summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* cjson: bump to version 1.6.0Fabrice Fontaine2017-10-312-2/+2
| | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/git: bump version to 2.15.0Bernd Kuhls2017-10-312-3/+4
| | | | | | | | | | | | To avoid the build error grep.c:(.text+0xa02): undefined reference to `pcre_jit_exec' we need to add NO_LIBPCRE1_JIT=1 according to https://www.spinics.net/lists/git/msg314515.html Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/dash: drop the default value of the DASH_SOURCE variableJerzy Grzegorek2017-10-311-1/+0
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* swupdate: Fix SHA256 hash verificationMaksim Salau2017-10-311-0/+119
| | | | | | | | | | | | swupdate 2017.07 has a bug which makes hash verification faulty. The commit adds a patch to fix the issue. The fix has already been pushed to upstream and is a copy of the commit dba95dcd3739c604a81ffa2df2545e7a4cd430cf in the swupdate repo [1]. [1] https://github.com/sbabic/swupdate Signed-off-by: Maksim Salau <msalau@iotecha.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* apr-util: security bump to version 1.6.1Baruch Siach2017-10-302-3/+6
| | | | | | | | | | | | | Fixes CVE-2017-12618: Out-of-bounds access in corrupted SDBM database. Switch to bz2 compressed tarball. Use upstream provided SHA256 hash. Add license hash. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* apr: security bump to version 1.6.3Baruch Siach2017-10-302-3/+5
| | | | | | | | | | | | Fixes CVE-2017-12613: Out-of-bounds array deref in apr_time_exp*() functions. Use upstream provided SHA256 hash. Add license has. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* libmediaart: bump to version 1.9.4Fabrice Fontaine2017-10-302-3/+3
| | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/cryptodev-linux: bump to the latest version (0a54e38)Antoine Tenart2017-10-302-2/+2
| | | | | | | | | | | | | The build of the cryptodev-linux version used in Buildroot is currently broken for kernels >= 4.13. A fix was pushed upstream: https://github.com/cryptodev-linux/cryptodev-linux/commit/f0d69774afb27ffc62bf353465fba145e70cb85a This patch bumps the cryptodev-linux package version to use the latest available one, which includes the commit fixing the build for recent kernels. Signed-off-by: Antoine Tenart <antoine.tenart@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* domoticz: bump to version 3.8153Fabrice Fontaine2017-10-302-2/+9
| | | | | Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/Config.in: fix alphabetical orderJerzy Grzegorek2017-10-301-2/+2
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* DEVELOPERS: add myself as interested in socatBaruch Siach2017-10-301-0/+1
| | | | | Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* lvm2: make basic package available under muslPeter Korsgaard2017-10-293-12/+16
| | | | | | | | | | | | | The basic lvm2 package (libdevmapper / dmsetup) does build under musl, only the standard (full) installation doesn't. Many setups only need the basic package, so move the !musl dependencies down to the sub options and adjust the reverse dependencies (cryptsetup/dmraid) to match. Signed-off-by: Peter Korsgaard <peter@korsgaard.com> [Thomas: adjust Config.in comments and dependencies.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/python-pyqt5: fix build with Qt 5.6.3Scott Ellis2017-10-291-6/+6
| | | | | | | | | This commit adds 5_6_3 to the Timeline patch that fixed the build with Qt 5.6.2. Signed-off-by: Scott Ellis <scott@jumpnowtek.com> [Thomas: adjust patch existing patch description.] Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/restorecond: indentation cleanupJerzy Grzegorek2017-10-291-3/+3
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/libnfs: allow parallel buildBernd Kuhls2017-10-291-1/+0
| | | | | | | Tested with BR2_JLEVEL=100. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/libnfs: bump version to 2.0.0Bernd Kuhls2017-10-292-2/+3
| | | | | | | Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/boinc: add optional dependency to freetypeBernd Kuhls2017-10-291-0/+4
| | | | | | | | No configure option present: https://github.com/BOINC/boinc/blob/client_release/7.8/7.8.3/configure.ac#L497 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boinc: new packageFabrice Fontaine2017-10-297-0/+130
| | | | | | | | | | | | | | | | | | Open-source software for volunteer computing and grid computing. Use the idle time on your computer to cure diseases, study global warming, discover pulsars, and do many other types of scientific research. https://boinc.berkeley.edu Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> [Bernd: - bumped to version 7.8.3 - removed patches which where applied upstream - added myself to DEVELOPERS as well] Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/libbsd: not available for ARCYann E. MORIN2017-10-291-2/+4
| | | | | | | | | | | | | | | | | | | | | | | libbsd has explicit, hard-coded checks about the architectures it can work on, and ARC is not one of those. We did not notice so far, because we only recently added support for glibc on ARC (and only for a single variant) in 0633eb58a291 (toolchain: add glibc support for ARCv2). Add an explicit exclusion on arc. Fixes: http://autobuild.buildroot.org/results/603baa77e95620ad1416e0d1dc4202c334801efc http://autobuild.buildroot.org/results/8a2ee5431501615cb150233e6d7bc9e7c3c5c1eb http://autobuild.buildroot.org/results/ea52364f536485ff4e43e3bc37f2175eb6178c5a http://autobuild.buildroot.org/results/32581f7a79372b525e4ad21e029ff0ede743ba94 Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Evgeniy Didin <Evgeniy.Didin@synopsys.com> Cc: Alexey Brodkin <abrodkin@synopsys.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* socat: bump down to version 1.7.3.2Baruch Siach2017-10-293-14/+12
| | | | | | | | | | | | | | | | | | | | | Upstream socat2 branch seems to be dead. Last commit is from January 2016 . Over the last few years socat2 received only fixes cherry picked from the master 1.x branch. Most major general purpose distros only package socat 1.x. Drop the threads dependency; not needed for 1.x. Mention the OpenSSL exception in the license. Add hashes for license files. Correct the autoconf comment. The tarball configure script is recent enough. But since we patch configure.in and Makefile.in we still need to autoconf. All patches we carry for socat2 are also needed for socat 1.x. Signed-off-by: Baruch Siach <baruch@tkos.co.il> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/glibc: switch to using the maintenance branchYann E. MORIN2017-10-298-656/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | glibc upstream has ruled against doing regular point-releases, but they do have a lot of interesting and important fixes for regressions and security. Backporting each patch, or cherry-picking individual patches is off limits for us, so we just switch to using the currently-latest HEAD of the maintenance branch instead. The version number is obtained with: $ git describe --match 'glibc-*' --abbrev=40 origin/release/2.26/master The alternative options were: - download the tarball from the git tree --> does not work; not an option - download the 2.26 tarball, and bundle the individual patches in Buildroot --> maintenance of patches is a burden; not an option - download the 2.26 tarball, maintain the list of patches to download from the git tree --> not an option for the same reason So we end up just doing a git clone. The git tree is today about ten times the size of the tarball, so a rough estimate makes it at about ten times the download time. Also upstream doesn't officially provide an https download location [1]. There is one but it's not reliable, sometimes the connection time out and end-up with a corrupted git repo: fatal: unable to access 'https://sourceware.org/git/glibc.git/': Failed to connect to sourceware.org port 443: Connection timed out So switch to using a git mirror from github which is updated once a day [2]. This allow at the same time to clone the git repository faster. Note: The glibc 2.26 patches are not kept for the arc toolchain since they are fixing an issue with the new float128 support introduced in x86, x86_64 and powerpc64le. [1] https://sourceware.org/git/?p=glibc.git;a=summary [2] https://github.com/bminor/glibc.git Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Cc: Romain Naour <romain.naour@openwide.fr> Cc: Peter Korsgaard <peter@korsgaard.com> Cc: Thomas Petazzoni <thomas.petazzoni@free-electrons.com> Cc: Arnout Vandecappelle <arnout@mind.be> Cc: Evgeniy Didin <didin@synopsys.com> CC: Alexey Brodkin <abrodkin@synopsys.com> [Romain: bump 4b692dffb95ac4812b161eb6a16113d7e824982e] Signed-off-by: Romain Naour <romain.naour@gmail.com> [yann.morin.1998@free.fr: update comment to never decide on the mirror] Signed-off-by: "Yann E. MORIN" <yann.morin.1998@free.fr> Reviewed-by: Romain Naour <romain.naour@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/glibc: remove mips r6 nan208 hookRomain Naour2017-10-291-30/+0
| | | | | | | | | | This hook is not needed since glibc 2.23 [1] and can be safely removed. [1] https://sourceware.org/git/?p=glibc.git;a=commitdiff;h=d5f2798a0ac9d5ad8ad7a506a2f840035135e2d2 Signed-off-by: Romain Naour <romain.naour@gmail.com> Cc: Vicente Olivert Riera <Vincent.Riera@imgtec.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* package/tvheadend: transcoding depends on ffmpegBernd Kuhls2017-10-291-0/+1
| | | | | | | | | | | | Commit https://git.buildroot.net/buildroot/commit/package/tvheadend?id=a9a14dc4357d32f705a52a5da73c782576ce6bc8 forgot to add the reverse dependency from ffmpeg. Fixes http://autobuild.buildroot.net/results/91a/91a08e63690421a0c197e987af15e91e78afb96f/ Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boost: add help messages to librariesAdam Duskett2017-10-291-1/+101
| | | | | | | All of the help messages come from http://www.boost.org/doc/libs/1_65_1/ Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* boost: add option for the stacktrace libraryAdam Duskett2017-10-292-0/+10
| | | | | | | | | | | | | | | | | stacktrace requires dynamic library support, which was causing the following build errors: http://autobuild.buildroot.net/results/692ffad93a7bd867ecc7ccbfc8c6280735d29435/ http://autobuild.buildroot.net/results/6058ece804889abaaab0a29258e1de2904162d26/ http://autobuild.buildroot.net/results/12df9b345a90a4e011b8bb4cb1d1ef1c2c7040c0/ http://autobuild.buildroot.net/results/7473c433e93b3e785e44d9868fec517437f59847/ Adding an option for it allows to have it disabled by default, and make sure it only gets enabled when shared library support is available. Signed-off-by: Adam Duskett <aduskett@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
* docs/website: update for 2017.02.7Peter Korsgaard2017-10-282-9/+28
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* Update for 2017.02.7Peter Korsgaard2017-10-281-0/+18
| | | | | | | [Peter: drop Makefile changes] Signed-off-by: Peter Korsgaard <peter@korsgaard.com> (cherry picked from commit 05a2e38af23ecdb04f54da97f5ce2b1f7f41b842) Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/util-linux: drop _VERSION_MINOR variableJerzy Grzegorek2017-10-281-2/+1
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/libdrm: bump version to 2.4.85Bernd Kuhls2017-10-282-6/+3
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/ffmpeg: bump version to 3.3.5Bernd Kuhls2017-10-282-2/+2
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/php: bump version to 7.1.11Bernd Kuhls2017-10-282-2/+2
| | | | | | Changelog: http://www.php.net/ChangeLog-7.php#7.1.11 Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/samba4: bump version to 4.6.9Bernd Kuhls2017-10-282-2/+3
| | | | | | | | | Release notes: https://www.samba.org/samba/history/samba-4.6.9.html Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/tzdata: bump version to 2017cMartin Bark2017-10-282-3/+3
| | | | | Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/zic: bump version to 2017cMartin Bark2017-10-282-3/+3
| | | | | Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* qt5wayland: fix config option indentationJoshua Henderson2017-10-281-4/+4
| | | | | | | | Reorganize so the optional composer option for the qt5wayland package shows up as an indented option. Signed-off-by: Joshua Henderson <joshua.henderson@microchip.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wget: add optional zlib supportPeter Korsgaard2017-10-281-0/+7
| | | | Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* wget: security bump to version 1.19.2Peter Korsgaard2017-10-283-43/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fixes the following security issues: CVE-2017-13089: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. CVE-2017-13090: The retr.c:fd_read_body() function is called when processing OK responses. When the response is sent chunked, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to read the chunk in pieces of 8192 bytes by using the MIN() macro, but ends up passing the negative chunk length to retr.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument. The attacker can corrupt malloc metadata after the allocated buffer. Drop now upstreamed patch and change to .tar.lz as .tar.xz is no longer available. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/tor: bump version to 0.3.1.8Bernd Kuhls2017-10-282-2/+3
| | | | | | | | | | Release notes: https://blog.torproject.org/new-stable-tor-releases-0318-03012-02913-02816-02515 Added license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux: bump default to version 4.13.10Bernd Kuhls2017-10-281-1/+1
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* linux-headers: bump 4.{4, 9, 13}.x seriesBernd Kuhls2017-10-281-3/+3
| | | | | Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* webkitgtk: security bump to version 2.18.2Adrian Perez de Castro2017-10-272-5/+5
| | | | | | | | | | | | | | | | | | This is a maintenance release of the current stable WebKitGTK+ version, which contains bugfixes; mostly for crashes and rendering issues, plus one important fix for the layout or Arabic text. Release notes: https://webkitgtk.org/2017/10/27/webkitgtk2.18.2-released.html Even though an acconpanying security advisory has not been published for this release, the release contains fixes for several crashes (one of them for the decoder of the very common GIF image format), which arguably can be considered potential security issues. Signed-off-by: Adrian Perez de Castro <aperez@igalia.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* barebox: bump to version 2017.09.0Peter Seiderer2017-10-272-5/+5
| | | | | Signed-off-by: Peter Seiderer <ps.report@gmx.net> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package: fix license typosJerzy Grzegorek2017-10-275-5/+5
| | | | | Signed-off-by: Jerzy Grzegorek <jerzy.m.grzegorek@gmail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* python-paho-mqtt: bump version to 1.3.1Yegor Yefremov2017-10-273-34/+7
| | | | | | | Remove upstreamed patch and add licence checksums. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* python-zope-interface: bump version to 4.4.3Yegor Yefremov2017-10-272-5/+6
| | | | | | | Add licence checksum. Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* openssh: security bump to version 7.6p1Peter Korsgaard2017-10-272-3/+5
| | | | | | | | | | | | | Fixes CVE-2017-15906 - The process_open function in sftp-server.c in OpenSSH before 7.6 does not properly prevent write operations in readonly mode, which allows attackers to create zero-length files. For more details, see the release notes: https://www.openssh.com/txt/release-7.6 Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* redis: bump to version 3.2.11Peter Korsgaard2017-10-272-2/+4
| | | | | | | | | | | | | | | | | | | 3.2.11 fixes important issues. From the release notes: ================================================================================ Redis 3.2.11 Released Thu Sep 21 15:47:53 CEST 2017 ================================================================================ Upgrade urgency HIGH: Potentially critical bugs fixed. AOF flush on SHUTDOWN did not cared to really write the AOF buffers (not in the kernel but in the Redis process memory) to disk before exiting. Calling SHUTDOWN during traffic resulted into not every operation to be persisted on disk. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* sdl2: security bump to version 2.0.7Peter Korsgaard2017-10-272-3/+5
| | | | | | | | | | | | | Fixes CVE-2017-2888 - An exploitable integer overflow vulnerability exists when creating a new RGB Surface in SDL 2.0.5. A specially crafted file can cause an integer overflow resulting in too little memory being allocated which can lead to a buffer overflow and potential code execution. An attacker can provide a specially crafted image file to trigger this vulnerability. Also add a hash for the license file while we're at it. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* sdl2: explicitly disable raspberry pi video backendPeter Korsgaard2017-10-261-1/+2
| | | | | | | | | | | | | | | | | | | | | Fixes: http://autobuild.buildroot.net/results/d59/d5992dcc9a49ee77afaebdcc9448ac1868fa7de1/ http://autobuild.buildroot.net/results/e89/e894f21ce1983ee3bd8d65a8e59e1adab9a62707/ The configure script automatically enables support for the raspberry pi video backend if it detects the rpi-userland package. Unfortunately it hardcodes a number of include/linker paths unsuitable for cross compilation, breaking the build: if test x$enable_video = xyes -a x$enable_video_rpi = xyes; then .. RPI_CFLAGS="-I/opt/vc/include -I/opt/vc/include/interface/vcos/pthreads -I/opt/vc/include/interface/vmcs_host/linux" RPI_LDFLAGS="-L/opt/vc/lib -lbcm_host" fi So explicitly disable it until the configure script is fixed. Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
* package/nodejs: bump version to 8.8.1Martin Bark2017-10-262-3/+3
| | | | | | | | | Fixes a regression introduced in 8.8.0. See https://nodejs.org/en/blog/release/v8.8.1/ Peter: apply on top of 8.8.0, mention that it fixes regression] Signed-off-by: Martin Bark <martin@barkynet.com> Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
OpenPOWER on IntegriCloud