Tavis has just reported, that he was recently trying to track down a
reproducible crash in a compressor. Believe it or not, it really was a
bug in zlib-1.2.11 when compressing (not decompressing!) certain inputs.
Tavis has reported it upstream, but it turns out the issue has been
public since 2018, but the patch never made it into a release. As far as
he knows, nobody ever assigned it a CVE.
Suggested-by: Tavis Ormandy <taviso@gmail.com>
References: https://www.openwall.com/lists/oss-security/2022/03/24/1
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Zip always try to generate new encryption header depending on execution
time and process id, which is far from being reproducible. This commit
changes the zip srand() seed to a predictable value to generate
reproducible random bytes for the encryption header. This will compromise
the goal of secure archive encryption, but it would not be a big problem
for our purpose.
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Remove "--mtime" option introduced in commit 18c9faa032 ("tools: zip:
add option for reproducible archives") and instead fetch SOURCE_DATE_EPOCH
environment variable directly in the code.
Ref: https://sourceforge.net/p/infozip/patches/25/
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
Release notes:
https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-3.4.2-relnotes.txt
```
It includes the following security fix
* In some situations the X.509 verifier would discard an error on an
unverified certificate chain, resulting in an authentication bypass.
Thanks to Ilya Shipitsin and Timo Steinlein for reporting.
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Remove macOS stuff. Upstream has fixed it in the same way.
Add SOL_TCP define. Taken from elsewhere in the code.
Refreshed patches.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Switched to CMake for faster compilation and greater parallel
friendliness.
Added CMake options from the packages feed.
This release fixes various CVEs.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Switched to building with meson as it's faster and does not need a
dependency on cmake, which takes a long time to build.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Refresh 2to3 patch. Upstream partially did this against some older
python version. This is still needed.
Refreshed other patches to be python3 safe.
Remove uClibc patches as only musl is present now.
Refresh others.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
706e9cc tplink-safeloader: support for Archer A6 v3 JP
497726b firmware-utils: support checksum for AVM fritzbox wasp SOCs
2ca6462 iptime-crc32: add support for AX8004M
57d0e31 tplink-safeloader: TP-Link EAP615-Wall v1 support
8a8da19 tplink-safeloader: add TL-WPA8631P v3 support
eea4ee7 tplink-safeloader: add TP-Link Archer A9 v6 support
Signed-off-by: Stijn Tintel <stijn@linux-ipv6.be>
- Call pager with original LANG environment variable
- Consistently complain early if no series file is found
- Fix handling of symbolic links by several commands
- Tighten the patch format parsing
- Reuse the shell (performance)
- Document the series file format further
- Document that quilt loads /etc/quilt.quiltrc
- configure: Make stat configurable
- series: Minor optimizations
- setup: Don't obey the settings of any englobing .pc
- setup: Default to fast mode
- quilt.el: Fix documentation of quilt-pc-directory
- quilt.el: Load /etc/quilt.quiltrc if ~/.quiltrc doesn't exist
- quilt.el: Fix quilt-editable when QUILT_PATCHES_PREFIX is set
Refresh patches.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
[add changelog]
Signed-off-by: Paul Spooren <mail@aparcar.org>
Makes sure that Ninja from staging_dir is used and nowhere else.
Reported by reproducible builds project. Builds have been failing ever
since tools/cmake started using Ninja.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Switched to building with meson as it's faster and does not need a
dependency on cmake, which takes a long time to build.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Changelog:
backend_startup_project
Add a man page backend to refman
extract_objects() supports generated sources
Python 3.6 support will be dropped in the next release
Warning if check kwarg of run_command is missing
meson rewrite can modify extra_files
meson rewrite target <target> info outputs target's extra_files
Visual Studio 2022 backend
Support for CMake <3.14 is now deprecated for CMake subprojects
Added support for sccache
install_symlink function
Signed-off-by: Rosen Penev <rosenp@gmail.com>
0c15cad iptime-naspkg: add image header tool for ipTIME NAS series
872c87c iptime-crc32: add image header tool for new ipTIME models
Signed-off-by: Sungbo Eo <mans0n@gorani.run>
6c95945 ptgen: add Chromium OS kernel partition support
8e7274e cros-vbutil: add Chrome OS vboot kernel-signing utility
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
On macOS, system binaries silently drop the environment variables for injecting
extra shared libraries (used by fakeroot). This is done for security reasons.
Work around this by building bash from source, so that it gets an ad-hoc signature
and does not have these restrictions
Signed-off-by: Felix Fietkau <nbd@nbd.name>
On ARM macOS, injecting extra shared libraries does not work for system
binaries. This causes fakeroot to fail for chown calls
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Changelog:
- upstream now needs OpenSSL in order to be able to sign FITs. See:
commit cb9faa6f98ae ("tools: Use a single target-independent config to enable OpenSSL")
- removes upstream patches.
Link: cb9faa6f98
Tested-by: Sergey V. Lobanov <sergey@lobanov.in>
Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Fixed -no-pie compilation warning on MacOS
Fixed errors related to using absolute addressing on MacOS arm64
Based on upstream patch from Jessica Clarke and suggestions from Ronny Kotzschmar
Link to original patch and discussion:
3b142045e8
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
change meson binary to use py extension. Fixes issue with meson's
symbolextractor using the host python instead of the system one.
We intentionally use a .py extension here so that meson launches
additional python scripts with the same build host python interpreter as
itself is running under (and not the host package one once it becomes
available)
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Added patch for MacOS without 32 bit inodes support
(__DARWIN_ONLY_64_BIT_INO_T is true)
This patch based on discussion https://github.com/archmac/bootstrap/issues/4
Signed-off-by: Sergey V. Lobanov <sergey@lobanov.in>
The llvm-bpf-$version.tar.xz might be absent. For example `make clean` executed, CONFIG_TARGET changed.
This commit can only guarantee that the target file can be built when tools/compile is explicitly called rather than $(tools/stamp-compile).
Signed-off-by: Huangbin Zhan <zhanhb88@gmail.com>
A define dealing with builtin type is wrong. A gnulib update fixes
this, but that requires a new cpio version.
Refresh other patch.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Remove the then unnecessary patch doing exactly that individually.
See also 09465d80 "u-boot.mk: always link host libraries static".
Signed-off-by: Andre Heider <a.heider@gmail.com>
