkcs11h_slotevent_init'
Fixes:
- http://autobuild.buildroot.org/results/fcaa70cc035d6f9d35dfa8d564e9948c7e1cfd9e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d76b7564f1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
4.4.x is now EOL, so no more updates for that series.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
(cherry picked from commit 607c5986a9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
CVE-2021-38593 fixes originally missed a usecase that was covered by the
to-be-removed patch. However, this patch was incorrect and added some
issues on its own, which was then fixed by now-removed
0012-Refix-for-avoiding-huge-number-of-tiny-dashes.patch.
Unfortunately for us, the to-be-removed patch (fixed by
0012-Refix-for-avoiding-huge-number-of-tiny-dashes.patch) can actually
be applied (with fuzz; by `patch` only) on top of the now-removed patch.
When the move to KDE Qt fork was made, some patches were removed as they
were already part of the new git fork. However, the to-be-removed patch
was not. This means the
0012-Refix-for-avoiding-huge-number-of-tiny-dashes.patch was actually
undone when Buildroot patched qt5base.
Let's remove this patch to fix this oversight.
As a reference:
e7ea2ed27c Improve fix for avoiding huge number of tiny dashes
fixed by
65b3aa6a1c Refix for avoiding huge number of tiny dashes
in the git repo.
Fixes: 5770a645a3 "package/qt5: bump packages to latest kde submodule versions"
Cc: Quentin Schulz <foss+buildroot@0leil.net>
Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com>
[Arnout: renumber patches 0007 and 0008]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3857bccca5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised since bump to version 0.40.2 in
commit 6acdbb81c8:
[108/298] Generating src/librygel-core/RygelCore-2.6.typelib with a custom command
FAILED: src/librygel-core/RygelCore-2.6.typelib
/home/giuliobenetti/autobuild/run/instance-3/output-1/host/nios2-buildroot-linux-gnu/sysroot/usr/bin/g-ir-compiler --output src/librygel-core/RygelCore-2.6.typelib /home/giuliobenetti/autobuild/run/instance-3/output-1/build/rygel-0.40.2/build/src/librygel-core/RygelCore-2.6.gir
Could not find GIR file 'GUPnP-1.2.gir'; check XDG_DATA_DIRS or use --includedir
error parsing file /home/giuliobenetti/autobuild/run/instance-3/output-1/build/rygel-0.40.2/build/src/librygel-core/RygelCore-2.6.gir: Failed to parse included gir GUPnP-1.2
Fixes:
- http://autobuild.buildroot.org/results/2b8956818f03f66a53480f7ed5fc0abb4f05288d
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 94515b902c)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Enable the python-rpi-gpio package on 64-bit ARM architectures. I've tested
this with a Raspberry Pi 4 64-bit and Python 3 build and it works as expected.
Signed-off-by: Mirza Kapetanovic <mirza.kapetanovic@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 45f2609ca2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
When generating a filesystem image on a power10 build machine running
Ubuntu, we see a segfault when fakeroot is running chmod.
This has been reported and fixed upstream in Debian in version 1.26-1.2:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=995393#53
Add the same patch to resolve the segfault.
Signed-off-by: Joel Stanley <joel@jms.id.au>
[Arnout: add patch signoff and give proper name (check-package)]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a38c6827db)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
I'm involved in the upstream kvm-unit-tests and the mcf5208 QEMU
machine, so I could help to have a look on these files, too.
Signed-off-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 3396e945df)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Switch to autotools-package to avoid the following static build failure
since commit d661740201:
[ 56%] Linking C executable rtl_biast
/home/peko/autobuild/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/riscv64-buildroot-linux-musl/10.3.0/../../../../riscv64-buildroot-linux-musl/bin/ld: attempted static link of dynamic object `/home/peko/autobuild/instance-1/output-1/host/riscv64-buildroot-linux-musl/sysroot/lib/libatomic.so'
collect2: error: ld returned 1 exit status
Drop both cmake-related patches
Fixes:
- http://autobuild.buildroot.org/results/cf84759682848db8ed5610e1abe5a92337d0e957
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 26a16ed9d8)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Writing into /dev/urandom doesn't actually credit any entropy bits. And
while it adds that data to the entropy pool, it won't actually be
immediately used when reading from /dev/urandom subsequently. This is
how the kernel's /dev/urandom has always worked, unfortunately.
As a result of this behavior, which may be understandably surprising,
writing a good seed file into /dev/urandom and then saving a new seed
file immediately after is dangerous, because the new seed file may wind
up being entirely deterministic, even if the old seed file was quite
good.
This has been fixed in systemd with
<da2862ef06>,
and fortunately it's possible to do the same thing in shell script here.
Specifically, instead of just saving new /dev/urandom output straight
up, we hash the new /dev/urandom together with the old seed, in order to
produce the new seed. This way the amount of entropy in the new seed
will stay the same or get better, but not appreciably regress.
At the same time, the pool size check in this script is useless. Writing
to /dev/urandom never credits bits anyway, so no matter what, writing
into /dev/urandom is useful and not harmful. There's also not much of a
point in seeding with more than 256 bits, which is what the hashing
operation above produces. So this commit removes the file size check.
As a final note, while this commit improves upon the status quo by
removing a vulnerability, this shell script still does not actually
initialize the RNG like it says it does. For initialization via a seed
file, the RNDADDENTROPY ioctl must be used but there's currently no way
to do that from a shell script for now.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit f0986de551)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-21716: Twisted is an event-based framework for internet
applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH
client and server implement is able to accept an infinite amount of data
for the peer's SSH version identifier. This ends up with a buffer using
all the available memory. The attach is a simple as `nc -rv localhost 22
< /dev/zero`. A patch is available in version 22.2.0. There are
currently no known workarounds.
https://github.com/twisted/twisted/releases/tag/twisted-22.2.0
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 92a3ca0932)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-26495: In nbd-server in nbd before 3.24, there is an
integer overflow with a resultant heap-based buffer overflow. A value of
0xffffffff in the name length field will cause a zero-sized buffer to be
allocated for the name, resulting in a write to a dangling pointer. This
issue exists for the NBD_OPT_INFO, NBD_OPT_GO, and NBD_OPT_EXPORT_NAME
messages.
Fix CVE-2022-26496: In nbd-server in nbd before 3.24, there is a
stack-based buffer overflow. An attacker can cause a buffer overflow in
the parsing of the name field by sending a crafted NBD_OPT_INFO or
NBD_OPT_GO message with an large value as the length of the name.
https://github.com/NetworkBlockDevice/nbd/compare/nbd-3.21...nbd-3.24
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit bf2e459bb9)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
openssl is mandatory since bump to version 9.16.26 in commit
8adeaec8af so move openssl variables in
the beginning of bind.mk instead of keeping them in the middle of the
file. Moreover, drop "BIND_DEPENDENCIES += host-pkgconf zlib" as
host-pkgconf is already mandatory
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 4b127b0c1b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
host-odb installs the ODB compiler, which when executed at runtime,
needs access to the libodb headers. This is a runtime dependency,
normally added in Config.in, but for host packages there is no way to
express a runtime dependency. In order to have them installed, add a
dependency on host-libodb.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com>
[Kamel: Add optional host-libodb-boost dependency]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 88471fe4fd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Add host variant of libodb-boost required by the ODB compiler.
The libodb-boost headers are needed at compile time, and
therefore installed in $(HOST_DIR).
Signed-off-by: Kamel Bouhara <kamel.bouhara@bootlin.com>
[Arnout: add -std=c++11]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit e2f1f28efd)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit adds support for a new type of graph, showing the timeline
of a build. It shows, with one line per package, when each of this
package steps started/ended, and therefore allows to see the
sequencing of the package builds.
For a fully serialized build like we have today, this is not super
useful (except to show that everything is serialized), but it becomes
much more useful in the context of top-level parallel build.
We chose to order the graph by the time-of-configure, as it is the
closest to the actual cascade-style of a true dependency graph, which is
tiny bit more complex to achieve properly. The actual result still looks
pretty good.
The graph-build make target is extended to also generate this new
timeline graph.
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr:
- sort by start-of-configure time
- re-use existing colorsets (default or alternate)
- fix python2isms
- fix check-package
]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 5e8b01afd5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
A malformed input file can lead to a segfault due to an out of bounds
array access in raptor_xml_writer_start_element_common.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2fca33462b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix CVE-2022-24128: Timescale TimescaleDB 1.x and 2.x before 2.5.2 may
allow privilege escalation during extension installation. The
installation process uses commands such as CREATE x IF NOT EXIST that
allow an unprivileged user to precreate objects. These objects will be
used by the installer (which executes as Superuser), leading to
privilege escalation. In order to be able to take advantage of this, an
unprivileged user would need to be able to create objects in a database
and then get a Superuser to install TimescaleDB into their database. (In
the fixed versions, the installation aborts when it finds that an object
already exists.)
"This release contains bug fixes since the 2.5.1 release.
This release is high priority for upgrade. We strongly recommend that
you upgrade as soon as possible."
https://github.com/timescale/timescaledb/releases/tag/2.5.2
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
(cherry picked from commit 3398e8e6d4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
It seems reasonable to expect that the download of the host and target
variants should usually be exactly the same and thus reuse the target
package values for the host package. This commits add support to
inherit host _DL_SUBDIR, _DOWNLOAD_DEPENDENCIES, _DL_ENV and
_DOwNLOAD_POST_PROCESS variables from target ones. These variables can
still be overriden if necessary for the host package.
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
Signed-off-by: Clément Léger <clement.leger@bootlin.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit efa7712b09)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1
allows a remote web server to exfiltrate media files.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c7520b7ea1)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
An out of bounds read was found in Wavpack 5.4.0 in processing *.WAV
files. This issue triggered in function WavpackPackSamples of file
src/pack_utils.c, tainted variable cnt is too large, that makes pointer
sptr read beyond heap bound.
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit a9bff8a0b0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This has been like tht for ages (probably an implicit dependency check
in older versions), but now wget has explicit flags, so let's use them.
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
[yann.morin.1998@free.fr: expand commit log]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit b0fc0a811b)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This reverts commit cf0c9830c0.
This doesn't work with the gnupg v1/v2 handling here:
package/gcr/Config.in:1:error: recursive dependency detected!
package/gcr/Config.in:1: symbol BR2_PACKAGE_GCR depends on BR2_PACKAGE_GNUPG
package/gnupg/Config.in:1: symbol BR2_PACKAGE_GNUPG is selected by BR2_PACKAGE_GNUPG2
package/gnupg2/Config.in:5: symbol BR2_PACKAGE_GNUPG2 is selected by BR2_PACKAGE_GCR
For a resolution refer to Documentation/kbuild/kconfig-language.txt
subsection "Kconfig recursive dependency limitations"
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The check_package_get_latest_version_by_distro() function analyzes the
data returned by release-monitoring.org. For two of our
packages (bento4 and qextserialport), release-monitoring.org returns
something that is a bit odd: it returns an entry with a
"stable_versions" field that contains an empty array. Our code was
ready to have or not have a "stable_versions" entry, but when it is
present, we assumed it was not an empty array. These two packages, for
some reason, break this assumption.
In order to solve this problem, this commit is more careful, and uses
the stable_versions field only if it exists and it has at least one
entry. The code is also reworked as a sequence of "if...elif...else"
to be more readable.
This fixes the following exception when running pkg-stats on the full
package set:
Task exception was never retrieved
future: <Task finished name='Task-10772' coro=<check_package_latest_version_get() done, defined at ./support/scripts/pkg-stats:532> exception=IndexError('list index out of range')>
Traceback (most recent call last):
File "./support/scripts/pkg-stats", line 535, in check_package_latest_version_get
if await check_package_get_latest_version_by_distro(session, pkg):
File "./support/scripts/pkg-stats", line 489, in check_package_get_latest_version_by_distro
version = data['stable_versions'][0] if 'stable_versions' in data else data['version'] if 'version' in data else None
IndexError: list index out of range
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
[yann.morin.1998@free.fr: non-sequence tests as True]
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit c72f3f2b43)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
alsa-lib is optional, not mandatory, since the addition of the package
in commit 18a8630637
Moreover, alsa support depends on BR2_PACKAGE_ALSA_LIB_SEQ (otherwise,
it is silently disabled)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 2fc2191845)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised since the addition of the package
in commit 18a8630637:
/home/giuliobenetti/autobuild/run/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/riscv64-buildroot-linux-musl/10.3.0/../../../../riscv64-buildroot-linux-musl/bin/ld: libzynaddsubfx_core.a(Master.cpp.o): in function `.L1880':
Master.cpp:(.text+0x7cc0): undefined reference to `__atomic_exchange_1'
Fixes:
- http://autobuild.buildroot.org/results/91b5959ca0eb136c1609462e71d109ff09cca5e5
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit ba7319a06e)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Changes between 1.1.1m and 1.1.1n [15 Mar 2022]
*) Fixed a bug in the BN_mod_sqrt() function that can cause it to loop forever
for non-prime moduli.
Internally this function is used when parsing certificates that contain
elliptic curve public keys in compressed form or explicit elliptic curve
parameters with a base point encoded in compressed form.
It is possible to trigger the infinite loop by crafting a certificate that
has invalid explicit curve parameters.
Since certificate parsing happens prior to verification of the certificate
signature, any process that parses an externally supplied certificate may
thus be subject to a denial of service attack. The infinite loop can also
be reached when parsing crafted private keys as they can contain explicit
elliptic curve parameters.
Thus vulnerable situations include:
- TLS clients consuming server certificates
- TLS servers consuming client certificates
- Hosting providers taking certificates or private keys from customers
- Certificate authorities parsing certification requests from subscribers
- Anything else which parses ASN.1 elliptic curve parameters
Also any other applications that use the BN_mod_sqrt() where the attacker
can control the parameter values are vulnerable to this DoS issue.
(CVE-2022-0778)
[Tomáš Mráz]
*) Add ciphersuites based on DHE_PSK (RFC 4279) and ECDHE_PSK (RFC 5489)
to the list of ciphersuites providing Perfect Forward Secrecy as
required by SECLEVEL >= 3.
[Dmitry Belyavskiy, Nicola Tuveri]
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 66868e9fab)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
In the list of full distribution, the FAQ contains a link to Emdebian.
This project stopped receiving updates in 2014 and the main web page does not exist anymore.
This replace the entry with a link to the Debian ports page.
Signed-off-by: Yannick Brosseau <yannick.brosseau@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit db2b8a1ce2)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Drop -DHAVE_DNSSEC_STATIC which has been added by commit
e913527b94 but is not needed and raises
the following static build failure because dnsmasq will wrongly append
"-Wl,-Bstatic -lgmp -Wl,-Bdynamic":
/home/buildroot/autobuild/instance-2/output-1/host/bin/x86_64-linux-gcc -static -o dnsmasq cache.o rfc1035.o util.o option.o forward.o network.o dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o pattern.o domain.o dnssec.o blockdata.o tables.o loop.o inotify.o poll.o rrfilter.o edns0.o arp.o crypto.o dump.o ubus.o metrics.o hash-questions.o domain-match.o -Wl,-Bstatic -L/home/buildroot/autobuild/instance-2/output-1/host/bin/../x86_64-buildroot-linux-musl/sysroot/usr/lib -lhogweed -lgmp -lnettle -Wl,-Bdynamic -Wl,-Bstatic -lgmp -Wl,-Bdynamic
/home/buildroot/autobuild/instance-2/output-1/host/opt/ext-toolchain/bin/../lib/gcc/x86_64-buildroot-linux-musl/10.3.0/../../../../x86_64-buildroot-linux-musl/bin/ld: attempted static link of dynamic object `/home/buildroot/autobuild/instance-2/output-1/host/x86_64-buildroot-linux-musl/sysroot/lib/../lib64/libc.so'
Strangely enough, this is the first time this build failure is raised by
the autobuilders whereas "-Wl,-Bdynamic" is set since a very long time:
https://thekelleys.org.uk/gitweb/?p=dnsmasq.git;a=commit;h=c979fa04a40ff12370c8d3a82ad27d9d3b5907e3
Fixes:
- http://autobuild.buildroot.org/results/99b419ddb5a3be561d39e715833510a59519213e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit b6a4453bd7)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
libfcgi raises the following build failure with glibc 2.34 and gcc
11.2.0:
In file included from /home/peko/autobuild/instance-1/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/features.h:488,
from /home/peko/autobuild/instance-1/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/bits/libc-header-start.h:33,
from /home/peko/autobuild/instance-1/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/stdio.h:27,
from /home/peko/autobuild/instance-1/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/fcgi_stdio.h:18,
from boinc_fcgi.h:19,
from coproc.cpp:22:
/home/peko/autobuild/instance-1/output-1/host/arm-buildroot-linux-gnueabihf/sysroot/usr/include/wchar.h:582:24: error: 'malloc' attribute argument 1 is ambiguous
582 | __attribute_malloc__ __attr_dealloc_fclose;
| ^~~~~~~~~~~~~~~~~~~~~
RawTherapee has the same kind of issue:
- https://github.com/Beep6581/RawTherapee/issues/6324
- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101747
Fixes:
- http://autobuild.buildroot.org/results/232dae62570ed7927a10864d83dccaf9b6214500
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 54cb3b506d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Since gcr selects gnupg2, it's incompatible with gnupg. Add this
dependency and corresponding comment.
While we're at it, also hide the existing comment when
!BR2_PACKAGE_LIBGPG_ERROR_ARCH_SUPPORTS.
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 5783a418f4)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Just like aarch64, aarch64 BE supports the Image and Image.gz format.
Signed-off-by: Rémi Duraffort <remi.duraffort@linaro.org>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d1579589e0)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This adds two extra commands to install dbus policy config
to target if dbus option is enabled.
Signed-off-by: Yunhao Tian <t123yh.xyz@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit d749634006)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
netsnmp support needs mib to avoid the following build failure raised
since the addition of the package in commit
42382a1712:
checks_snmp.c: In function ‘zbx_snmp_get_octet_string’:
checks_snmp.c:694:35: error: invalid use of undefined type ‘struct tree’
694 | hint = (NULL != subtree ? subtree->hint : NULL);
| ^~
Fixes:
- No autobuilder failures (yet)
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 77f9d2d6a6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fix the following build failure raised on uclibc and musl since the
addition of libexecinfo package in commit
eea8ba446c:
/home/peko/autobuild/instance-1/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/10.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: ../../build/lib/libvcos.so: undefined reference to `backtrace_symbols'
Fixes:
- http://autobuild.buildroot.org/results/93d3b8cc2ac5dfa9d4b44946c0b4d8171e8f52a1
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit bc4cc27705)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Without musl-root in config.toml the build stop with the following error:
thread 'main' panicked at 'couldn't find libc.a in musl libdir: output/host/arm-buildroot-linux-musleabihf/sysroot/lib/lib', src/bootstrap/sanity.rs:192:25
musl-root is needed to provide the path to libc.a and libunwind.a because
rust link them statically into the standard library and liblibc [1].
For other libc, musl-root is not used and ignored [2].
[1] cd980b3bee
[2] https://github.com/rust-lang/rust/blob/1.58.1/src/bootstrap/sanity.rs#L181
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit a41b0f31de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
bpftool uses its own local copy of libbpf so add
BR2_PACKAGE_BPFTOOL_ARCH_SUPPORTS to avoid the following build failure
on ARM:
btf.c: In function 'btf_type_by_id':
btf.c:461:14: warning: comparison between signed and unsigned integer expressions [-Wsign-compare]
if (type_id < btf->start_id)
^
bpf.c:62:4: error: #error __NR_bpf not defined. libbpf does not support your arch.
# error __NR_bpf not defined. libbpf does not support your arch.
^
Fixes:
- http://autobuild.buildroot.org/results/aae772f1cfb16516a57f310c4f022e80a2a8d65e
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit c750dd4e5d)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
The test TestRust is currently broken with ripgrep package with
the following error:
error[E0514]: found crate `core` compiled by an incompatible version of rustc
|
= help: please recompile that crate using this compiler (rustc 1.58.1) (consider running `cargo clean` first)
= note: the following crate versions were found:
crate `core` compiled by rustc 1.58.1 (db9d1b20b 2022-01-20): TestRust/host/lib/rustlib/x86_64-unknown-linux-gnu/lib/libcore-6cfcec236d576603.rlib
error[E0514]: found crate `std` compiled by an incompatible version of rustc
The problem is not really a cross-compilation issue (we are building
for an armv7 target on x86_64 host) but a problem with rust-std libraries
(rlib).
We can notice that "rustc 1.58.1 (db9d1b20b 2022-01-20)" is the same
version as the prebuilt rustc used to bootstrap the build:
TestRust/host/bin/rustc --version
rustc 1.58.1
TestRustBin/host/bin/rustc --version
rustc 1.58.1 (db9d1b20b 2022-01-20)
Indeed we are using host-rust-bin to bootstrap the host-rust compiler
package built by Buildroot. The problem is that the
libcore-6cfcec236d576603.rlib file come from host-rust-bin (rust-std)
and is not removed before installing host-rust built by Buildroot.
We actually spent a lot of time to build host-rust with rust-std
and forget to install this important library HOST_DIR.
Looking at the host-rust build directory we can notice two installer
script "install.sh" (the same scripts used to install host-rust-bin):
TestRust/build/host-rust-1.58.1/build/tmp/tarball/rust/x86_64-unknown-linux-gnu/rust-1.58.1-x86_64-unknown-linux-gnu/install.sh
TestRust/build/host-rust-1.58.1/build/tmp/tarball/rust-std/armv7-unknown-linux-gnueabihf/rust-std-1.58.1-armv7-unknown-linux-gnueabihf/install.sh
The "tarball" directory is generated by the "python x.py dist" during
the install step, we have to keep it.
Replace "python x.py install" by theses two install scripts.
Installing rust-std with the install.sh script replace the rust-std
libraries installed by host-rust-bin.
Fixes:
https://gitlab.com/buildroot.org/buildroot/-/jobs/2116202544
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
[Arnout: remove redundant parenthesis; only use a variable for the
common install opts]
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 1568249391)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
TestRust and TestRustBin has been introduced at the time when there was
no cargo package infrastructure or any package using rust compiler
(Buildroot 2018.02).
Since then the ripgrep package has been introduced, initially using
the generic package infrastructure and converted later to the cargo
package infrastructure.
Due a recent change in rust/cargo removing the cargo config file [1]
the test TestRust and TestRustBin now fail to compile since they build
an hello-world crate outside of the cargo package infrastructure
without the correct environment for cross-compiling.
Replace the 'hello-world' crate by ripgrep package and check if it
can run properly in Qemu.
Fixes tests.package.test_rust.TestRustBin:
https://gitlab.com/buildroot.org/buildroot/-/jobs/2116202545
But doesn't fixes tests.package.test_rust.TestRust due another bug:
https://gitlab.com/buildroot.org/buildroot/-/jobs/2116202544
[1] b6378631c2
Signed-off-by: Romain Naour <romain.naour@gmail.com>
Cc: Eric Le Bihan <eric.le.bihan.dev@free.fr>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit f0d1f21195)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- add upstream patch ([1]) to fix '-fzero-call-used-regs' gcc compiler option
support detection
- add autoreconf as the patch touches m4/openssh.m4
Fixes:
- https://bugs.busybox.net/show_bug.cgi?id=14651
bitmap.c: In function ‘reserve’:
bitmap.c:98:1: sorry, unimplemented: ‘-fzero-call-used-regs’ not supported on this target
98 | }
| ^
[1] f107467179.patch
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 66fd92a4ce)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
BIND 9.11 EOL in March, 2022. BIND 9.16 is current Stable/ESV version.
Changes:
* libuv (new dependency)
* openssl is now mandatory
* zlib must be detected with PKG_CONFIG_PATH (specifying zlib
installation path is not supported)
* bind9-config and isc-config.sh removed
* updated COPYRIGHT hash
Signed-off-by: Petr Vorel <petr.vorel@gmail.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 8adeaec8af)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Fixes the following security issues:
- CVE-2022-24303: In show_file, use os.remove to remove temporary images
- CVE-2022-22817: Restrict builtins within lambdas for ImageMath.eval
Signed-off-by: Angelo Compagnucci <angelo@amarulasolutions.com>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 07b070be39)
[Peter: mention security fixes]
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Different shells can have different behaviours when it comes to globbing
patterns. The dash shell (/bin/sh) on Debian testing switched to a
different fnmatch/glob implementation that results in this new behaviour:
Using bash:
$ mkdir /tmp/foo
$ echo /tmp/foo/.[^.]*
/tmp/foo/.[^.]*
Using dash:
$ mkdir /tmp/foo
$ echo /tmp/foo/.[^.]*
/tmp/foo/..
The current FAKEROOT script uses this shell glob pattern which now fails
on recent Debian testing systems:
rm: refusing to remove '.' or '..' directory: skipping '/build/buildroot-fs/cpio/target/run/..'
rm: refusing to remove '.' or '..' directory: skipping '/build/buildroot-fs/cpio/target/tmp/..'
Additionally, the glob will miss files which have at least two leading
dots, like ..foo ...bar or ......buz (highly improbable, but still).
It seems safer to use `find | xargs rm` here instead of relying on shell
globbing patterns.
Signed-off-by: Mathieu Mirmont <mat@parad0x.org>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 38c4f6b807)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
- remove 001-dpp-fix-implicit-declaration-of-function-explicit_bz.patch
(upstream applied [1])
- Changelog (since 1.21, from [2]):
ver 1.24:
Fix issue with handshake and missing rekeying support.
Fix issue with BSS ranking and zero signal strength.
Fix issue with setting OWE IE length correctly.
ver 1.23:
Fix issue with handling handshake offloading.
Fix issue with at_console and D-Bus policy.
ver 1.22:
Fix issue with handling periodic scanning.
Fix issue with handling scanning completion.
Fix issue with handling scanning for OWE auto-connect.
Add support for additional DPP features.
[1] https://git.kernel.org/pub/scm/network/wireless/iwd.git/commit/?id=6ce41f621154eff0145dab41308bc145c0440f16
[2] https://git.kernel.org/pub/scm/network/wireless/iwd.git/tree/ChangeLog
Signed-off-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 92e0fe71de)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
sshd is broken on 32-bit systems because ppoll_time64 is used by the
application although it is not allowed by the seccomp filter.
Apply the upstream patch to fix this.
Signed-off-by: John Keeping <john@metanate.com>
Reviewed-by: Peter Seiderer <ps.report@gmx.net>
Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
(cherry picked from commit 10c1d887d6)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Technologic Systems has rebranded as embeddedTS with the current
domain eventually going offline. Update web/doc URLs to correct
resource locations.
Signed-off-by: Kris Bahnsen <kris@embeddedTS.com>
Signed-off-by: Yann E. MORIN <yann.morin.1998@free.fr>
(cherry picked from commit 0b058e15f5)
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
2022-03-17 22:32:15 +01:00
12701 changed files with 196669 additions and 236239 deletions
Some files were not shown because too many files have changed in this diff
Show More
Reference in New Issue
Block a user
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
