Future U-Boot 2026.07 will build mkeficapsule with pkcs11 support. [1]
This causes link errors with Buildroot, such as the following one:
mkeficapsule.c:(.text.startup+0xcd3): undefined reference to `gnutls_pkcs11_init'
(Other symbols the linker complains about are: gnutls_pkcs11_add_provider,
gnutls_pkcs11_obj_list_import_url4, gnutls_x509_crt_import_pkcs11 and
gnutls_pkcs11_deinit.)
The following example commands can be used to reproduce the issue:
make qemu_aarch64_ebbr_defconfig
echo 'BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.07-rc3"' >>.config
echo 'BR2_TARGET_UBOOT_NEEDS_GNUTLS=y' >>.config
echo '# BR2_DOWNLOAD_FORCE_CHECK_HASHES is not set' >>.config
make olddefconfig
make uboot
This commit adds the pkcs11 support for host-gnutls.
In Buildroot, since host-gnutls is currently only needed by uboot
(and other uboot derivatives such as uboot-tools) the pkcs11 support
is added unconditionally to host-gnutls.
Link: 0c716a157b [1]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
libcamera has moved for a while now to gitlab.freedesktop.org. The
mirror on git.linuxtv.org is still active, but it isn't the canonical
repository and has less bandwidth than freedesktop.org. Switch the
libcamera source URL to gitlab.freedesktop.org.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Kieran Bingham <kieran.bingham@ideasonboard.com>
[Julien: removed trailing slash in _SITE]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Add upstream commit to buildroot to fix build errors introduced by the
upcoming bump of acl to 2.4.0:
https://lists.nongnu.org/archive/html/acl-devel/2026-06/msg00000.html
"Compatibility Notes
- libacl now exports the new functions acl_get_file_at(),
acl_set_file_at(), acl_delete_def_file_at(), and acl_extended_file_at(),
which are declared in <sys/acl.h>. This may cause conflicts in programs
that define functions of the same name and link against libacl.
One such program is GNU tar which defines its own versions of functions
like acl_get_file_at(). The fix is to rename those functions. (In the
case if GNU tar, a fix is already on the way.)"
This patch will also fix build errors seen on the autobuilders for
host-tar on hosts which already provide acl >= 2.4.0.
Fixes:
https://autobuild.buildroot.net/results/478/478a9781f481df7cf2eecda80a4c13f900a0dc80/
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: server: Don't allow -B (accept blank password) with
-t (two factor auth). If run with -t and -B a user configured with a
blank password would be allowed to log in without pubkey auth.
23ec782856
Reported by nvidia
- Security: server: Fix parsing of long authorized_keys lines.
The remainder of a long line would be handled as the start of a new line.
In the case where external programs add semi-trusted public keys to
authorized_keys, a crafted key might bypass restrictions such as "command=".
8d8e1930b8
Reported by nvidia
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Debian 12 Bookworm snapshot we use, 20250203, uses the new deb822
format [0] for source list files; it carries a source list file that
points to the current repository, not to the snapshot.
Even though we do inject an old-style source list that points to the
snapshot repository, the packages in the current repository are more
recent than the one in the snapshot, so when we install our packages,
they get retrieved mostly from the current repository rather than from
the snapshot. The image is not reproducible.
Switch to using the new deb822-style source list file.
Note: we do not need to carry the "Latest just before" trick: the
snapshot repository will use the most recent actual snapshot before the
requested dated, so we can just use the date of the image we use (stuck
at midnight because we don't have better).
Since the snapshot repository can be really slow, while at the same time
the remote http server not dropping connections, it can take a very long
while to build the image; add a timeout so that stale connections are
detected and re-attemped early-ish (the timeout applies to both the
connect and the actual download, so it should be large enough to
accomodate slowish network connections).
Fixes: c95d5b8e1e (support/docker: move to current bookworm (Debian
12) snapshot)
[0] https://manpages.debian.org/trixie/apt/sources.list.5.en.html#DEB822-STYLE_FORMAT
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Romain Naour <romain.naour@smile.fr>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
Commit da9dcddff1 (package/mosquitto: requires cmake >= 4.3) added
a requirement against cmake 4.3 for the target variant, but forgot
to add the same requirement to the host variant.
Do so, for the same reasons as reported for the target variant in
da9dcddff1.
Fixes: da9dcddff1
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Cc: Peter Korsgaard <peter@korsgaard.com>
Cc: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Romain Naour <romain.naour@smile.fr>
https://www.openssh.org/releasenotes.html#10.4p1
Changes since OpenSSH 10.3
==========================
This release contains a number of security fixes as well as general
bugfixes and a couple of new features.
Security
========
* sftp(1): when downloading files on the command-line using
"sftp host:/path .", a malicious server could cause the file to
be downloaded to an unexpected location. This issue was identified
by the Swival Security Scanner.
* scp(1): when copying files between two remote destinations, do
not allow a malicious server to write files to the parent
directory of the intended target directory. This issue was
identified by the Swival Security Scanner.
* sshd(8): when using the "internal-sftp" SFTP server implementation
(this is not the default), long command lines were previously
truncated silently after the 9th argument. If a security-relevant
option was in the 10th or later position, it would be discarded.
Reported by Steve Caffrey.
* sshd(8): add a documentation note to mention that the
GSSAPIStrictAcceptorCheck option is ineffective when the server
is joined to a Windows Active Directory. Reported by Yarin Aharoni
of Safebreach.
* sshd(8): DisableForwarding=yes didn't override PermitTunnel=yes
as it was documented to do. Note that PermitTunnel is not enabled
by default. Reported independently by Huzaifa Sidhpurwala of
Redhat and Marko Jevtic.
* sshd(8): avoid a potential pre-authentication denial of service
when GSSAPIAuthentication was enabled (this feature is off by
default). This was not mitigated by MaxAuthTries, but would be
penalised by PerSourcePenalties. This was reported by Manfred
Kaiser of the milCERT AT (Austrian Ministry of Defence).
* sshd(8): fix a number of cases where the minimum authentication
delay was not being enforced. Reported by the Orange Cyberdefense
Vulnerability Team.
* ssh(1): fix a possible client-side use-after-free if the server
changes its host key during a key reexchange. This was reported by
Zhenpeng (Leo) Lin of Depthfirst.
[...]
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Buildroot commit cc5c36afff bumped fmt to
version 12.2.0 which breaks the gerbera build. To fix the problem we add
two upstream patches.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Release notes:
https://webkitgtk.org/2026/06/02/webkitgtk2.52.4-released.html
Fixes the following security issues:
https://webkitgtk.org/security/WSA-2026-0003.html
Includes fixes (among others) for CVE-2026-28847, CVE-2026-28883,
CVE-2026-28901, CVE-2026-28902, CVE-2026-28903, CVE-2026-28904,
CVE-2026-28905, CVE-2026-28907, CVE-2026-28942, CVE-2026-28946,
CVE-2026-28947, CVE-2026-28953, CVE-2026-28955, CVE-2026-28958,
CVE-2026-43658, and CVE-2026-43660.
Also added 0001-REGRESSION-313606-main-Fails-to-build-with-system-ma.patch,
to get webkitgtk compiled when -DUSE_SYSTEM_MALLOC=ON is in use.
Signed-off-by: Thomas Devoogdt <thomas.devoogdt@barco.com>
[Julien: add "security" in commit log title]
Signed-off-by: Julien Olivain <ju.o@free.fr>
UEFI platforms with a Devicetree have recently gained support for some form
of network booting. [1][2]
On those platforms, the UEFI firmware downloads the disk image over the
network and presents it to UEFI applications using the simple filesystem
protocol. This is sufficient for OS loaders such as e.g. GRUB to find their
configuration and load the kernel image.
The firmware must also describe the ramdisk to the OS, so that it finds its
root filesystem. On ACPI based platforms this is done with an NVDIMM
Firmware Interface Table (NFIT). On Devicetree based platforms, this can be
done with a pmem node. [3]
Add a kernel config fragment to add pmem support, which enables network
boot on UEFI platforms with Devicetree.
Also, briefly mention that we support this scenario in the readme.
This can be tested on Qemu, with the following procedure:
Build aarch64_efi_defconfig in a folder, to obtain output/images/disk.img,
and serve the image over HTTP with python:
$ python -m http.server -d output/images/
In another terminal and another folder, configure a U-Boot based firmware
starting from qemu_aarch64_ebbr_defconfig, and with the following
additional configurations:
BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2026.04"
BR2_TARGET_UBOOT_NEEDS_DTC=y
Add the following U-Boot configurations to
board/qemu/aarch64-ebbr/u-boot.fragment:
CONFIG_EFI_HTTP_BOOT=y
CONFIG_NET_LWIP=y
Build everything; you should obtain output/images/flash.bin.
Start Qemu as per board/qemu/aarch64-ebbr/readme.txt, but omitting the hd0
-device and -drive stanzas.
U-Boot should start; interrupt it with enter.
At U-Boot prompt, type the following commands:
=> setenv loadaddr 0x43000000
=> efidebug boot rm 0
=> efidebug boot add -u 0 net http://10.0.2.2:8000/disk.img
=> efidebug boot order 0
=> bootefi bootmgr
U-Boot should download the disk image over HTTP and boot Linux with UEFI.
Look for the following message in Linux boot log, to confirm that it did
indeed mount its rootfs from the downloaded image:
EXT4-fs (pmem0p2): mounted filesystem ...
Link: https://www.linaro.org/blog/installing-fedora-with-uefi-http-boot/ [1]
Link: https://docs.u-boot-project.org/en/latest/develop/uefi/uefi.html#uefi-http-boot-using-the-legacy-tcp-stack [2]
Link: https://github.com/ARM-software/edge-iot-arch-guide/blob/main/source/http-boot/pmem_node.md [3]
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Cc: Dick Olsson <hi@senzilla.io>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2025-64503:
cups-filters contains backends, filters, and other software required
to get the cups printing service working on operating systems other
than macos. In cups-filters prior to 1.28.18, by crafting a PDF file
with a large `MediaBox` value, an attacker can cause CUPS-Filter 1.x’s
`pdftoraster` tool to write beyond the bounds of an array. First, a
PDF with a large `MediaBox` width value causes `header.cupsWidth` to
become large. Next, the calculation of `bytesPerLine =
(header.cupsBitsPerPixel * header.cupsWidth + 7) / 8` overflows,
resulting in a small value. Then, `lineBuf` is allocated with the
small `bytesPerLine` size. Finally, `convertLineChunked` calls
`writePixel8`, which attempts to write to `lineBuf` outside of its
buffer size (out of bounds write). In libcupsfilters, the maintainers
found the same `bytesPerLine` multiplication without overflow check,
but the provided test case does not cause an overflow there, because
the values are different. Commit
50d94ca0f2fa6177613c97c59791bde568631865 contains a patch, which is
incorporated into cups-filters version 1.28.18.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2025-64503
- 50d94ca0f2
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
This fixes the following vulnerability:
- CVE-2026-34933:
Avahi is a system which facilitates service discovery on a local
network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4,
any unprivileged local user can crash avahi-daemon by sending a single
D-Bus method call with conflicting publish flags. This issue has been
patched in version 0.9-rc4.
For more information, see:
- https://www.cve.org/CVERecord?id=CVE-2026-34933
- 0be89b6bb5
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Upstream v85 no longer requires the -Dfwctl=enabled / -Dkeyutils=enabled
workaround, so drop both options along with the stale comment.
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
