Update buildroot to 2020.11.3 (#1294)

Signed-off-by: Stefan Agner <stefan@agner.ch>

buildroot-patches/0006-ODROID-XU4-video-firmware.patch

@@ -1,50 +0,0 @@
-From 4526121b86b259e426766c4ba35b2911b2c0965c Mon Sep 17 00:00:00 2001
-Message-Id: <4526121b86b259e426766c4ba35b2911b2c0965c.1607000394.git.stefan@agner.ch>
-In-Reply-To: <dd83e231779b8daaeaa0a78d6686b80eeb49c12b.1607000394.git.stefan@agner.ch>
-References: <dd83e231779b8daaeaa0a78d6686b80eeb49c12b.1607000394.git.stefan@agner.ch>
-From: Stefan Agner <stefan@agner.ch>
-Date: Wed, 11 Nov 2020 22:16:10 +0100
-Subject: [PATCH 6/7] ODROID-XU4: video firmware
-
----
- package/linux-firmware/Config.in         | 6 ++++++
- package/linux-firmware/linux-firmware.mk | 6 ++++++
- 2 files changed, 12 insertions(+)
-
-diff --git a/package/linux-firmware/Config.in b/package/linux-firmware/Config.in
-index 105daf42b8..109af152f8 100644
---- a/package/linux-firmware/Config.in
-+++ b/package/linux-firmware/Config.in
-@@ -44,6 +44,12 @@ config BR2_PACKAGE_LINUX_FIRMWARE_QCOM_ADRENO
- 	help
- 	  Firmware files for Qualcomm Adreno GPU firmware
- 
-+
-+config BR2_PACKAGE_LINUX_FIRMWARE_MFC_V8
-+	bool "Samsung MFC video encoder/decoder driver v8"
-+	help
-+	  Firmware files for samsung MFC video encoder/decoder driver v8
-+
- endmenu # Video
- 
- menu "Bluetooth firmware"
-diff --git a/package/linux-firmware/linux-firmware.mk b/package/linux-firmware/linux-firmware.mk
-index 8808b5284c..f1c84a134d 100644
---- a/package/linux-firmware/linux-firmware.mk
-+++ b/package/linux-firmware/linux-firmware.mk
-@@ -39,6 +39,12 @@ LINUX_FIRMWARE_FILES += qcom/a*
- LINUX_FIRMWARE_ALL_LICENSE_FILES += LICENSE.qcom qcom/NOTICE.txt
- endif
- 
-+ifeq ($(BR2_PACKAGE_LINUX_FIRMWARE_MFC_V8),y)
-+LINUX_FIRMWARE_FILES += s5p-mfc-v8.fw
-+# No license file; the license is in the file WHENCE
-+# which is installed unconditionally
-+endif
-+
- # Intel Wireless Bluetooth
- ifeq ($(BR2_PACKAGE_LINUX_FIRMWARE_IBT),y)
- LINUX_FIRMWARE_FILES += intel/ibt-*
--- 
-2.29.2
-

buildroot/CHANGES

@@ -1,3 +1,27 @@
+2020.11.3, released February 17th, 2021
+
+	meson: Fix ccache detection handling when per-package builds
+	are used.
+
+	Fakeroot: Fix compatibility issue with glibc 2.33
+
+	Updated/fixed packages: atftp, binutils, busybox, cereal,
+	chartjs, connman, dhcpcd, dnsmasq, docker-cli, docker-engine,
+	ebtables, fakeroot, flashrom, go, gst1-python, guile,
+	intel-mediadriver, intel-microcode, jasper,
+	kodi-inputstream-adaptive, lcms2, libbsd, libopenssl,
+	makedumpfile, memtester, mosquitto, ne10, openblas, orc, php,
+	postgresql, privoxy, pugixml, python-bottle, python-django,
+	python3, rauc, sox, stress-ng, subversion, tzdate,
+	uboot-tools, uclibc, webkitgtk, wireguard-linux-compat,
+	wireshark, wpa_supplicant, wpewebkit, xenomai,
+	xserver_xorg-server, xterm
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#11706: binman (U-boot tool) cannot find libfdt "binman: No mod..
+	#13506: BR2_PACKAGE_DHCPCD missing directory creation
+
 2020.11.2, released January 31st, 2021
 
 	Important / security related fixes.

buildroot/DEVELOPERS

@@ -1033,11 +1033,6 @@ F:	package/python-redis/
 F:	package/python-rpi-ws281x/
 F:	package/python-wtforms/
 
-N:	Guillaume Gardet <guillaume.gardet@oliseo.fr>
-F:	package/c-icap/
-F:	package/c-icap-modules/
-F:	package/sdl2/
-
 N:	Guillaume William Brs <guillaume.bressaix@gmail.com>
 F:	package/libnids/
 F:	package/liquid-dsp/
@@ -2165,10 +2160,6 @@ F:	package/gupnp-av/
 F:	package/let-me-create/
 F:	package/nanomsg/
 
-N:	Rahul Jain <rahul.jain@imgtec.com>
-F:	package/uhttpd/
-F:	package/ustream-ssl/
-
 N:	Ramon Fried <rfried.dev@gmail.com>
 F:	package/bitwise/
 

buildroot/Makefile

@@ -92,9 +92,9 @@ all:
 .PHONY: all
 
 # Set and export the version string
-export BR2_VERSION := 2020.11.2
+export BR2_VERSION := 2020.11.3
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1612125000
+BR2_VERSION_EPOCH = 1613586000
 
 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)

buildroot/docs/manual/manual.text

@@ -174,13 +174,13 @@ List of Examples
 
 ---------------------------------------------------------------------
 
-Buildroot 2020.11.2 manual generated on 2021-01-31 20:36:55 UTC from
+Buildroot 2020.11.3 manual generated on 2021-02-17 18:26:17 UTC from
-git revision 551cb63007
+git revision 610e67b1fc
 
 The Buildroot manual is written by the Buildroot developers. It is
 licensed under the GNU General Public License, version 2. Refer to
 the COPYING [http://git.buildroot.org/buildroot/tree/COPYING?id=
-551cb630079316efe928d7c2eb0358a19e38fc48] file in the Buildroot
+610e67b1fc4ac44e0c4a7ba437c917ad6d63f481] file in the Buildroot
 sources for the full text of this license.
 
 Copyright © 2004-2020 The Buildroot developers

buildroot/linux/linux.hash

@@ -1,12 +1,12 @@
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
 sha256  b0d7abae88e5f91893627c645e680a95c818defd1b4fcaf3e2afb4b2b6b4ab86  linux-5.9.16.tar.xz
 sha256  4ab4a3f694b7b4cfbe78871eab34c8039ad33692144c45c669827a594da85534  linux-5.8.18.tar.xz
-sha256  d37449403664cc3b1bac96d0d9a199dbe619885cd899c0ae3108843f42e3d522  linux-5.4.93.tar.xz
+sha256  030ae544f346bfa2ce619dd9e17e93d10ec393632d3b6d6cf5d1fc84b914d449  linux-5.4.95.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
-sha256  661e98b9448cbac948c705fd44cd7d30200422ee1cb02950d142aa99a1b3985a  linux-4.4.253.tar.xz
+sha256  2f3830ed4767b27dc6ead9af5c802eed7258b28c527efe90ce188cc6bd668550  linux-4.4.255.tar.xz
-sha256  9a5b51a8350201bd38e3ff13909323a6571b4572a7b3caed76e462b07619bc18  linux-4.9.253.tar.xz
+sha256  afdf2d03c920f6b12f4e207ab18e45fbe2d7f4a61c066eff0d9916fc5d00c118  linux-4.9.255.tar.xz
-sha256  62a36a25431016d98d0f1cff98be432086c51f86fd79042bd10a867b3a924d11  linux-4.14.217.tar.xz
+sha256  75eecaa731c091fcf3bc2ec914b01d299a447d78041cb66a11a2ab169eb801dd  linux-4.14.219.tar.xz
-sha256  f4e352fe0eb986e5b532b99d9b0725a67046cbb3e5f53fcd5b098cbaeb2ac60a  linux-4.19.171.tar.xz
+sha256  d2fdd236e6f31aa8e939f4a686c95417d8571bde3d091fc6a2535937c144195f  linux-4.19.173.tar.xz
 # Locally computed
 sha256  d2a06f52143deb929b8d513cf9afc9bd065951389a80fa70bc4d63025b5b3fb9  linux-cip-4.19.152-cip37.tar.gz
 sha256  bc1dacd3d0f526de3e8754a444e8e02a54521527af639ddb907cb35cda775a8c  linux-cip-4.19.152-cip37-rt16.tar.gz

buildroot/package/atftp/0004-Fix-for-DoS-issue-CVE-2020-6097.patch

@@ -0,0 +1,104 @@
+From 96409ef3b9ca061f9527cfaafa778105cf15d994 Mon Sep 17 00:00:00 2001
+From: Peter Kaestle <peter.kaestle@nokia.com>
+Date: Wed, 14 Oct 2020 14:02:41 +0200
+Subject: [PATCH] Fix for DoS issue CVE-2020-6097
+
+"sockaddr_print_addr" of tftpd can be triggered remotely to call
+assert(), which will crash the tftpd daemon.  See:
+https://talosintelligence.com/vulnerability_reports/TALOS-2020-1029
+
+"sockaddr_print_addr" originaly had two features:
+1) returning pointer to string of the incoming ip address
+2) checking whether ss_family of the connection is supported
+
+To fix the issue, a separate function "sockaddr_family_supported" is
+used to take care of 2) and "sockaddr_print_addr" returns an error
+message string for unsupported cases when using 1) insert of calling
+assert().
+
+[Upstream:
+ https://sourceforge.net/u/peterkaestle/atftp/ci/96409ef3b9ca061f9527cfaafa778105cf15d994/]
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ tftp_def.c    | 11 ++++++++++-
+ tftp_def.h    |  1 +
+ tftpd.c       |  5 +++++
+ tftpd_mtftp.c |  5 +++++
+ 4 files changed, 21 insertions(+), 1 deletion(-)
+
+diff --git a/tftp_def.c b/tftp_def.c
+index d457c2a..428a930 100644
+--- a/tftp_def.c
++++ b/tftp_def.c
+@@ -180,6 +180,15 @@ int Gethostbyname(char *addr, struct hostent *host)
+      return OK;
+ }
+ 
++int
++sockaddr_family_supported(const struct sockaddr_storage *ss)
++{
++     if (ss->ss_family == AF_INET || ss->ss_family == AF_INET6)
++          return 1;
++     else
++          return 0;
++}
++
+ char *
+ sockaddr_print_addr(const struct sockaddr_storage *ss, char *buf, size_t len)
+ {
+@@ -189,7 +198,7 @@ sockaddr_print_addr(const struct sockaddr_storage *ss, char *buf, size_t len)
+      else if (ss->ss_family == AF_INET6)
+           addr = &((const struct sockaddr_in6 *)ss)->sin6_addr;
+      else
+-          assert(!"sockaddr_print: unsupported address family");
++          return "sockaddr_print: unsupported address family";
+      return (char *)inet_ntop(ss->ss_family, addr, buf, len);
+ }
+ 
+diff --git a/tftp_def.h b/tftp_def.h
+index 0841746..458e310 100644
+--- a/tftp_def.h
++++ b/tftp_def.h
+@@ -54,6 +54,7 @@ int print_eng(double value, char *string, int size, char *format);
+ inline char *Strncpy(char *to, const char *from, size_t size);
+ int Gethostbyname(char *addr, struct hostent *host);
+ 
++int sockaddr_family_supported(const struct sockaddr_storage *ss);
+ char *sockaddr_print_addr(const struct sockaddr_storage *, char *, size_t);
+ #define SOCKADDR_PRINT_ADDR_LEN INET6_ADDRSTRLEN
+ uint16_t sockaddr_get_port(const struct sockaddr_storage *);
+diff --git a/tftpd.c b/tftpd.c
+index 0b6f6a5..a7561a5 100644
+--- a/tftpd.c
++++ b/tftpd.c
+@@ -644,6 +644,11 @@ void *tftpd_receive_request(void *arg)
+      }
+ 
+ #ifdef HAVE_WRAP
++     if (!abort && !sockaddr_family_supported(&data->client_info->client))
++     {
++          logger(LOG_ERR, "Connection from unsupported network address family refused");
++          abort = 1;
++     }
+      if (!abort)
+      {
+           /* Verify the client has access. We don't look for the name but
+diff --git a/tftpd_mtftp.c b/tftpd_mtftp.c
+index d420d10..0032905 100644
+--- a/tftpd_mtftp.c
++++ b/tftpd_mtftp.c
+@@ -393,6 +393,11 @@ void *tftpd_mtftp_server(void *arg)
+                                         &data_size, data->data_buffer);
+ 
+ #ifdef HAVE_WRAP
++               if (!sockaddr_family_supported(&sa))
++               {
++                    logger(LOG_ERR, "mtftp: Connection from unsupported network address family refused");
++                    continue;
++               }
+                /* Verify the client has access. We don't look for the name but
+                   rely only on the IP address for that. */
+                sockaddr_print_addr(&sa, addr_str, sizeof(addr_str));
+-- 
+2.20.1
+

buildroot/package/atftp/atftp.mk

@@ -18,6 +18,9 @@ ATFTP_LIBS = -lpthread
 ATFTP_CONF_ENV = LIBS="$(ATFTP_LIBS)" \
 	CFLAGS="$(TARGET_CFLAGS) -fgnu89-inline"
 
+# 0004-Fix-for-DoS-issue-CVE-2020-6097.patch
+ATFTP_IGNORE_CVES += CVE-2020-6097
+
 ifeq ($(BR2_PACKAGE_READLINE),y)
 ATFTP_DEPENDENCIES += readline
 ATFTP_CONF_OPTS += --enable-libreadline

buildroot/package/binutils/Config.in.host

@@ -32,7 +32,7 @@ config BR2_BINUTILS_VERSION_2_34_X
 	depends on !BR2_BINFMT_FLAT
 
 config BR2_BINUTILS_VERSION_2_35_X
-	bool "binutils 2.35.1"
+	bool "binutils 2.35.2"
 	depends on !BR2_csky
 	# https://github.com/uclinux-dev/elf2flt/pull/16
 	# https://github.com/uclinux-dev/elf2flt/issues/12
@@ -55,7 +55,7 @@ config BR2_BINUTILS_VERSION
 	default "2.32"		if BR2_BINUTILS_VERSION_2_32_X
 	default "2.33.1"	if BR2_BINUTILS_VERSION_2_33_X
 	default "2.34"		if BR2_BINUTILS_VERSION_2_34_X
-	default "2.35.1"	if BR2_BINUTILS_VERSION_2_35_X
+	default "2.35.2"	if BR2_BINUTILS_VERSION_2_35_X
 
 config BR2_BINUTILS_ENABLE_LTO
 	bool

buildroot/package/binutils/binutils.hash

@@ -2,7 +2,7 @@
 sha512  d326408f12a03d9a61a9de56584c2af12f81c2e50d2d7e835d51565df8314df01575724afa1e43bd0db45cfc9916b41519b67dfce03232aa4978704492a6994a  binutils-2.32.tar.xz
 sha512  b7a6767c6c7ca6b5cafa7080e6820b7bb3a53b7148348c438d99905defbdf0d30c9744a484ee01c9441a8153901808513366b15ba9533e20c9673c262ade36ac  binutils-2.33.1.tar.xz
 sha512  2c7976939dcf5e8c5b7374cccd39bfe803b1bec73c6abfa0eb17c24e1942574c6bdb874c66a092a82adc443182eacd8a5a8001c19a76101f0c7ba40c27de0bbd  binutils-2.34.tar.xz
-sha512  94ff72708403413b70b247f3af4099ebaa882b6659249869f1ed9941a0f1912e313f08357d470f9fd2359e7f5e5b0eb86285e5eaf883fa8187789d6b1bd304eb  binutils-2.35.1.tar.xz
+sha512  9974ede5978d32e0d68fef23da48fa00bd06b0bff7ec45b00ca075c126d6bbe0cf2defc03ecc3f17bc6cc85b64271a13009c4049d7ba17de26e84e3a6e2c0348  binutils-2.35.2.tar.xz
 
 # Locally calculated (fetched from Github)
 sha512  76a8227a19218435319c660e4983ea17985194b7f496f163e97543e7f6fd3e9249241fdc05a16ba512fba96a1d846c1f7b080983404d821d6215f10e7f11e238  binutils-gdb-arc-2020.09-release.tar.gz

buildroot/package/busybox/udhcpc.script

@@ -18,7 +18,7 @@ fi
 wait_for_ipv6_default_route() {
 	printf "Waiting for IPv6 default route to appear"
 	while [ $IF_WAIT_DELAY -gt 0 ]; do
-		if [ -z "$(ip -6 route list | grep default)" ]; then
+		if ip -6 route list | grep -q default; then
 			printf "\n"
 			return
 		fi

buildroot/package/cereal/0001-Store-a-copy-of-each-serialized-shared_ptr-within-the-archive.patch

@@ -0,0 +1,67 @@
+From f27c12d491955c94583512603bf32c4568f20929 Mon Sep 17 00:00:00 2001
+From: Michael Walz <code@serpedon.de>
+Date: Tue, 2 Feb 2021 00:50:29 +0100
+Subject: [PATCH] Store a copy of each serialized shared_ptr within the archive
+ to prevent the shared_ptr to be freed to early. (#667)
+
+The archives use the memory address pointed by the shared_ptr as a
+unique id which must not be reused during lifetime of the archive.
+Therefore, the archives stores a copy of it.
+This problem was also reported as CVE-2020-11105.
+
+[Retrieved from:
+https://github.com/USCiLab/cereal/commit/f27c12d491955c94583512603bf32c4568f20929]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ include/cereal/cereal.hpp       | 13 +++++++++++--
+ include/cereal/types/memory.hpp |  2 +-
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/include/cereal/cereal.hpp b/include/cereal/cereal.hpp
+index 99bed9d6..f0d15e8b 100644
+--- a/include/cereal/cereal.hpp
++++ b/include/cereal/cereal.hpp
+@@ -369,12 +369,17 @@ namespace cereal
+           point to the same data.
+ 
+           @internal
+-          @param addr The address (see shared_ptr get()) pointed to by the shared pointer
++          @param sharedPointer The shared pointer itself (the adress is taked via get()).
++                               The archive takes a copy to prevent the memory location to be freed
++                               as long as the address is used as id. This is needed to prevent CVE-2020-11105.
+           @return A key that uniquely identifies the pointer */
+-      inline std::uint32_t registerSharedPointer( void const * addr )
++      inline std::uint32_t registerSharedPointer(const std::shared_ptr<const void>& sharedPointer)
+       {
++        void const * addr = sharedPointer.get();
++
+         // Handle null pointers by just returning 0
+         if(addr == 0) return 0;
++        itsSharedPointerStorage.push_back(sharedPointer);
+ 
+         auto id = itsSharedPointerMap.find( addr );
+         if( id == itsSharedPointerMap.end() )
+@@ -645,6 +650,10 @@ namespace cereal
+       //! Maps from addresses to pointer ids
+       std::unordered_map<void const *, std::uint32_t> itsSharedPointerMap;
+ 
++      //! Copy of shared pointers used in #itsSharedPointerMap to make sure they are kept alive
++      //  during lifetime of itsSharedPointerMap to prevent CVE-2020-11105.
++      std::vector<std::shared_ptr<const void>> itsSharedPointerStorage;
++
+       //! The id to be given to the next pointer
+       std::uint32_t itsCurrentPointerId;
+ 
+diff --git a/include/cereal/types/memory.hpp b/include/cereal/types/memory.hpp
+index 59e9da9b..cac1f334 100644
+--- a/include/cereal/types/memory.hpp
++++ b/include/cereal/types/memory.hpp
+@@ -263,7 +263,7 @@ namespace cereal
+   {
+     auto & ptr = wrapper.ptr;
+ 
+-    uint32_t id = ar.registerSharedPointer( ptr.get() );
++    uint32_t id = ar.registerSharedPointer( ptr );
+     ar( CEREAL_NVP_("id", id) );
+ 
+     if( id & detail::msb_32bit )

buildroot/package/cereal/cereal.mk

@@ -15,4 +15,7 @@ CEREAL_CONF_OPTS = \
 	-DTHREAD_SAFE=ON \
 	-DJUST_INSTALL_CEREAL=ON
 
+# 0001-Store-a-copy-of-each-serialized-shared_ptr-within-the-archive.patch
+CEREAL_IGNORE_CVES += CVE-2020-11105
+
 $(eval $(cmake-package))

buildroot/package/chartjs/chartjs.hash

@@ -1,3 +1,3 @@
 # Locally computed:
-sha256	8079d8fd39131fcfaec33f1c7799412bcf8e051e25b10bd6e37fc16159417aa1  chartjs-v2.9.3.tar.gz
+sha256	9ef3697e279a585c79730f35dba16ad4e24ddeed49a150adb341c31f191fb78e  chartjs-2.9.4.tar.gz
 sha256	7b43caae91f31b18dc81fae6e0f7aa1acbecaa6d84e3249905cbe15308307d67  LICENSE.md

buildroot/package/chartjs/chartjs.mk

@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-CHARTJS_VERSION = v2.9.3
+CHARTJS_VERSION = 2.9.4
-CHARTJS_SITE = $(call github,chartjs,Chart.js,$(CHARTJS_VERSION))
+CHARTJS_SITE = $(call github,chartjs,Chart.js,v$(CHARTJS_VERSION))
 CHARTJS_LICENSE = MIT
 CHARTJS_LICENSE_FILES = LICENSE.md
 

buildroot/package/connman/0001-gdhcp-Avoid-reading-invalid-data-in-dhcp_get_option.patch

@@ -0,0 +1,226 @@
+From 58d397ba74873384aee449690a9070bacd5676fa Mon Sep 17 00:00:00 2001
+From: Colin Wee <cwee@tesla.com>
+Date: Thu, 28 Jan 2021 19:39:14 +0100
+Subject: [PATCH] gdhcp: Avoid reading invalid data in dhcp_get_option
+
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ gdhcp/client.c | 20 +++++++++++---------
+ gdhcp/common.c | 24 +++++++++++++++++++-----
+ gdhcp/common.h |  2 +-
+ gdhcp/server.c | 12 +++++++-----
+ 4 files changed, 38 insertions(+), 20 deletions(-)
+
+diff --git a/gdhcp/client.c b/gdhcp/client.c
+index 09dfe5ec..6a5613e7 100644
+--- a/gdhcp/client.c
++++ b/gdhcp/client.c
+@@ -1629,12 +1629,12 @@ static void start_request(GDHCPClient *dhcp_client)
+ 							NULL);
+ }
+ 
+-static uint32_t get_lease(struct dhcp_packet *packet)
++static uint32_t get_lease(struct dhcp_packet *packet, uint16_t packet_len)
+ {
+ 	uint8_t *option;
+ 	uint32_t lease_seconds;
+ 
+-	option = dhcp_get_option(packet, DHCP_LEASE_TIME);
++	option = dhcp_get_option(packet, packet_len, DHCP_LEASE_TIME);
+ 	if (!option)
+ 		return 3600;
+ 
+@@ -2226,7 +2226,8 @@ static void get_dhcpv6_request(GDHCPClient *dhcp_client,
+ 	}
+ }
+ 
+-static void get_request(GDHCPClient *dhcp_client, struct dhcp_packet *packet)
++static void get_request(GDHCPClient *dhcp_client, struct dhcp_packet *packet,
++		uint16_t packet_len)
+ {
+ 	GDHCPOptionType type;
+ 	GList *list, *value_list;
+@@ -2237,7 +2238,7 @@ static void get_request(GDHCPClient *dhcp_client, struct dhcp_packet *packet)
+ 	for (list = dhcp_client->request_list; list; list = list->next) {
+ 		code = (uint8_t) GPOINTER_TO_INT(list->data);
+ 
+-		option = dhcp_get_option(packet, code);
++		option = dhcp_get_option(packet, packet_len, code);
+ 		if (!option) {
+ 			g_hash_table_remove(dhcp_client->code_value_hash,
+ 						GINT_TO_POINTER((int) code));
+@@ -2297,6 +2298,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 		re = dhcp_recv_l2_packet(&packet,
+ 					dhcp_client->listener_sockfd,
+ 					&dst_addr);
++		pkt_len = (uint16_t)(unsigned int)re;
+ 		xid = packet.xid;
+ 	} else if (dhcp_client->listen_mode == L3) {
+ 		if (dhcp_client->type == G_DHCP_IPV6) {
+@@ -2361,7 +2363,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 			dhcp_client->status_code = status;
+ 		}
+ 	} else {
+-		message_type = dhcp_get_option(&packet, DHCP_MESSAGE_TYPE);
++		message_type = dhcp_get_option(&packet, pkt_len, DHCP_MESSAGE_TYPE);
+ 		if (!message_type)
+ 			return TRUE;
+ 	}
+@@ -2378,7 +2380,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 		dhcp_client->timeout = 0;
+ 		dhcp_client->retry_times = 0;
+ 
+-		option = dhcp_get_option(&packet, DHCP_SERVER_ID);
++		option = dhcp_get_option(&packet, pkt_len, DHCP_SERVER_ID);
+ 		dhcp_client->server_ip = get_be32(option);
+ 		dhcp_client->requested_ip = ntohl(packet.yiaddr);
+ 
+@@ -2428,9 +2430,9 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 
+ 			remove_timeouts(dhcp_client);
+ 
+-			dhcp_client->lease_seconds = get_lease(&packet);
++			dhcp_client->lease_seconds = get_lease(&packet, pkt_len);
+ 
+-			get_request(dhcp_client, &packet);
++			get_request(dhcp_client, &packet, pkt_len);
+ 
+ 			switch_listening_mode(dhcp_client, L_NONE);
+ 
+@@ -2438,7 +2440,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 			dhcp_client->assigned_ip = get_ip(packet.yiaddr);
+ 
+ 			if (dhcp_client->state == REBOOTING) {
+-				option = dhcp_get_option(&packet,
++				option = dhcp_get_option(&packet, pkt_len,
+ 							DHCP_SERVER_ID);
+ 				dhcp_client->server_ip = get_be32(option);
+ 			}
+diff --git a/gdhcp/common.c b/gdhcp/common.c
+index 1d667d17..c8916aa8 100644
+--- a/gdhcp/common.c
++++ b/gdhcp/common.c
+@@ -73,18 +73,21 @@ GDHCPOptionType dhcp_get_code_type(uint8_t code)
+ 	return OPTION_UNKNOWN;
+ }
+ 
+-uint8_t *dhcp_get_option(struct dhcp_packet *packet, int code)
++uint8_t *dhcp_get_option(struct dhcp_packet *packet, uint16_t packet_len, int code)
+ {
+ 	int len, rem;
+-	uint8_t *optionptr;
++	uint8_t *optionptr, *options_end;
++	size_t options_len;
+ 	uint8_t overload = 0;
+ 
+ 	/* option bytes: [code][len][data1][data2]..[dataLEN] */
+ 	optionptr = packet->options;
+ 	rem = sizeof(packet->options);
++	options_len = packet_len - (sizeof(*packet) - sizeof(packet->options));
++	options_end = optionptr + options_len - 1;
+ 
+ 	while (1) {
+-		if (rem <= 0)
++		if ((rem <= 0) && (optionptr + OPT_CODE > options_end))
+ 			/* Bad packet, malformed option field */
+ 			return NULL;
+ 
+@@ -115,14 +118,25 @@ uint8_t *dhcp_get_option(struct dhcp_packet *packet, int code)
+ 			break;
+ 		}
+ 
++		if (optionptr + OPT_LEN > options_end) {
++			/* bad packet, would read length field from OOB */
++			return NULL;
++		}
++
+ 		len = 2 + optionptr[OPT_LEN];
+ 
+ 		rem -= len;
+ 		if (rem < 0)
+ 			continue; /* complain and return NULL */
+ 
+-		if (optionptr[OPT_CODE] == code)
+-			return optionptr + OPT_DATA;
++		if (optionptr[OPT_CODE] == code) {
++			if (optionptr + len > options_end) {
++				/* bad packet, option length points OOB */
++				return NULL;
++			} else {
++				return optionptr + OPT_DATA;
++			}
++		}
+ 
+ 		if (optionptr[OPT_CODE] == DHCP_OPTION_OVERLOAD)
+ 			overload |= optionptr[OPT_DATA];
+diff --git a/gdhcp/common.h b/gdhcp/common.h
+index 9660231c..8f63fd75 100644
+--- a/gdhcp/common.h
++++ b/gdhcp/common.h
+@@ -179,7 +179,7 @@ struct in6_pktinfo {
+ };
+ #endif
+ 
+-uint8_t *dhcp_get_option(struct dhcp_packet *packet, int code);
++uint8_t *dhcp_get_option(struct dhcp_packet *packet, uint16_t packet_len, int code);
+ uint8_t *dhcpv6_get_option(struct dhcpv6_packet *packet, uint16_t pkt_len,
+ 			int code, uint16_t *option_len, int *option_count);
+ uint8_t *dhcpv6_get_sub_option(unsigned char *option, uint16_t max_len,
+diff --git a/gdhcp/server.c b/gdhcp/server.c
+index 85405f19..52ea2a55 100644
+--- a/gdhcp/server.c
++++ b/gdhcp/server.c
+@@ -413,7 +413,7 @@ error:
+ }
+ 
+ 
+-static uint8_t check_packet_type(struct dhcp_packet *packet)
++static uint8_t check_packet_type(struct dhcp_packet *packet, uint16_t packet_len)
+ {
+ 	uint8_t *type;
+ 
+@@ -423,7 +423,7 @@ static uint8_t check_packet_type(struct dhcp_packet *packet)
+ 	if (packet->op != BOOTREQUEST)
+ 		return 0;
+ 
+-	type = dhcp_get_option(packet, DHCP_MESSAGE_TYPE);
++	type = dhcp_get_option(packet, packet_len, DHCP_MESSAGE_TYPE);
+ 
+ 	if (!type)
+ 		return 0;
+@@ -651,6 +651,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 	struct dhcp_lease *lease;
+ 	uint32_t requested_nip = 0;
+ 	uint8_t type, *server_id_option, *request_ip_option;
++	uint16_t packet_len;
+ 	int re;
+ 
+ 	if (condition & (G_IO_NVAL | G_IO_ERR | G_IO_HUP)) {
+@@ -661,12 +662,13 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 	re = dhcp_recv_l3_packet(&packet, dhcp_server->listener_sockfd);
+ 	if (re < 0)
+ 		return TRUE;
++	packet_len = (uint16_t)(unsigned int)re;
+ 
+-	type = check_packet_type(&packet);
++	type = check_packet_type(&packet, packet_len);
+ 	if (type == 0)
+ 		return TRUE;
+ 
+-	server_id_option = dhcp_get_option(&packet, DHCP_SERVER_ID);
++	server_id_option = dhcp_get_option(&packet, packet_len, DHCP_SERVER_ID);
+ 	if (server_id_option) {
+ 		uint32_t server_nid =
+ 			get_unaligned((const uint32_t *) server_id_option);
+@@ -675,7 +677,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ 			return TRUE;
+ 	}
+ 
+-	request_ip_option = dhcp_get_option(&packet, DHCP_REQUESTED_IP);
++	request_ip_option = dhcp_get_option(&packet, packet_len, DHCP_REQUESTED_IP);
+ 	if (request_ip_option)
+ 		requested_nip = get_be32(request_ip_option);
+ 
+-- 
+2.20.1
+

buildroot/package/connman/0002-gdhcp-Avoid-leaking-stack-data-via-unitiialized-vari.patch

@@ -0,0 +1,27 @@
+From a74524b3e3fad81b0fd1084ffdf9f2ea469cd9b1 Mon Sep 17 00:00:00 2001
+From: Colin Wee <cwee@tesla.com>
+Date: Thu, 28 Jan 2021 19:41:09 +0100
+Subject: [PATCH] gdhcp: Avoid leaking stack data via unitiialized variable
+
+Fixes: CVE-2021-26676
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ gdhcp/client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/gdhcp/client.c b/gdhcp/client.c
+index 6a5613e7..c7b85e58 100644
+--- a/gdhcp/client.c
++++ b/gdhcp/client.c
+@@ -2270,7 +2270,7 @@ static gboolean listener_event(GIOChannel *channel, GIOCondition condition,
+ {
+ 	GDHCPClient *dhcp_client = user_data;
+ 	struct sockaddr_in dst_addr = { 0 };
+-	struct dhcp_packet packet;
++	struct dhcp_packet packet = { 0 };
+ 	struct dhcpv6_packet *packet6 = NULL;
+ 	uint8_t *message_type = NULL, *client_id = NULL, *option,
+ 		*server_id = NULL;
+-- 
+2.20.1
+

buildroot/package/connman/0003-dnsproxy-Add-length-checks-to-prevent-buffer-overflo.patch

@@ -0,0 +1,56 @@
+From e4079a20f617a4b076af503f6e4e8b0304c9f2cb Mon Sep 17 00:00:00 2001
+From: Colin Wee <cwee@tesla.com>
+Date: Thu, 28 Jan 2021 19:41:53 +0100
+Subject: [PATCH] dnsproxy: Add length checks to prevent buffer overflow
+
+Fixes: CVE-2021-26675
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ src/dnsproxy.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/src/dnsproxy.c b/src/dnsproxy.c
+index a7bf87a1..4f5c897f 100644
+--- a/src/dnsproxy.c
++++ b/src/dnsproxy.c
+@@ -1767,6 +1767,7 @@ static char *uncompress(int16_t field_count, char *start, char *end,
+ 			char **uncompressed_ptr)
+ {
+ 	char *uptr = *uncompressed_ptr; /* position in result buffer */
++	char * const uncomp_end = uncompressed + uncomp_len - 1;
+ 
+ 	debug("count %d ptr %p end %p uptr %p", field_count, ptr, end, uptr);
+ 
+@@ -1787,12 +1788,15 @@ static char *uncompress(int16_t field_count, char *start, char *end,
+ 		 * tmp buffer.
+ 		 */
+ 
+-		ulen = strlen(name);
+-		strncpy(uptr, name, uncomp_len - (uptr - uncompressed));
+-
+ 		debug("pos %d ulen %d left %d name %s", pos, ulen,
+ 			(int)(uncomp_len - (uptr - uncompressed)), uptr);
+ 
++		ulen = strlen(name);
++		if ((uptr + ulen + 1) > uncomp_end) {
++			goto out;
++		}
++		strncpy(uptr, name, uncomp_len - (uptr - uncompressed));
++
+ 		uptr += ulen;
+ 		*uptr++ = '\0';
+ 
+@@ -1802,6 +1806,10 @@ static char *uncompress(int16_t field_count, char *start, char *end,
+ 		 * We copy also the fixed portion of the result (type, class,
+ 		 * ttl, address length and the address)
+ 		 */
++		if ((uptr + NS_RRFIXEDSZ) > uncomp_end) {
++			debug("uncompressed data too large for buffer");
++			goto out;
++		}
+ 		memcpy(uptr, ptr, NS_RRFIXEDSZ);
+ 
+ 		dns_type = uptr[0] << 8 | uptr[1];
+-- 
+2.20.1
+

buildroot/package/dhcpcd/dhcpcd.mk

@@ -41,6 +41,7 @@ endef
 
 define DHCPCD_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) install DESTDIR=$(TARGET_DIR)
+	mkdir -p $(TARGET_DIR)/var/db/dhcpcd
 endef
 
 # When network-manager is enabled together with dhcpcd, it will use

buildroot/package/dnsmasq/dnsmasq.hash

@@ -1,6 +1,6 @@
 # Locally calculated after checking pgp signature
-# http://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.81.tar.xz.asc
+# https://www.thekelleys.org.uk/dnsmasq/dnsmasq-2.83.tar.xz.asc
-sha256  749ca903537c5197c26444ac24b0dce242cf42595fdfe6b9a5b9e4c7ad32f8fb  dnsmasq-2.81.tar.xz
+sha256  603195c64b73137609b07e1024ae0b37f652b2f5fe467dce66985b3d1850050c  dnsmasq-2.84.tar.xz
 # Locally calculated
 sha256  dcc100d4161cc0b7177545ab6e47216f84857cda3843847c792a25289852dcaa  COPYING
 sha256  8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903  COPYING-v3

buildroot/package/dnsmasq/dnsmasq.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DNSMASQ_VERSION = 2.81
+DNSMASQ_VERSION = 2.84
 DNSMASQ_SOURCE = dnsmasq-$(DNSMASQ_VERSION).tar.xz
 DNSMASQ_SITE = http://thekelleys.org.uk/dnsmasq
 DNSMASQ_MAKE_ENV = $(TARGET_MAKE_ENV) CC="$(TARGET_CC)"
@@ -77,13 +77,7 @@ DNSMASQ_DEPENDENCIES += ubus
 DNSMASQ_COPTS += -DHAVE_UBUS
 endif
 
-define DNSMASQ_FIX_PKGCONFIG
-	$(SED) 's^PKG_CONFIG = pkg-config^PKG_CONFIG = $(PKG_CONFIG_HOST_BINARY)^' \
-		$(DNSMASQ_DIR)/Makefile
-endef
-
 define DNSMASQ_BUILD_CMDS
-	$(DNSMASQ_FIX_PKGCONFIG)
 	$(DNSMASQ_TWEAK_LIBLUA)
 	$(DNSMASQ_MAKE_ENV) $(MAKE) -C $(@D) $(DNSMASQ_MAKE_OPTS) all$(DNSMASQ_I18N)
 endef

buildroot/package/docker-cli/docker-cli.hash

@@ -1,3 +1,3 @@
 # Locally calculated
-sha256	21b88a00e8f7a3194c0ae1de5a31e3e1728ef6aa2804158dcb502a8b5fd6ae2b  docker-cli-19.03.13.tar.gz
+sha256	1b577057daf269fabab93b7035d1685aa690118ca7c84e1d772a770a021da883  docker-cli-19.03.15.tar.gz
 sha256	2d81ea060825006fc8f3fe28aa5dc0ffeb80faf325b612c955229157b8c10dc0  LICENSE

buildroot/package/docker-cli/docker-cli.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DOCKER_CLI_VERSION = 19.03.13
+DOCKER_CLI_VERSION = 19.03.15
 DOCKER_CLI_SITE = $(call github,docker,cli,v$(DOCKER_CLI_VERSION))
 
 DOCKER_CLI_LICENSE = Apache-2.0

buildroot/package/docker-engine/docker-engine.hash

@@ -1,3 +1,3 @@
 # Locally calculated
-sha256	f43331fef1d24e31f43392fc1fed72b48fc17fd432d341d6eb1f68ca11383406  docker-engine-19.03.13.tar.gz
+sha256	ef5cd0bdd3e06102dcdae72ffba7f89e663c680d9dc17b811f51aad8ff5b0405  docker-engine-19.03.15.tar.gz
 sha256	7c87873291f289713ac5df48b1f2010eb6963752bbd6b530416ab99fc37914a8  LICENSE

buildroot/package/docker-engine/docker-engine.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-DOCKER_ENGINE_VERSION = 19.03.13
+DOCKER_ENGINE_VERSION = 19.03.15
 DOCKER_ENGINE_SITE = $(call github,moby,moby,v$(DOCKER_ENGINE_VERSION))
 
 DOCKER_ENGINE_LICENSE = Apache-2.0

buildroot/package/ebtables/ebtables.mk

@@ -31,4 +31,11 @@ endef
 EBTABLES_POST_INSTALL_TARGET_HOOKS += EBTABLES_REMOVE_UTILS_RESTORE
 endif
 
+ifeq ($(BR2_PACKAGE_IPTABLES_NFTABLES),)
+define EBTABLES_INSTALL_LEGACY_SYMLINK
+	ln -sf /usr/sbin/ebtables-legacy $(TARGET_DIR)/sbin/ebtables
+endef
+EBTABLES_POST_INSTALL_TARGET_HOOKS += EBTABLES_INSTALL_LEGACY_SYMLINK
+endif
+
 $(eval $(autotools-package))

buildroot/package/fakeroot/0002-libfakeroot.c-define-_STAT_VER-if-not-already-define.patch

@@ -0,0 +1,45 @@
+From 03bc0ee07fb6e293d081ffd8af1654788b434f6a Mon Sep 17 00:00:00 2001
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Date: Thu, 11 Feb 2021 20:59:25 -0800
+Subject: [PATCH] libfakeroot.c: define _STAT_VER if not already defined
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+glibc 2.33 does does declare `_STAT_VER` anymore.
+
+Based on patch from Jan Pazdziora:
+https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/message/SMQ3RYXEYTVZH6PLQMKNB3NM4XLPMNZO/
+
+Backported from: feda578ca3608b7fc9a28a3a91293611c0ef47b7
+
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
+---
+ libfakeroot.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/libfakeroot.c b/libfakeroot.c
+index 3e80e38..14cdbc4 100644
+--- a/libfakeroot.c
++++ b/libfakeroot.c
+@@ -90,6 +90,16 @@
+ #define SEND_GET_XATTR64(a,b,c) send_get_xattr64(a,b)
+ #endif
+ 
++#ifndef _STAT_VER
++ #if defined (__aarch64__)
++  #define _STAT_VER 0
++ #elif defined (__x86_64__)
++  #define _STAT_VER 1
++ #else
++  #define _STAT_VER 3
++ #endif
++#endif
++
+ /*
+    These INT_* (which stands for internal) macros should always be used when
+    the fakeroot library owns the storage of the stat variable.
+-- 
+2.30.1
+

buildroot/package/fakeroot/0003-libfakeroot.c-add-wrappers-for-new-glibc-2.33-symbol.patch

@@ -0,0 +1,80 @@
+From feda578ca3608b7fc9a28a3a91293611c0ef47b7 Mon Sep 17 00:00:00 2001
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Date: Thu, 11 Feb 2021 21:00:04 -0800
+Subject: [PATCH] libfakeroot.c: add wrappers for new glibc 2.33+ symbols
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+This patch add wrappers for newly exported symbols in glibc 2.33.
+
+Backported from: feda578ca3608b7fc9a28a3a91293611c0ef47b7
+
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
+---
+ libfakeroot.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
+ 1 file changed, 48 insertions(+)
+
+diff --git a/libfakeroot.c b/libfakeroot.c
+index 14cdbc4..d75c51f 100644
+--- a/libfakeroot.c
++++ b/libfakeroot.c
+@@ -1352,6 +1352,54 @@ int renameat(int olddir_fd, const char *oldpath,
+ #endif /* HAVE_FSTATAT */
+ 
+ 
++#if defined(__GLIBC__) && __GLIBC_PREREQ(2,33)
++/* Glibc 2.33 exports symbols for these functions in the shared lib */
++  int lstat(const char *file_name, struct stat *statbuf) {
++     return WRAP_LSTAT LSTAT_ARG(_STAT_VER, file_name, statbuf);
++  }
++  int stat(const char *file_name, struct stat *st) {
++     return WRAP_STAT STAT_ARG(_STAT_VER, file_name, st);
++  }
++  int fstat(int fd, struct stat *st) {
++     return WRAP_FSTAT FSTAT_ARG(_STAT_VER, fd, st);
++  }
++
++  #ifdef HAVE_FSTATAT
++    int fstatat(int dir_fd, const char *path, struct stat *st, int flags) {
++       return WRAP_FSTATAT FSTATAT_ARG(_STAT_VER, dir_fd, path, st, flags);
++    }
++  #endif
++
++  #ifdef STAT64_SUPPORT
++    int lstat64(const char *file_name, struct stat64 *st) {
++       return WRAP_LSTAT64 LSTAT64_ARG(_STAT_VER, file_name, st);
++    }
++    int stat64(const char *file_name, struct stat64 *st) {
++       return WRAP_STAT64 STAT64_ARG(_STAT_VER, file_name, st);
++    }
++    int fstat64(int fd, struct stat64 *st) {
++       return WRAP_FSTAT64 FSTAT64_ARG(_STAT_VER, fd, st);
++    }
++
++    #ifdef HAVE_FSTATAT
++      int fstatat64(int dir_fd, const char *path, struct stat64 *st, int flags) {
++	 return WRAP_FSTATAT64 FSTATAT64_ARG(_STAT_VER, dir_fd, path, st, flags);
++      }
++    #endif
++  #endif
++
++  int mknod(const char *pathname, mode_t mode, dev_t dev) {
++     return WRAP_MKNOD MKNOD_ARG(_STAT_VER, pathname, mode, &dev);
++  }
++
++  #if defined(HAVE_FSTATAT) && defined(HAVE_MKNODAT)
++    int mknodat(int dir_fd, const char *pathname, mode_t mode, dev_t dev) {
++       return WRAP_MKNODAT MKNODAT_ARG(_STAT_VER, dir_fd, pathname, mode, &dev);
++    }
++  #endif
++#endif /* GLIBC_PREREQ */
++
++
+ #ifdef FAKEROOT_FAKENET
+ pid_t fork(void)
+ {
+-- 
+2.30.1
+

buildroot/package/fakeroot/0004-configure.ac-fix-__xmknod-at-pointer-argument.patch

@@ -0,0 +1,66 @@
+From 432dd46e662772020306a2ce8b1be38321697e69 Mon Sep 17 00:00:00 2001
+From: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Date: Sat, 13 Feb 2021 19:32:08 -0800
+Subject: [PATCH] configure.ac: fix __xmknod{,at} pointer argument
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Switch default to assume * and not the absence of *.
+
+On glibc 2.33+, there is no definition for these functions in header
+files, so the compile test doesn't work. But, we can default to using
+the pointer (as is the case with newer glibc), and use the header file
+on older platforms to fail the test and use no pointer.
+
+Backported from: c3eebec293e35b997bb46c22fb5a4e114afb5e7f
+
+Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
+Signed-off-by: Jörg Krause <joerg.krause@embedded.rocks>
+---
+ configure.ac | 16 ++++++++--------
+ 1 file changed, 8 insertions(+), 8 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index 73415d2..d85566f 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -183,13 +183,13 @@ AC_MSG_CHECKING([for type of arg of __xmknod])
+   ]], [[
+        int __xmknod  ( int ver,
+                        const char *pathname ,
+-                       mode_t  mode ,  dev_t dev);
++                       mode_t  mode ,  dev_t *dev);
+   ]])],[
+-   AC_DEFINE(XMKNOD_FRTH_ARG,)
+-   AC_MSG_RESULT([no extra *])
+-  ],[
+    AC_DEFINE(XMKNOD_FRTH_ARG,[*])
+    AC_MSG_RESULT([needs *])
++  ],[
++   AC_DEFINE(XMKNOD_FRTH_ARG,)
++   AC_MSG_RESULT([no extra *])
+ 
+   ])
+ 
+@@ -210,13 +210,13 @@ AC_MSG_CHECKING([for type of arg of __xmknodat])
+        int __xmknodat  ( int ver,
+                          int dirfd,
+                          const char *pathname ,
+-                         mode_t  mode ,  dev_t dev);
++                         mode_t  mode ,  dev_t *dev);
+   ]])],[
+-   AC_DEFINE(XMKNODAT_FIFTH_ARG,)
+-   AC_MSG_RESULT([no extra *])
+-  ],[
+    AC_DEFINE(XMKNODAT_FIFTH_ARG,[*])
+    AC_MSG_RESULT([needs *])
++  ],[
++   AC_DEFINE(XMKNODAT_FIFTH_ARG,)
++   AC_MSG_RESULT([no extra *])
+ 
+   ])
+ 
+-- 
+2.30.1
+

buildroot/package/fakeroot/fakeroot.mk

@@ -15,7 +15,7 @@ HOST_FAKEROOT_DEPENDENCIES = host-acl
 HOST_FAKEROOT_CONF_ENV = \
 	ac_cv_header_sys_capability_h=no \
 	ac_cv_func_capset=no
-# upstream does not ship with configure script anymore
+# patching configure.ac in patch 0003
 HOST_FAKEROOT_AUTORECONF = YES
 FAKEROOT_LICENSE = GPL-3.0+
 FAKEROOT_LICENSE_FILES = COPYING

buildroot/package/flashrom/0001-Makefile-Fix-building-on-AArch64-NixOS.patch

@@ -0,0 +1,95 @@
+From da6b3b70cb852dd8e9f9e21aef95fa83e7f7ab0d Mon Sep 17 00:00:00 2001
+From: Pyry Kontio <pyry.kontio@drasa.eu>
+Date: Mon, 6 Jul 2020 12:57:35 +0900
+Subject: [PATCH] Makefile: Fix building on AArch64 NixOS
+
+The parsing of the output of archtest.c produced an unexpected
+value on AArch64 NixOS. For example, the make variable ARCH was set to:
+
+```
+bit outside of fd_set selected
+arm
+```
+
+This made the arch and OS checks fail.
+
+This commit simplifies the parsing, making it more robust.
+
+The C files archtest.c, endiantest.c and os.h used to set the
+TARGET_OS, ARCH and ENDIAN variables, respectively, output
+the result of the test as the final line, so just extracting
+the final line and removing double quoting is enough.
+
+This commit also fixes a bug with debug_shell lacking escaping
+single quotes, which prevented using the single quote in the
+debug_shell calls. It used to work by accident before this fix;
+the line in the call happened to contain a balanced pair of double
+quotes and lacked other characters that needed escaping, which
+didn't break the debug_shell, but this was accidental and very
+brittle.
+
+Signed-off-by: Pyry Kontio <pyry.kontio@drasa.eu>
+Change-Id: Iaa4477a71e758cf9ecad2c22f3b77bc6508a3510
+Reviewed-on: https://review.coreboot.org/c/flashrom/+/43140
+Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
+Reviewed-by: Angel Pons <th3fanbus@gmail.com>
+
+[Retrieved from:
+https://github.com/flashrom/flashrom/commit/da6b3b70cb852dd8e9f9e21aef95fa83e7f7ab0d]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ Makefile | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+diff --git a/Makefile b/Makefile
+index f3f7717e2..e475cbdbd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -83,7 +83,8 @@ dummy_for_make_3_80:=$(shell printf "Build started on %s\n\n" "$$(date)" >$(BUIL
+ 
+ # Provide an easy way to execute a command, print its output to stdout and capture any error message on stderr
+ # in the build details file together with the original stdout output.
+-debug_shell = $(shell export LC_ALL=C ; { echo 'exec: export LC_ALL=C ; { $(1) ; }' >&2;  { $(1) ; } | tee -a $(BUILD_DETAILS_FILE) ; echo >&2 ; } 2>>$(BUILD_DETAILS_FILE))
++debug_shell = $(shell export LC_ALL=C ; { echo 'exec: export LC_ALL=C ; { $(subst ','\'',$(1)) ; }' >&2; \
++    { $(1) ; } | tee -a $(BUILD_DETAILS_FILE) ; echo >&2 ; } 2>>$(BUILD_DETAILS_FILE))
+ 
+ ###############################################################################
+ # General OS-specific settings.
+@@ -106,7 +107,8 @@ endif
+ # IMPORTANT: The following line must be placed before TARGET_OS is ever used
+ # (of course), but should come after any lines setting CC because the line
+ # below uses CC itself.
+-override TARGET_OS := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E os.h 2>/dev/null | grep -v '^\#' | grep '"' | cut -f 2 -d'"'))
++override TARGET_OS := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E os.h 2>/dev/null \
++    | tail -1 | cut -f 2 -d'"'))
+ 
+ ifeq ($(TARGET_OS), Darwin)
+ override CPPFLAGS += -I/opt/local/include -I/usr/local/include
+@@ -490,8 +492,10 @@ endif
+ # IMPORTANT: The following line must be placed before ARCH is ever used
+ # (of course), but should come after any lines setting CC because the line
+ # below uses CC itself.
+-override ARCH := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E archtest.c 2>/dev/null | grep -v '^\#' | grep '"' | cut -f 2 -d'"'))
+-override ENDIAN := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E endiantest.c 2>/dev/null | grep -v '^\#'))
++override ARCH := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E archtest.c 2>/dev/null \
++    | tail -1 | cut -f 2 -d'"'))
++override ENDIAN := $(strip $(call debug_shell,$(CC) $(CPPFLAGS) -E endiantest.c 2>/dev/null \
++    | tail -1))
+ 
+ # Disable the internal programmer on unsupported architectures (everything but x86 and mipsel)
+ ifneq ($(ARCH)-little, $(filter $(ARCH),x86 mips)-$(ENDIAN))
+@@ -1299,12 +1303,12 @@ compiler: featuresavailable
+ 	@printf "Target arch is "
+ 	@# FreeBSD wc will output extraneous whitespace.
+ 	@echo $(ARCH)|wc -w|grep -q '^[[:blank:]]*1[[:blank:]]*$$' ||	\
+-		( echo "unknown. Aborting."; exit 1)
++		( echo "unknown (\"$(ARCH)\"). Aborting."; exit 1)
+ 	@printf "%s\n" '$(ARCH)'
+ 	@printf "Target OS is "
+ 	@# FreeBSD wc will output extraneous whitespace.
+ 	@echo $(TARGET_OS)|wc -w|grep -q '^[[:blank:]]*1[[:blank:]]*$$' ||	\
+-		( echo "unknown. Aborting."; exit 1)
++		( echo "unknown (\"$(TARGET_OS)\"). Aborting."; exit 1)
+ 	@printf "%s\n" '$(TARGET_OS)'
+ ifeq ($(TARGET_OS), libpayload)
+ 	@$(CC) --version 2>&1 | grep -q coreboot || \

buildroot/package/fwts/Config.in

@@ -5,6 +5,7 @@ config BR2_PACKAGE_FWTS
 	depends on BR2_USE_MMU # libglib2
 	depends on BR2_USE_WCHAR # libglib2, libbsd
 	depends on BR2_TOOLCHAIN_HAS_THREADS # libglib2, libbsd
+	depends on !BR2_STATIC_LIBS # libbsd
 	depends on BR2_TOOLCHAIN_USES_GLIBC # execinfo.h
 	select BR2_PACKAGE_LIBGLIB2
 	select BR2_PACKAGE_LIBBSD
@@ -31,9 +32,9 @@ comment "efi_runtime module needs a Linux kernel to be built"
 	depends on !BR2_LINUX_KERNEL
 endif
 
-comment "fwts needs a glibc toolchain w/ wchar, threads"
+comment "fwts needs a glibc toolchain w/ wchar, threads, dynamic library"
 	depends on BR2_i386 || BR2_x86_64 || BR2_aarch64
 	depends on BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS # libbsd
 	depends on BR2_USE_MMU
 	depends on !BR2_USE_WCHAR || !BR2_TOOLCHAIN_HAS_THREADS || \
-		!BR2_TOOLCHAIN_USES_GLIBC
+		!BR2_TOOLCHAIN_USES_GLIBC || BR2_STATIC_LIBS

buildroot/package/go/go.hash

@@ -1,3 +1,3 @@
 # From https://golang.org/dl/
-sha256  890bba73c5e2b19ffb1180e385ea225059eb008eb91b694875dd86ea48675817  go1.15.6.src.tar.gz
+sha256  540c0ab7781084d124991321ed1458e479982de94454a98afab6acadf38497c2  go1.15.8.src.tar.gz
 sha256	2d36597f7117c38b006835ae7f537487207d8ec407aa9d9980794b2030cbc067  LICENSE

buildroot/package/go/go.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GO_VERSION = 1.15.6
+GO_VERSION = 1.15.8
 GO_SITE = https://storage.googleapis.com/golang
 GO_SOURCE = go$(GO_VERSION).src.tar.gz
 

buildroot/package/gstreamer1/gst1-python/Config.in

@@ -6,6 +6,7 @@ config BR2_PACKAGE_GST1_PYTHON
 	depends on BR2_TOOLCHAIN_USES_GLIBC # gobject-introspection
 	depends on BR2_PACKAGE_PYTHON3 # gobject-introspection
 	select BR2_PACKAGE_GOBJECT_INTROSPECTION
+	select BR2_PACKAGE_GST1_PLUGINS_BASE
 	select BR2_PACKAGE_LIBGLIB2
 	select BR2_PACKAGE_PYTHON_GOBJECT
 	help

buildroot/package/gstreamer1/gst1-python/gst1-python.mk

@@ -12,6 +12,7 @@ GST1_PYTHON_LICENSE_FILES = COPYING
 GST1_PYTHON_LICENSE = LGPL-2.1+
 
 GST1_PYTHON_DEPENDENCIES = \
+	gst1-plugins-base \
 	gstreamer1 \
 	python-gobject
 

buildroot/package/guile/guile.mk

@@ -29,6 +29,10 @@ GUILE_CFLAGS = \
 	-DHAVE_GC_GET_FREE_SPACE_DIVISOR \
 	-DHAVE_GC_SET_FINALIZE_ON_DEMAND
 
+ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
+GUILE_CONF_ENV += LIBS=-latomic
+endif
+
 ifeq ($(BR2_STATIC_LIBS),y)
 GUILE_CFLAGS += -DGC_NO_DLOPEN
 endif

buildroot/package/intel-mediadriver/0002-build-fix-Werror=format-overflow-under-gcc-10.patch

@@ -0,0 +1,162 @@
+From da966a2ab1f5161cc0a21a4cd7e07edf732ebee9 Mon Sep 17 00:00:00 2001
+From: Dmitry Rogozhkin <dmitry.v.rogozhkin@intel.com>
+Date: Thu, 19 Mar 2020 20:59:12 -0700
+Subject: [PATCH] build: fix Werror=format-overflow under gcc-10
+
+Fixes: #870
+
+With upcoming gcc-10 we start to see Werror=format-overflow reporting
+that we attempt to printf %s null strings.
+
+Change-Id: I7a62bc98bf7dd6bcd61d475d7650a06aa1a70932
+Signed-off-by: Dmitry Rogozhkin <dmitry.v.rogozhkin@intel.com>
+[Retrieved from:
+https://github.com/intel/media-driver/commit/da966a2ab1f5161cc0a21a4cd7e07edf732ebee9]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ media_driver/linux/common/os/i915/xf86drm.c   | 57 ++++++++++---------
+ .../linux/ult/libdrm_mock/xf86drm_mock.c      | 57 ++++++++++---------
+ 2 files changed, 58 insertions(+), 56 deletions(-)
+
+diff --git a/media_driver/linux/common/os/i915/xf86drm.c b/media_driver/linux/common/os/i915/xf86drm.c
+index 7594bde99..d0fc1b7ac 100644
+--- a/media_driver/linux/common/os/i915/xf86drm.c
++++ b/media_driver/linux/common/os/i915/xf86drm.c
+@@ -581,37 +581,38 @@ static int drmOpenByBusid(const char *busid, int type)
+ 
+     drmMsg("drmOpenByBusid: Searching for BusID %s\n", busid);
+     for (i = base; i < base + DRM_MAX_MINOR; i++) {
+-    fd = drmOpenMinor(i, 1, type);
+-    drmMsg("drmOpenByBusid: drmOpenMinor returns %d\n", fd);
+-    if (fd >= 0) {
+-        /* We need to try for 1.4 first for proper PCI domain support
+-         * and if that fails, we know the kernel is busted
+-         */
+-        sv.drm_di_major = 1;
+-        sv.drm_di_minor = 4;
+-        sv.drm_dd_major = -1;    /* Don't care */
+-        sv.drm_dd_minor = -1;    /* Don't care */
+-        if (drmSetInterfaceVersion(fd, &sv)) {
++        fd = drmOpenMinor(i, 1, type);
++        drmMsg("drmOpenByBusid: drmOpenMinor returns %d\n", fd);
++        if (fd >= 0) {
++            /* We need to try for 1.4 first for proper PCI domain support
++             * and if that fails, we know the kernel is busted
++             */
++            sv.drm_di_major = 1;
++            sv.drm_di_minor = 4;
++            sv.drm_dd_major = -1;    /* Don't care */
++            sv.drm_dd_minor = -1;    /* Don't care */
++            if (drmSetInterfaceVersion(fd, &sv)) {
+ #ifndef __alpha__
+-        pci_domain_ok = 0;
++                pci_domain_ok = 0;
+ #endif
+-        sv.drm_di_major = 1;
+-        sv.drm_di_minor = 1;
+-        sv.drm_dd_major = -1;       /* Don't care */
+-        sv.drm_dd_minor = -1;       /* Don't care */
+-        drmMsg("drmOpenByBusid: Interface 1.4 failed, trying 1.1\n");
+-        drmSetInterfaceVersion(fd, &sv);
+-        }
+-        buf = drmGetBusid(fd);
+-        drmMsg("drmOpenByBusid: drmGetBusid reports %s\n", buf);
+-        if (buf && drmMatchBusID(buf, busid, pci_domain_ok)) {
+-        drmFreeBusid(buf);
+-        return fd;
++                sv.drm_di_major = 1;
++                sv.drm_di_minor = 1;
++                sv.drm_dd_major = -1;       /* Don't care */
++                sv.drm_dd_minor = -1;       /* Don't care */
++                drmMsg("drmOpenByBusid: Interface 1.4 failed, trying 1.1\n");
++                drmSetInterfaceVersion(fd, &sv);
++            }
++            buf = drmGetBusid(fd);
++            if (buf) {
++                drmMsg("drmOpenByBusid: drmGetBusid reports %s\n", buf);
++                if (drmMatchBusID(buf, busid, pci_domain_ok)) {
++                    drmFreeBusid(buf);
++                    return fd;
++                }
++                drmFreeBusid(buf);
++            }
++            close(fd);
+         }
+-        if (buf)
+-        drmFreeBusid(buf);
+-        close(fd);
+-    }
+     }
+     return -1;
+ }
+diff --git a/media_driver/linux/ult/libdrm_mock/xf86drm_mock.c b/media_driver/linux/ult/libdrm_mock/xf86drm_mock.c
+index 7e5246295..2e5863798 100644
+--- a/media_driver/linux/ult/libdrm_mock/xf86drm_mock.c
++++ b/media_driver/linux/ult/libdrm_mock/xf86drm_mock.c
+@@ -790,37 +790,38 @@ static int drmOpenByBusid(const char *busid, int type)
+ 
+     drmMsg("drmOpenByBusid: Searching for BusID %s\n", busid);
+     for (i = base; i < base + DRM_MAX_MINOR; i++) {
+-    fd = drmOpenMinor(i, 1, type);
+-    drmMsg("drmOpenByBusid: drmOpenMinor returns %d\n", fd);
+-    if (fd >= 0) {
+-        /* We need to try for 1.4 first for proper PCI domain support
+-         * and if that fails, we know the kernel is busted
+-         */
+-        sv.drm_di_major = 1;
+-        sv.drm_di_minor = 4;
+-        sv.drm_dd_major = -1;    /* Don't care */
+-        sv.drm_dd_minor = -1;    /* Don't care */
+-        if (drmSetInterfaceVersion(fd, &sv)) {
++        fd = drmOpenMinor(i, 1, type);
++        drmMsg("drmOpenByBusid: drmOpenMinor returns %d\n", fd);
++        if (fd >= 0) {
++            /* We need to try for 1.4 first for proper PCI domain support
++             * and if that fails, we know the kernel is busted
++             */
++            sv.drm_di_major = 1;
++            sv.drm_di_minor = 4;
++            sv.drm_dd_major = -1;    /* Don't care */
++            sv.drm_dd_minor = -1;    /* Don't care */
++            if (drmSetInterfaceVersion(fd, &sv)) {
+ #ifndef __alpha__
+-        pci_domain_ok = 0;
++                pci_domain_ok = 0;
+ #endif
+-        sv.drm_di_major = 1;
+-        sv.drm_di_minor = 1;
+-        sv.drm_dd_major = -1;       /* Don't care */
+-        sv.drm_dd_minor = -1;       /* Don't care */
+-        drmMsg("drmOpenByBusid: Interface 1.4 failed, trying 1.1\n");
+-        drmSetInterfaceVersion(fd, &sv);
+-        }
+-        buf = drmGetBusid(fd);
+-        drmMsg("drmOpenByBusid: drmGetBusid reports %s\n", buf);
+-        if (buf && drmMatchBusID(buf, busid, pci_domain_ok)) {
+-        drmFreeBusid(buf);
+-        return fd;
++                sv.drm_di_major = 1;
++                sv.drm_di_minor = 1;
++                sv.drm_dd_major = -1;       /* Don't care */
++                sv.drm_dd_minor = -1;       /* Don't care */
++                drmMsg("drmOpenByBusid: Interface 1.4 failed, trying 1.1\n");
++                drmSetInterfaceVersion(fd, &sv);
++            }
++            buf = drmGetBusid(fd);
++            if (buf) {
++                drmMsg("drmOpenByBusid: drmGetBusid reports %s\n", buf);
++                if (drmMatchBusID(buf, busid, pci_domain_ok)) {
++                    drmFreeBusid(buf);
++                    return fd;
++                }
++                drmFreeBusid(buf);
++            }
++            close(fd);
+         }
+-        if (buf)
+-        drmFreeBusid(buf);
+-        close(fd);
+-    }
+     }
+     return -1;
+ }

buildroot/package/intel-mediadriver/intel-mediadriver.mk

@@ -22,9 +22,7 @@ INTEL_MEDIADRIVER_DEPENDENCIES = \
 INTEL_MEDIADRIVER_SUPPORTS_IN_SOURCE_BUILD = NO
 
 INTEL_MEDIADRIVER_CONF_OPTS = \
-	-DBUILD_ALONG_WITH_CMRTLIB=1 \
+	-DINSTALL_DRIVER_SYSCONF=OFF \
-	-DINSTALL_DRIVERS_SYSCONF=OFF \
+	-DMEDIA_RUN_TEST_SUITE=OFF
-	-DMEDIA_RUN_TEST_SUITE=OFF \
-	-DRUN_TEST_SUITE=OFF
 
 $(eval $(cmake-package))

buildroot/package/intel-microcode/intel-microcode.hash

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  eb4f939421ac6cdea3c586c9d984ec518320f00c07eb2b3d6754309c83c93371  intel-microcode-20200616.tar.gz
+sha256  e42a264b7b86e80d013d6d00062467352c1f37e0aaea10fe5b51e4d8687921ab  intel-microcode-20201118.tar.gz
 sha256  d9e989e1a7747f3ce93cb749aceca67a430d36c9bebc6e3205e0b3af3ca6304b  license

buildroot/package/intel-microcode/intel-microcode.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-INTEL_MICROCODE_VERSION = 20200616
+INTEL_MICROCODE_VERSION = 20201118
 INTEL_MICROCODE_SITE = $(call github,intel,Intel-Linux-Processor-Microcode-Data-Files,microcode-$(INTEL_MICROCODE_VERSION))
 INTEL_MICROCODE_LICENSE = PROPRIETARY
 INTEL_MICROCODE_LICENSE_FILES = license

buildroot/package/jasper/jasper.hash

@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  20facc904bd9d38c20e0c090b1be3ae02ae5b2703b803013be2ecad586a18927  jasper-2.0.23.tar.gz
+sha256  f5bc48e2884bcabd2aca1737baff4ca962ec665b6eb673966ced1f7adea07edb  jasper-2.0.25.tar.gz
 sha256  4ad1bb42aff888c4403d792e6e2c5f1716d6c279fea70b296333c9d577d30b81  LICENSE

buildroot/package/jasper/jasper.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-JASPER_VERSION = 2.0.23
+JASPER_VERSION = 2.0.25
 JASPER_SITE = $(call github,jasper-software,jasper,version-$(JASPER_VERSION))
 JASPER_INSTALL_STAGING = YES
 JASPER_LICENSE = JasPer-2.0

buildroot/package/kodi-inputstream-adaptive/Config.in

@@ -6,4 +6,4 @@ config BR2_PACKAGE_KODI_INPUTSTREAM_ADAPTIVE
 	help
 	  Kodi inputstream addon for several manifest types
 
-	  https://github.com/peak3d/inputstream.adaptive
+	  https://github.com/xbmc/inputstream.adaptive

buildroot/package/kodi-inputstream-adaptive/kodi-inputstream-adaptive.mk

@@ -5,7 +5,7 @@
 ################################################################################
 
 KODI_INPUTSTREAM_ADAPTIVE_VERSION = 2.4.6-Leia
-KODI_INPUTSTREAM_ADAPTIVE_SITE = $(call github,peak3d,inputstream.adaptive,$(KODI_INPUTSTREAM_ADAPTIVE_VERSION))
+KODI_INPUTSTREAM_ADAPTIVE_SITE = $(call github,xbmc,inputstream.adaptive,$(KODI_INPUTSTREAM_ADAPTIVE_VERSION))
 KODI_INPUTSTREAM_ADAPTIVE_LICENSE = GPL-2.0+
 KODI_INPUTSTREAM_ADAPTIVE_LICENSE_FILES = LICENSE.GPL
 KODI_INPUTSTREAM_ADAPTIVE_DEPENDENCIES = kodi

buildroot/package/lcms2/lcms2.mk

@@ -9,6 +9,8 @@ LCMS2_SITE = http://downloads.sourceforge.net/project/lcms/lcms/$(LCMS2_VERSION)
 LCMS2_LICENSE = MIT
 LCMS2_LICENSE_FILES = COPYING
 LCMS2_INSTALL_STAGING = YES
+# tiff is only used by tificc sample
+LCMS2_CONF_OPTS = --without-tiff
 
 ifeq ($(BR2_PACKAGE_JPEG),y)
 LCMS2_CONF_OPTS += --with-jpeg
@@ -17,13 +19,6 @@ else
 LCMS2_CONF_OPTS += --without-jpeg
 endif
 
-ifeq ($(BR2_PACKAGE_TIFF),y)
-LCMS2_CONF_OPTS += --with-tiff
-LCMS2_DEPENDENCIES += tiff
-else
-LCMS2_CONF_OPTS += --without-tiff
-endif
-
 ifeq ($(BR2_PACKAGE_ZLIB),y)
 LCMS2_CONF_OPTS += --with-zlib
 LCMS2_DEPENDENCIES += zlib

buildroot/package/libbsd/Config.in

@@ -10,6 +10,7 @@ config BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS
 config BR2_PACKAGE_LIBBSD
 	bool "libbsd"
 	depends on BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS
+	depends on !BR2_STATIC_LIBS
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on BR2_USE_WCHAR
 	help
@@ -21,6 +22,7 @@ config BR2_PACKAGE_LIBBSD
 
 	  http://libbsd.freedesktop.org/
 
-comment "libbsd needs a toolchain w/ threads, wchar"
+comment "libbsd needs a toolchain w/ dynamic library, threads, wchar"
 	depends on BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS
-	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_USE_WCHAR
+	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS || \
+		!BR2_USE_WCHAR

buildroot/package/libopenssl/libopenssl.hash

@@ -1,5 +1,5 @@
-# From https://www.openssl.org/source/openssl-1.1.1i.tar.gz.sha256
+# From https://www.openssl.org/source/openssl-1.1.1j.tar.gz.sha256
-sha256  e8be6a35fe41d10603c3cc635e93289ed00bf34b79671a3a4de64fcee00d5242  openssl-1.1.1i.tar.gz
+sha256  aaf2fcb575cdf6491b98ab4829abf78a3dec8402b8b81efc8f23c00d443981bf  openssl-1.1.1j.tar.gz
 
 # License files
 sha256  c32913b33252e71190af2066f08115c69bc9fddadf3bf29296e20c835389841c  LICENSE

buildroot/package/libopenssl/libopenssl.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBOPENSSL_VERSION = 1.1.1i
+LIBOPENSSL_VERSION = 1.1.1j
 LIBOPENSSL_SITE = https://www.openssl.org/source
 LIBOPENSSL_SOURCE = openssl-$(LIBOPENSSL_VERSION).tar.gz
 LIBOPENSSL_LICENSE = OpenSSL or SSLeay
@@ -65,7 +65,7 @@ define HOST_LIBOPENSSL_CONFIGURE_CMDS
 		shared \
 		zlib-dynamic \
 	)
-	$(SED) "s#-O[0-9s]#$(HOST_CFLAGS)#" $(@D)/Makefile
+	$(SED) "s#-O[0-9sg]#$(HOST_CFLAGS)#" $(@D)/Makefile
 endef
 
 define LIBOPENSSL_CONFIGURE_CMDS
@@ -89,7 +89,7 @@ define LIBOPENSSL_CONFIGURE_CMDS
 			$(if $(BR2_STATIC_LIBS),zlib,zlib-dynamic) \
 	)
 	$(SED) "s#-march=[-a-z0-9] ##" -e "s#-mcpu=[-a-z0-9] ##g" $(@D)/Makefile
-	$(SED) "s#-O[0-9s]#$(LIBOPENSSL_CFLAGS)#" $(@D)/Makefile
+	$(SED) "s#-O[0-9sg]#$(LIBOPENSSL_CFLAGS)#" $(@D)/Makefile
 	$(SED) "s# build_tests##" $(@D)/Makefile
 endef
 

buildroot/package/linux-firmware/Config.in

@@ -44,11 +44,10 @@ config BR2_PACKAGE_LINUX_FIRMWARE_QCOM_ADRENO
 	help
 	  Firmware files for Qualcomm Adreno GPU firmware
 
-
 config BR2_PACKAGE_LINUX_FIRMWARE_MFC_V8
-	bool "Samsung MFC video encoder/decoder driver v8"
+	bool "Samsung MFC video encoder/decoder v8 firmware"
 	help
-	  Firmware files for samsung MFC video encoder/decoder driver v8
+	  Firmware files for Samsung MFC video encoder/decoder driver v8
 
 endmenu # Video
 

buildroot/package/linux-headers/Config.in.host

@@ -346,11 +346,11 @@ endchoice
 
 config BR2_DEFAULT_KERNEL_HEADERS
 	string
-	default "4.4.253"	if BR2_KERNEL_HEADERS_4_4
+	default "4.4.255"	if BR2_KERNEL_HEADERS_4_4
-	default "4.9.253"	if BR2_KERNEL_HEADERS_4_9
+	default "4.9.255"	if BR2_KERNEL_HEADERS_4_9
-	default "4.14.217"	if BR2_KERNEL_HEADERS_4_14
+	default "4.14.219"	if BR2_KERNEL_HEADERS_4_14
-	default "4.19.171"	if BR2_KERNEL_HEADERS_4_19
+	default "4.19.173"	if BR2_KERNEL_HEADERS_4_19
-	default "5.4.93"	if BR2_KERNEL_HEADERS_5_4
+	default "5.4.95"	if BR2_KERNEL_HEADERS_5_4
 	default "5.8.18"	if BR2_KERNEL_HEADERS_5_8
 	default "5.9.16"	if BR2_KERNEL_HEADERS_5_9
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION

buildroot/package/linux-headers/linux-headers.mk

@@ -18,6 +18,10 @@ LINUX_HEADERS_VERSION = $(call qstrip,$(BR2_LINUX_KERNEL_VERSION))
 LINUX_HEADERS_CUSTOM_TARBALL_LOCATION = $(call qstrip,$(BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION))
 LINUX_HEADERS_REPO_URL = $(call qstrip,$(BR2_LINUX_KERNEL_CUSTOM_REPO_URL))
 LINUX_HEADERS_CIP = $(BR2_LINUX_KERNEL_LATEST_CIP_VERSION)$(BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION)
+ifneq ($(LINUX_HEADERS_OVERRIDE_SRCDIR),)
+$(error LINUX_HEADERS_OVERRIDE_SRCDIR must not be set when BR2_KERNEL_HEADERS_AS_KERNEL=y)
+endif
+LINUX_HEADERS_OVERRIDE_SRCDIR = $(LINUX_OVERRIDE_SRCDIR)
 else # ! BR2_KERNEL_HEADERS_AS_KERNEL
 LINUX_HEADERS_CUSTOM_TARBALL = $(call qstrip,$(BR2_KERNEL_HEADERS_CUSTOM_TARBALL))
 LINUX_HEADERS_CUSTOM_GIT = $(call qstrip,$(BR2_KERNEL_HEADERS_CUSTOM_GIT))

buildroot/package/makedumpfile/0002-makedumpfile.h-fix-build-on-sparc64.patch

@@ -0,0 +1,35 @@
+From 2c132ac5e6656723821acdb0ee57b34c42851fed Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Thu, 4 Feb 2021 20:15:56 +0100
+Subject: [PATCH] makedumpfile.h: fix build on sparc64
+
+Fix the following build failure on sparc64:
+
+/home/giuliobenetti/autobuild/run/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/sparc64-buildroot-linux-gnu/9.3.0/../../../../sparc64-buildroot-linux-gnu/bin/ld: /tmp/ccylTux8.o: in function `find_kaslr_offsets':
+/home/giuliobenetti/autobuild/run/instance-0/output-1/build/makedumpfile-1.6.8/makedumpfile.c:4017: undefined reference to `get_kaslr_offset'
+
+Fixes:
+ - http://autobuild.buildroot.org/results/1421f54f7599bba62c0a4bd5c65ce21c8cc7ee1a
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status:
+http://lists.infradead.org/pipermail/kexec/2021-February/021996.html]
+---
+ makedumpfile.h | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/makedumpfile.h b/makedumpfile.h
+index 97a5554..dfc1a77 100644
+--- a/makedumpfile.h
++++ b/makedumpfile.h
+@@ -1139,6 +1139,7 @@ unsigned long long vaddr_to_paddr_sparc64(unsigned long vaddr);
+ #define get_machdep_info()      TRUE
+ #define get_phys_base()         get_phys_base_sparc64()
+ #define get_versiondep_info()   get_versiondep_info_sparc64()
++#define get_kaslr_offset(X)     stub_false()
+ #define vaddr_to_paddr(X)       vaddr_to_paddr_sparc64(X)
+ #define paddr_to_vaddr(X)	paddr_to_vaddr_general(X)
+ #define is_phys_addr(X)		stub_true_ul(X)
+-- 
+2.29.2
+

buildroot/package/memtester/memtester.mk

@@ -12,8 +12,9 @@ MEMTESTER_LICENSE_FILES = COPYING
 MEMTESTER_TARGET_INSTALL_OPTS = INSTALLPATH=$(TARGET_DIR)/usr
 
 define MEMTESTER_BUILD_CMDS
-	$(SED) "s,^cc,$(TARGET_CC)," $(@D)/conf-*
+	$(SED) "s%^cc%$(TARGET_CC) $(TARGET_CFLAGS)%" $(@D)/conf-cc
-	$(TARGET_MAKE_ENV) $(MAKE) $(TARGET_CONFIGURE_OPTS) -C $(@D)
+	$(SED) "s%^cc%$(TARGET_CC) $(TARGET_LDFLAGS)%" $(@D)/conf-ld
+	$(MAKE) -C $(@D)
 endef
 
 define MEMTESTER_INSTALL_TARGET_CMDS

buildroot/package/mosquitto/mosquitto.hash

@@ -1,6 +1,6 @@
 # Locally calculated after checking gpg signature
-# from https://mosquitto.org/files/source/mosquitto-1.6.12.tar.gz.asc
+# from https://mosquitto.org/files/source/mosquitto-1.6.13.tar.gz.asc
-sha256  548d73d19fb787dd0530334e398fd256ef3a581181678488a741a995c4f007fb  mosquitto-1.6.12.tar.gz
+sha256  ce205248dd323e4e562ff83e9e84d0f9a16f4bda87183c367c66a7163c0fc287  mosquitto-1.6.13.tar.gz
 
 # License files
 sha256  cc77e25bafd40637b7084f04086d606f0a200051b61806f97c93405926670bc1  LICENSE.txt

buildroot/package/mosquitto/mosquitto.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-MOSQUITTO_VERSION = 1.6.12
+MOSQUITTO_VERSION = 1.6.13
 MOSQUITTO_SITE = https://mosquitto.org/files/source
 MOSQUITTO_LICENSE = EPL-1.0 or EDLv1.0
 MOSQUITTO_LICENSE_FILES = LICENSE.txt epl-v10 edl-v10

buildroot/package/ne10/ne10.mk

@@ -12,6 +12,8 @@ NE10_INSTALL_STAGING = YES
 
 NE10_CONF_OPTS = \
 	-DGNULINUX_PLATFORM=ON \
+	-DNE10_BUILD_EXAMPLES=OFF \
+	-DNE10_BUILD_UNIT_TEST=OFF \
 	-DNE10_LINUX_TARGET_ARCH=$(if $(BR2_aarch64),aarch64,armv7)
 
 ifeq ($(BR2_STATIC_LIBS),)

buildroot/package/netcat-openbsd/Config.in

@@ -1,6 +1,7 @@
 config BR2_PACKAGE_NETCAT_OPENBSD
 	bool "netcat-openbsd"
 	depends on BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS
+	depends on !BR2_STATIC_LIBS # libbsd
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on BR2_TOOLCHAIN_USES_GLIBC
 	depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS
@@ -21,8 +22,9 @@ config BR2_PACKAGE_NETCAT_OPENBSD
 
 	  https://packages.debian.org/sid/netcat-openbsd
 
-comment "netcat-openbsd needs a glibc toolchain w/ threads, headers >= 3.12"
+comment "netcat-openbsd needs a glibc toolchain w/ dynamic library, threads, headers >= 3.12"
 	depends on BR2_PACKAGE_LIBBSD_ARCH_SUPPORTS
-	depends on !BR2_TOOLCHAIN_HAS_THREADS || !BR2_TOOLCHAIN_USES_GLIBC || \
+	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS || \
+		!BR2_TOOLCHAIN_USES_GLIBC || \
 		!BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12
 	depends on BR2_PACKAGE_BUSYBOX_SHOW_OTHERS

buildroot/package/openblas/0001-fix-gfortran-detection.patch

@@ -0,0 +1,30 @@
+From ece3ce581e3ec530eaccfe7f284c52e115ec7aa9 Mon Sep 17 00:00:00 2001
+From: Martin Kroeker <martin@ruby.chemie.uni-freiburg.de>
+Date: Wed, 10 Feb 2021 14:22:59 +0100
+Subject: [PATCH] Strip parenthesized (pkgversion) data from GCC version string
+ to avoid misinterpretation
+
+See https://github.com/xianyi/OpenBLAS/issues/3099 for details.
+
+Upstream-status: backport
+
+[for import into Buildroot]
+Signed-off-by: Thomas De Schampheleire <thomas.de_schampheleire@nokia.com>
+
+
+---
+ f_check | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/f_check b/f_check
+index e9aca4ff9..ffe9c6b46 100644
+--- a/f_check
++++ b/f_check
+@@ -75,6 +75,7 @@ if ($compiler eq "") {
+ 
+ 	} elsif ($data =~ /GNU/ || $data =~ /GCC/ ) {
+ 
++            $data =~ s/\(+.*?\)+//g;
+ 	    $data =~ /(\d+)\.(\d+).(\d+)/;
+ 	    $major = $1;
+ 	    $minor = $2;

buildroot/package/orc/0001-orc-orccpu-powerpc.c-fix-build-with-kernel-4.11.patch

@@ -0,0 +1,70 @@
+From a45f6d49ec090ad94333c0865c378d2d96ab2af4 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Mon, 15 Feb 2021 20:17:43 +0100
+Subject: [PATCH] orc/orccpu-powerpc.c: fix build with kernel < 4.11
+
+Build with powerpc and kernel < 4.11 is broken since version 0.4.30 and
+https://gitlab.freedesktop.org/gstreamer/orc/-/commit/a999325abea6a5549d60d99ddeb0271d2aa00235:
+
+FAILED: orc/liborc-0.4.so.0.32.0.p/orccpu-powerpc.c.o
+/home/giuliobenetti/autobuild/run/instance-3/output-1/host/bin/powerpc-linux-gcc -Iorc/liborc-0.4.so.0.32.0.p -Iorc -I../orc -I. -I.. -fdiagnostics-color=always -pipe -Wall -Winvalid-pch -std=gnu99 -O3 -DHAVE_CONFIG_H -fvisibility=hidden -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64 -O2 -fPIC -pthread -DORC_ENABLE_UNSTABLE_API -D_GNU_SOURCE -DBUILDING_ORC -MD -MQ orc/liborc-0.4.so.0.32.0.p/orccpu-powerpc.c.o -MF orc/liborc-0.4.so.0.32.0.p/orccpu-powerpc.c.o.d -o orc/liborc-0.4.so.0.32.0.p/orccpu-powerpc.c.o -c ../orc/orccpu-powerpc.c
+../orc/orccpu-powerpc.c: In function 'orc_check_powerpc_proc_auxv':
+../orc/orccpu-powerpc.c:164:21: error: 'AT_L1D_CACHESIZE' undeclared (first use in this function); did you mean 'AT_DCACHEBSIZE'?
+  164 |       if (buf[i] == AT_L1D_CACHESIZE) {
+      |                     ^~~~~~~~~~~~~~~~
+      |                     AT_DCACHEBSIZE
+../orc/orccpu-powerpc.c:164:21: note: each undeclared identifier is reported only once for each function it appears in
+../orc/orccpu-powerpc.c:168:21: error: 'AT_L2_CACHESIZE' undeclared (first use in this function); did you mean 'AT_ICACHEBSIZE'?
+  168 |       if (buf[i] == AT_L2_CACHESIZE) {
+      |                     ^~~~~~~~~~~~~~~
+      |                     AT_ICACHEBSIZE
+../orc/orccpu-powerpc.c:172:21: error: 'AT_L3_CACHESIZE' undeclared (first use in this function); did you mean 'AT_ICACHEBSIZE'?
+  172 |       if (buf[i] == AT_L3_CACHESIZE) {
+      |                     ^~~~~~~~~~~~~~~
+      |                     AT_ICACHEBSIZE
+
+Indeed, AT_{L1D,L2,L3}_CACHESIZE is only defined since kernel 4.11 and
+https://github.com/torvalds/linux/commit/98a5f361b8625c6f4841d6ba013bbf0e80d08147
+
+Fixes:
+ - http://autobuild.buildroot.org/results/0821e96cba3e455edd47b87485501d892fc7ac6a
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status:
+https://gitlab.freedesktop.org/gstreamer/orc/-/merge_requests/56]
+---
+ orc/orccpu-powerpc.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/orc/orccpu-powerpc.c b/orc/orccpu-powerpc.c
+index 6796f17..340cf05 100644
+--- a/orc/orccpu-powerpc.c
++++ b/orc/orccpu-powerpc.c
+@@ -161,18 +161,24 @@ orc_check_powerpc_proc_auxv (void)
+         _orc_cpu_name = (char*)buf[i + 1];
+         found++;
+       }
++#ifdef AT_L1D_CACHESIZE
+       if (buf[i] == AT_L1D_CACHESIZE) {
+         _orc_data_cache_size_level1 = buf[i + 1];
+         found++;
+       }
++#endif
++#ifdef AT_L2_CACHESIZE
+       if (buf[i] == AT_L2_CACHESIZE) {
+         _orc_data_cache_size_level2 = buf[i + 1];
+         found++;
+       }
++#endif
++#ifdef AT_L3_CACHESIZE
+       if (buf[i] == AT_L3_CACHESIZE) {
+         _orc_data_cache_size_level3 = buf[i + 1];
+         found++;
+       }
++#endif
+       if (found == 6)
+         break;
+     }
+-- 
+2.30.0
+

buildroot/package/php/php.hash

@@ -1,5 +1,5 @@
 # From https://www.php.net/downloads.php
-sha256  f9f3c37969fcd9006c1dbb1dd76ab53f28c698a1646fa2dde8547c3f45e02886  php-7.4.14.tar.xz
+sha256  9b859c65f0cf7b3eff9d4a28cfab719fb3d36a1db3c20d874a79b5ec44d43cb8  php-7.4.15.tar.xz
 
 # License file
 sha256  0967ad6cf4b7fe81d38709d7aaef3fecb3bd685be7eebb37b864aa34c991baa7  LICENSE

buildroot/package/php/php.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PHP_VERSION = 7.4.14
+PHP_VERSION = 7.4.15
 PHP_SITE = http://www.php.net/distributions
 PHP_SOURCE = php-$(PHP_VERSION).tar.xz
 PHP_INSTALL_STAGING = YES

buildroot/package/pkg-meson.mk

@@ -82,8 +82,8 @@ define $(2)_CONFIGURE_CMDS
 	    package/meson/cross-compilation.conf.in \
 	    > $$($$(PKG)_SRCDIR)/build/cross-compilation.conf
 	PATH=$$(BR_PATH) \
-	CC_FOR_BUILD="$(HOSTCC)" \
+	CC_FOR_BUILD="$$(HOSTCC)" \
-	CXX_FOR_BUILD="$(HOSTCC)" \
+	CXX_FOR_BUILD="$$(HOSTCC)" \
 	$$($$(PKG)_CONF_ENV) \
 	$$(MESON) \
 		--prefix=/usr \

buildroot/package/postgresql/postgresql.hash

@@ -1,7 +1,7 @@
-# From https://ftp.postgresql.org/pub/source/v12.5/postgresql-12.5.tar.bz2.md5
+# From https://ftp.postgresql.org/pub/source/v12.6/postgresql-12.6.tar.bz2.md5
-md5  f19e48090bbd59ea81826b5fd99e7e97  postgresql-12.5.tar.bz2
+md5  8a9cfd8956429d69a97114d3883a4b8e  postgresql-12.6.tar.bz2
-# From https://ftp.postgresql.org/pub/source/v12.5/postgresql-12.5.tar.bz2.sha256
+# From https://ftp.postgresql.org/pub/source/v12.6/postgresql-12.6.tar.bz2.sha256
-sha256  bd0d25341d9578b5473c9506300022de26370879581f5fddd243a886ce79ff95  postgresql-12.5.tar.bz2
+sha256  df7dd98d5ccaf1f693c7e1d0d084e9fed7017ee248bba5be0167c42ad2d70a09  postgresql-12.6.tar.bz2
 
 # License file, Locally calculated
-sha256  739e5d454d81d31a482469338b7c856f1f5c6b4cdda1551cea6f0f6d18eef62c  COPYRIGHT
+sha256  31ccadc0a70e8e0e8a35c5833567b64388dfe34987d962e1911554e271294105  COPYRIGHT

buildroot/package/postgresql/postgresql.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-POSTGRESQL_VERSION = 12.5
+POSTGRESQL_VERSION = 12.6
 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2
 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION)
 POSTGRESQL_LICENSE = PostgreSQL

buildroot/package/privoxy/privoxy.hash

@@ -1,6 +1,6 @@
-# From http://sourceforge.net/projects/ijbswa/files/Sources/3.0.28%20%29stable%29/
+# From https://sourceforge.net/projects/ijbswa/files/Sources/3.0.31%20%28stable%29/
-md5  493a3a643247e6c8bc60725e9993d4ee  privoxy-3.0.29-stable-src.tar.gz
+md5  014cc371d00e84b2db34d0e2b05c77d4  privoxy-3.0.31-stable-src.tar.gz
-sha1  59873a122729b1b03e1d202d663036d2b5fa1120  privoxy-3.0.29-stable-src.tar.gz
+sha1  4f0e0c36d55f72f6b33e4c645a9c5d4f40026abd  privoxy-3.0.31-stable-src.tar.gz
 # Locally computed
-sha256  25c6069efdaf577d47c257da63b03cd6d063fb790e19cc39603d82e5db72489d  privoxy-3.0.29-stable-src.tar.gz
+sha256  077729a3aac79222a4e8d88a650d9028d16fd4b0d6038da8f5f5e47120d004eb  privoxy-3.0.31-stable-src.tar.gz
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  LICENSE

buildroot/package/privoxy/privoxy.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-PRIVOXY_VERSION = 3.0.29
+PRIVOXY_VERSION = 3.0.31
 PRIVOXY_SITE = http://downloads.sourceforge.net/project/ijbswa/Sources/$(PRIVOXY_VERSION)%20%28stable%29
 PRIVOXY_SOURCE = privoxy-$(PRIVOXY_VERSION)-stable-src.tar.gz
 # configure not shipped

buildroot/package/pugixml/pugixml.hash

@@ -1,3 +1,3 @@
 # Locally computed:
-sha256  55f399fbb470942410d348584dc953bcaec926415d3462f471ef350f29b5870a  pugixml-1.10.tar.gz
+sha256  8ddf57b65fb860416979a3f0640c2ad45ddddbbafa82508ef0a0af3ce7061716  pugixml-1.11.4.tar.gz
-sha256  16582559c91ecf831d6289d472a903032e7d7994a86521c5c39513568d6ad208  readme.txt
+sha256  ee495f34aeff0c578a99f3350a2050d4e5860d27b2004c03c384a594fa2b0a7a  LICENSE.md

buildroot/package/pugixml/pugixml.mk

@@ -4,10 +4,10 @@
 #
 ################################################################################
 
-PUGIXML_VERSION = 1.10
+PUGIXML_VERSION = 1.11.4
 PUGIXML_SITE = http://github.com/zeux/pugixml/releases/download/v$(PUGIXML_VERSION)
 PUGIXML_LICENSE = MIT
-PUGIXML_LICENSE_FILES = readme.txt
+PUGIXML_LICENSE_FILES = LICENSE.md
 PUGIXML_INSTALL_STAGING = YES
 
 # Pugixml will automatically enable 'long long' support on C++11 compilers,

buildroot/package/python-bottle/python-bottle.hash

@@ -1,5 +1,5 @@
 # md5, sha256 from https://pypi.org/pypi/bottle/json
-md5	c7d8a42dbc6955593e5b9f957e650a60  bottle-0.12.17.tar.gz
+md5  50075544706b5e662a3fbd9a98e24b07  bottle-0.12.19.tar.gz
-sha256	e9eaa412a60cc3d42ceb42f58d15864d9ed1b92e9d630b8130c871c5bb16107c  bottle-0.12.17.tar.gz
+sha256	a9d73ffcbc6a1345ca2d7949638db46349f5b2b77dac65d6494d45c23628da2c  bottle-0.12.19.tar.gz
 # Locally computed sha256 checksums
 sha256	d0e7211f1c3c1a1c56f39d18bcb07f27f480c8a9552617756dda3a335933b8a6  LICENSE

buildroot/package/python-bottle/python-bottle.mk

@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-PYTHON_BOTTLE_VERSION = 0.12.17
+PYTHON_BOTTLE_VERSION = 0.12.19
 PYTHON_BOTTLE_SOURCE = bottle-$(PYTHON_BOTTLE_VERSION).tar.gz
-PYTHON_BOTTLE_SITE = https://files.pythonhosted.org/packages/c4/a5/6bf41779860e9b526772e1b3b31a65a22bd97535572988d16028c5ab617d
+PYTHON_BOTTLE_SITE = https://files.pythonhosted.org/packages/ea/80/3d2dca1562ffa1929017c74635b4cb3645a352588de89e90d0bb53af3317
 PYTHON_BOTTLE_LICENSE = MIT
 PYTHON_BOTTLE_LICENSE_FILES = LICENSE
 PYTHON_BOTTLE_SETUP_TYPE = setuptools

buildroot/package/python-django/python-django.hash

@@ -1,5 +1,5 @@
 # md5, sha256 from https://pypi.org/pypi/django/json
-md5	deec48e8713727e443a7cee6b54baaeb  Django-3.0.10.tar.gz
+md5  55291777e25bd9e0a286c6f64751246a  Django-3.0.12.tar.gz
-sha256	2d14be521c3ae24960e5e83d4575e156a8c479a75c935224b671b1c6e66eddaf  Django-3.0.10.tar.gz
+sha256  fd63e2c7acca5f2e7ad93dfb53d566e040d871404fc0f684a3e720006d221f9a  Django-3.0.12.tar.gz
 # Locally computed sha256 checksums
-sha256	b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669  LICENSE
+sha256  b846415d1b514e9c1dff14a22deb906d794bc546ca6129f950a18cd091e2a669  LICENSE

buildroot/package/python-django/python-django.mk

@@ -4,10 +4,10 @@
 #
 ################################################################################
 
-PYTHON_DJANGO_VERSION = 3.0.10
+PYTHON_DJANGO_VERSION = 3.0.12
 PYTHON_DJANGO_SOURCE = Django-$(PYTHON_DJANGO_VERSION).tar.gz
 # The official Django site has an unpractical URL
-PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/f4/09/d7c995b128bec61233cfea0e5fa40e442cae54c127b4b2b0881e1fdd0023
+PYTHON_DJANGO_SITE = https://files.pythonhosted.org/packages/32/e3/e7e9a9378321fdfc3eb55de151911dce968fa245d1f16d8c480c63ea4ed1
 PYTHON_DJANGO_LICENSE = BSD-3-Clause
 PYTHON_DJANGO_LICENSE_FILES = LICENSE
 PYTHON_DJANGO_SETUP_TYPE = setuptools

buildroot/package/python3/0035-closes-bpo-42938-Replace-snprintf-with-Python-unicod.patch

@@ -0,0 +1,190 @@
+From c347cbe694743cee120457aa6626712f7799a932 Mon Sep 17 00:00:00 2001
+From: "Miss Islington (bot)"
+ <31488909+miss-islington@users.noreply.github.com>
+Date: Mon, 18 Jan 2021 13:29:31 -0800
+Subject: [PATCH] closes bpo-42938: Replace snprintf with Python unicode
+ formatting in ctypes param reprs. (GH-24247)
+
+(cherry picked from commit 916610ef90a0d0761f08747f7b0905541f0977c7)
+
+Co-authored-by: Benjamin Peterson <benjamin@python.org>
+
+Co-authored-by: Benjamin Peterson <benjamin@python.org>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ Lib/ctypes/test/test_parameters.py            | 43 ++++++++++++++++
+ .../2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst  |  2 +
+ Modules/_ctypes/callproc.c                    | 51 +++++++------------
+ 3 files changed, 64 insertions(+), 32 deletions(-)
+ create mode 100644 Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+
+diff --git a/Lib/ctypes/test/test_parameters.py b/Lib/ctypes/test/test_parameters.py
+index e4c25fd880..531894fdec 100644
+--- a/Lib/ctypes/test/test_parameters.py
++++ b/Lib/ctypes/test/test_parameters.py
+@@ -201,6 +201,49 @@ class SimpleTypesTestCase(unittest.TestCase):
+         with self.assertRaises(ZeroDivisionError):
+             WorseStruct().__setstate__({}, b'foo')
+ 
++    def test_parameter_repr(self):
++        from ctypes import (
++            c_bool,
++            c_char,
++            c_wchar,
++            c_byte,
++            c_ubyte,
++            c_short,
++            c_ushort,
++            c_int,
++            c_uint,
++            c_long,
++            c_ulong,
++            c_longlong,
++            c_ulonglong,
++            c_float,
++            c_double,
++            c_longdouble,
++            c_char_p,
++            c_wchar_p,
++            c_void_p,
++        )
++        self.assertRegex(repr(c_bool.from_param(True)), r"^<cparam '\?' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_char.from_param(97)), "<cparam 'c' ('a')>")
++        self.assertRegex(repr(c_wchar.from_param('a')), r"^<cparam 'u' at 0x[A-Fa-f0-9]+>$")
++        self.assertEqual(repr(c_byte.from_param(98)), "<cparam 'b' (98)>")
++        self.assertEqual(repr(c_ubyte.from_param(98)), "<cparam 'B' (98)>")
++        self.assertEqual(repr(c_short.from_param(511)), "<cparam 'h' (511)>")
++        self.assertEqual(repr(c_ushort.from_param(511)), "<cparam 'H' (511)>")
++        self.assertRegex(repr(c_int.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegex(repr(c_uint.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegex(repr(c_long.from_param(20000)), r"^<cparam '[li]' \(20000\)>$")
++        self.assertRegex(repr(c_ulong.from_param(20000)), r"^<cparam '[LI]' \(20000\)>$")
++        self.assertRegex(repr(c_longlong.from_param(20000)), r"^<cparam '[liq]' \(20000\)>$")
++        self.assertRegex(repr(c_ulonglong.from_param(20000)), r"^<cparam '[LIQ]' \(20000\)>$")
++        self.assertEqual(repr(c_float.from_param(1.5)), "<cparam 'f' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1.5)), "<cparam 'd' (1.5)>")
++        self.assertEqual(repr(c_double.from_param(1e300)), "<cparam 'd' (1e+300)>")
++        self.assertRegex(repr(c_longdouble.from_param(1.5)), r"^<cparam ('d' \(1.5\)|'g' at 0x[A-Fa-f0-9]+)>$")
++        self.assertRegex(repr(c_char_p.from_param(b'hihi')), "^<cparam 'z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegex(repr(c_wchar_p.from_param('hihi')), "^<cparam 'Z' \(0x[A-Fa-f0-9]+\)>$")
++        self.assertRegex(repr(c_void_p.from_param(0x12)), r"^<cparam 'P' \(0x0*12\)>$")
++
+ ################################################################
+ 
+ if __name__ == '__main__':
+diff --git a/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+new file mode 100644
+index 0000000000..7df65a156f
+--- /dev/null
++++ b/Misc/NEWS.d/next/Security/2021-01-18-09-27-31.bpo-42938.4Zn4Mp.rst
+@@ -0,0 +1,2 @@
++Avoid static buffers when computing the repr of :class:`ctypes.c_double` and
++:class:`ctypes.c_longdouble` values.
+diff --git a/Modules/_ctypes/callproc.c b/Modules/_ctypes/callproc.c
+index b0a36a3024..f2506de544 100644
+--- a/Modules/_ctypes/callproc.c
++++ b/Modules/_ctypes/callproc.c
+@@ -489,58 +489,47 @@ is_literal_char(unsigned char c)
+ static PyObject *
+ PyCArg_repr(PyCArgObject *self)
+ {
+-    char buffer[256];
+     switch(self->tag) {
+     case 'b':
+     case 'B':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.b);
+-        break;
+     case 'h':
+     case 'H':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.h);
+-        break;
+     case 'i':
+     case 'I':
+-        sprintf(buffer, "<cparam '%c' (%d)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%d)>",
+             self->tag, self->value.i);
+-        break;
+     case 'l':
+     case 'L':
+-        sprintf(buffer, "<cparam '%c' (%ld)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%ld)>",
+             self->tag, self->value.l);
+-        break;
+ 
+     case 'q':
+     case 'Q':
+-        sprintf(buffer,
+-#ifdef MS_WIN32
+-            "<cparam '%c' (%I64d)>",
+-#else
+-            "<cparam '%c' (%lld)>",
+-#endif
++        return PyUnicode_FromFormat("<cparam '%c' (%lld)>",
+             self->tag, self->value.q);
+-        break;
+     case 'd':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.d);
+-        break;
+-    case 'f':
+-        sprintf(buffer, "<cparam '%c' (%f)>",
+-            self->tag, self->value.f);
+-        break;
+-
++    case 'f': {
++        PyObject *f = PyFloat_FromDouble((self->tag == 'f') ? self->value.f : self->value.d);
++        if (f == NULL) {
++            return NULL;
++        }
++        PyObject *result = PyUnicode_FromFormat("<cparam '%c' (%R)>", self->tag, f);
++        Py_DECREF(f);
++        return result;
++    }
+     case 'c':
+         if (is_literal_char((unsigned char)self->value.c)) {
+-            sprintf(buffer, "<cparam '%c' ('%c')>",
++            return PyUnicode_FromFormat("<cparam '%c' ('%c')>",
+                 self->tag, self->value.c);
+         }
+         else {
+-            sprintf(buffer, "<cparam '%c' ('\\x%02x')>",
++            return PyUnicode_FromFormat("<cparam '%c' ('\\x%02x')>",
+                 self->tag, (unsigned char)self->value.c);
+         }
+-        break;
+ 
+ /* Hm, are these 'z' and 'Z' codes useful at all?
+    Shouldn't they be replaced by the functionality of c_string
+@@ -549,22 +538,20 @@ PyCArg_repr(PyCArgObject *self)
+     case 'z':
+     case 'Z':
+     case 'P':
+-        sprintf(buffer, "<cparam '%c' (%p)>",
++        return PyUnicode_FromFormat("<cparam '%c' (%p)>",
+             self->tag, self->value.p);
+         break;
+ 
+     default:
+         if (is_literal_char((unsigned char)self->tag)) {
+-            sprintf(buffer, "<cparam '%c' at %p>",
++            return PyUnicode_FromFormat("<cparam '%c' at %p>",
+                 (unsigned char)self->tag, (void *)self);
+         }
+         else {
+-            sprintf(buffer, "<cparam 0x%02x at %p>",
++            return PyUnicode_FromFormat("<cparam 0x%02x at %p>",
+                 (unsigned char)self->tag, (void *)self);
+         }
+-        break;
+     }
+-    return PyUnicode_FromString(buffer);
+ }
+ 
+ static PyMemberDef PyCArgType_members[] = {
+-- 
+2.20.1
+

buildroot/package/python3/python3.mk

@@ -11,6 +11,9 @@ PYTHON3_SITE = https://python.org/ftp/python/$(PYTHON3_VERSION)
 PYTHON3_LICENSE = Python-2.0, others
 PYTHON3_LICENSE_FILES = LICENSE
 
+# 0035-closes-bpo-42938-Replace-snprintf-with-Python-unicod.patch
+PYTHON3_IGNORE_CVES += CVE-2021-3177
+
 # This host Python is installed in $(HOST_DIR), as it is needed when
 # cross-compiling third-party Python modules.
 

buildroot/package/rauc/0001-src-mount.c-fix-build-with-kernel-4.14.patch

@@ -1,43 +0,0 @@
-From f73eefdbc0577b125f7d36f54a27d8e95af831dd Mon Sep 17 00:00:00 2001
-From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-Date: Tue, 22 Dec 2020 11:52:31 +0100
-Subject: [PATCH] src/mount.c: fix build with kernel < 4.14
-
-Build with kernel headers < 4.14 fails since version 1.5.0 and
-https://github.com/rauc/rauc/commit/527bf2f7f746e0253f7843542e19cb0fa0c7c869:
-
-src/mount.c: In function 'r_setup_loop':
-src/mount.c:201:25: error: 'LOOP_SET_BLOCK_SIZE' undeclared (first use in this function)
-  looprc = ioctl(loopfd, LOOP_SET_BLOCK_SIZE, 4096);
-                         ^
-
-Indeed, LOOP_SET_BLOCK_SIZE is only defined since
-https://github.com/torvalds/linux/commit/89e4fdecb51cf5535867026274bc97de9480ade5
-
-Fixes:
- - http://autobuild.buildroot.org/results/829ae7ed66686c11a941ac99bd08a06f754affb4
-
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-[Upstream status: https://github.com/rauc/rauc/pull/673]
----
- src/mount.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/mount.c b/src/mount.c
-index 2e593ca..75acf49 100644
---- a/src/mount.c
-+++ b/src/mount.c
-@@ -11,6 +11,10 @@
- #include "mount.h"
- #include "utils.h"
- 
-+#ifndef LOOP_SET_BLOCK_SIZE
-+#define LOOP_SET_BLOCK_SIZE 0x4C09
-+#endif
-+
- gboolean r_mount_bundle(const gchar *source, const gchar *mountpoint, GError **error)
- {
- 	const unsigned long flags = MS_NODEV | MS_NOSUID | MS_RDONLY;
--- 
-2.29.2
-

buildroot/package/rauc/rauc.hash

@@ -1,4 +1,4 @@
 # Locally calculated, after verifying against
-# https://github.com/rauc/rauc/releases/download/v1.5/rauc-1.5.tar.xz.asc
+# https://github.com/rauc/rauc/releases/download/v1.5.1/rauc-1.5.1.tar.xz.asc
-sha256  5dfbc46e808240c5014d318cfe64f0431307c37aa79cb2b013caa12daaf96d9d  rauc-1.5.tar.xz
+sha256  d4ea009ce702bcb083d942398ccfedec959c6bbb7adc0fd77ae9314ce11d9d91  rauc-1.5.1.tar.xz
 sha256  dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551  COPYING

buildroot/package/rauc/rauc.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-RAUC_VERSION = 1.5
+RAUC_VERSION = 1.5.1
 RAUC_SITE = https://github.com/rauc/rauc/releases/download/v$(RAUC_VERSION)
 RAUC_SOURCE = rauc-$(RAUC_VERSION).tar.xz
 RAUC_LICENSE = LGPL-2.1

buildroot/package/sox/0002-configure.ac-put-back-disable-stack-protector.patch

@@ -0,0 +1,45 @@
+From 18ace560a15207503805d4df25b90c7a756bcbf6 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Tue, 2 Feb 2021 23:53:39 +0100
+Subject: [PATCH] configure.ac: put back --disable-stack-protector
+
+Put back --disable-stack-protector which has been removed by commit
+70c85915eace83142b84e4f65f5db421cf0c09e3. This will allow the user to
+disable it or to let a higher buildsystem such as buildroot to finely
+configure it.
+
+Indeed, without this patch, build can fail as some compilers (such as
+uclibc) could missed the needed library (-lssp or -lssp_nonshared) at
+linking step:
+
+  CCLD     libsox.la
+/home/fabrice/br-test-pkg/br-arm-full/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/5.5.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp_nonshared
+/home/fabrice/br-test-pkg/br-arm-full/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/5.5.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: cannot find -lssp
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://sourceforge.net/p/sox/patches/122/]
+---
+ configure.ac | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 39306398..a1665467 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -32,7 +32,12 @@ AC_PROG_LN_S
+ PKG_PROG_PKG_CONFIG
+ PKG_INSTALLDIR
+ 
+-AX_APPEND_COMPILE_FLAGS([-fstack-protector-strong])
++AC_ARG_ENABLE([stack-protector],
++    AS_HELP_STRING([--disable-stack-protector], [Disable -fstack-protector-strong]),
++    [enable_stack_protector=$enableval], [enable_stack_protector=yes])
++AS_IF([test x"$enable_stack_protector" = "xyes"],
++    [AX_APPEND_COMPILE_FLAGS([-fstack-protector-strong])])
++
+ AX_APPEND_COMPILE_FLAGS([-Wall -Wmissing-prototypes -Wstrict-prototypes])
+ AX_APPEND_LINK_FLAGS([-Wl,--as-needed])
+ 
+-- 
+2.29.2
+

buildroot/package/sox/0003-configure.ac-fix-static-linking-with-id3tag.patch

@@ -0,0 +1,47 @@
+From 8df3a56cfb104c84d4701562ae2e3c9dc4686798 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Sat, 6 Feb 2021 11:08:45 +0100
+Subject: [PATCH] configure.ac: fix static linking with id3tag
+
+Put back -lz (i.e. ZLIB_LIBS) when searching for id3tag which was
+wrongly removed by commit 6ff0e9322f9891f5a6ac6c9b3bceffbfca16bec3. This
+will fix the following static build failure:
+
+configure:15290: checking for id3_file_open in -lid3tag
+configure:15315: /home/buildroot/autobuild/instance-0/output-1/host/bin/arm-linux-gcc -o conftest -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -O2   -static -Wall -Wmissing-prototypes -Wstrict-prototypes  -D_LARGEFILE_SOURCE -D_LARGEFILE64_SOURCE -D_FILE_OFFSET_BITS=64  -static -Wl,--as-needed conftest.c -lid3tag    >&5
+conftest.c:60:1: warning: function declaration isn't a prototype [-Wstrict-prototypes]
+   60 | char id3_file_open ();
+      | ^~~~
+conftest.c:62:1: warning: function declaration isn't a prototype [-Wstrict-prototypes]
+   62 | main ()
+      | ^~~~
+/home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/buildroot/autobuild/instance-0/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libid3tag.a(util.o): in function `id3_util_compress':
+util.c:(.text+0x1ac): undefined reference to `compress2'
+/home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/bin/../lib/gcc/arm-buildroot-linux-uclibcgnueabi/9.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: /home/buildroot/autobuild/instance-0/output-1/host/arm-buildroot-linux-uclibcgnueabi/sysroot/usr/lib/libid3tag.a(util.o): in function `id3_util_decompress':
+util.c:(.text+0x240): undefined reference to `uncompress'
+
+Fixes:
+ - http://autobuild.buildroot.org/results/73efdacf237e3d567fa66f3b3f68e624f5e35bc7
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://sourceforge.net/p/sox/patches/123]
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 39306398..896714f5 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -83,7 +83,7 @@ dnl Various libraries
+ SOX_WITH_LIB([magic], [magic.h], [magic], [magic_open])
+ SOX_CHECK_LIB([ZLIB], [zlib.h], [z], [uncompress])
+ SOX_WITH_LIB([png], [png.h], [png], [png_set_rows], [], [], [], [$ZLIB_LIBS])
+-SOX_WITH_LIB([id3tag], [id3tag.h], [id3tag], [id3_file_open])
++SOX_WITH_LIB([id3tag], [id3tag.h], [id3tag], [id3_file_open], [], [], [], [$ZLIB_LIBS])
+ SOX_WITH_LIB([libgsm], [gsm/gsm.h gsm.h], [gsm], [gsm_create])
+ 
+ dnl Optional formats
+-- 
+2.29.2
+

buildroot/package/sox/sox.hash

@@ -1,6 +1,4 @@
-# From http://sourceforge.net/projects/sox/files/sox/14.4.2/
-md5	ba804bb1ce5c71dd484a102a5b27d0dd	sox-14.4.2.tar.bz2
-sha1	dc9668256b9d81ef25d672f14f12ec026b0b4087	sox-14.4.2.tar.bz2
 # Locally computed
+sha256  ece6f43bcf3eafde29024087597a1aa3a346e77cef64f01497f167512e62e0ef  sox-7524160b29a476f7e87bc14fddf12d349f9a3c5e.tar.gz
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  LICENSE.GPL
 sha256  5df07007198989c622f5d41de8d703e7bef3d0e79d62e24332ee739a452af62a  LICENSE.LGPL

buildroot/package/sox/sox.mk

@@ -4,107 +4,135 @@
 #
 ################################################################################
 
-SOX_VERSION = 14.4.2
+SOX_VERSION = 7524160b29a476f7e87bc14fddf12d349f9a3c5e
-SOX_SITE = http://downloads.sourceforge.net/project/sox/sox/$(SOX_VERSION)
+SOX_SITE = git://git.code.sf.net/p/sox/code
-SOX_SOURCE = sox-$(SOX_VERSION).tar.bz2
+SOX_SITE_METHOD = git
-SOX_DEPENDENCIES = host-pkgconf
+SOX_DEPENDENCIES = host-autoconf-archive host-pkgconf
 SOX_LICENSE = GPL-2.0+ (sox binary), LGPL-2.1+ (libraries)
 SOX_LICENSE_FILES = LICENSE.GPL LICENSE.LGPL
+# From git and we're patching configure.ac
+SOX_AUTORECONF = YES
+SOX_AUTORECONF_OPTS = --include=$(HOST_DIR)/share/autoconf-archive
+
+SOX_IGNORE_CVES += CVE-2017-11332 CVE-2017-11358 CVE-2017-11359 \
+	CVE-2017-15370 CVE-2017-15371 CVE-2017-15372 CVE-2017-15642 \
+	CVE-2017-18189 CVE-2019-8354 CVE-2019-8355 CVE-2019-8356 \
+	CVE-2019-8357 CVE-2019-13590
 
 SOX_CONF_OPTS = \
 	--with-distro="Buildroot" \
-	--without-ffmpeg \
-	--disable-gomp \
 	--disable-stack-protector
 
 ifeq ($(BR2_PACKAGE_ALSA_LIB_PCM),y)
 SOX_DEPENDENCIES += alsa-lib
+SOX_CONF_OPTS += --enable-alsa
 else
-SOX_CONF_OPTS += --without-alsa
+SOX_CONF_OPTS += --disable-alsa
 endif
 
 ifeq ($(BR2_PACKAGE_FILE),y)
 SOX_DEPENDENCIES += file
+SOX_CONF_OPTS += --with-magic
 else
 SOX_CONF_OPTS += --without-magic
 endif
 
 ifeq ($(BR2_PACKAGE_FLAC),y)
 SOX_DEPENDENCIES += flac
+SOX_CONF_OPTS += --enable-flac
 else
-SOX_CONF_OPTS += --without-flac
+SOX_CONF_OPTS += --disable-flac
 endif
 
 ifeq ($(BR2_PACKAGE_LAME),y)
 SOX_DEPENDENCIES += lame
+SOX_CONF_OPTS += --with-lame
 else
 SOX_CONF_OPTS += --without-lame
 endif
 
 ifeq ($(BR2_PACKAGE_LIBAO),y)
 SOX_DEPENDENCIES += libao
+SOX_CONF_OPTS += --enable-ao
 else
-SOX_CONF_OPTS += --without-ao
+SOX_CONF_OPTS += --disable-ao
+endif
+
+ifeq ($(BR2_PACKAGE_LIBGSM),y)
+SOX_DEPENDENCIES += libgsm
+SOX_CONF_OPTS += --enable-gsm
+else
+SOX_CONF_OPTS += --disable-gsm
 endif
 
 ifeq ($(BR2_PACKAGE_LIBID3TAG),y)
 SOX_DEPENDENCIES += libid3tag
+SOX_CONF_OPTS += --with-id3tag
 else
 SOX_CONF_OPTS += --without-id3tag
 endif
 
 ifeq ($(BR2_PACKAGE_LIBMAD),y)
 SOX_DEPENDENCIES += libmad
+SOX_CONF_OPTS += --with-mad
 else
 SOX_CONF_OPTS += --without-mad
 endif
 
 ifeq ($(BR2_PACKAGE_LIBPNG),y)
 SOX_DEPENDENCIES += libpng
+SOX_CONF_OPTS += --with-png
 else
 SOX_CONF_OPTS += --without-png
 endif
 
 ifeq ($(BR2_PACKAGE_LIBSNDFILE),y)
 SOX_DEPENDENCIES += libsndfile
+SOX_CONF_OPTS += --enable-sndfile
 else
-SOX_CONF_OPTS += --without-sndfile
+SOX_CONF_OPTS += --disable-sndfile
 endif
 
 ifeq ($(BR2_PACKAGE_LIBVORBIS),y)
 SOX_DEPENDENCIES += libvorbis
+SOX_CONF_OPTS += --enable-oggvorbis
 else
-SOX_CONF_OPTS += --without-oggvorbis
+SOX_CONF_OPTS += --disable-oggvorbis
 endif
 
 ifeq ($(BR2_PACKAGE_OPENCORE_AMR),y)
 SOX_DEPENDENCIES += opencore-amr
+SOX_CONF_OPTS += --enable-amrwb --enable-amrnb
 else
-SOX_CONF_OPTS += --without-amrwb --without-amrnb
+SOX_CONF_OPTS += --disable-amrwb --disable-amrnb
 endif
 
 ifeq ($(BR2_PACKAGE_OPUSFILE),y)
 SOX_DEPENDENCIES += opusfile
+SOX_CONF_OPTS += --enable-opus
 else
-SOX_CONF_OPTS += --without-opus
+SOX_CONF_OPTS += --disable-opus
 endif
 
 ifeq ($(BR2_PACKAGE_PULSEAUDIO),y)
 SOX_DEPENDENCIES += pulseaudio
+SOX_CONF_OPTS += --enable-pulseaudio
 else
-SOX_CONF_OPTS += --without-pulseaudio
+SOX_CONF_OPTS += --disable-pulseaudio
 endif
 
 ifeq ($(BR2_PACKAGE_TWOLAME),y)
 SOX_DEPENDENCIES += twolame
+SOX_CONF_OPTS += --with-twolame
 else
 SOX_CONF_OPTS += --without-twolame
 endif
 
 ifeq ($(BR2_PACKAGE_WAVPACK),y)
 SOX_DEPENDENCIES += wavpack
+SOX_CONF_OPTS += --enable-wavpack
 else
-SOX_CONF_OPTS += --without-wavpack
+SOX_CONF_OPTS += --disable-wavpack
 endif
 
 $(eval $(autotools-package))

buildroot/package/stress-ng/stress-ng.mk

@@ -10,11 +10,8 @@ STRESS_NG_SITE = http://kernel.ubuntu.com/~cking/tarballs/stress-ng
 STRESS_NG_LICENSE = GPL-2.0+
 STRESS_NG_LICENSE_FILES = COPYING
 
-ifeq ($(BR2_PACKAGE_LIBBSD):$(BR2_STATIC_LIBS),y:)
+ifeq ($(BR2_PACKAGE_LIBBSD),y)
 STRESS_NG_DEPENDENCIES += libbsd
-else
-STRESS_NG_MAKE_OPTS += HAVE_LIB_BSD=0 HAVE_WCSLCAT=0 \
-	HAVE_WCSLCPY=0 HAVE_SETPROCTITLE=0
 endif
 
 ifeq ($(BR2_PACKAGE_KEYUTILS),y)
@@ -22,7 +19,7 @@ STRESS_NG_DEPENDENCIES += keyutils
 endif
 
 define STRESS_NG_BUILD_CMDS
-	$(TARGET_CONFIGURE_OPTS) $(MAKE) $(STRESS_NG_MAKE_OPTS) -C $(@D)
+	$(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)
 endef
 
 # Don't use make install otherwise stress-ng will be rebuild without

buildroot/package/subversion/subversion.hash

@@ -1,5 +1,5 @@
-# From https://www.apache.org/dist/subversion/subversion-1.14.0.tar.bz2.sha512
+# From https://www.apache.org/dist/subversion/subversion-1.14.1.tar.bz2.sha512
-sha512  af6b706fdc91f7ab292fce9d9de582da306fd11e92767dc852687e71a6a8b65bb867fa70d5afd7f76a46005acb1b3c2d3193e690def48cd26875b3a7851cd13b  subversion-1.14.0.tar.bz2
+sha512  0a70c7152b77cdbcb810a029263e4b3240b6ef41d1c19714e793594088d3cca758d40dfbc05622a806b06463becb73207df249393924ce591026b749b875fcdd  subversion-1.14.1.tar.bz2
 
 # Locally calculated
 sha256  484aff0cfbb81155a10f903ed756e27e9fc65578c245a295bae295c4bb51eaad  LICENSE

buildroot/package/subversion/subversion.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SUBVERSION_VERSION = 1.14.0
+SUBVERSION_VERSION = 1.14.1
 SUBVERSION_SOURCE = subversion-$(SUBVERSION_VERSION).tar.bz2
 SUBVERSION_SITE = https://downloads.apache.org/subversion
 SUBVERSION_LICENSE = Apache-2.0

buildroot/package/tzdata/tzdata.mk

@@ -51,8 +51,8 @@ endef
 define HOST_TZDATA_BUILD_CMDS
 	(cd $(@D); \
 		for zone in $(TZDATA_ZONELIST); do \
-			$(ZIC) -d _output/posix $$zone || exit 1; \
+			$(ZIC) -b fat -d _output/posix $$zone || exit 1; \
-			$(ZIC) -d _output/right -L leapseconds $$zone || exit 1; \
+			$(ZIC) -b fat -d _output/right -L leapseconds $$zone || exit 1; \
 		done; \
 	)
 endef

buildroot/package/uboot-tools/uboot-tools.mk

@@ -111,7 +111,20 @@ endif
 ifeq ($(BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE),y)
 
 UBOOT_TOOLS_GENERATE_ENV_FILE = $(call qstrip,$(BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE_SOURCE))
-ifeq ($(UBOOT_TOOLS_GENERATE_ENV_FILE):$(BR2_TARGET_UBOOT),:y)
+
+# If BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE_SOURCE is left empty, we
+# will use the default environment provided in the U-Boot build
+# directory as boot-env-defaults.txt, which requires having uboot as a
+# dependency.
+# If BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE_SOURCE is not empty, is
+# might be referring to a file within the U-Boot source tree, so we
+# also need to have uboot as a dependency.
+ifeq ($(BR2_TARGET_UBOOT),y)
+HOST_UBOOT_TOOLS_DEPENDENCIES += uboot
+
+# Handle the case where BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE_SOURCE
+# is left empty, use the default U-Boot environment.
+ifeq ($(UBOOT_TOOLS_GENERATE_ENV_FILE),)
 UBOOT_TOOLS_GENERATE_ENV_FILE = $(@D)/boot-env-defaults.txt
 define HOST_UBOOT_TOOLS_GENERATE_ENV_DEFAULTS
 	CROSS_COMPILE="$(TARGET_CROSS)" \
@@ -119,8 +132,8 @@ define HOST_UBOOT_TOOLS_GENERATE_ENV_DEFAULTS
 		$(UBOOT_SRCDIR) \
 		> $(UBOOT_TOOLS_GENERATE_ENV_FILE)
 endef
-HOST_UBOOT_TOOLS_DEPENDENCIES += uboot
+endif # UBOOT_TOOLS_GENERATE_ENV_FILE
-endif #UBOOT_TOOLS_GENERATE_ENV_FILE:BR2_TARGET_UBOOT
+endif # BR2_TARGET_UBOOT
 
 ifeq ($(BR_BUILDING),y)
 ifeq ($(call qstrip,$(BR2_PACKAGE_HOST_UBOOT_TOOLS_ENVIMAGE_SIZE)),)

buildroot/package/uclibc/0001-arch-sh-Add-64-bit-time-types-from-kernel.patch

@@ -0,0 +1,33 @@
+From 385f2b18ccde15f72a6e8aee4c960a5bc18481d7 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Geoffrey=20Le=20Gourri=C3=A9rec?=
+ <geoffrey.legourrierec@gmail.com>
+Date: Tue, 26 Jan 2021 20:39:36 +0100
+Subject: [PATCH] arch/sh: Add 64-bit time types from kernel
+
+---
+ libc/sysdeps/linux/sh/bits/kernel_types.h | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/libc/sysdeps/linux/sh/bits/kernel_types.h b/libc/sysdeps/linux/sh/bits/kernel_types.h
+index ac97261e6..90b2e66b6 100644
+--- a/libc/sysdeps/linux/sh/bits/kernel_types.h
++++ b/libc/sysdeps/linux/sh/bits/kernel_types.h
+@@ -21,6 +21,7 @@ typedef unsigned int	__kernel_size_t;
+ typedef int		__kernel_ssize_t;
+ typedef int		__kernel_ptrdiff_t;
+ typedef long		__kernel_time_t;
++typedef long long	__kernel_time64_t;
+ typedef long		__kernel_suseconds_t;
+ typedef long		__kernel_clock_t;
+ typedef int		__kernel_daddr_t;
+@@ -33,6 +34,7 @@ typedef unsigned short	__kernel_old_uid_t;
+ typedef unsigned short	__kernel_old_gid_t;
+ typedef __kernel_dev_t	__kernel_old_dev_t;
+ typedef long		__kernel_long_t;
++typedef __kernel_long_t	__kernel_old_time_t;
+ typedef unsigned long	__kernel_ulong_t;
+ typedef long long	__kernel_loff_t;
+ 
+-- 
+2.17.1
+

buildroot/package/webkitgtk/webkitgtk.hash

@@ -1,7 +1,7 @@
-# From https://webkitgtk.org/releases/webkitgtk-2.30.4.tar.xz.sums
+# From https://webkitgtk.org/releases/webkitgtk-2.30.5.tar.xz.sums
-md5  81c813d77a7b52ef655922f9b387f3a1  webkitgtk-2.30.4.tar.xz
+md5  c8291af0c5102fff1f73e67f0bff6c87  webkitgtk-2.30.5.tar.xz
-sha1  330f45d7badf944fb01a3238ebb2ceaad8c2a91f  webkitgtk-2.30.4.tar.xz
+sha1  4fc8753786d7762a3c4ecdc7ea11fc38b5468d6f  webkitgtk-2.30.5.tar.xz
-sha256  d595a37c5001ff787266b155e303a5f2e5b48a6d466f2714c2f30c11392f7b24  webkitgtk-2.30.4.tar.xz
+sha256  7d0dab08e3c5ae07bec80b2822ef42e952765d5724cac86eb23999bfed5a7f1f  webkitgtk-2.30.5.tar.xz
 
 # Hashes for license files:
 sha256  0b5d3a7cc325942567373b0ecd757d07c132e0ebd7c97bfc63f7e1a76094edb4  Source/WebCore/LICENSE-APPLE

buildroot/package/webkitgtk/webkitgtk.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WEBKITGTK_VERSION = 2.30.4
+WEBKITGTK_VERSION = 2.30.5
 WEBKITGTK_SITE = https://www.webkitgtk.org/releases
 WEBKITGTK_SOURCE = webkitgtk-$(WEBKITGTK_VERSION).tar.xz
 WEBKITGTK_INSTALL_STAGING = YES

buildroot/package/wireguard-linux-compat/wireguard-linux-compat.hash

@@ -1,4 +1,4 @@
-# https://lists.zx2c4.com/pipermail/wireguard/2020-December/006210.html
+# https://lists.zx2c4.com/pipermail/wireguard/2021-January/006349.html
-sha256  6e5289a8b602eaaf1383aebefcbc41b8ad2721269055858b150363076c1c2132  wireguard-linux-compat-1.0.20201221.tar.xz
+sha256  dac6e68cd4c3db441499850dfa8a70706384a3295f37fda1b839a50b79faef54  wireguard-linux-compat-1.0.20210124.tar.xz
 # Locally calculated
 sha256  8177f97513213526df2cf6184d8ff986c675afb514d4e68a404010521b880643  COPYING

buildroot/package/wireguard-linux-compat/wireguard-linux-compat.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WIREGUARD_LINUX_COMPAT_VERSION = 1.0.20201221
+WIREGUARD_LINUX_COMPAT_VERSION = 1.0.20210124
 WIREGUARD_LINUX_COMPAT_SITE = https://git.zx2c4.com/wireguard-linux-compat/snapshot
 WIREGUARD_LINUX_COMPAT_SOURCE = wireguard-linux-compat-$(WIREGUARD_LINUX_COMPAT_VERSION).tar.xz
 WIREGUARD_LINUX_COMPAT_LICENSE = GPL-2.0

buildroot/package/wireshark/wireshark.hash

@@ -1,6 +1,6 @@
-# From https://www.wireshark.org/download/src/all-versions/SIGNATURES-3.4.2.txt
+# From https://www.wireshark.org/download/src/all-versions/SIGNATURES-3.4.3.txt
-sha1  b33276e4e6c3d6a057da3b569b58316330a5f3e3  wireshark-3.4.2.tar.xz
+sha1  7dec4332f21827e360b5830d1d6d566365796a67  wireshark-3.4.3.tar.xz
-sha256  de9868729e426a469baabd8d444240d84fa5445020e92c842dd19afd0d47a4c4  wireshark-3.4.2.tar.xz
+sha256  f467cc77f0fc73fce0b854cdbc292f132d4879fca69d417eccad5f967fbf262b  wireshark-3.4.3.tar.xz
 
 # Locally calculated
 sha256  7cdbed2b697efaa45576a033f1ac0e73cd045644a91c79bbf41d4a7d81dac7bf  COPYING

buildroot/package/wireshark/wireshark.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-WIRESHARK_VERSION = 3.4.2
+WIRESHARK_VERSION = 3.4.3
 WIRESHARK_SOURCE = wireshark-$(WIRESHARK_VERSION).tar.xz
 WIRESHARK_SITE = https://www.wireshark.org/download/src/all-versions
 WIRESHARK_LICENSE = wireshark license

buildroot/package/wpa_supplicant/wpa_supplicant.hash

@@ -1,3 +1,4 @@
 # Locally calculated
 sha256  fcbdee7b4a64bea8177973299c8c824419c413ec2e3a95db63dd6a5dc3541f17  wpa_supplicant-2.9.tar.gz
 sha256  9da5dd0776da266b180b915e460ff75c6ff729aca1196ab396529510f24f3761  README
+sha256  c4d65cc13863e0237d0644198558e2c47b4ed91e2b2be4516ff590724187c4a5  0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch

buildroot/package/wpa_supplicant/wpa_supplicant.mk

@@ -6,6 +6,8 @@
 
 WPA_SUPPLICANT_VERSION = 2.9
 WPA_SUPPLICANT_SITE = http://w1.fi/releases
+WPA_SUPPLICANT_PATCH = \
+	https://w1.fi/security/2020-2/0001-P2P-Fix-copying-of-secondary-device-types-for-P2P-gr.patch
 WPA_SUPPLICANT_LICENSE = BSD-3-Clause
 WPA_SUPPLICANT_LICENSE_FILES = README
 WPA_SUPPLICANT_CONFIG = $(WPA_SUPPLICANT_DIR)/wpa_supplicant/.config