buildroot/package/libcurl, branch 2017.08

libcurl: fix build on uncommon architectures

2017-08-11T20:06:36+00:00

Since the bump to 7.55.0, libcurl fails to build on a number of uncommon architectures (ARC, OpenRISC, etc.). This is due to upstream commit 73a2fcea0b4adea6ba342cd7ed1149782c214ae3 ("includes: remove curl/curlbuild.h and curl/curlrules.h"), which makes libcurl rely on more architecture-specific related defines in include/curl/system.h. This commit therefore adds a patch that fixes the 32-bit vs. 64-bit detection for all architecture, using gcc's __SIZEOF_LONG__ definition. It has been tested successfully with test-pkg on all 47 toolchain configurations. Fixes: http://autobuild.buildroot.net/results/bf26c08cf3267214278674472f931603f69951ae/ (and many similar issues) Signed-off-by: Thomas Petazzoni

libcurl: security bump to version 7.55.0

2017-08-11T10:42:34+00:00

Fixes: glob: do not parse after a strtoul() overflow range (CVE-2017-1000101) tftp: reject file name lengths that don't fit (CVE-2017-1000100) file: output the correct buffer to the user (CVE-2017-1000099) Switch to .tar.xz to save bandwidth. Add reference to tarball signature. Signed-off-by: Baruch Siach Signed-off-by: Arnout Vandecappelle (Essensium/Mind)

package/lib*: fix wrapping of Config.in help text

2017-07-31T17:10:08+00:00

The check-package script when ran gives warnings on text wrapping on all of these Config files. This patch cleans up all warnings related to the text wrapping for the Config files starting with lib in the package directory. The appropriate indentation is: <2 spaces><62 chars> See http://nightly.buildroot.org/#writing-rules-config-in for more information. Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

libcurl: LICENSE value changes to SPDX

2017-07-02T21:35:46+00:00

The curl license is a MIT/X derivative license, but has a distinct identifier in SPDX, so use that: https://spdx.org/licenses/curl.html [Peter: reword commit message] Signed-off-by: Naoki Matsumoto Signed-off-by: Peter Korsgaard

libcurl: bump version to 7.54.1

2017-06-21T20:42:54+00:00

Signed-off-by: Adam Duskett Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.54.0 (security)

2017-04-20T21:13:07+00:00

Security fixes: - CVE-2017-7468: switch off SSL session id when client cert is used Full changelog: https://curl.haxx.se/changes.html Removing 0001-CVE-2017-7407.patch. It's included in this release: https://github.com/curl/curl/commit/1890d59905414ab84a35892b2e45833654aa5c13 Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

libcurl: apply upstream security patch

2017-04-12T19:14:01+00:00

CVE-2017-7407: --write-out out of buffer read https://curl.haxx.se/docs/adv_20170403.html Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni

libcurl: bump version to 7.53.1

2017-03-10T20:52:40+00:00

Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

libcurl: security bump to version 7.53.0

2017-02-23T20:35:11+00:00

Fixes CVE-2017-2629 - curl SSL_VERIFYSTATUS ignored >From the advisory (http://www.openwall.com/lists/oss-security/2017/02/21/6): Curl and libcurl support "OCSP stapling", also known as the TLS Certificate Status Request extension (using the `CURLOPT_SSL_VERIFYSTATUS` option). When telling curl to use this feature, it uses that TLS extension to ask for a fresh proof of the server's certificate's validity. If the server doesn't support the extension, or fails to provide said proof, curl is expected to return an error. Due to a coding mistake, the code that checks for a test success or failure, ends up always thinking there's valid proof, even when there is none or if the server doesn't support the TLS extension in question. Contrary to how it used to function and contrary to how this feature is documented to work. This could lead to users not detecting when a server's certificate goes invalid or otherwise be mislead that the server is in a better shape than it is in reality. Signed-off-by: Peter Korsgaard

libcurl: optional verbose strings config

2017-02-01T21:01:50+00:00

This patch enables a config to set --enable-verbose during the configuration of libcurl. The option is triggered by setting BR2_PACKAGE_LIBCURL_VERBOSE. Signed-off-by: Judd Meinders Signed-off-by: Matt Weber Signed-off-by: Thomas Petazzoni