Commit Graph

1434 Commits

Author SHA1 Message Date
Jeffery To fbcac2d532 python,python3: Fix CVE-2019-9636 - urlsplit missing NFKC normalization
These patches address issue:
CVE-2019-9636: urlsplit does not handle NFKC normalization

Link to Python issue:
https://bugs.python.org/issue36216

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-04-21 00:52:30 +08:00
Rosen Penev 890993d406 Merge pull request #8477 from BKPepe/openwrt-18.06_perl
[OpenWrt 18.06] perlmod: fix ability to build module out-of-feed
2019-04-11 09:42:51 -07:00
Jan Pavlinec 1a23db5b23 php7: Add PKG_CPE_ID for proper CVE tracking
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 0465f6fb46)
2019-03-26 20:21:10 +01:00
Michael Heimpold 7aacf24236 php7: update to 7.2.16
Also refresh patch which does not apply cleanly anymore.

Run tested on Duckbill for mxs platform.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 80cdd53134)
2019-03-26 20:21:04 +01:00
Michael Heimpold 27433fc3eb php7: fix cross compiling patch (fixes #8166)
Fixes: e148924a4 ("php7: update to 7.2.15")

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 1d4081dd4c)
2019-03-26 20:20:57 +01:00
Michael Heimpold 00f6119bd2 php7: update to 7.2.15
Also refresh patch which does not apply cleanly anymore.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit e148924a4c)
2019-03-26 20:20:51 +01:00
Michael Heimpold ef57201aa9 php7: update to 7.2.14
While at, add --with-pic to configure arguments. This prevents the following
build errors spotted by the build bots for i386 targets:

-snip-
...
ext/openssl/.libs/openssl.o: direct GOT relocation R_386_GOT32X against
`X509_REQ_free' without base register can not be used when making a shared object
...
-snap-

This parameter seems to make no difference on other targets, nor
improve or make worse the package size.

Run tested for i386 in VirtualBox VM and on Duckbill for mxs platform.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 963c841463)
2019-03-26 20:20:43 +01:00
Michael Heimpold e9271cf276 php7: update to 7.2.13
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 794f8f8e94)
2019-03-26 20:20:36 +01:00
Michael Heimpold 1308ba92ce php7: update to 7.2.12
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 2186fe821d)
2019-03-26 20:20:31 +01:00
Michael Heimpold 9e330d6e9d php7: update to 7.2.11
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 797776a3b3)
2019-03-26 20:20:24 +01:00
Michael Heimpold 5e25be5353 php7: update to 7.2.10
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit c69af6717c)
2019-03-26 20:20:18 +01:00
Michael Heimpold 85c616557f php7: adjust load priority for openssl (fixes #6893)
This orders loading of openssl extension before extensions
which require openssl functions.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit 5afeb3f9c8)
2019-03-26 20:20:05 +01:00
Philip Prindeville b8970833bf perlmod: fix ability to build module out-of-feed
Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2019-03-23 13:06:13 +01:00
Rosen Penev e47fe43ea5 Jinja2: Update to 2.10
Switch URL to a deterministic one.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
2019-03-19 00:19:46 +01:00
Luiz Angelo Daros de Luca 8d7e62d952 ruby: update to 2.5.5
2.5.5: Bug fix for a deadlock in multi-thread/multi-process (using Process.fork) applications, like for example Puma

2.5.4: Fixes multiple vulnerabilities:

CVE-2019-8320: Delete directory using symlink when decompressing tar
CVE-2019-8321: Escape sequence injection vulnerability in verbose
CVE-2019-8322: Escape sequence injection vulnerability in gem owner
CVE-2019-8323: Escape sequence injection vulnerability in API response handling
CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
CVE-2019-8325: Escape sequence injection vulnerability in errors

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
2019-03-18 14:39:28 -03:00
Luiz Angelo Daros de Luca 17a0279dd1 ruby: fix build for uclibc
Backporting upstream fix. Closes #8051.

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit f9b16dea51)
2019-03-18 14:39:21 -03:00
Karel Kočí 2324d341ea Jinja2: add missing dependency on markupsafe
Signed-off-by: Karel Kočí <karel.koci@nic.cz>
2019-03-05 17:20:36 +01:00
Alexandru Ardelean d0f5ae180c [18.06] python3: fix [CVE-2018-20406]
Link to Python bug:
  https://bugs.python.org/issue34656

Upstream commit:
  https://github.com/python/cpython/commit/71a9c65e74a70b6ed39adc4ba81d311ac1aa2acc

OpenWrt 18.06 contains version Python 3.6.5, which doesn't contain this
fix.
Python 2.7 is not affected.

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2019-02-13 10:27:22 +02:00
Jeffery To 4368783e97 python-idna: Add missing dependency on python(3)-codecs
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-01-27 20:26:48 +08:00
Jeffery To 480e4d7e88 python/python3: Fix lib2to3 fixes search
This is the patch from c98b12d9a9 (#7931),
applied for both python 2 and 3.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2019-01-13 06:14:36 +08:00
Hannu Nyman 85bfefb561 Merge pull request #7757 from jefferyto/openwrt-18.06-python-dist-info
[openwrt-18.06] python/python3: fix .dist-info missing for setuptools and pip
2019-01-01 21:55:43 +02:00
Hannu Nyman 94b3e50e04 Merge pull request #7820 from commodo/18-06-python3-CVE-2018-14647
[18.06] python3: backport CVE-2018-14647 patch from upstream
2018-12-31 22:33:38 +02:00
Alexandru Ardelean 34dec81901 python3: backport CVE-2018-14647 patch from upstream [18.06]
These patches are backports from Python 3.6 upstream.
The security issue is described here:
  https://nvd.nist.gov/vuln/detail/CVE-2018-14647

The Python bug report:
  https://bugs.python.org/issue34623

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2018-12-31 19:20:27 +02:00
Alexandru Ardelean 3785db429f python: backport CVE-2018-14647 patches from upstream [18.06]
These patches are backports from Python 2.7 upstream.
The security issue is described here:
  https://nvd.nist.gov/vuln/detail/CVE-2018-14647

The Python bug report:
  https://bugs.python.org/issue34623

Signed-off-by: Alexandru Ardelean <ardeleanalex@gmail.com>
2018-12-31 18:58:19 +02:00
Jeffery To e3f32b75b3 python/python3: fix .dist-info missing for setuptools and pip
Without .dist-info (similar to .egg-info), setuptools and pip are not
discoverable by pkg_resources.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-12-23 03:28:02 +08:00
Luiz Angelo Daros de Luca 06579f632e ruby: bump to 2.5.3
Fix only release, including:
* CVE-2018-16396: Tainted flags are not propagated in Array#pack
  and String#unpack with some directives
* CVE-2018-16395: OpenSSL::X509::Name equality check does not work
  correctly

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry picked from commit 74216a55e1)
2018-10-22 14:14:12 -03:00
Guo Li 21b69c23a2 jamvm: Use <fenv.h> instead of <fpu_control.h>
musl libc (http://musl-libc.org lack the non-standard <fpu_control.h>
header, which is used in src/os/linux/{i386,x86_64}/init.c files to
setup the floating point precision. This patch makes it use the
standard C <fenv.h> header instead.

Original patch at Felix Janda at
https://sourceforge.net/p/jamvm/patches/6/

Signed-off-by: Guo Li <uxgood.org@gmail.com>
Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
2018-09-27 03:24:43 +00:00
Hirokazu MORIKAWA 93587e54e6 node: Fix incorrect detection of arm_version and arm_fpu
Automatic detection of the arm architecture does not work well.

http://downloads.lede-project.org/snapshots/faillogs/arm_arm1176jzf-s_vfp/packages/node/compile.txt

```
../deps/v8/src/arm/assembler-arm.cc:176:2: error: #error "CAN_USE_ARMV7_INSTRUCTIONS should match CAN_USE_VFP3_INSTRUCTIONS"
 #error "CAN_USE_ARMV7_INSTRUCTIONS should match CAN_USE_VFP3_INSTRUCTIONS"
   ^~~~~
```

https://github.com/openwrt/packages/issues/5728

Explicitly set cpu arch optimization flag to the compiler option so that "configure" script correctly identifies "arm version".

(Raspberry Pi Zero W)
Raspbian:
```
raspberrypi:~ $ echo | gcc -dM -E - | grep ARM_ARCH
```
OpenWrt (cross-env):
```
ubuntu:~ $ echo | ./arm-openwrt-linux-muslgnueabi-gcc -dM -E - | grep ARM_ARCH
```
```
ubuntu:~ $ echo | ./arm-openwrt-linux-muslgnueabi-gcc -mcpu=arm1176jzf-s -dM -E - | grep ARM_ARCH
```

Also specifying an option lines compactly.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 3482320c2a)
2018-09-24 08:45:42 +02:00
Hirokazu MORIKAWA c999832881 node: fix host build fail
modify patch.
 https://github.com/nodejs/node/pull/19196

made not to use libressl headers
 fix to include path not to use "host/include"

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry picked from commit 818770d273)
2018-09-24 08:45:42 +02:00
Michael Heimpold 88db40cd26 php7: update to 7.2.9
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-08-23 22:14:42 +02:00
Michael Heimpold 853f87a5f6 php7: add dependency to hash for mysqlnd
The following error shows that mysqlnd depends on functions
provided by hash:

root@OpenWrt:/etc/php7# php-cli -m
PHP Warning:  PHP Startup: Unable to load dynamic library
'mysqlnd.so' (tried: /usr/lib/php/mysqlnd.so (Error
relocating /usr/lib/php/mysqlnd.so: PHP_SHA256Final: symbol
not found), /usr/lib/php/mysqlnd.so.so (Error loading shared
library /usr/lib/php/mysqlnd.so.so: No such file or
directory)) in Unknown on line 0

So let's model this dep in package metadata.

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-08-23 22:14:35 +02:00
Philip Prindeville 4f3f81b64f perl: version modules and non-base packages
Currently external modules and non-base packages are numbered
from their own internal number space, and even though the Perl
ABI number is embedded into them this isn't externally visible.

For example, perl-html-parser-3.72.1 could be built for ABI
5.26 or for 5.28, we can't easily tell.  This changes all of
that by embedding the ABI number into the filename.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit 0d9584724f)
2018-08-14 13:28:53 -06:00
Philip Prindeville c875de62b3 perl: update to 5.28
Refresh patches 900 and 910.

Add fix (920) for improperly gated variable.

Add workaround (020) for Storable's run-time check for stacksize.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
(cherry picked from commit b94744496f)
2018-08-02 22:39:16 -06:00
Philip Prindeville e9854d09f3 perl: build with -fno-strict-liasing and -fwrapv
Looking at Configure and Porting/config.sh, it seems that Perl
requires both of these options to build correctly.

Should fix FS #1464.

Signed-off-by: Philip Prindeville <philipp@redfish-solutions.com>
2018-08-02 22:28:03 -06:00
Michael Heimpold 522800696d php7: update to 7.2.8
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-07-21 23:42:23 +02:00
Michael Heimpold 98edb6e210 php7: fix load order of mysqli extension
This problem was reported by Teun Lubberhuizen, thanks!

Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-07-21 23:42:15 +02:00
Michael Heimpold cdf150d0ca php7: update to 7.2.7
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-07-21 23:42:08 +02:00
Rafał Miłecki 81332c4765 php7: add package dependency on zoneinfo-core
Having "select PACKAGE_zoneinfo-core" wasn't enough for builds without
php7-cli=y or php7-cgi=y. It didn't result in installing zoneinfo-core
when using "opkg install" (during runtime or when building images with
CONFIG_TARGET_PER_DEVICE_ROOTFS).

Missing zoneinfo results in PHP fatal errors, e.g.:
Fatal error: DateTime::createFromFormat(): Timezone database is corrupt - this should *never* happen!

For years users were told to manually install zoneinfo-core package.
This problem was hidden for some time (including 17.01 release) due to
disabled support for CONFIG_PHP7_SYSTEMTZDATA. It's now back as support
for --with-system-tzdata was enabled again.

The proper solution is to simply make php7 package depend on
zoneinfo-core when PHP7_SYSTEMTZDATA is used.

Fixes: 84e5012e88 ("php7: re-enable system timezone data usage")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
2018-07-21 23:41:56 +02:00
Sebastian Kemper b65a759e80 php7: use mysqlnd
This is in anticipation of the MariaDB upgrade from mariadb 10.1.x to
10.2.x. With the latter the PHP MySQL plugins fail to compile, e.g.:

In file included from /home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/php_mysqli_structs.h:63:0,
                 from /home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/mysqli.c:34:
/home/equeiroz/src/openwrt-asus/staging_dir/target-mipsel_74kc_musl/usr/include/mysql/my_global.h:3:2: warning: #warning This file should not be included by clients, include only <mysql.h> [-Wcpp]
 #warning This file should not be included by clients, include only <mysql.h>
  ^~~~~~~
In file included from /home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/php_mysqli_structs.h:79:0,
                 from /home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/mysqli.c:34:
/home/equeiroz/src/openwrt-asus/staging_dir/target-mipsel_74kc_musl/usr/include/mysql/my_sys.h:3:2: warning: #warning This file should not be included by clients, include only <mysql.h> [-Wcpp]
 #warning This file should not be included by clients, include only <mysql.h>
  ^~~~~~~
In file included from /home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/mysqli.c:34:0:
/home/equeiroz/src/openwrt-asus/build_dir/target-mipsel_74kc_musl/php-7.2.6/ext/mysqli/php_mysqli_structs.h:82:10: fatal error: my_list.h: No such file or directory
 #include <my_list.h>

Upstream seems unlikely to fix this, see
https://bugs.php.net/bug.php?id=75612. In the bug report it is suggested
to not use libmysqlclient/libmariadbclient and instead utilize mysqlnd
(MySQL Native Driver) provided by PHP. This is the default anyway.

So add the mysqlnd module and remove the libmariadbclient depends.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>
2018-07-21 23:41:47 +02:00
Michael Heimpold 7e33126dc0 php7: update to 7.2.6
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-07-21 23:41:32 +02:00
Michael Heimpold ac5ee1ffb1 php7: replace libmysqlclient dependencies with libmariadbclient
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
2018-07-21 23:41:22 +02:00
Jeffery To 5d289ccd6a golang: Download bootstrap source directly, use golang-specific mirrors
These changes are a result of this conversation:
https://github.com/openwrt/packages/commit/19292650241de44b4f12fb02f0e11127f069d2b4#r29531922

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-29 15:04:26 +08:00
Jeffery To 665f3d2bbc golang: Allow additional arguments when compiling Go packages
This updates GoPackage/Build/Compile in golang-package.mk to accept
additional arguments that are passed to the go command line.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-28 03:11:56 +08:00
Jeffery To 7789257342 golang: update to 1.10.3, add mirrors
This also changes the bootstrap source URL to the official GitHub
mirror, to make building easier for places where Google sites aren't
accessible. Fixes #6326.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-27 11:39:26 +08:00
Jeffery To 9250b7283a twisted: update to 18.4.0, refresh patches
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:58:14 +08:00
Jeffery To d25196bc28 python-zope-interface: update to 4.5.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:57:35 +08:00
Jeffery To e7af1e992d python-pyasn1: update to 0.4.3
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:57:25 +08:00
Jeffery To 8c545ae8dd python-ply: update to 3.11
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:57:16 +08:00
Jeffery To dcdc8807a0 python-ipaddress: update to 1.0.22
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:57:04 +08:00
Jeffery To 4d225bb519 python-hyperlink: update to 18.0.0
Signed-off-by: Jeffery To <jeffery.to@gmail.com>
2018-06-26 04:56:53 +08:00