buildroot/package/libzip/libzip.mk, branch 2017.11.2

libzip: security bump to version 1.3.0

2017-09-08T09:16:56+00:00

Fixes the following security issues: CVE-2017-12858: Double free vulnerability in the _zip_dirent_read function in zip_dirent.c in libzip allows attackers to have unspecified impact via unknown vectors. CVE-2017-14107: The _zip_read_eocd64 function in zip_open.c in libzip before 1.3.0 mishandles EOCD records, which allows remote attackers to cause a denial of service (memory allocation failure in _zip_cdir_grow in zip_dirent.c) via a crafted ZIP archive. For more details, see https://blogs.gentoo.org/ago/2017/09/01/libzip-use-after-free-in-_zip_buffer_free-zip_buffer-c/ https://blogs.gentoo.org/ago/2017/09/01/libzip-memory-allocation-failure-in-_zip_cdir_grow-zip_dirent-c/ libzip-1.3.0 also adds optional bzip2 support, so handle that. While we're at it, add a hash for the license file. Signed-off-by: Peter Korsgaard

libzip: bump version to 1.2.0

2017-07-01T22:43:31+00:00

It's a major release, but the API seems to be mostly backwards-compatible. The only package depending on this library in buildroot is libsigrok and it builds fine. Signed-off-by: Bartosz Golaszewski Signed-off-by: Thomas Petazzoni

boot, package: use SPDX short identifier for BSD-3c

2017-04-01T13:26:57+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-3c is BSD-3-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-3c/BSD-3-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

Remove trailing slash from all package site URLs

2015-03-10T19:40:08+00:00

The recommended form is without the trailing slash. Buildroot will add a slash between FOO_SITE and FOO_SOURCE as appropriate. Reported-by: Arnout Vandecappelle Signed-off-by: Luca Ceresoli Signed-off-by: Peter Korsgaard

libzip: new package

2015-01-31T23:21:10+00:00

[Peter: license is BSD-3c] Signed-off-by: Bartosz Golaszewski Acked-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard