BSD-0-Clause is not a recognized SPDX license identifier. 0BSD is used
in the LICENSE file, and LICENSE.0BSD matches the 0BSD license text
[1].
[1] https://spdx.org/licenses/0BSD.html
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
A few headers outside libiberty use LGPL-2.1+, too, and other headers
and some scripts use GPL-2.0+.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
BSD-0-Clause is not a recognized SPDX license identifier. 0BSD is used
in the source SPDX-License-Identifier headers, and the associated text
[1] matches the COPYING.0BSD file.
FSFUL and FSFULLR are the "few permissive licenses" of certain build
system files mentioned in COPYING.
Move "Public Domain" to the end of the list because it applies only to
a few files.
[1] https://spdx.org/licenses/0BSD.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The package is part of Buildroot and thus under GPL-2.0-or-later
unless stated otherwise, as described in COPYING.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
All these packages are part of Buildroot and thus under
GPL-2.0-or-later unless stated otherwise, as described in COPYING.
package/skeleton-custom is excluded because it provides a way to copy
skeleton data from any location chosen by the user, the license of
which is unknown to Buildroot.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.96 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.12.96 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.211 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 5.15.211 and, for the SD
configuration, also updates U-Boot to version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.1.177. The size of
xipImage has increased by 23131 bytes (1696766 bytes compared to
1673635 in version 6.1.167).
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board hangs after starting init:
[ 1.231624] Run /sbin/init as init process
[ 1.235599] with arguments:
[ 1.238549] /sbin/init
[ 1.241331] earlyprintk
[ 1.244018] with environment:
[ 1.247143] HOME=/
[ 1.249554] TERM=linux
[ 1.252177] consoleblank=0
No error message is printed and the boot simply stalls at this
point.
The STM32F769 has no MMU, and uClibc's standard malloc()
implementation returns NULL for allocations performed during early
init on this target, causing init to fail.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via a uClibc config fragment. Unlike
the STM32F429/STM32F469 fix, the fragment is kept board-specific
since the STM32F769 is a Cortex-M7 board and does not belong to the
stm32f4xx family.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board fails to boot:
sh: out of memory
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---
The STM32F469 has no MMU, and uClibc's standard malloc() implementation
returns NULL for allocations performed during early init on this target,
causing init to abort immediately.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via the uClibc config fragment already
introduced for the STM32F429 in board/stmicroelectronics/common/stm32f4xx/,
which addresses the same issue on this Cortex-M4/noMMU board.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Since uClibc was bumped to 1.0.58 (c7fef3704c, "package/uclibc:
bump to 1.0.58"), the board fails to boot:
sh: out of memory
Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
CPU: 0 PID: 1 Comm: init Not tainted 6.1.167 #2
Hardware name: STM32 (Device Tree Support)
Function entered at [<0800ea1e>] from [<0800de7b>]
Function entered at [<0800de7b>] from [<080e4991>]
Function entered at [<080e4991>] from [<080e2d19>]
Function entered at [<080e2d19>] from [<080125eb>]
Function entered at [<080125eb>] from [<08012b09>]
Function entered at [<08012b09>] from [<08012b69>]
---[ end Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100 ]---
The STM32F429 has no MMU, and uClibc's standard malloc() implementation
returns NULL for allocations performed during early init on this target,
causing init to abort immediately.
Fix this by switching to MALLOC_SIMPLE, a plain mmap-based allocator
meant for small/noMMU systems, via a uClibc config fragment. The
fragment is placed under board/stmicroelectronics/common/stm32f4xx/,
rather than under the board-specific directory, so that it can be
shared with the STM32F469, another Cortex-M4/noMMU board affected by
the same issue, which will be fixed in a subsequent patch.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The patch bumps the Linux kernel to version 6.18.39 and U-Boot to
version 2026.07.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://matt.ucc.asn.au/dropbear/CHANGES
- Security: Fix a use-after-free in X11 forwarding that could possibly lead
to memory corruption. This is vulnerable to authenticated users if X11
forwarding is enabled. By default X11 forwarding is not built.
In 2026.89 the server is running as the authenticated user for X11
forwarding, in earlier versions it runs as root.
This removes X11 "single connection" which has probably never been used.
Reported by @peter-pe
882f83806d
Added patch to fix build errors which would be introduced by this bump:
86baa66fc9
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
https://gitlab.com/libssh/libssh-mirror/-/tags/libssh-0.12.1https://www.libssh.org/2026/07/21/libssh-0-12-1-and-0-11-5-security-releases/
Fixes the following security problems:
CVE-2026-15370: Stack buffer overflow in SFTP server longname construction
CVE-2026-59842: Information disclosure via short GSSAPI Curve25519 public key
CVE-2026-59843: Denial of service via zero advertised channel packet size
CVE-2026-59844: Denial of service via oversized SFTP read length
CVE-2026-59845: Denial of service via unchecked ProxyCommand fork() failure
CVE-2026-59846: Information disclosure via ProxyCommand %r username expansion
CVE-2026-59847: Integrity downgrade via OpenSSL AES-GCM tag verification
CVE-2026-59848: Denial of service via SFTP responses with unknown request IDs
CVE-2026-59849: Denial of service via automatic certificate authentication loop
CVE-2026-59850: Use-after-free via data callbacks on closed channels
CVE-2026-59851: Authentication bypass via missing GSSAPI principal check
Zero-initialize every ssh_string
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
"bzip2-1.0.4" is not a valid SPDX license identifier. The license text
in archival/libarchive/bz/LICENSE in the busybox source matches the
text associated with the bzip2-1.0.6 identifier [1].
[1] https://spdx.org/licenses/bzip2-1.0.6.html
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The Nettle manual (nettle.html in the source archive) states:
> Nettle is dual licenced under the GNU General Public License version
> 2 or later, and the GNU Lesser General Public License version 3 or
> later. When using Nettle, you must comply fully with all conditions
> of at least one of these licenses. [...]
This means "or" is the correct description. Ellipsis covers a note
that a few files are licensed more permissively.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
All these bundled subprojects explicitly give "Apache-2.0 OR
LGPL-2.1-or-later" in their README.md files.
Signed-off-by: Fiona Klute (Othermo GmbH) <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
docker-credential-gcr calls pthread_getattr_np() which is only available
with NPTL; i.e. always available with glibc (where it originates from,
since 2.2.3), always available with musl (which has had it since 0.9.10
in 2013), and only available when uClibc has NPTL (since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/3ed18da254082b7823b49be4578274792bb7380e/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
amazon-ecr-credential-helper calls pthread_getattr_np() which is only
available with NPTL; i.e. always available with glibc (where it
originates from, since 2.2.3), always available with musl (which has
had it since 0.9.10 in 2013), and only available when uClibc has NPTL
(since 1.0.0 in 2015).
Fixes: https://autobuild.buildroot.org/results/4e6e13f1161485b412d4601cb8972a1524ddd2d6/
Signed-off-by: Yann E. MORIN <yann.morin@orange.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
When building pahole using a modern GCC (e.g. when building
host-pahole), discarded-qualifiers and unused-but-set-variable warnings
are produced. In builds that don't set CMAKE_BUILD_TYPE=Release, -Werror
gets set and causes a build failure.
Fix this by backporting an unreleased upstream patch (for
discarded-qualifiers) and adding another pending one for
unused-but-set-variable (and, arguably, a correctness issue).
Fixes: https://autobuild.buildroot.org/results/ba7/ba79fb9d08b2c6ec573b79fdbb6b4880bf603a57
Signed-off-by: Florian Larysch <fl@n621.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
