Switch to:
* Linux LTS 6.12.6
* U-Boot 2024.10
Provide hashes for all above components and enable
BR2_DOWNLOAD_FORCE_CHECK_HASHES.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to:
* Linux LTS 6.12.6
* U-Boot 2024.10
Provide hashes for all above components and enable
BR2_DOWNLOAD_FORCE_CHECK_HASHES.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to:
* Linux LTS 6.12.6
* U-Boot 2024.10
* ATF 2.11
Provide hashes for all above components and enable
BR2_DOWNLOAD_FORCE_CHECK_HASHES.
Increase ext4 rootfs size to fit larger components.
Signed-off-by: Marcin Niestroj <m.niestroj@grinn-global.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
- Bump Linux kernel to 6.1.120
- Bump U-Boot to 2024.10 and add the dependency on GnuTLS and
util-linux (for uuid)
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security issue:
CVE-2024-11614: An out-of-bounds read vulnerability was found in DPDK's
Vhost library checksum offload feature. This issue enables an untrusted or
compromised guest to crash the hypervisor's vSwitch by forging Virtio
descriptors to cause out-of-bounds reads. This flaw allows an attacker with
a malicious VM using a virtio driver to cause the vhost-user side to crash
by sending a packet with a Tx checksum offload request and an invalid
csum_start offset.
https://www.openwall.com/lists/oss-security/2024/12/17/3
Release notes: http://doc.dpdk.org/guides-24.11/rel_notes/release_24_11.html
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The mongodb package has not been updated in close to 3 years (since commit
49bbf644d4 "package/mongodb: security bump to version 4.2.18") and the
4.2.x series is EOL since April 2023:
https://www.mongodb.com/legal/support-policy/lifecycles
There are no reverse dependencies, so drop the package. If a maintainer
steps up to support it, then (a newer version of) the package can be
re-added later.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
[Julien: remove .checkpackageignore entries to fix check-package errors]
Signed-off-by: Julien Olivain <ju.o@free.fr>
If the u-boot DP driver attempts to configure the Kria SOM DP before it is
released from reset, it will cause a boot hang. Since the KV260 uses the DP
by default, this patch needs to be included with buildroot until it is part
of a u-boot-xlnx release tag.
While only the KV260 is directly affected, there is no issue with applying
this patch to all 3 zynqmp_kria defconfigs.
This patch has also been committed to u-boot upstream.
Upstream: 8b81010a2f
Signed-off-by: Neal Frager <neal.frager@amd.com>
[Julien: fix check-package error by adding Upstream tag in patch]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump Linux kernel version to 6.12.5 and update the hash accordingly.
Signed-off-by: Scott Fan <fancp2007@gmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Bump Linux kernel version to 6.12.5 and update the hash accordingly.
Signed-off-by: Scott Fan <fancp2007@gmail.com>
[Julien: add missing BR2_TARGET_UBOOT_NEEDS_GNUTLS=y]
Signed-off-by: Julien Olivain <ju.o@free.fr>
We have no more hash file for TF-A v2.11 in the package directory since
commit 24615d1502 ("boot/arm-trusted-firmware: bump to v2.12"); add
one in our global patches directory.
This fixes the following warning:
WARNING: no hash file for arm-trusted-firmware-v2.11-git4.tar.gz
Signed-off-by: Vincent Stehlé <vincent.stehle@arm.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes the following security vulnerabilities:
CVE-2022-33065: Multiple signed integers overflow in function au_read_header
in src/au.c and in functions mat4_open and mat4_read_header in src/mat4.c in
Libsndfile, allows an attacker to cause Denial of Service or other
unspecified impacts.
CVE-2024-50612: libsndfile through 1.2.2 has an ogg_vorbis.c
vorbis_analysis_wrote out-of-bounds read.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes CVE-2023-49582: Lax permissions set by the Apache Portable Runtime
library on Unix platforms would allow local users read access to named
shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with
APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR
version 1.7.5, which fixes this issue.
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
The python-m2crypto package was removed as it is in maintained
only mode and is not recommended for new projects.
See:
3721ec298f
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
[Julien: add reference url]
Signed-off-by: Julien Olivain <ju.o@free.fr>
The service failed to start correctly if any custom rules were
installed. This commit aligns the permissions with the upstream
meson build step. See [1].
[1] b6169f3113
Signed-off-by: Martin Böh <contact@martb.dev>
[Julien:
- remove unneeded leading zeroes on file permissions
- add reference to upstream change in commit log
]
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error
/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/wpewebkit-2.44.4/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
117 | pthread_getattr_np(thread, &sattr);
using this defconfig (and libvpx bump to 1.15.0 reverted)
BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WPEWEBKIT=y
A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error
/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp: In static member function 'static WTF::StackBounds WTF::StackBounds::newThreadStackBounds(WTF::PlatformThreadHandle)':
/home/buildroot/buildroot/output/build/webkitgtk-2.44.2/Source/WTF/wtf/StackBounds.cpp:117:5: error: 'pthread_getattr_np' was not declared in this scope; did you mean 'pthread_attr_t'?
117 | pthread_getattr_np(thread, &sattr);
using this defconfig (and libvpx bump to 1.15.0 reverted)
BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y
A backport of this patch should be considered because the code is
present since 2011:
03f678fac7/Source/WTF/wtf/StackBounds.cpp (L117)
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Fixes build error
-- Could NOT find LibDRM (missing: LibDRM_INCLUDE_DIR LibDRM_LIBRARY)
CMake Error at Source/cmake/OptionsGTK.cmake:320 (message):
libdrm is required for USE_LIBDRM
Call Stack (most recent call first):
Source/cmake/WebKitCommon.cmake:237 (include)
CMakeLists.txt:21 (include)
with this defconfig:
BR2_arm=y
BR2_TOOLCHAIN_BUILDROOT_UCLIBC=y
BR2_TOOLCHAIN_BUILDROOT_WCHAR=y
BR2_PTHREADS=y
BR2_TOOLCHAIN_BUILDROOT_CXX=y
BR2_PER_PACKAGE_DIRECTORIES=y
BR2_PACKAGE_XORG7=y
BR2_PACKAGE_RPI_USERLAND=y
BR2_PACKAGE_LIBGTK3=y
BR2_PACKAGE_WEBKITGTK=y
due to libdrm being enabled by default:
f736325e66/Source/cmake/OptionsGTK.cmake (L59)
This is a port of buildroot commit 65f8174648
for the wpewebkit package, quoting its commit message:
Pass USE_LIBDRM=OFF to the wpewebkit CMake configuration step when the
libdrm package has not been selected.
WPE WebKit can be built without libdrm support, and it will still work
with backends that use other platform-specific methods to handle
graphics buffers and/or presenting content onto an output. For example
this is the case with wpebackend-rdk configured to use rpi-userland,
which uses dispmanx to produce the output instead of DRM/KMS.
Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to the new Linux LTS release 6.12.3. Switch to U-Boot 2024.10 and
ATF 2.11. Force check of hashes for Linux kernel, headers, U-Boot, ATF.
Finally, add BR2_TARGET_UBOOT_NEEDS_GNUTLS option required by new U-Boot.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to the new Linux LTS release 6.12.3. Switch to U-Boot 2024.10 and
ATF 2.11. Force check of hashes for Linux kernel, headers, U-Boot, ATF.
Increase ext2 partition size to fit new software versions. Finally, add
BR2_TARGET_UBOOT_NEEDS_GNUTLS option required by new U-Boot.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to the new Linux LTS release 6.12.3 and to U-Boot 2024.10.
Force check of hashes for Linux kernel, headers, U-Boot. Finally,
add BR2_TARGET_UBOOT_NEEDS_GNUTLS option required by new U-Boot.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
Switch to the new Linux LTS release 6.12.3 and to U-Boot 2024.10.
Force check of hashes for Linux kernel, headers, U-Boot. Finally,
add BR2_TARGET_UBOOT_NEEDS_GNUTLS option required by new U-Boot.
Signed-off-by: Sergey Matyukevich <geomatsi@gmail.com>
Signed-off-by: Julien Olivain <ju.o@free.fr>
