Baruch Siach [Fri, 2 Jun 2017 04:55:23 +0000 (07:55 +0300)]
swupdate: fix build without json-c
swupdate enables SURICATTA_HAWKBIT by default, which unconditionally selects
JSON. This breaks the build when the optional json-c dependency is not built.
Add a patch fixing SURICATTA_HAWKBIT dependencies.
Bernd Kuhls [Fri, 2 Jun 2017 04:54:51 +0000 (06:54 +0200)]
package/poppler: fix openjpeg support
Since the last version bump --enable-libopenjpeg always needs a
parameter:
https://cgit.freedesktop.org/poppler/poppler/commit/configure.ac?id=65c5a5266462244130f110599ac5d1011a04216e
Thomas Petazzoni [Fri, 19 May 2017 21:04:41 +0000 (23:04 +0200)]
fetchmail: adjust zlib handling
fetchmail itself does not need zlib, there is no reference to it in its
source, so the "select BR2_PACKAGE_ZLIB" is not necessary. Moreover,
"zlib" was not added to FETCHMAIL_DEPENDENCIES (but was anyway in the
dependency chain through openssl).
In addition, LIBS="-lz" is only needed in static linking configurations,
to help fetchmail's configure script find OpenSSL (it doesn't use
pkg-config unfortunately).
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
This patch bumps mono the version 4.8.1.0. Simultaneously it removes an
upstreamed patch and updates another one to the latest source code.
It also disables the compilation of 'aot' cause the build system was
fixed to support this option again.
It also disables the compilation of the optional BoringTLS stack: this
stack is distributed as an external component inside the mono source
tree and it carries it's own build system (cmake). To be compiled inside
buildroot it requires hacking the mono build system to pass the correct
compiling options to cmake. This will be done in a future patch set.
Signed-off-by: Angelo Compagnucci <angelo.compagnucci@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Daniel Sabogal [Tue, 23 May 2017 17:19:31 +0000 (13:19 -0400)]
bash: disable bash malloc by default
Bash's malloc relies on sbrk which is implemented as a fail-only stub in
musl. Presently, it is disabled when configured for static
libs. Instead, default to using libc malloc.
Peter Korsgaard [Wed, 31 May 2017 06:47:18 +0000 (08:47 +0200)]
sudo: add upstream security patch for CVE-2017-1000367
CVE-2017-1000367 - Potential overwrite of arbitrary files on Linux
On Linux systems, sudo parses the /proc/[pid]/stat file to determine the
device number of the process's tty (field 7). The fields in the file are
space-delimited, but it is possible for the command name (field 2) to
include spaces, which sudo does not account for. A user with sudo
privileges can cause sudo to use a device number of the user's choosing by
creating a symbolic link from the sudo binary to a name that contains a
space, followed by a number.
If SELinux is enabled on the system and sudo was built with SELinux support,
a user with sudo privileges may be able to to overwrite an arbitrary file.
This can be escalated to full root access by rewriting a trusted file such
as /etc/shadow or even /etc/sudoers.
For more details, see: https://www.sudo.ws/alerts/linux_tty.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Tue, 30 May 2017 13:03:24 +0000 (15:03 +0200)]
strongswan: add upstream security patches
Fixes:
CVE-2017-9022 - RSA public keys passed to the gmp plugin aren't
validated sufficiently before attempting signature verification, so that
invalid input might lead to a floating point exception and crash of the
process. A certificate with an appropriately prepared public key sent by a
peer could be used for a denial-of-service attack.
CVE-2017-9023 - ASN.1 CHOICE types are not correctly handled by the ASN.1
parser when parsing X.509 certificates with extensions that use such types.
This could lead to infinite looping of the thread parsing a specifically
crafted certificate.
Alistair Francis [Tue, 30 May 2017 17:26:13 +0000 (10:26 -0700)]
package/xen: Backport a header include fix for makedev
maekdev() is available from sys/types.h but only due to a bug in glibc. This
is being fixed by printing an error when using makedev() from sys/types.h.
To fix the issue we should include sys/sysmacros.h for makedev(). As this
has already been fixed in upstream Xen we can backport the patch.
Romain Naour [Tue, 30 May 2017 14:53:17 +0000 (16:53 +0200)]
package/madplay: add custom libtool patch
madplay use a libtool script in version 1.5.2 but the libtool patch
"buildroot-libtool-v1.5.patch.patch" doesn't apply.
From [1]:
"It's libtool dropping -static. That's because madplay has a
weird version of libtool, on which our libtool patch doesn't apply so
we have MADPLAY_LIBTOOL_PATCH = NO. Therefore, the hack we have that
makes libtool -static behave like -all-static isn't applied, causing
this build failure."
Go 1.8 comes with significant performance improvements, particularly
around ARM: "CPU time required by our benchmark programs was reduced by
20-30% on 32-bit ARM systems."
Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Thomas Petazzoni [Tue, 30 May 2017 09:34:17 +0000 (11:34 +0200)]
toolchain-external: adjust musl dynamic linker symlink for mips-sf
The external toolchain code has some logic to calculate the correct name
for the dynamic linker symbolic link that needs to be created when the
musl C library is being used. There was already some handling for the
mipsel+soft-float case, but not for the mips+soft-float case. Due to
this, the symbolic link was incorrectly named, and programs were
referencing an non-existing file.
Reported-by: Florent Jacquet <florent.jacquet@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
The Docker engine can optionally log to systemd-journald. For this
driver to work correctly, Docker needs to build against
systemd-journald's client library.
This patch conditionally adds a build-time dependency on systemd and
enables compiling the journald driver in docker-engine if systemd is
used as the Buildroot init process.
Signed-off-by: Christian Stewart <christian@paral.in> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Mon, 29 May 2017 21:54:48 +0000 (23:54 +0200)]
libtasn1: security bump to version 4.12
Fixes CVE-2017-7650: Two errors in the "asn1_find_node()" function
(lib/parser_aux.c) within GnuTLS libtasn1 version 4.10 can be exploited to
cause a stacked-based buffer overflow by tricking a user into processing a
specially crafted assignments file via the e.g. asn1Coding utility.
Gonçalo Salazar [Mon, 29 May 2017 21:53:41 +0000 (22:53 +0100)]
mosh: add notes to clarify runtime issues
Added notes to the mosh package help to clarify some runtime
issues related with it to ensure mosh will work properly after adding it.
This includes adding a proper LOCALE and an extra flag when using
mosh with dropbear.
Signed-off-by: Gonçalo Salazar <glbsalazar@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Peter Korsgaard [Mon, 29 May 2017 21:19:59 +0000 (23:19 +0200)]
mosquitto: security bump to version 1.4.12
Fixes CVE-2017-7650: Pattern based ACLs can be bypassed by clients that set
their username/client id to ‘#’ or ‘+’. This allows locally or remotely
connected clients to access MQTT topics that they do have the rights to.
The same issue may be present in third party authentication/access control
plugins for Mosquitto.
For more details, see:
https://mosquitto.org/2017/05/security-advisory-cve-2017-7650/
Remove 0001-Remove-lanl-when-WITH_ADNS-is-unset.patch as that patch is now
upstream.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Alistair Francis [Wed, 24 May 2017 20:30:29 +0000 (13:30 -0700)]
package/acpica: add host package
Add support to build the ACPICA package for the host. This is useful
for the iasl command which is required to build some packages,
including Xen tools.
This is a necessary requirement before changing the Xen package to
address:
Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Acked-by: Erico Nunes <nunes.erico@gmail.com>
[Thomas: use PREFIX= and not DESTDIR= for host installation, tweak
commit log.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Thomas Petazzoni [Mon, 29 May 2017 21:31:51 +0000 (23:31 +0200)]
ffmpeg: do not build on m68k coldfire
m68k coldfire causes ffmpeg to think atomic intrinsics are available,
so ffmpeg doesn't use its fallback on pthreads based atomic
operations. However, m68k coldfire doesn't provide properly working
sync 4 atomics, causing a build failure.
Since fixing ffmpeg on m68k coldfire is not really important (who
wants to use ffmpeg on such platform?), we simply disallow the
selection of ffmpeg on this platform.
Alternate approaches have been proposed in the past:
- Bernd Kuhls proposed in http://patchwork.ozlabs.org/patch/766909/
to add a dependency on BR2_TOOLCHAIN_HAS_SYNC_4, but this is wrong
because other architectures that lack sync 4 atomics, such as
Sparc, can build ffmpeg perfectly fine thanks to the pthreads based
fallback code.
- Waldemar Brodkorb proposed in
https://patchwork.ozlabs.org/patch/756664/ to add an explicit
option in ffmpeg configure to force the use of pthreads based
atomics. However, we believe that running ffmpeg on m68k coldfire
is such an unlikely use case that it isn't worth carrying a patch
for this.
Bernd Kuhls [Thu, 25 May 2017 16:34:43 +0000 (18:34 +0200)]
package/gnutls: disable for static build
The gnutils code uses __attribute__((constructor)) and
__attribute__((destructor)) to call constructor/desctructor when a
shared library is loaded.
Constructor/desctructor are not used when a static library is used
(except when if -Wl,--whole-archive -lgnutls -Wno-whole-archive is
used, not tested).
Even if gnutls initialization (_gnutls_global_init()) may be
called manually, the gnutls maintainer said it's not supported [1].
"Note that static linking applications with gnutls is not something
supported. gnutls relies on library constructors and destructors
which are not loaded when linking statically."
Now the gnutls script warns about static linking [2].
So disable gnutls statically by adding "depends on !BR2_STATIC_LIBS"
at Kconfig level and --disable-static in GNUTLS_CONF_OPTS.
Romain Naour [Mon, 29 May 2017 20:13:29 +0000 (22:13 +0200)]
package/google-breakpad: use PRE_CONFIGURE hooks to copy linux_syscall_support.h
As reported by Bernd [1], using POST_EXTRACT to copy
linux_syscall_support.h break the legal-info target when
google-breakpad package is selected:
/usr/bin/install: cannot stat '/home/bernd/buildroot/buildroot/output/ost/usr/i586-buildroot-linux-uclibc/sysroot/usr/include/linux_syscall_support.h': No such file or directory
This is because linux_syscall_support.h is installed by a dependency
of google-breakpad, and dependencies are only guaranteed to be
available for the configure step of a package. To fix this, we use a
PRE_CONFIGURE hook instead of POST_EXTRACT hook.
Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Chris Frederick <chrisf@cdf123.net> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Bernd Kuhls [Sun, 28 May 2017 21:37:38 +0000 (23:37 +0200)]
package/mxml: fix download URL
The project moved to github, the current download URL is broken:
$ wget -q http://www.msweet.org/files/project3/mxml-2.10.tar.gz
$ file mxml-2.10.tar.gz
mxml-2.10.tar.gz: HTML document, UTF-8 Unicode text, with very long lines
Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
projects / coffee / buildroot.git / log