Update for 2020.08.2

Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
package/qemu: fix build with 64 bits time_t
2020-11-16 23:13:14 +01:00 · 2020-11-16 22:33:35 +01:00 · 2020-11-16 22:30:39 +01:00 · 2020-11-16 22:30:13 +01:00 · 2020-11-16 22:28:24 +01:00 · 2020-11-16 22:25:00 +01:00
143 changed files with 2478 additions and 194 deletions
@@ -1,3 +1,30 @@
+2020.08.2, released November 16th, 2020
+
+	Important / security related fixes.
+
+	Toolchain-wrapper: Pass -fno-tree-loop-distribute-patterns to
+	fix kernel build on microblaze with gcc 10.x when
+	optimizations are enabled.
+
+	Updated/fixed packages: apparmor, argp-standalone, asterisk,
+	bandwidthd, binutils, bitcoin, busybox, collectd, cryptsetup,
+	cups-filters, darkhttpd, davfs2, dvb-apps, docker-cli,
+	docker-containerd, docker-engine, dovecot-pigeonhole, elf2flt,
+	fastd, fbset, fbtft, freetype, gcc, ghostscript, grpc,
+	gst1-plugins-bad, jsoncpp, kernel-module-imx-gpu-viv,
+	keepalived, kmscube, libass, libexif, libiqrf,
+	libnetfilter_conntrack, libpam-tacplus, libraw,
+	linux-backports, linux-firmware, lzlib, mp4v2, netsnmp, nginx,
+	numactl, oniguruma, opencv3, openntpd, patchelf, php,
+	pistache, postgresql, python-pyqt5, qemu, qt5base, rauc,
+	redis, samba4, slirp, systemd, tcpdump, tinyproxy, tmux, tor,
+	waf, webkitgtk, wine, wireguard-linux-compat, wireshark,
+	wpewebkit, xen, xorriso, xvisor, zeromq, zxing-cpp
+
+	Issues resolved (http://bugs.uclibc.org):
+
+	#11931: Bugs in support/scripts/apply-patches.sh
+
 2020.08.1, released October 12th, 2020

 	Important / security related fixes.
@@ -236,10 +236,9 @@ F:	package/pkg-golang.mk
 N:	Anthony Viallard <viallard@syscom-instruments.com>
 F:	package/gnuplot/

-N:	Antoine Ténart <antoine.tenart@bootlin.com>
+N:	Antoine Tenart <atenart@kernel.org>
 F:	package/libselinux/
 F:	package/refpolicy/
-F:	package/wf111/

 N:	Antony Pavlov <antonynpavlov@gmail.com>
 F:	package/lsscsi/
@@ -700,7 +699,7 @@ N:	Dominik Faessler <faessler@was.ch>
 F:	package/logsurfer/
 F:	package/python-id3/

-N:	Doug Kehn <rdkehn@yahoo.com>
+N:	Doug Kehn <rdkehn@gmail.com>
 F:	package/nss-pam-ldapd/
 F:	package/sp-oops-extract/
 F:	package/unscd/
@@ -1433,7 +1432,7 @@ F:	board/technologic/ts7680/
 F:	configs/ts7680_defconfig
 F:	package/paho-mqtt-c

-N:	Julien Olivain <juju@cotds.org>
+N:	Julien Olivain <ju.o@free.fr>
 F:	board/qmtech/zynq/
 F:	board/technexion/imx8mmpico/
 F:	board/technexion/imx8mpico/
@@ -1577,9 +1576,6 @@ F:	package/mpv/
 F:	package/rpi-firmware/
 F:	package/rpi-userland/

-N:	Mamatha Inamdar <mamatha4@linux.vnet.ibm.com>
-F:	package/nvme/
-
 N:	Manuel Vögele <develop@manuel-voegele.de>
 F:	package/python-pyqt5/
 F:	package/python-requests-toolbelt/
@@ -2265,11 +2261,6 @@ F:	package/python-tornado/
 F:	package/resiprocate/
 F:	package/websocketpp/

-N:	Ryan Coe <bluemrp9@gmail.com>
-F:	package/inadyn/
-F:	package/libite/
-F:	package/mariadb/
-
 N:	Ryan Wilkins <ryan@deadfrog.net>
 F:	package/biosdevname/

@@ -2576,9 +2567,6 @@ F:	package/waf/
 F:	support/testing/tests/package/test_crudini.py
 F:	support/testing/tests/package/test_redis.py

-N:	Trent Piepho <tpiepho@impinj.com>
-F:	package/libp11/
-
 N:	Tudor Holton <buildroot@tudorholton.com>
 F:	package/openjdk/

@@ -2629,6 +2617,8 @@ N:	Wade Berrier <wberrier@gmail.com>
 F:	package/ngrep/

 N:	Waldemar Brodkorb <wbx@openadk.org>
+F:	package/mksh/
+F:	package/ruby/
 F:	package/uclibc/
 F:	package/uclibc-ng-test/

@@ -92,7 +92,7 @@ all:
 .PHONY: all

 # Set and export the version string
-export BR2_VERSION := 2020.08.1
+export BR2_VERSION := 2020.08.2
 # Actual time the release is cut (for reproducible builds)
 BR2_VERSION_EPOCH = 1602507000

@@ -510,7 +510,7 @@ ifeq ($(call qstrip,$(BR2_TARGET_UBOOT_CUSTOM_REPO_URL)),)
 $(error No custom U-Boot repository URL specified. Check your BR2_TARGET_UBOOT_CUSTOM_REPO_URL setting)
 endif # qstrip BR2_TARGET_UBOOT_CUSTOM_CUSTOM_REPO_URL
 ifeq ($(call qstrip,$(BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION)),)
-$(error No custom U-Boot repository URL specified. Check your BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION setting)
+$(error No custom U-Boot repository version specified. Check your BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION setting)
 endif # qstrip BR2_TARGET_UBOOT_CUSTOM_CUSTOM_REPO_VERSION
 endif # BR2_TARGET_UBOOT_CUSTOM_GIT || BR2_TARGET_UBOOT_CUSTOM_HG

@@ -30,7 +30,7 @@ config BR2_LINUX_KERNEL_LATEST_VERSION
 	bool "Latest version (5.7)"

 config BR2_LINUX_KERNEL_LATEST_CIP_VERSION
-	bool "Latest CIP SLTS version (4.19.132-cip30)"
+	bool "Latest CIP SLTS version (4.19.152-cip37)"
 	help
 	  CIP launched in the spring of 2016 to address the needs of
 	  organizations in industries such as power generation and
@@ -43,13 +43,13 @@ config BR2_LINUX_KERNEL_LATEST_CIP_VERSION
 	  implementation of software building blocks that meet
 	  these requirements.

-	  The CIP community plans to maintain 4.4 for security and
+	  The CIP community plans to maintain 4.19 for security and
 	  bug fixes for more than 10 years.

 	  https://www.cip-project.org

 config BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
-	bool "Latest CIP RT SLTS version (4.19.132-cip30-rt12)"
+	bool "Latest CIP RT SLTS version (4.19.152-cip37-rt16)"
 	help
 	  Same as the CIP version, but this is the PREEMPT_RT realtime
 	  variant.
@@ -125,8 +125,8 @@ endif
 config BR2_LINUX_KERNEL_VERSION
 	string
 	default "5.7.19" if BR2_LINUX_KERNEL_LATEST_VERSION
-	default "4.19.132-cip30" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
-	default "4.19.132-cip30-rt12" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
+	default "4.19.152-cip37" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
+	default "4.19.152-cip37-rt16" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \
 		if BR2_LINUX_KERNEL_CUSTOM_VERSION
 	default "custom" if BR2_LINUX_KERNEL_CUSTOM_TARBALL
@@ -1,14 +1,14 @@
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
 sha256  419c6248b9ae4dfead4599787aecbfd202e88bc4124523adfa6dd2d642b99fe7  linux-5.7.19.tar.xz
-sha256  c0b3d8085c5ba235df38b00b740e053659709e8a5ca21957a239f6bc22c45007  linux-5.4.70.tar.xz
+sha256  a3e03e6970240dddc8174bf9f49b56d774c40125eabe1582d2ebe85b01addbf7  linux-5.4.77.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v4.x/sha256sums.asc
-sha256  067814035c17e77dee84076dcc06a95eb675344cd926b7b79a16b80fee593364  linux-4.4.238.tar.xz
-sha256  b1eaf60b771ec4df0546d2b7539e164355008ea2f680a0642ae430e9cb134a3f  linux-4.9.238.tar.xz
-sha256  5d404a0224a34b5379f1871cc46825487d557c2660459d2b5c3cd4871d699a38  linux-4.14.200.tar.xz
-sha256  f2f709ef086a4d8cb3c15a857daa44dfecf1b88d7d7c53c980fb180f6dccbace  linux-4.19.150.tar.xz
+sha256  95de46b6bd72f66169629eb0e343b005778539864598eae76c3ca999645d58b5  linux-4.4.243.tar.xz
+sha256  d3aa189ca7fcc6e52d6c0333a0d7acd8789e9a492b32dbf9476e926ffaa73984  linux-4.9.243.tar.xz
+sha256  1c233efaa5063983293a02d4692acc9ced9c03e18857364855d4f612347086ac  linux-4.14.206.tar.xz
+sha256  76dca365255c1a13778c3b24f0eae14f4e66bc12fe79f5e6592b116fc57ef755  linux-4.19.157.tar.xz
 # Locally computed
-sha256  c20f9014b89ea3e27f55f1d407aa5a4724ed38ac520c197291e9d644f164c43a  linux-cip-4.19.132-cip30.tar.gz
-sha256  81dd791d9ad6c3fddaeaffc6d7d8df0e13831283a5fe494c437ac7820d79ca39  linux-cip-4.19.132-cip30-rt12.tar.gz
+sha256  d2a06f52143deb929b8d513cf9afc9bd065951389a80fa70bc4d63025b5b3fb9  linux-cip-4.19.152-cip37.tar.gz
+sha256  bc1dacd3d0f526de3e8754a444e8e02a54521527af639ddb907cb35cda775a8c  linux-cip-4.19.152-cip37-rt16.tar.gz

 # Licenses hashes
 sha256  fb5a425bd3b3cd6071a3a9aff9909a859e7c1158d54d32e07658398cd67eb6a0  COPYING
@@ -88,7 +88,7 @@ endef
 define APPARMOR_INSTALL_INIT_SYSTEMD
 	$(INSTALL) -D -m 0755 $(@D)/parser/apparmor.systemd \
 		$(TARGET_DIR)/lib/apparmor/apparmor.systemd
-	$(INSTALL) -D -m 0755 $(@D)/parser/apparmor.service \
+	$(INSTALL) -D -m 0644 $(@D)/parser/apparmor.service \
 		$(TARGET_DIR)/usr/lib/systemd/system/apparmor.service
 endef

@@ -1,2 +1,5 @@
 # Locally calculated after checking pgp signature
-sha256	dec79694da1319acd2238ce95df57f3680fea2482096e483323fddf3d818d8be  argp-standalone-1.3.tar.gz
+sha256  dec79694da1319acd2238ce95df57f3680fea2482096e483323fddf3d818d8be  argp-standalone-1.3.tar.gz
+
+# License file
+sha256  bbb8919aa520069b0234faf5e83a94052d278419ffe97ca8e843ecc9b212d1ab  argp.h
@@ -8,6 +8,7 @@ ARGP_STANDALONE_VERSION = 1.3
 ARGP_STANDALONE_SITE = http://www.lysator.liu.se/~nisse/archive
 ARGP_STANDALONE_INSTALL_STAGING = YES
 ARGP_STANDALONE_LICENSE = LGPL-2.0+
+ARGP_STANDALONE_LICENSE_FILES = argp.h

 ARGP_STANDALONE_CONF_ENV = \
 	CFLAGS="$(TARGET_CFLAGS) -fPIC -fgnu89-inline"
@@ -1,5 +1,5 @@
 # Locally computed
-sha256  f0ba5e3c4ef46f6657dd3a7167190f9b6cd6bbf4af09ecc291a9d5868b477609  asterisk-16.10.0.tar.gz
+sha256  226eaef400d2d335ce29d7b3c8aca8dfdfc5e854c215e0c47615c095ced12171  asterisk-16.14.1.tar.gz

 # sha1 from: http://downloads.asterisk.org/pub/telephony/sounds/releases
 # sha256 locally computed
@@ -12,4 +12,4 @@ sha256  449fb810d16502c3052fedf02f7e77b36206ac5a145f3dacf4177843a2fcb538  asteri
 sha256  82af40ed7f49c08685360811993d9396320842f021df828801d733e8fdc0312f  COPYING
 sha256  ac5571f00e558e3b7c9b3f13f421b874cc12cf4250c4f70094c71544cf486312  main/sha1.c
 sha256  6215e3ed73c3982a5c6701127d681ec0b9f1121ac78a28805bd93f93c3eb84c0  codecs/speex/speex_resampler.h
-sha256  1ca2c7a7a1ae7ccd75212a8c1e85dd9ec92bdbc9170aafd97ea60459387755fd  utils/db1-ast/include/db.h
+sha256  ea69cc96ab8a779c180a362377caeada71926897d1b55b980f04d74ba5aaa388  utils/db1-ast/include/db.h
@@ -4,7 +4,7 @@
 #
 ################################################################################

-ASTERISK_VERSION = 16.10.0
+ASTERISK_VERSION = 16.14.1
 # Use the github mirror: it's an official mirror maintained by Digium, and
 # provides tarballs, which the main Asterisk git tree (behind Gerrit) does not.
 ASTERISK_SITE = $(call github,asterisk,asterisk,$(ASTERISK_VERSION))
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256 0270d0def6cc53c8d47d59a9dd093d51fbca1620adeef85c15e35a32010e26ab  bandwidthd-2.0.1-auto-r11.tar.gz
+sha256  0270d0def6cc53c8d47d59a9dd093d51fbca1620adeef85c15e35a32010e26ab  bandwidthd-2.0.1-auto-r11.tar.gz
+sha256  58573c40770e0c0b91f3eef8192952832321a344f66a4fb2d966095cbbfc86c2  README
@@ -10,6 +10,7 @@ BANDWIDTHD_SITE = $(call github,nroach44,bandwidthd,v$(BANDWIDTHD_VERSION))
 # Specified as "any version of the GPL that is current as of your
 # download" by upstream.
 BANDWIDTHD_LICENSE = GPL
+BANDWIDTHD_LICENSE_FILES = README

 BANDWIDTHD_DEPENDENCIES = gd libpng libpcap host-pkgconf

@@ -93,6 +93,7 @@ HOST_BINUTILS_CONF_OPTS = \
 	--enable-static \
 	--with-sysroot=$(STAGING_DIR) \
 	--enable-poison-system-directories \
+	--without-debuginfod \
 	$(BINUTILS_DISABLE_GDB_CONF_OPTS) \
 	$(BINUTILS_EXTRA_CONFIG_OPTIONS)

@@ -0,0 +1,48 @@
+From 330cb33985d0ce97c20f4a0f0bbda0fbffe098d4 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Mon, 9 Nov 2020 21:18:40 +0100
+Subject: [PATCH] src/randomenv.cpp: fix build on uclibc
+
+Check for HAVE_STRONG_GETAUXVAL or HAVE_WEAK_GETAUXVAL before using
+getauxval to avoid a build failure on uclibc
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: https://github.com/bitcoin/bitcoin/pull/20358]
+---
+ src/randomenv.cpp | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/randomenv.cpp b/src/randomenv.cpp
+index 07122b7f6..5e07c3db4 100644
+--- a/src/randomenv.cpp
+++ b/src/randomenv.cpp
+@@ -53,7 +53,7 @@
+ #include <sys/vmmeter.h>
+ #endif
+ #endif
+-#ifdef __linux__
+#if defined(HAVE_STRONG_GETAUXVAL) || defined(HAVE_WEAK_GETAUXVAL)
+ #include <sys/auxv.h>
+ #endif
+ 
+@@ -326,7 +326,7 @@ void RandAddStaticEnv(CSHA512& hasher)
+     // Bitcoin client version
+     hasher << CLIENT_VERSION;
+ 
+-#ifdef __linux__
+#if defined(HAVE_STRONG_GETAUXVAL) || defined(HAVE_WEAK_GETAUXVAL)
+     // Information available through getauxval()
+ #  ifdef AT_HWCAP
+     hasher << getauxval(AT_HWCAP);
+@@ -346,7 +346,7 @@ void RandAddStaticEnv(CSHA512& hasher)
+     const char* exec_str = (const char*)getauxval(AT_EXECFN);
+     if (exec_str) hasher.Write((const unsigned char*)exec_str, strlen(exec_str) + 1);
+ #  endif
+-#endif // __linux__
+#endif // HAVE_STRONG_GETAUXVAL || HAVE_WEAK_GETAUXVAL
+ 
+ #ifdef HAVE_GETCPUID
+     AddAllCPUID(hasher);
+-- 
+2.28.0
+
@@ -18,9 +18,6 @@ config BR2_PACKAGE_BITCOIN
 	select BR2_PACKAGE_BOOST_SYSTEM
 	select BR2_PACKAGE_BOOST_FILESYSTEM
 	select BR2_PACKAGE_BOOST_THREAD
-	select BR2_PACKAGE_BOOST_CHRONO
-	select BR2_PACKAGE_BOOST_PROGRAM_OPTIONS
-	select BR2_PACKAGE_OPENSSL
 	select BR2_PACKAGE_LIBEVENT
 	help
 	  Bitcoin Core is an open source project which maintains and
@@ -1,5 +1,5 @@
-# From https://bitcoincore.org/bin/bitcoin-core-0.19.0.1/SHA256SUMS.asc
-sha256 7ac9f972249a0a16ed01352ca2a199a5448fe87a4ea74923404a40b4086de284  bitcoin-0.19.0.1.tar.gz
+# From https://bitcoincore.org/bin/bitcoin-core-0.20.1/SHA256SUMS.asc
+sha256  4bbd62fd6acfa5e9864ebf37a24a04bc2dcfe3e3222f056056288d854c53b978  bitcoin-0.20.1.tar.gz

 # Hash for license file
-sha256 9a0f75d688e9cf5c69d3efdaa2a83af496700d252b212ec6a72f7784b47fed0c  COPYING
+sha256  96fe807030b21f88305adc32af62f9aa19915f2783509fd6f52aea02cf83f644  COPYING
@@ -4,12 +4,13 @@
 #
 ################################################################################

-BITCOIN_VERSION = 0.19.0.1
+BITCOIN_VERSION = 0.20.1
 BITCOIN_SITE = https://bitcoincore.org/bin/bitcoin-core-$(BITCOIN_VERSION)
 BITCOIN_AUTORECONF = YES
 BITCOIN_LICENSE = MIT
 BITCOIN_LICENSE_FILES = COPYING
-BITCOIN_DEPENDENCIES = host-pkgconf boost openssl libevent
+BITCOIN_DEPENDENCIES = host-pkgconf boost libevent
+BITCOIN_MAKE_ENV = BITCOIN_GENBUILD_NO_GIT=1
 BITCOIN_CONF_OPTS = \
 	--disable-bench \
 	--disable-wallet \
@@ -0,0 +1,63 @@
+From b226d7730b2c4ca73fc569b404cd6adff1c5b05f Mon Sep 17 00:00:00 2001
+From: Eddie James <eajames@linux.ibm.com>
+Date: Mon, 10 Aug 2020 09:59:02 -0500
+Subject: [PATCH] hwclock: Fix settimeofday for glibc v2.31+
+
+The glibc implementation changed for settimeofday, resulting in "invalid
+argument" error when attempting to set both timezone and time with a single
+call. Fix this by calling settimeofday twice
+
+Signed-off-by: Eddie James <eajames@linux.ibm.com>
+Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
+
+(cherry picked from commit 1a5d6fcbb5e606ab4acdf22afa26361a25f1d43b)
+(Klaus: use bb_perror_msg_and_die() instead of
+bb_simple_perror_msg_and_die() for 1_31_1 backport)
+Signed-off-by: Klaus Heinrich Kiwi <klaus@linux.vnet.ibm.com>
+---
+ util-linux/hwclock.c | 14 +++++++++++---
+ 1 file changed, 11 insertions(+), 3 deletions(-)
+
+diff --git a/util-linux/hwclock.c b/util-linux/hwclock.c
+index 29f51021e..d2c68efbe 100644
+--- a/util-linux/hwclock.c
+++ b/util-linux/hwclock.c
+@@ -122,16 +122,20 @@ static void to_sys_clock(const char **pp_rtcname, int utc)
+ 	struct timeval tv;
+ 	struct timezone tz;
+ 
+-	tz.tz_minuteswest = timezone/60;
+	tz.tz_minuteswest = timezone / 60;
+ 	/* ^^^ used to also subtract 60*daylight, but it's wrong:
+ 	 * daylight!=0 means "this timezone has some DST
+ 	 * during the year", not "DST is in effect now".
+ 	 */
+ 	tz.tz_dsttime = 0;
+ 
+	/* glibc v2.31+ returns an error if both args are non-NULL */
+	if (settimeofday(NULL, &tz))
+		bb_perror_msg_and_die("settimeofday");
+
+ 	tv.tv_sec = read_rtc(pp_rtcname, NULL, utc);
+ 	tv.tv_usec = 0;
+-	if (settimeofday(&tv, &tz))
+	if (settimeofday(&tv, NULL))
+ 		bb_perror_msg_and_die("settimeofday");
+ }
+ 
+@@ -283,7 +287,11 @@ static void set_system_clock_timezone(int utc)
+ 	gettimeofday(&tv, NULL);
+ 	if (!utc)
+ 		tv.tv_sec += tz.tz_minuteswest * 60;
+-	if (settimeofday(&tv, &tz))
+
+	/* glibc v2.31+ returns an error if both args are non-NULL */
+	if (settimeofday(NULL, &tz))
+		bb_perror_msg_and_die("settimeofday");
+	if (settimeofday(&tv, NULL))
+ 		bb_perror_msg_and_die("settimeofday");
+ }
+ 
+-- 
+2.17.1
+
@@ -1,4 +1,5 @@
 # From https://busybox.net/downloads/busybox-1.31.1.tar.bz2.sha256
-sha256 d0f940a72f648943c1f2211e0e3117387c31d765137d92bd8284a3fb9752a998  busybox-1.31.1.tar.bz2
+sha256  d0f940a72f648943c1f2211e0e3117387c31d765137d92bd8284a3fb9752a998  busybox-1.31.1.tar.bz2
 # Locally computed
-sha256 bbfc9843646d483c334664f651c208b9839626891d8f17604db2146962f43548  LICENSE
+sha256  bbfc9843646d483c334664f651c208b9839626891d8f17604db2146962f43548  LICENSE
+sha256  b5a136ed67798e51fe2e0ca0b2a21cb01b904ff0c9f7d563a6292e276607e58f  archival/libarchive/bz/LICENSE
@@ -7,8 +7,8 @@
 BUSYBOX_VERSION = 1.31.1
 BUSYBOX_SITE = http://www.busybox.net/downloads
 BUSYBOX_SOURCE = busybox-$(BUSYBOX_VERSION).tar.bz2
-BUSYBOX_LICENSE = GPL-2.0
-BUSYBOX_LICENSE_FILES = LICENSE
+BUSYBOX_LICENSE = GPL-2.0, bzip2-1.0.4
+BUSYBOX_LICENSE_FILES = LICENSE archival/libarchive/bz/LICENSE

 define BUSYBOX_HELP_CMDS
 	@echo '  busybox-menuconfig     - Run BusyBox menuconfig'
@@ -571,6 +571,7 @@ comment "Select at least one for collectd to be useful"

 config BR2_PACKAGE_COLLECTD_AMQP
 	bool "amqp"
+	select BR2_PACKAGE_OPENSSL # needs rabbitmq-c with ssl support
 	select BR2_PACKAGE_RABBITMQ_C
 	help
 	  Send/receive values via the Advanced Message Queuing Protocol
@@ -1,4 +1,4 @@
 # From https://www.kernel.org/pub/linux/utils/cryptsetup/v2.3/sha256sums.asc
-sha256  3bca4ffe39e2f94cef50f6ea65acb873a6dbce5db34fc6bcefe38b6d095e82df  cryptsetup-2.3.3.tar.xz
+sha256  9d16eebb96b53b514778e813019b8dd15fea9fec5aafde9fae5febf59df83773  cryptsetup-2.3.4.tar.xz
 sha256  45670cce8b6a0ddd66c8016cd8ccef6cd71f35717cbacc7f1e895b3855207b33  COPYING
 sha256  8c33cc37871654ec7ed87e6fbb896c8cf33ef5ef05b1611a5aed857596ffafa5  COPYING.LGPL
@@ -5,7 +5,7 @@
 ################################################################################

 CRYPTSETUP_VERSION_MAJOR = 2.3
-CRYPTSETUP_VERSION = $(CRYPTSETUP_VERSION_MAJOR).3
+CRYPTSETUP_VERSION = $(CRYPTSETUP_VERSION_MAJOR).4
 CRYPTSETUP_SOURCE = cryptsetup-$(CRYPTSETUP_VERSION).tar.xz
 CRYPTSETUP_SITE = $(BR2_KERNEL_MIRROR)/linux/utils/cryptsetup/v$(CRYPTSETUP_VERSION_MAJOR)
 CRYPTSETUP_DEPENDENCIES = lvm2 popt util-linux host-pkgconf json-c libargon2 \
@@ -6,7 +6,7 @@ PIDFILE="/var/run/$DAEMON.pid"
 start() {
 	printf 'Starting %s: ' "$DAEMON"
 	# shellcheck disable=SC2086 # we need the word splitting
-	start-stop-daemon -b -m -S -q -p "$PIDFILE" -x "/sbin/$DAEMON" \
+	start-stop-daemon -b -m -S -q -p "$PIDFILE" -x "/usr/sbin/$DAEMON" \
 		-- -c /etc/cups/cups-browsed.conf
 	status=$?
 	if [ "$status" -eq 0 ]; then
@@ -1,2 +1,3 @@
 # Locally generated
-sha256 a50417b622b32b5f421b3132cb94ebeff04f02c5fb87fba2e31147d23de50505 darkhttpd-1.12.tar.bz2
+sha256  a50417b622b32b5f421b3132cb94ebeff04f02c5fb87fba2e31147d23de50505  darkhttpd-1.12.tar.bz2
+sha256  6e1a2e45d8dd3c8835222e3c82e5cccde8e60f02d55555910e18715ec5dc6d04  darkhttpd.c
@@ -8,6 +8,7 @@ DARKHTTPD_VERSION = 1.12
 DARKHTTPD_SITE = https://unix4lyfe.org/darkhttpd
 DARKHTTPD_SOURCE = darkhttpd-$(DARKHTTPD_VERSION).tar.bz2
 DARKHTTPD_LICENSE = MIT
+DARKHTTPD_LICENSE_FILES = darkhttpd.c

 define DARKHTTPD_BUILD_CMDS
 	$(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)
@@ -18,4 +18,8 @@ DAVFS2_CONF_ENV += \
 	ac_cv_path_NEON_CONFIG=$(STAGING_DIR)/usr/bin/neon-config \
 	LIBS=$(TARGET_NLS_LIBS)

+define DAVFS2_USERS
+	davfs2 -1 davfs2 -1 * - - - davfs user
+endef
+
 $(eval $(autotools-package))
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256	00801d6b7e9777cf2cf54255ca5afb7b58b3d35c14bb0f60bb9f07d031883223  docker-cli-19.03.12.tar.gz
+sha256	21b88a00e8f7a3194c0ae1de5a31e3e1728ef6aa2804158dcb502a8b5fd6ae2b  docker-cli-19.03.13.tar.gz
 sha256	2d81ea060825006fc8f3fe28aa5dc0ffeb80faf325b612c955229157b8c10dc0  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-DOCKER_CLI_VERSION = 19.03.12
+DOCKER_CLI_VERSION = 19.03.13
 DOCKER_CLI_SITE = $(call github,docker,cli,v$(DOCKER_CLI_VERSION))
 DOCKER_CLI_WORKSPACE = gopath

@@ -1,3 +1,3 @@
 # Computed locally
-sha256	0811057ab67b78ce911416e793edaeb14b3f1e105d67b8e67b6302e0eab572e4  docker-containerd-1.2.13.tar.gz
-sha256 4bbe3b885e8cd1907ab4cf9a41e862e74e24b5422297a4f2fe524e6a30ada2b4  LICENSE
+sha256	80ea55655612d7d9f9e8e10df5993a3636b088390e1a372962687d70ef265d97  docker-containerd-1.2.14.tar.gz
+sha256  4bbe3b885e8cd1907ab4cf9a41e862e74e24b5422297a4f2fe524e6a30ada2b4  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-DOCKER_CONTAINERD_VERSION = 1.2.13
+DOCKER_CONTAINERD_VERSION = 1.2.14
 DOCKER_CONTAINERD_SITE = $(call github,containerd,containerd,v$(DOCKER_CONTAINERD_VERSION))
 DOCKER_CONTAINERD_LICENSE = Apache-2.0
 DOCKER_CONTAINERD_LICENSE_FILES = LICENSE
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256	858e4e74ee0097bcbdb71d737e268dfcfd1970efa4a1600354253b02fd403e39  docker-engine-19.03.12.tar.gz
+sha256	f43331fef1d24e31f43392fc1fed72b48fc17fd432d341d6eb1f68ca11383406  docker-engine-19.03.13.tar.gz
 sha256	7c87873291f289713ac5df48b1f2010eb6963752bbd6b530416ab99fc37914a8  LICENSE
@@ -4,8 +4,8 @@
 #
 ################################################################################

-DOCKER_ENGINE_VERSION = 19.03.12
-DOCKER_ENGINE_SITE = $(call github,docker,engine,v$(DOCKER_ENGINE_VERSION))
+DOCKER_ENGINE_VERSION = 19.03.13
+DOCKER_ENGINE_SITE = $(call github,moby,moby,v$(DOCKER_ENGINE_VERSION))

 DOCKER_ENGINE_LICENSE = Apache-2.0
 DOCKER_ENGINE_LICENSE_FILES = LICENSE
@@ -13,4 +13,12 @@ DOVECOT_PIGEONHOLE_DEPENDENCIES = dovecot

 DOVECOT_PIGEONHOLE_CONF_OPTS = --with-dovecot=$(STAGING_DIR)/usr/lib

+ifeq ($(BR2_PER_PACKAGE_DIRECTORIES),y)
+define DOVECOT_PIGEONHOLE_FIXUP_DOVECOT_CONFIG
+	$(SED) 's,$(PER_PACKAGE_DIR)/dovecot/,$(PER_PACKAGE_DIR)/dovecot-pigeonhole/,g' \
+		$(STAGING_DIR)/usr/lib/dovecot-config
+endef
+DOVECOT_PIGEONHOLE_PRE_CONFIGURE_HOOKS = DOVECOT_PIGEONHOLE_FIXUP_DOVECOT_CONFIG
+endif
+
 $(eval $(autotools-package))
@@ -0,0 +1,21 @@
+dvbdate: fix compilation error with glibc 2.31
+
+as stime func doesn't exists anymore in newer versions of glibc >= 2.31 due
+to obseletion, a replacment with clock_settime is inorder to fix the issue.
+
+Signed-off-by: Dagg Stompler <daggs@gmx.com>
+
+--- a/util/dvbdate/dvbdate.c
+++ b/util/dvbdate/dvbdate.c
+@@ -309,7 +309,10 @@
+  */
+ int set_time(time_t * new_time)
+ {
+-	if (stime(new_time)) {
+	struct timespec s = {0};
+	s.tv_sec = new_time;
+
+	if (clock_settime(CLOCK_REALTIME, &s)) {
+ 		perror("Unable to set time");
+ 		return -1;
+ 	}
@@ -0,0 +1,377 @@
+From 26165906f85d82f0a4456f34b5c60fcaaef48535 Mon Sep 17 00:00:00 2001
+From: Romain Naour <romain.naour@smile.fr>
+Date: Wed, 5 Feb 2020 10:31:32 +0100
+Subject: [PATCH] elf2flt: handle binutils >= 2.34
+
+The latest Binutils release (2.34) is not compatible with elf2flt due
+to a change in bfd_section_* macros [1]. The issue has been reported
+to the Binutils mailing list but Alan Modra recommend to bundle
+libbfd library sources into each projects using it [2]. That's
+because the API is not stable over the time without any backward
+compatibility guaranties.
+
+On the other hand, the elf2flt tools needs to support modified
+version of binutils for specific arch/target [3].
+
+Add two tests in the configure script to detect this API change
+in order to support binutils < 2.34 and binutils >= 2.34.
+
+Upstream status: [4]
+
+[1] https://sourceware.org/git/?p=binutils-gdb.git;a=commitdiff;h=fd3619828e94a24a92cddec42cbc0ab33352eeb4
+[2] https://sourceware.org/ml/binutils/2020-02/msg00044.html
+[3] https://github.com/uclinux-dev/elf2flt/issues/14
+[4] https://github.com/uclinux-dev/elf2flt/pull/15
+
+Signed-off-by: Romain Naour <romain.naour@smile.fr>
+---
+ configure.ac | 16 +++++++++++
+ elf2flt.c    | 81 +++++++++++++++++++++++++++++-----------------------
+ 2 files changed, 61 insertions(+), 36 deletions(-)
+
+diff --git a/configure.ac b/configure.ac
+index e82eb1d..cf7dea8 100644
+--- a/configure.ac
+++ b/configure.ac
+@@ -229,6 +229,22 @@ AC_CHECK_FUNCS([ \
+ 	strsignal \
+ ])
+ 
+dnl Various bfd section macros and functions like bfd_section_size() have been
+dnl modified starting with binutils >= 2.34.
+dnl Check if the prototypes take a bfd argument.
+if test "$binutils_build_dir" != "NONE"; then
+    CFLAGS="-I$binutils_include_dir -I$bfd_include_dir $CFLAGS"
+fi
+
+AC_TRY_COMPILE([#include <bfd.h>],
+ [const asection *sec; bfd_section_size(sec);],
+ bfd_section_api_takes_bfd=no,
+ bfd_section_api_takes_bfd=yes)
+if test "$bfd_section_api_takes_bfd" = "yes" ; then
+  AC_DEFINE(HAVE_BFD_SECTION_API_TAKES_BFD, 1,
+   [define to 1 for binutils < 2.34])
+fi
+
+ if test "$GCC" = yes ; then
+ 	CFLAGS="-Wall $CFLAGS"
+ 	if test "$werror" = 1 ; then
+diff --git a/elf2flt.c b/elf2flt.c
+index b93aecd..3bcf4fe 100644
+--- a/elf2flt.c
+++ b/elf2flt.c
+@@ -149,6 +149,17 @@ const char *elf2flt_progname;
+ #define O_BINARY 0
+ #endif
+ 
+/*
+ * The bfd parameter isn't actually used by any of the bfd_section funcs and
+ * have been removed since binutils 2.34.
+ */
+#ifdef HAVE_BFD_SECTION_API_TAKES_BFD
+#define elf2flt_bfd_section_size(s) bfd_section_size(NULL, s)
+#define elf2flt_bfd_section_vma(s)  bfd_section_vma(NULL, s)
+#else
+#define elf2flt_bfd_section_size(s) bfd_section_size(s)
+#define elf2flt_bfd_section_vma(s)  bfd_section_vma(s)
+#endif
+ 
+ /* Extra output when running.  */
+ static int verbose = 0;
+@@ -323,10 +334,8 @@ compare_relocs (const void *pa, const void *pb)
+ 	else if (!rb->sym_ptr_ptr || !*rb->sym_ptr_ptr)
+ 		return 1;
+ 
+-	a_vma = bfd_section_vma(compare_relocs_bfd,
+-				(*(ra->sym_ptr_ptr))->section);
+-	b_vma = bfd_section_vma(compare_relocs_bfd,
+-				(*(rb->sym_ptr_ptr))->section);
+	a_vma = elf2flt_bfd_section_vma((*(ra->sym_ptr_ptr))->section);
+	b_vma = elf2flt_bfd_section_vma((*(rb->sym_ptr_ptr))->section);
+ 	va = (*(ra->sym_ptr_ptr))->value + a_vma + ra->addend;
+ 	vb = (*(rb->sym_ptr_ptr))->value + b_vma + rb->addend;
+ 	return va - vb;
+@@ -403,7 +412,7 @@ output_relocs (
+   }
+ 
+   for (a = abs_bfd->sections; (a != (asection *) NULL); a = a->next) {
+-  	section_vma = bfd_section_vma(abs_bfd, a);
+	section_vma = elf2flt_bfd_section_vma(a);
+ 
+ 	if (verbose)
+ 		printf("SECTION: %s [%p]: flags=0x%x vma=0x%"PRIx32"\n",
+@@ -442,7 +451,7 @@ output_relocs (
+ 	  continue;
+ 	if (verbose)
+ 	  printf(" RELOCS: %s [%p]: flags=0x%x vma=0x%"BFD_VMA_FMT"x\n",
+-			r->name, r, r->flags, bfd_section_vma(abs_bfd, r));
+			r->name, r, r->flags, elf2flt_bfd_section_vma(r));
+   	if ((r->flags & SEC_RELOC) == 0)
+   	  continue;
+ 	relsize = bfd_get_reloc_upper_bound(rel_bfd, r);
+@@ -694,7 +703,7 @@ output_relocs (
+ 				case R_BFIN_RIMM16:
+ 				case R_BFIN_LUIMM16:
+ 				case R_BFIN_HUIMM16:
+-				    sym_vma = bfd_section_vma(abs_bfd, sym_section);
+				    sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 				    sym_addr += sym_vma + q->addend;
+ 
+ 				    if (weak_und_symbol(sym_section->name, (*(q->sym_ptr_ptr))))
+@@ -727,7 +736,7 @@ output_relocs (
+ 				    break;
+ 
+ 				case R_BFIN_BYTE4_DATA:
+-				    sym_vma = bfd_section_vma(abs_bfd, sym_section);
+				    sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 				    sym_addr += sym_vma + q->addend;
+ 
+ 				    if (weak_und_symbol (sym_section->name, (*(q->sym_ptr_ptr))))
+@@ -885,7 +894,7 @@ output_relocs (
+ #if defined(TARGET_m68k)
+ 				case R_68K_32:
+ 					relocation_needed = 1;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_68K_PC16:
+@@ -910,7 +919,7 @@ output_relocs (
+ 							q->address, sym_addr,
+ 							(*p)->howto->rightshift,
+ 							*(uint32_t *)r_mem);
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_ARM_GOT32:
+@@ -938,7 +947,7 @@ output_relocs (
+ #ifdef TARGET_v850
+ 				case R_V850_ABS32:
+ 					relocation_needed = 1;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_V850_ZDA_16_16_OFFSET:
+@@ -960,7 +969,7 @@ output_relocs (
+ 					sym_addr = (*(q->sym_ptr_ptr))->value;
+ 					q->address -= 1;
+ 					r_mem -= 1; /* tracks q->address */
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					sym_addr |= (*(unsigned char *)r_mem<<24);
+ 					break;
+@@ -973,7 +982,7 @@ output_relocs (
+ 					/* Absolute symbol done not relocation */
+ 					relocation_needed = !bfd_is_abs_section(sym_section);
+ 					sym_addr = (*(q->sym_ptr_ptr))->value;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_H8_DIR32:
+@@ -986,7 +995,7 @@ output_relocs (
+ 					}
+ 					relocation_needed = 1;
+ 					sym_addr = (*(q->sym_ptr_ptr))->value;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_H8_PCREL16:
+@@ -1012,7 +1021,7 @@ output_relocs (
+ #ifdef TARGET_microblaze
+ 				case R_MICROBLAZE_64:
+ 					/* work out the relocation */
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					/* Write relocated pointer back */
+ 					r_mem[2] = (sym_addr >> 24) & 0xff;
+@@ -1026,7 +1035,7 @@ output_relocs (
+ 					pflags = 0x80000000;
+ 					break;
+ 				case R_MICROBLAZE_32:
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					relocation_needed = 1;
+ 					break;
+@@ -1058,7 +1067,7 @@ output_relocs (
+ 				case R_NIOS2_BFD_RELOC_32:
+ 					relocation_needed = 1;
+ 					pflags = (FLAT_NIOS2_R_32 << 28);
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					/* modify target, in target order */
+ 					*(unsigned long *)r_mem = htoniosl(sym_addr);
+@@ -1068,7 +1077,7 @@ output_relocs (
+ 					unsigned long exist_val;
+ 					relocation_needed = 1;
+ 					pflags = (FLAT_NIOS2_R_CALL26 << 28);
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					
+ 					/* modify target, in target order */
+@@ -1099,7 +1108,7 @@ output_relocs (
+ 								? FLAT_NIOS2_R_HIADJ_LO : FLAT_NIOS2_R_HI_LO;
+ 							pflags <<= 28;
+ 						
+-							sym_vma = bfd_section_vma(abs_bfd, sym_section);
+							sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 							sym_addr += sym_vma + q->addend;
+ 
+ 							/* modify high 16 bits, in target order */
+@@ -1132,7 +1141,7 @@ output_relocs (
+ 						goto NIOS2_RELOC_ERR;
+ 					}
+ 					/* _gp holds a absolute value, otherwise the ld cannot generate correct code */
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					//printf("sym=%x, %d, _gp=%x, %d\n", sym_addr+sym_vma, sym_addr+sym_vma, gp, gp);
+ 					sym_addr += sym_vma + q->addend;
+ 					sym_addr -= gp;
+@@ -1213,7 +1222,7 @@ NIOS2_RELOC_ERR:
+ 				case R_SPARC_32:
+ 				case R_SPARC_UA32:
+ 					relocation_needed = 1;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_SPARC_PC22:
+@@ -1232,7 +1241,7 @@ NIOS2_RELOC_ERR:
+ 				case R_SPARC_HI22:
+ 					relocation_needed = 1;
+ 					pflags = 0x80000000;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					sym_addr |= (
+ 						htonl(*(uint32_t *)r_mem)
+@@ -1242,7 +1251,7 @@ NIOS2_RELOC_ERR:
+ 				case R_SPARC_LO10:
+ 					relocation_needed = 1;
+ 					pflags = 0x40000000;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					sym_addr &= 0x000003ff;
+ 					sym_addr |= (
+@@ -1256,7 +1265,7 @@ NIOS2_RELOC_ERR:
+ #ifdef TARGET_sh
+ 				case R_SH_DIR32:
+ 					relocation_needed = 1;
+-					sym_vma = bfd_section_vma(abs_bfd, sym_section);
+					sym_vma = elf2flt_bfd_section_vma(sym_section);
+ 					sym_addr += sym_vma + q->addend;
+ 					break;
+ 				case R_SH_REL32:
+@@ -1288,7 +1297,7 @@ NIOS2_RELOC_ERR:
+ 				case R_E1_CONST31:
+ 						relocation_needed = 1;
+ 						DBG_E1("Handling Reloc <CONST31>\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x], q->address : [0x%x]\n",
+ 										sec_vma, sym_addr, q->address);
+ 						sym_addr = sec_vma + sym_addr;
+@@ -1303,7 +1312,7 @@ NIOS2_RELOC_ERR:
+ 						relocation_needed = 0;
+ 						DBG_E1("Handling Reloc <CONST31_PCREL>\n");
+ 						DBG_E1("DONT RELOCATE AT LOADING\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x], q->address : [0x%x]\n",
+ 										sec_vma, sym_addr, q->address);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1330,7 +1339,7 @@ NIOS2_RELOC_ERR:
+ 						relocation_needed = 0;
+ 						DBG_E1("Handling Reloc <DIS29W_PCREL>\n");
+ 						DBG_E1("DONT RELOCATE AT LOADING\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x], q->address : [0x%x]\n",
+ 										sec_vma, sym_addr, q->address);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1363,7 +1372,7 @@ NIOS2_RELOC_ERR:
+ 						DBG_E1("Handling Reloc <DIS29B>\n");
+ DIS29_RELOCATION:
+ 						relocation_needed = 1;
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%08x]\n",
+ 										sec_vma, sym_addr);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1380,7 +1389,7 @@ DIS29_RELOCATION:
+ 						relocation_needed = 0;
+ 						DBG_E1("Handling Reloc <IMM32_PCREL>\n");
+ 						DBG_E1("DONT RELOCATE AT LOADING\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x]\n",
+ 										sec_vma, sym_addr);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1406,7 +1415,7 @@ DIS29_RELOCATION:
+ 				case R_E1_IMM32:
+ 						relocation_needed = 1;
+ 						DBG_E1("Handling Reloc <IMM32>\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x]\n",
+ 										sec_vma, sym_addr);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1422,7 +1431,7 @@ DIS29_RELOCATION:
+ 				case R_E1_WORD:
+ 						relocation_needed = 1;
+ 						DBG_E1("Handling Reloc <WORD>\n");
+-						sec_vma = bfd_section_vma(abs_bfd, sym_section);
+						sec_vma = elf2flt_bfd_section_vma(sym_section);
+ 						DBG_E1("sec_vma : [0x%x], sym_addr : [0x%x]\n",
+ 										sec_vma, sym_addr);
+ 						sym_addr =  sec_vma + sym_addr;
+@@ -1449,7 +1458,7 @@ DIS29_RELOCATION:
+ 			}
+ 
+ 			sprintf(&addstr[0], "+0x%lx", sym_addr - (*(q->sym_ptr_ptr))->value -
+-					 bfd_section_vma(abs_bfd, sym_section));
+					 elf2flt_bfd_section_vma(sym_section));
+ 
+ 
+ 			/*
+@@ -1887,8 +1896,8 @@ int main(int argc, char *argv[])
+     } else
+       continue;
+ 
+-    sec_size = bfd_section_size(abs_bfd, s);
+-    sec_vma  = bfd_section_vma(abs_bfd, s);
+    sec_size = elf2flt_bfd_section_size(s);
+    sec_vma  = elf2flt_bfd_section_vma(s);
+ 
+     if (sec_vma < *vma) {
+       if (*len > 0)
+@@ -1913,7 +1922,7 @@ int main(int argc, char *argv[])
+     if (s->flags & SEC_CODE) 
+       if (!bfd_get_section_contents(abs_bfd, s,
+ 				   text + (s->vma - text_vma), 0,
+-				   bfd_section_size(abs_bfd, s)))
+				   elf2flt_bfd_section_size(s)))
+       {
+ 	fatal("read error section %s", s->name);
+       }
+@@ -1939,7 +1948,7 @@ int main(int argc, char *argv[])
+     if (s->flags & SEC_DATA) 
+       if (!bfd_get_section_contents(abs_bfd, s,
+ 				   data + (s->vma - data_vma), 0,
+-				   bfd_section_size(abs_bfd, s)))
+				   elf2flt_bfd_section_size(s)))
+       {
+ 	fatal("read error section %s", s->name);
+       }
+-- 
+2.25.4
+
@@ -11,6 +11,9 @@ ELF2FLT_LICENSE_FILES = LICENSE.TXT

 HOST_ELF2FLT_DEPENDENCIES = host-binutils host-zlib

+# 0003-elf2flt-handle-binutils-2.34.patch
+HOST_ELF2FLT_AUTORECONF = YES
+
 # It is not exactly a host variant, but more a cross variant, which is
 # why we pass a special --target option.
 HOST_ELF2FLT_CONF_OPTS = \
@@ -0,0 +1,45 @@
+From 737925113363b6130879729cdff9ccc46c33eaea Mon Sep 17 00:00:00 2001
+From: Matthias Schiffer <mschiffer@universe-factory.net>
+Date: Mon, 19 Oct 2020 21:08:16 +0200
+Subject: [PATCH] receive: fix buffer leak when receiving invalid packets
+
+For fastd versions before v20, this was just a memory leak (which could
+still be used for DoS, as it's remotely triggerable). With the new
+buffer management of fastd v20, this will trigger an assertion failure
+instead as soon as the buffer pool is empty.
+
+[Retrieved from:
+https://github.com/NeoRaider/fastd/commit/737925113363b6130879729cdff9ccc46c33eaea]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ src/receive.c | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/src/receive.c b/src/receive.c
+index 043c9f2..6bca9f4 100644
+--- a/src/receive.c
+++ b/src/receive.c
+@@ -169,6 +169,11 @@ static inline void handle_socket_receive_known(
+ 
+ 	case PACKET_HANDSHAKE:
+ 		fastd_handshake_handle(sock, local_addr, remote_addr, peer, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from %P[%I]", peer, remote_addr);
+ 	}
+ }
+ 
+@@ -195,6 +200,11 @@ static inline void handle_socket_receive_unknown(
+ 
+ 	case PACKET_HANDSHAKE:
+ 		fastd_handshake_handle(sock, local_addr, remote_addr, NULL, buffer);
+		break;
+
+	default:
+		fastd_buffer_free(buffer);
+		pr_debug("received packet with invalid type from unknown address %I", remote_addr);
+ 	}
+ }
+ 
@@ -6,7 +6,6 @@ config BR2_PACKAGE_FASTD
 	select BR2_PACKAGE_LIBUECC
 	select BR2_PACKAGE_LIBSODIUM
 	select BR2_PACKAGE_LIBSODIUM_FULL
-	select BR2_PACKAGE_LIBCAP
 	help
 	  Fast and Secure Tunneling Daemon

@@ -10,7 +10,17 @@ FASTD_SOURCE = fastd-$(FASTD_VERSION).tar.xz
 FASTD_LICENSE = BSD-2-Clause
 FASTD_LICENSE_FILES = COPYRIGHT
 FASTD_CONF_OPTS = -DENABLE_LIBSODIUM=ON
-FASTD_DEPENDENCIES = host-bison host-pkgconf libuecc libsodium libcap
+FASTD_DEPENDENCIES = host-bison host-pkgconf libuecc libsodium
+
+# 0002-receive-fix-buffer-leak-when-receiving-invalid-packets.patch
+FASTD_IGNORE_CVES += CVE-2020-27638
+
+ifeq ($(BR2_PACKAGE_LIBCAP),y)
+FASTD_CONF_OPTS += -DWITH_CAPABILITIES=ON
+FASTD_DEPENDENCIES += libcap
+else
+FASTD_CONF_OPTS += -DWITH_CAPABILITIES=OFF
+endif

 ifeq ($(BR2_PACKAGE_OPENSSL),y)
 FASTD_CONF_OPTS += -DENABLE_OPENSSL=ON
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256	40ff4ab0247b75138a0887ed40f81c1a6184f340b77126c16d074b1075b41c20	fbset-2.1.tar.gz
+sha256  40ff4ab0247b75138a0887ed40f81c1a6184f340b77126c16d074b1075b41c20  fbset-2.1.tar.gz
+sha256  c3285709a0840899a789faefae1704e87f96f757e905a38a1931a9d4fde95ddd  fbset.c
@@ -8,6 +8,7 @@ FBSET_VERSION = 2.1
 FBSET_SITE = http://users.telenet.be/geertu/Linux/fbdev
 FBSET_DEPENDENCIES = host-bison host-flex
 FBSET_LICENSE = GPL-2.0
+FBSET_LICENSE_FILES = fbset.c

 define FBSET_BUILD_CMDS
 	$(MAKE1) $(TARGET_CONFIGURE_OPTS) -C $(@D)
@@ -1,2 +1,3 @@
 # locally computed
 sha256  0e81de89fdd7ab810716fc0549e767527f342e829309dee5c2cca1e9d1728770  fbtft-274035404701245e7491c0c6471c5b72ade4d491.tar.gz
+sha256  a9ca80d65a5ef10fe614a6c1e8c8d4d3b96637e8855a96c7cf0fa438526097a7  fbtft-core.c
@@ -7,5 +7,6 @@
 FBTFT_VERSION = 274035404701245e7491c0c6471c5b72ade4d491
 FBTFT_SITE = $(call github,notro,fbtft,$(FBTFT_VERSION))
 FBTFT_LICENSE = GPL-2.0
+FBTFT_LICENSE_FILES = fbtft-core.c

 $(eval $(generic-package))
@@ -16,7 +16,7 @@ KERNEL_MODULE_IMX_GPU_VIV_MODULE_MAKE_OPTS = \

 KERNEL_MODULE_IMX_GPU_VIV_MODULE_SUBDIRS = kernel-module-imx-gpu-viv-src

-define KERNEL_MODULE_IMX_GPU_VIV_MODULE_LINUX_CONFIG_FIXUPS
+define KERNEL_MODULE_IMX_GPU_VIV_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_DISABLE_OPT,CONFIG_MXC_GPU_VIV)
 endef

@@ -1,9 +1,8 @@
-# From https://sourceforge.net/projects/freetype/files/freetype2/2.10.2/
-md5  7c0d5a39f232d7eb9f9d7da76bf08074  freetype-2.10.2.tar.xz
-sha1  b074d5c34dc0e3cc150be6e7aa6b07c9ec4ed875  freetype-2.10.2.tar.xz
+# From https://sourceforge.net/projects/freetype/files/freetype2/2.10.4/
+sha1  0181862673f7216ad2b5074f95fc131209e30b27  freetype-2.10.4.tar.xz

 # Locally calculated
-sha256  1543d61025d2e6312e0a1c563652555f17378a204a61e99928c9fcef030a2d8b  freetype-2.10.2.tar.xz
+sha256  86a854d8905b19698bbc8f23b860bc104246ce4854dcea8e3b0fb21284f75784  freetype-2.10.4.tar.xz
 sha256  fd056de4196903a676208ef58cfddafc7d583d1f28fa2e44c309cf84a59e62fb  docs/LICENSE.TXT
 sha256  08c135755dd589039470f1fdbb400daaabaaa50d0b366d19cebff4d22986baa1  docs/FTL.TXT
 sha256  c4120c6752c910c299e3bd9cb3a46ff262c268303ca2069b61f92f10a5656c18  docs/GPLv2.TXT
@@ -4,7 +4,7 @@
 #
 ################################################################################

-FREETYPE_VERSION = 2.10.2
+FREETYPE_VERSION = 2.10.4
 FREETYPE_SOURCE = freetype-$(FREETYPE_VERSION).tar.xz
 FREETYPE_SITE = http://download.savannah.gnu.org/releases/freetype
 FREETYPE_INSTALL_STAGING = YES
@@ -98,6 +98,12 @@ ifeq ($(BR2_ENABLE_DEBUG),y)
 GCC_COMMON_TARGET_CFLAGS += -Wno-error
 endif

+# Make sure libgcc & libstdc++ always get built with -matomic on ARC700
+ifeq ($(GCC_TARGET_CPU):$(BR2_ARC_ATOMIC_EXT),arc700:y)
+GCC_COMMON_TARGET_CFLAGS += -matomic
+GCC_COMMON_TARGET_CXXFLAGS += -matomic
+endif
+
 # Propagate options used for target software building to GCC target libs
 HOST_GCC_COMMON_CONF_ENV += CFLAGS_FOR_TARGET="$(GCC_COMMON_TARGET_CFLAGS)"
 HOST_GCC_COMMON_CONF_ENV += CXXFLAGS_FOR_TARGET="$(GCC_COMMON_TARGET_CXXFLAGS)"
@@ -116,7 +122,7 @@ endif
 ifeq ($(BR2_USE_WCHAR)$(BR2_TOOLCHAIN_HAS_LIBQUADMATH),yy)
 HOST_GCC_COMMON_CONF_OPTS += --enable-libquadmath
 else
-HOST_GCC_COMMON_CONF_OPTS += --disable-libquadmath
+HOST_GCC_COMMON_CONF_OPTS += --disable-libquadmath --disable-libquadmath-support
 endif

 # Disable libsanitizer due to a build issue with gcc 7.5 and glibc 2.31.
@@ -0,0 +1,55 @@
+From 41ef9a0bc36b9db7115fbe9623f989bfb47bbade Mon Sep 17 00:00:00 2001
+From: Chris Liddell <chris.liddell@artifex.com>
+Date: Tue, 20 Oct 2020 09:49:45 +0100
+Subject: [PATCH] Bug 702985: drop use of FT_CALLBACK_DEF() def
+
+From 2.10.3, Freetype disappeared the FT_CALLBACK_DEF() macro, which is what
+we used when defining our callbacks from Freetype.
+
+No guidance forthcoming from the Freetype developer who made those changes,
+so change to explicitly declaring the callbacks file static.
+
+Should fix the reported build failures.
+
+Downloaded from upstream commit:
+https://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=41ef9a0bc36b
+
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+---
+ base/fapi_ft.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/base/fapi_ft.c b/base/fapi_ft.c
+index 65fa6dcf4..21aef2f06 100644
+--- a/base/fapi_ft.c
+++ b/base/fapi_ft.c
+@@ -125,7 +125,7 @@ static void
+ delete_inc_int_info(gs_fapi_server * a_server,
+                     FT_IncrementalRec * a_inc_int_info);
+ 
+-FT_CALLBACK_DEF(void *)
+static void *
+ FF_alloc(FT_Memory memory, long size)
+ {
+     gs_memory_t *mem = (gs_memory_t *) memory->user;
+@@ -133,7 +133,7 @@ FF_alloc(FT_Memory memory, long size)
+     return (gs_malloc(mem, size, 1, "FF_alloc"));
+ }
+ 
+-FT_CALLBACK_DEF(void *)
+static void *
+     FF_realloc(FT_Memory memory, long cur_size, long new_size, void *block)
+ {
+     gs_memory_t *mem = (gs_memory_t *) memory->user;
+@@ -153,7 +153,7 @@ FT_CALLBACK_DEF(void *)
+     return (tmp);
+ }
+ 
+-FT_CALLBACK_DEF(void)
+static void
+     FF_free(FT_Memory memory, void *block)
+ {
+     gs_memory_t *mem = (gs_memory_t *) memory->user;
+-- 
+2.17.1
+
@@ -70,5 +70,13 @@ HOST_GRPC_CONF_OPTS = \
 	-DgRPC_ZLIB_PROVIDER=package \
 	-DgRPC_ABSL_PROVIDER=package

+# With gcc 4.8 (at least on ubuntu) there is a bug in LTO which breaks
+# the linkage of the grpc_cpp_plugin with libprotobuf and pthread. This
+# additional flag fixes this.
+ifeq ($(BR2_HOST_GCC_AT_LEAST_4_9),)
+HOST_GRPC_CONF_OPTS += \
+	-DCMAKE_EXE_LINKER_FLAGS="$(HOST_LDFLAGS) -Wl,--no-as-needed"
+endif
+
 $(eval $(cmake-package))
 $(eval $(host-cmake-package))
@@ -88,7 +88,7 @@ config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_DEBUGUTILS
 	  debugging

 config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_DVBSUBOVERLAY
-	bool "dvdsuboverlay"
+	bool "dvbsuboverlay"
 	help
 	  DVB subtitle renderer plugin

@@ -306,8 +306,16 @@ comment "plugins with external dependencies"

 config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_ASSRENDER
 	bool "assrender"
+	depends on BR2_INSTALL_LIBSTDCPP # libass -> harfbuzz
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4 # libass -> harfbuzz
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # libass -> harfbuzz
 	select BR2_PACKAGE_LIBASS

+comment "assrender plugin needs a toolchain w/ C++, gcc => 4.8"
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4
+	depends on !BR2_INSTALL_LIBSTDCPP || \
+		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_8
+
 config BR2_PACKAGE_GST1_PLUGINS_BAD_PLUGIN_BLUEZ
 	bool "bluez"
 	depends on BR2_USE_WCHAR # bluez5_utils -> libglib2
@@ -11,7 +11,7 @@ config BR2_PACKAGE_HARFBUZZ
 	  Harfbuzz can make optional use of cairo, freetype,
 	  glib2 and icu packages if they are selected.

-comment "harfbuzz needs a toolchain w/ C++, gcc => 4.8"
+comment "harfbuzz needs a toolchain w/ C++, gcc >= 4.8"
 	depends on BR2_TOOLCHAIN_HAS_SYNC_4
 	depends on !BR2_INSTALL_LIBSTDCPP || \
 		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_8
@@ -1,3 +1,3 @@
 # Locally computed
-sha256  8593c1d69e703563d94d8c12244e2e18893eeb9a8a9f8aa3d09a327aa45c8f7d  jsoncpp-1.9.3.tar.gz
+sha256  e34a628a8142643b976c7233ef381457efad79468c67cb1ae0b83a33d7493999  jsoncpp-1.9.4.tar.gz
 sha256  95039d77a20e75b428207740d9a8f97b2dce3c89da4b21f1ad862b5997160e0a  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-JSONCPP_VERSION = 1.9.3
+JSONCPP_VERSION = 1.9.4
 JSONCPP_SITE = $(call github,open-source-parsers,jsoncpp,$(JSONCPP_VERSION))
 JSONCPP_LICENSE = Public Domain or MIT
 JSONCPP_LICENSE_FILES = LICENSE
@@ -2,7 +2,6 @@ config BR2_PACKAGE_KEEPALIVED
 	bool "keepalived"
 	depends on BR2_USE_MMU
 	depends on !BR2_STATIC_LIBS # uses libdl
-	depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_4
 	select BR2_PACKAGE_OPENSSL
 	help
 	  The main goal of the keepalived project is to add a strong &
@@ -15,6 +14,6 @@ config BR2_PACKAGE_KEEPALIVED

 	  http://www.keepalived.org/

-comment "keepalived needs a toolchain w/ dynamic library, headers >= 3.4"
+comment "keepalived needs a toolchain w/ dynamic library"
 	depends on BR2_USE_MMU
-	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_4
+	depends on BR2_STATIC_LIBS
@@ -1,2 +1,3 @@
 # Locally computed
 sha256  ec135069d8bee7f4fe38cb9dc96fbbd56e0057290fa25eff8b5b314ee473c502  kmscube-4660a7dca6512b6e658759d00cff7d4ad2a2059d.tar.gz
+sha256  f622099ab0d274133f6e62d5fccfe970b61134d80ed036f45f8cf1e90c3d5a05  COPYING
@@ -7,6 +7,7 @@
 KMSCUBE_VERSION = 4660a7dca6512b6e658759d00cff7d4ad2a2059d
 KMSCUBE_SITE = https://gitlab.freedesktop.org/mesa/kmscube/-/archive/$(KMSCUBE_VERSION)
 KMSCUBE_LICENSE = MIT
+KMSCUBE_LICENSE_FILES = COPYING
 KMSCUBE_DEPENDENCIES = host-pkgconf mesa3d libdrm

 $(eval $(meson-package))
@@ -7,6 +7,7 @@ config BR2_PACKAGE_KODI_ARCH_SUPPORTS

 comment "kodi needs python w/ .py modules, a uClibc or glibc toolchain w/ C++, threads, wchar, dynamic library, gcc >= 4.8"
 	depends on BR2_PACKAGE_KODI_ARCH_SUPPORTS
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4
 	depends on !BR2_INSTALL_LIBSTDCPP || !BR2_TOOLCHAIN_HAS_THREADS \
 		|| !BR2_USE_WCHAR || BR2_STATIC_LIBS \
 		|| !BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 \
@@ -61,6 +62,7 @@ comment "kodi needs an OpenGL EGL backend with OpenGL support"
 menuconfig BR2_PACKAGE_KODI
 	bool "kodi"
 	depends on BR2_INSTALL_LIBSTDCPP
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4 # libass -> harfbuzz
 	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8
 	depends on BR2_TOOLCHAIN_HAS_THREADS
 	depends on !BR2_TOOLCHAIN_USES_MUSL
@@ -1,9 +1,18 @@
 config BR2_PACKAGE_LIBASS
 	bool "libass"
+	depends on BR2_INSTALL_LIBSTDCPP # harfbuzz
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4 # harfbuzz
+	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # harfbuzz
 	select BR2_PACKAGE_FREETYPE
+	select BR2_PACKAGE_HARFBUZZ
 	select BR2_PACKAGE_LIBFRIBIDI
 	help
 	  libass is a portable subtitle renderer for the ASS/SSA
 	  (Advanced Substation Alpha/Substation Alpha) subtitle format

 	  https://github.com/libass/libass
+
+comment "libass needs a toolchain w/ C++, gcc >= 4.8"
+	depends on BR2_TOOLCHAIN_HAS_SYNC_4
+	depends on !BR2_INSTALL_LIBSTDCPP || \
+		!BR2_TOOLCHAIN_GCC_AT_LEAST_4_8
@@ -1,3 +1,3 @@
 # Locally computed
-sha256 881f2382af48aead75b7a0e02e65d88c5ebd369fe46bc77d9270a94aa8fd38a2  libass-0.14.0.tar.xz
-sha256 f7e30699d02798351e7f839e3d3bfeb29ce65e44efa7735c225464c4fd7dfe9c  COPYING
+sha256  9f09230c9a0aa68ef7aa6a9e2ab709ca957020f842e52c5b2e52b801a7d9e833  libass-0.15.0.tar.xz
+sha256  f7e30699d02798351e7f839e3d3bfeb29ce65e44efa7735c225464c4fd7dfe9c  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBASS_VERSION = 0.14.0
+LIBASS_VERSION = 0.15.0
 LIBASS_SOURCE = libass-$(LIBASS_VERSION).tar.xz
 # Do not use the github helper here, the generated tarball is *NOT*
 # the same as the one uploaded by upstream for the release.
@@ -15,6 +15,7 @@ LIBASS_LICENSE_FILES = COPYING
 LIBASS_DEPENDENCIES = \
 	host-pkgconf \
 	freetype \
+	harfbuzz \
 	libfribidi \
 	$(if $(BR2_PACKAGE_LIBICONV),libiconv)

@@ -31,11 +32,4 @@ else
 LIBASS_CONF_OPTS += --disable-fontconfig --disable-require-system-font-provider
 endif

-ifeq ($(BR2_PACKAGE_HARFBUZZ),y)
-LIBASS_DEPENDENCIES += harfbuzz
-LIBASS_CONF_OPTS += --enable-harfbuzz
-else
-LIBASS_CONF_OPTS += --disable-harfbuzz
-endif
-
 $(eval $(autotools-package))
@@ -0,0 +1,63 @@
+From ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c Mon Sep 17 00:00:00 2001
+From: Marcus Meissner <marcus@jet.franken.de>
+Date: Mon, 8 Jun 2020 17:27:06 +0200
+Subject: [PATCH] fixed another unsigned integer overflow
+
+first fixed by google in android fork,
+https://android.googlesource.com/platform/external/libexif/+/1e187b62682ffab5003c702657d6d725b4278f16%5E%21/#F0
+
+(use a more generic overflow check method, also check second overflow instance.)
+
+https://security-tracker.debian.org/tracker/CVE-2020-0198
+
+Downloaded from upstream commit:
+https://github.com/libexif/libexif/commit/ce03ad7ef4e8aeefce79192bf5b6f69fae396f0c
+
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+---
+ libexif/exif-data.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+diff --git a/libexif/exif-data.c b/libexif/exif-data.c
+index 8b280d3..b495726 100644
+--- a/libexif/exif-data.c
+++ b/libexif/exif-data.c
+@@ -47,6 +47,8 @@
+ #undef JPEG_MARKER_APP1
+ #define JPEG_MARKER_APP1 0xe1
+ 
+#define CHECKOVERFLOW(offset,datasize,structsize) (( offset >= datasize) || (structsize > datasize) || (offset > datasize - structsize ))
+
+ static const unsigned char ExifHeader[] = {0x45, 0x78, 0x69, 0x66, 0x00, 0x00};
+ 
+ struct _ExifDataPrivate
+@@ -327,7 +329,7 @@ exif_data_load_data_thumbnail (ExifData *data, const unsigned char *d,
+ 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail offset (%u).", o);
+ 		return;
+ 	}
+-	if (s > ds - o) {
+	if (CHECKOVERFLOW(o,ds,s)) {
+ 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData", "Bogus thumbnail size (%u), max would be %u.", s, ds-o);
+ 		return;
+ 	}
+@@ -420,9 +422,9 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd,
+ 	}
+ 
+ 	/* Read the number of entries */
+-	if ((offset + 2 < offset) || (offset + 2 < 2) || (offset + 2 > ds)) {
+	if (CHECKOVERFLOW(offset, ds, 2)) {
+ 		exif_log (data->priv->log, EXIF_LOG_CODE_CORRUPT_DATA, "ExifData",
+-			  "Tag data past end of buffer (%u > %u)", offset+2, ds);
+			  "Tag data past end of buffer (%u+2 > %u)", offset, ds);
+ 		return;
+ 	}
+ 	n = exif_get_short (d + offset, data->priv->order);
+@@ -431,7 +433,7 @@ exif_data_load_data_content (ExifData *data, ExifIfd ifd,
+ 	offset += 2;
+ 
+ 	/* Check if we have enough data. */
+-	if (offset + 12 * n > ds) {
+	if (CHECKOVERFLOW(offset, ds, 12*n)) {
+ 		n = (ds - offset) / 12;
+ 		exif_log (data->priv->log, EXIF_LOG_CODE_DEBUG, "ExifData",
+ 				  "Short data; only loading %hu entries...", n);
@@ -0,0 +1,36 @@
+From 9266d14b5ca4e29b970fa03272318e5f99386e06 Mon Sep 17 00:00:00 2001
+From: Marcus Meissner <marcus@jet.franken.de>
+Date: Thu, 5 Nov 2020 09:50:08 +0100
+Subject: [PATCH] fixed a incorrect overflow check that could be optimized
+ away.
+
+inspired by:
+https://android.googlesource.com/platform/external/libexif/+/8e7345f3bc0bad06ac369d6cbc1124c8ceaf7d4b
+
+https://source.android.com/security/bulletin/2020-11-01
+
+CVE-2020-0452
+
+Downloaded from upstream commit, rebased for 0.6.22:
+https://github.com/libexif/libexif/commit/9266d14b5ca4e29b970fa03272318e5f99386e06
+
+Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
+---
+ libexif/exif-entry.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/libexif/exif-entry.c b/libexif/exif-entry.c
+index 3fc0ff9..4b866ce 100644
+--- a/libexif/exif-entry.c
+++ b/libexif/exif-entry.c
+@@ -1371,8 +1371,8 @@ exif_entry_get_value (ExifEntry *e, char *val, unsigned int maxlen)
+ 	{
+ 		unsigned char *utf16;
+ 
+-		/* Sanity check the size to prevent overflow */
+-		if (e->size+sizeof(uint16_t)+1 < e->size) break;
+		/* Sanity check the size to prevent overflow. Note EXIF files are 64kb at most. */
+		if (e->size >= 65536 - sizeof(uint16_t)*2) break;
+ 
+ 		/* The tag may not be U+0000-terminated , so make a local
+ 		   U+0000-terminated copy before converting it */
@@ -12,5 +12,9 @@ LIBEXIF_INSTALL_STAGING = YES
 LIBEXIF_DEPENDENCIES = host-pkgconf
 LIBEXIF_LICENSE = LGPL-2.1+
 LIBEXIF_LICENSE_FILES = COPYING
+# 0001-fixed-another-unsigned-integer-overflow.patch
+LIBEXIF_IGNORE_CVES += CVE-2020-0198
+# 0002-fixed-a-incorrect-overflow-check.patch
+LIBEXIF_IGNORE_CVES += CVE-2020-0452

 $(eval $(autotools-package))
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256 8111031dd9dd6093a1927eb32dd7476fe22cfee9190043aa8e4c88003c104b16  libiqrf-0.1.2.tar.gz
+sha256  8111031dd9dd6093a1927eb32dd7476fe22cfee9190043aa8e4c88003c104b16  libiqrf-0.1.2.tar.gz
+sha256  11e0700d7c23604d86fa1e7c54c7caa778d79eeb0035be8f80b5a552224ef015  src/iqrf.c
@@ -9,5 +9,6 @@ LIBIQRF_SITE = $(call github,nandra,libiqrf,v$(LIBIQRF_VERSION))
 LIBIQRF_INSTALL_STAGING = YES
 LIBIQRF_DEPENDENCIES = libusb
 LIBIQRF_LICENSE = LGPL-2.1+
+LIBIQRF_LICENSE_FILES = src/iqrf.c

 $(eval $(cmake-package))
@@ -0,0 +1,38 @@
+From 93bbd7e56cefc8488a61892b3bf5df63a175d20d Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Sun, 12 Apr 2020 14:05:15 +0200
+Subject: [PATCH] libnetfilter_conntrack.pc.in: add LIBMNL_LIBS to Libs.Private
+
+Since version 1.0.8 and commit
+c1c0f16c1fedb46547c2e104beeaaeac5933b214, libnetfilter_conntrack depends
+on libmnl so add it to Libs.Private.
+
+Otherwise, applications such as dnsmasq will fail to link on:
+
+/home/buildroot/autobuild/instance-0/output-1/host/bin/arm-linux-gcc -Wl,-elf2flt -static -o dnsmasq cache.o rfc1035.o util.o option.o forward.o network.o dnsmasq.o dhcp.o lease.o rfc2131.o netlink.o dbus.o bpf.o helper.o tftp.o log.o conntrack.o dhcp6.o rfc3315.o dhcp-common.o outpacket.o radv.o slaac.o auth.o ipset.o domain.o dnssec.o blockdata.o tables.o loop.o inotify.o poll.o rrfilter.o edns0.o arp.o crypto.o dump.o ubus.o metrics.o -L/home/buildroot/autobuild/instance-0/output-1/host/bin/../arm-buildroot-uclinux-uclibcgnueabi/sysroot/usr/lib -lnetfilter_conntrack -L/home/buildroot/autobuild/instance-0/output-1/host/bin/../arm-buildroot-uclinux-uclibcgnueabi/sysroot/usr/lib -lnfnetlink
+/home/buildroot/autobuild/instance-0/output-1/host/opt/ext-toolchain/arm-buildroot-uclinux-uclibcgnueabi/bin/ld.real: /home/buildroot/autobuild/instance-0/output-1/host/bin/../arm-buildroot-uclinux-uclibcgnueabi/sysroot/usr/lib/libnetfilter_conntrack.a(api.o): in function `nfct_fill_hdr.constprop.4':
+api.c:(.text+0x34): undefined reference to `mnl_nlmsg_put_header'
+
+Fixes:
+ - http://autobuild.buildroot.org/results/3fdc2cba20162eb86eaa5c49a056fb40fb18a392
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Upstream status: commit e94172f09e4d]
+---
+ libnetfilter_conntrack.pc.in | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/libnetfilter_conntrack.pc.in b/libnetfilter_conntrack.pc.in
+index 857f993..fbd7132 100644
+--- a/libnetfilter_conntrack.pc.in
+++ b/libnetfilter_conntrack.pc.in
+@@ -12,5 +12,5 @@ Version: @VERSION@
+ Requires: libnfnetlink
+ Conflicts:
+ Libs: -L${libdir} -lnetfilter_conntrack
+-Libs.private: @LIBNFNETLINK_LIBS@
+Libs.private: @LIBNFNETLINK_LIBS@ @LIBMNL_LIBS@
+ Cflags: -I${includedir}
+-- 
+2.25.1
+
@@ -0,0 +1,146 @@
+From c9bed7496e81e550ee22746f23bbb11be2e046ed Mon Sep 17 00:00:00 2001
+From: Duncan Eastoe <duncan.eastoe@att.com>
+Date: Thu, 22 Oct 2020 19:18:27 +0100
+Subject: [PATCH] magic.c: check for failure of RAND_[pseudo_]bytes
+
+When magic() is implemented via libcrypto's RAND_bytes or
+RAND_pseudo_bytes we should check for a failure and abort to
+ensure we don't use a predictable session_id.
+
+This prevents (further) weakening* of the TACACS+ protocol
+"encryption" since session_id is an input to the algorithm.
+
+*by modern standards TACACS+ is deemed "obfuscated" - RFC 8907.
+
+[Retrieved from:
+https://github.com/kravietz/pam_tacplus/commit/468cc9d484364ecdc8bb245805f5c1fcb415fec9]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ libtac/lib/magic.c | 26 +++++++++++++++++++++-----
+ pam_tacplus.c      |  6 ++++++
+ 2 files changed, 27 insertions(+), 5 deletions(-)
+
+diff --git a/libtac/lib/magic.c b/libtac/lib/magic.c
+index e13a483..ae6b44f 100644
+--- a/libtac/lib/magic.c
+++ b/libtac/lib/magic.c
+@@ -81,26 +81,42 @@ magic()
+ 
+ #elif defined(HAVE_OPENSSL_RAND_H) && defined(HAVE_LIBCRYPTO)
+ 
+#include <openssl/err.h>
+ #include <openssl/rand.h>
+ 
+ /* RAND_bytes is OpenSSL's classic function to obtain cryptographic strength pseudo-random bytes
+-   however, since the magic() function is used to generate TACACS+ session id rather than crypto keys
+-   we can use RAND_pseudo_bytes() which doesn't deplete the system's entropy pool
+   however, we can use RAND_pseudo_bytes() which doesn't deplete the system's entropy pool, so long
+   as it returns a "cryptographically strong" result - since session_id is an input to the TACACS+
+   "encryption" ("obfuscation" by modern standards - RFC 8907) algorithm.
+    */
+ 
+ u_int32_t
+ magic()
+ {
+     u_int32_t num;
+    int ret;
+ 
+ #ifdef HAVE_RAND_BYTES
+-    RAND_bytes((unsigned char *)&num, sizeof(num));
+    ret = RAND_bytes((unsigned char *)&num, sizeof(num));
+ #elif HAVE_RAND_PSEUDO_BYTES
+-    RAND_pseudo_bytes((unsigned char *)&num, sizeof(num));
+    ret = RAND_pseudo_bytes((unsigned char *)&num, sizeof(num));
+ #else
+ 	#error Neither  RAND_bytes nor RAND_pseudo_bytes seems to be available
+ #endif
+-    return num;
+
+    /* RAND_bytes success / RAND_pseudo_bytes "cryptographically strong" result */
+    if (ret == 1)
+        return num;
+
+    TACSYSLOG(LOG_CRIT,"%s: "
+#ifdef HAVE_RAND_BYTES
+                       "RAND_bytes "
+#else
+                       "RAND_pseudo_bytes "
+#endif
+                       "failed; ret: %d err: %ld", __FUNCTION__, ret, ERR_get_error());
+
+    exit(1);
+ }
+ 
+ #else
+diff --git a/pam_tacplus.c b/pam_tacplus.c
+index a0cb83d..4999ca9 100644
+--- a/pam_tacplus.c
+++ b/pam_tacplus.c
+@@ -718,6 +718,12 @@ int pam_sm_acct_mgmt(pam_handle_t *pamh, int UNUSED(flags), int argc,
+ PAM_EXTERN
+ int pam_sm_open_session(pam_handle_t *pamh, int UNUSED(flags), int argc,
+                         const char **argv) {
+
+/* Task ID has no need to be cryptographically strong so we don't
+ * check for failures of the RAND functions. If they fail then we are
+ * as well sending the accounting request regardless of whether any value
+ * was written to task_id.
+ */
+ #if defined(HAVE_OPENSSL_RAND_H) && defined(HAVE_LIBCRYPTO)
+ # if defined(HAVE_RAND_BYTES)
+ 	RAND_bytes((unsigned char *) &task_id, sizeof(task_id));
+
+From bceaab0cd51a09b88f40f19da799ac7390264bf8 Mon Sep 17 00:00:00 2001
+From: Duncan Eastoe <duncan.eastoe@att.com>
+Date: Fri, 23 Oct 2020 11:23:07 +0100
+Subject: [PATCH 2/2] pam_tacplus.c: Fallback to using PID as task ID
+
+If there is a failure obtaining a random task ID for the session
+accounting request then fallback to using the PID, as this is unique
+for the lifetime of the PAM application and therefore session.
+---
+ pam_tacplus.c | 16 ++++++++++++----
+ 1 file changed, 12 insertions(+), 4 deletions(-)
+
+diff --git a/pam_tacplus.c b/pam_tacplus.c
+index 4999ca9..b69e3d0 100644
+--- a/pam_tacplus.c
+++ b/pam_tacplus.c
+@@ -100,8 +100,13 @@ int _pam_send_account(int tac_fd, int type, const char *user, char *tty,
+ 	} else if (type == TAC_PLUS_ACCT_FLAG_STOP) {
+ 		tac_add_attrib(&attr, "stop_time", buf);
+ 	}
+-	sprintf(buf, "%hu", task_id);
+
+	if (task_id == 0)
+		snprintf(buf, sizeof(buf), "%d", getpid());
+	else
+		snprintf(buf, sizeof(buf), "%hu", task_id);
+ 	tac_add_attrib(&attr, "task_id", buf);
+
+ 	tac_add_attrib(&attr, "service", tac_service);
+ 	if (tac_protocol[0] != '\0')
+ 		tac_add_attrib(&attr, "protocol", tac_protocol);
+@@ -720,9 +725,8 @@ int pam_sm_open_session(pam_handle_t *pamh, int UNUSED(flags), int argc,
+                         const char **argv) {
+ 
+ /* Task ID has no need to be cryptographically strong so we don't
+- * check for failures of the RAND functions. If they fail then we are
+- * as well sending the accounting request regardless of whether any value
+- * was written to task_id.
+ * check for failures of the RAND functions. If we fail to get an ID we
+ * fallback to using our PID (in _pam_send_account).
+  */
+ #if defined(HAVE_OPENSSL_RAND_H) && defined(HAVE_LIBCRYPTO)
+ # if defined(HAVE_RAND_BYTES)
+@@ -734,6 +738,10 @@ int pam_sm_open_session(pam_handle_t *pamh, int UNUSED(flags), int argc,
+ 	task_id=(short int) magic();
+ #endif
+ 
+	if (task_id == 0)
+		syslog(LOG_INFO, "%s: failed to generate random task ID, "
+				"falling back to PID", __FUNCTION__);
+
+ 	return _pam_account(pamh, argc, argv, TAC_PLUS_ACCT_FLAG_START, NULL);
+ } /* pam_sm_open_session */
+ 
@@ -17,4 +17,7 @@ LIBPAM_TACPLUS_INSTALL_STAGING = YES
 LIBPAM_TACPLUS_CONF_ENV = \
 	ax_cv_check_cflags___fstack_protector_all=$(if $(BR2_TOOLCHAIN_HAS_SSP),yes,no)

+# 0005-Check-for-failure-of-OpenSSL-RAND_pseudo_bytes.patch
+LIBPAM_TACPLUS_IGNORE_CVES += CVE-2020-27743
+
 $(eval $(autotools-package))
@@ -1,5 +1,5 @@
 # Locally calculated
-sha256  1f0a383da2ce9f409087facd28261decbf6be72cc90c78cd003b0766e4d694a3  LibRaw-0.20.0.tar.gz
+sha256  dc1b486c2003435733043e4e05273477326e51c3ea554c6864a4eafaff1004a6  LibRaw-0.20.2.tar.gz
 sha256  eea173a556abac0370461e57e12aab266894ea6be3874c2be05fd87871f75449  LICENSE.LGPL
 sha256  0e3098d2d54a12434715f6679ea408d57da5e8d613c385c58ecc6fe5d30cc81f  LICENSE.CDDL
 sha256  313415f7f48f6cd3cc78856626aab4bbe97dbb1e9a11db9c25396ca8d0e76cd9  README.md
@@ -4,7 +4,7 @@
 #
 ################################################################################

-LIBRAW_VERSION = 0.20.0
+LIBRAW_VERSION = 0.20.2
 LIBRAW_SOURCE = LibRaw-$(LIBRAW_VERSION).tar.gz
 LIBRAW_SITE = http://www.libraw.org/data
 LIBRAW_INSTALL_STAGING = YES
@@ -14,6 +14,8 @@ LIBRAW_CONF_OPTS += \
 LIBRAW_LICENSE = LGPL-2.1 or CDDL-1.0
 LIBRAW_LICENSE_FILES = LICENSE.LGPL LICENSE.CDDL README.md
 LIBRAW_DEPENDENCIES = host-pkgconf
+# https://github.com/LibRaw/LibRaw/issues/353
+LIBRAW_AUTORECONF = YES
 LIBRAW_CXXFLAGS = $(TARGET_CXXFLAGS)
 LIBRAW_CONF_ENV = CXXFLAGS="$(LIBRAW_CXXFLAGS)"

@@ -11,6 +11,14 @@ LINUX_BACKPORTS_SITE = $(BR2_KERNEL_MIRROR)/linux/kernel/projects/backports/stab
 LINUX_BACKPORTS_LICENSE = GPL-2.0
 LINUX_BACKPORTS_LICENSE_FILES = COPYING

+# flex and bison are needed to generate kconfig parser. We use the
+# same logic as the linux kernel (we add host dependencies only if
+# host does not have them). See linux/linux.mk and
+# support/dependencies/check-host-bison-flex.mk.
+LINUX_BACKPORTS_DEPENDENCIES = \
+	$(BR2_BISON_HOST_DEPENDENCY) \
+	$(BR2_FLEX_HOST_DEPENDENCY)
+
 ifeq ($(BR2_PACKAGE_LINUX_BACKPORTS_USE_DEFCONFIG),y)
 LINUX_BACKPORTS_KCONFIG_FILE = $(LINUX_BACKPORTS_DIR)/defconfigs/$(call qstrip,$(BR2_PACKAGE_LINUX_BACKPORTS_DEFCONFIG))
 else ifeq ($(BR2_PACKAGE_LINUX_BACKPORTS_USE_CUSTOM_CONFIG),y)
@@ -33,6 +41,8 @@ LINUX_BACKPORTS_KCONFIG_OPTS = $(LINUX_BACKPORTS_MAKE_OPTS)
 # LINUX_BACKPORTS_MODULE_MAKE_OPTS is used by the kernel-module infra.
 #
 LINUX_BACKPORTS_MAKE_OPTS = \
+	LEX=flex \
+	YACC=bison \
 	BACKPORT_DIR=$(@D) \
 	KLIB_BUILD=$(LINUX_DIR) \
 	KLIB=$(TARGET_DIR)/lib/modules/$(LINUX_VERSION_PROBED) \
@@ -75,21 +85,24 @@ $(eval $(kconfig-package))
 # not have been parsed yet, so the Linux build dir LINUX_DIR is not yet
 # known. Thus, we use a "secondary expansion" so the rule is re-evaluated
 # after all Makefiles are parsed, and thus at that time we will have the
-# LINUX_DIR variable set to the proper value.
+# LINUX_DIR variable set to the proper value. Moreover, since linux-4.19,
+# the kernel's build system internally touches its .config file, so we
+# can't use it as a stamp file. We use the LINUX_KCONFIG_STAMP_DOTCONFIG
+# instead.
 #
 # Furthermore, we want to check the kernel version, since linux-backports
 # only supports kernels >= 3.0. To avoid overriding linux-backports'
-# .config rule defined in the kconfig-package infra, we use an
-# intermediate stamp-file.
+# KCONFIG_STAMP_DOTCONFIG rule defined in the kconfig-package infra, we
+# use an intermediate stamp-file.
 #
 # Finally, it must also come after the call to kconfig-package, so we get
 # LINUX_BACKPORTS_DIR properly defined (because the target part of the
 # rule is not re-evaluated).
 #
-$(LINUX_BACKPORTS_DIR)/.config: $(LINUX_BACKPORTS_DIR)/.stamp_check_kernel_version
+$(LINUX_BACKPORTS_DIR)/$(LINUX_BACKPORTS_KCONFIG_STAMP_DOTCONFIG): $(LINUX_BACKPORTS_DIR)/.stamp_check_kernel_version

 .SECONDEXPANSION:
-$(LINUX_BACKPORTS_DIR)/.stamp_check_kernel_version: $$(LINUX_DIR)/.config
+$(LINUX_BACKPORTS_DIR)/.stamp_check_kernel_version: $$(LINUX_DIR)/$$(LINUX_KCONFIG_STAMP_DOTCONFIG)
 	$(Q)LINUX_VERSION_PROBED=$(LINUX_VERSION_PROBED); \
 	if [ $${LINUX_VERSION_PROBED%%.*} -lt 3 ]; then \
 		printf "Linux version '%s' is too old for linux-backports (needs 3.0 or later)\n" \
@@ -542,7 +542,10 @@ LINUX_FIRMWARE_FILES += \
 	brcm/brcmfmac43362-sdio.bin brcm/brcmfmac43430-sdio.bin \
 	brcm/brcmfmac43430a0-sdio.bin brcm/brcmfmac43455-sdio.bin \
 	brcm/brcmfmac43569.bin brcm/brcmfmac43570-pcie.bin \
-	brcm/brcmfmac43602-pcie.ap.bin brcm/brcmfmac43602-pcie.bin
+	brcm/brcmfmac43602-pcie.ap.bin brcm/brcmfmac43602-pcie.bin \
+	brcm/brcmfmac43430-sdio.raspberrypi,3-model-b.txt \
+	brcm/brcmfmac43455-sdio.raspberrypi,3-model-b-plus.txt \
+	brcm/brcmfmac43455-sdio.raspberrypi,4-model-b.txt
 LINUX_FIRMWARE_ALL_LICENSE_FILES += LICENCE.broadcom_bcm43xx
 endif

@@ -334,11 +334,11 @@ endchoice

 config BR2_DEFAULT_KERNEL_HEADERS
 	string
-	default "4.4.238"	if BR2_KERNEL_HEADERS_4_4
-	default "4.9.238"	if BR2_KERNEL_HEADERS_4_9
-	default "4.14.200"	if BR2_KERNEL_HEADERS_4_14
-	default "4.19.150"	if BR2_KERNEL_HEADERS_4_19
-	default "5.4.70"	if BR2_KERNEL_HEADERS_5_4
+	default "4.4.243"	if BR2_KERNEL_HEADERS_4_4
+	default "4.9.243"	if BR2_KERNEL_HEADERS_4_9
+	default "4.14.206"	if BR2_KERNEL_HEADERS_4_14
+	default "4.19.157"	if BR2_KERNEL_HEADERS_4_19
+	default "5.4.77"	if BR2_KERNEL_HEADERS_5_4
 	default "5.7.19"	if BR2_KERNEL_HEADERS_5_7
 	default BR2_DEFAULT_KERNEL_VERSION if BR2_KERNEL_HEADERS_VERSION
 	default "custom"	if BR2_KERNEL_HEADERS_CUSTOM_TARBALL
@@ -1,2 +1,3 @@
 # Locally calculated
-sha256 cbb0cac5825e940b4ea2f31a336d2aaf6db39847d456920afd8e443804420dbb lzlib-0.4.3.tar.gz
+sha256  cbb0cac5825e940b4ea2f31a336d2aaf6db39847d456920afd8e443804420dbb  lzlib-0.4.3.tar.gz
+sha256  f817d4a37077e94e9adf379f46ba5cc0b68775d7add2bbd5b2ca68ba140ad5bb  lzlib.c
@@ -8,6 +8,7 @@ LZLIB_VERSION = 0.4.3
 LZLIB_SITE = $(call github,LuaDist,lzlib,$(LZLIB_VERSION))
 LZLIB_DEPENDENCIES = lua zlib
 LZLIB_LICENSE = MIT
+LZLIB_LICENSE_FILES = lzlib.c
 LZLIB_CONF_OPTS = -DINSTALL_CMOD="/usr/lib/lua/$(LUAINTERPRETER_ABIVER)" \
 	-DINSTALL_LMOD="/usr/share/lua/$(LUAINTERPRETER_ABIVER)"

@@ -0,0 +1,99 @@
+From a5ca35b044bbf13c0b16f0066bf24646604bb218 Mon Sep 17 00:00:00 2001
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+Date: Thu, 6 Aug 2020 15:22:04 +0200
+Subject: [PATCH] Static cast to unsigned int for cases
+
+Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+[Retrieved from:
+https://gitweb.gentoo.org/repo/gentoo.git/tree/media-libs/libmp4v2/files/libmp4v2-2.0.0-unsigned-int-cast.patch]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ libutil/Utility.cpp  | 2 +-
+ util/mp4art.cpp      | 2 +-
+ util/mp4chaps.cpp    | 2 +-
+ util/mp4file.cpp     | 2 +-
+ util/mp4subtitle.cpp | 2 +-
+ util/mp4track.cpp    | 2 +-
+ 6 files changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/libutil/Utility.cpp b/libutil/Utility.cpp
+index 76cdd12..d6739d4 100644
+--- a/libutil/Utility.cpp
+++ b/libutil/Utility.cpp
+@@ -493,7 +493,7 @@ Utility::process_impl()
+         if( codes.find( code ) == codes.end() )
+             continue;
+ 
+-        switch( code ) {
+        switch( static_cast<unsigned int>( code ) ) {
+             case 'z':
+                 _optimize = true;
+                 break;
+diff --git a/util/mp4art.cpp b/util/mp4art.cpp
+index add935e..6e7f531 100644
+--- a/util/mp4art.cpp
+++ b/util/mp4art.cpp
+@@ -376,7 +376,7 @@ ArtUtility::utility_option( int code, bool& handled )
+ {
+     handled = true;
+ 
+-    switch( code ) {
+    switch( static_cast<unsigned int> ( code ) ) {
+         case LC_ART_ANY:
+             _artFilter = numeric_limits<uint32_t>::max();
+             break;
+diff --git a/util/mp4chaps.cpp b/util/mp4chaps.cpp
+index 98400f8..ccc8b70 100644
+--- a/util/mp4chaps.cpp
+++ b/util/mp4chaps.cpp
+@@ -632,7 +632,7 @@ ChapterUtility::utility_option( int code, bool& handled )
+ {
+     handled = true;
+ 
+-    switch( code ) {
+    switch( static_cast<unsigned int> ( code ) ) {
+         case 'A':
+         case LC_CHPT_ANY:
+             _ChapterType = MP4ChapterTypeAny;
+diff --git a/util/mp4file.cpp b/util/mp4file.cpp
+index c27844b..b127cd1 100644
+--- a/util/mp4file.cpp
+++ b/util/mp4file.cpp
+@@ -189,7 +189,7 @@ FileUtility::utility_option( int code, bool& handled )
+ {
+     handled = true;
+ 
+-    switch( code ) {
+    switch( static_cast<unsigned int>( code ) ) {
+         case LC_LIST:
+             _action = &FileUtility::actionList;
+             break;
+diff --git a/util/mp4subtitle.cpp b/util/mp4subtitle.cpp
+index 7462153..19d977d 100644
+--- a/util/mp4subtitle.cpp
+++ b/util/mp4subtitle.cpp
+@@ -164,7 +164,7 @@ SubtitleUtility::utility_option( int code, bool& handled )
+ {
+     handled = true;
+ 
+-    switch( code ) {
+    switch( static_cast<unsigned int>( code ) ) {
+         case LC_LIST:
+             _action = &SubtitleUtility::actionList;
+             break;
+diff --git a/util/mp4track.cpp b/util/mp4track.cpp
+index d550506..cd63d7e 100644
+--- a/util/mp4track.cpp
+++ b/util/mp4track.cpp
+@@ -788,7 +788,7 @@ TrackUtility::utility_option( int code, bool& handled )
+ {
+     handled = true;
+ 
+-    switch( code ) {
+    switch( static_cast<unsigned int>( code ) ) {
+         case LC_TRACK_WILDCARD:
+             _trackMode = TM_WILDCARD;
+             break;
+-- 
+2.28.0
+
@@ -0,0 +1,30 @@
+From cd09fd82522861830aaf9d237b26eef5f9ba50d2 Mon Sep 17 00:00:00 2001
+From: Bart Van Assche <bvanassche@acm.org>
+Date: Wed, 21 Nov 2018 20:47:42 -0800
+Subject: [PATCH] MIB-II: Only log once that opening /proc/net/if_inet6 failed
+
+If IPv6 has been disabled (ipv6.disable=1) then opening /proc/net/if_inet6
+fails. Only log this once instead of thousand of times a day.
+
+Reported-by: Fif <lefif@users.sourceforge.net>
+Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
+---
+ agent/mibgroup/ip-mib/data_access/ipaddress_linux.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c b/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c
+index 5ddead3e0c..280575ce39 100644
+--- a/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c
+++ b/agent/mibgroup/ip-mib/data_access/ipaddress_linux.c
+@@ -234,7 +234,7 @@ _load_v6(netsnmp_container *container, int idx_offset)
+ 
+ #define PROCFILE "/proc/net/if_inet6"
+     if (!(in = fopen(PROCFILE, "r"))) {
+-        snmp_log_perror("ipaddress_linux: could not open " PROCFILE);
+        NETSNMP_LOGONCE((LOG_ERR, "ipaddress_linux: could not open " PROCFILE));
+         return -2;
+     }
+ 
+-- 
+2.20.1
+
@@ -49,8 +49,8 @@ NGINX_CONF_OPTS += \
 	--prefix=/usr \
 	--conf-path=/etc/nginx/nginx.conf \
 	--sbin-path=/usr/sbin/nginx \
-	--pid-path=/var/run/nginx.pid \
-	--lock-path=/var/run/lock/nginx.lock \
+	--pid-path=/run/nginx.pid \
+	--lock-path=/run/lock/nginx.lock \
 	--user=www-data \
 	--group=www-data \
 	--error-log-path=/var/log/nginx/error.log \
@@ -6,10 +6,10 @@ After=syslog.target network.target
 Type=forking
 PIDFile=/run/nginx.pid
 ExecStartPre=/usr/bin/mkdir -p /var/log/nginx /var/tmp/nginx
-ExecStartPre=/usr/sbin/nginx -t -q -g 'pid /var/run/nginx.pid; daemon on; master_process on;'
-ExecStart=/usr/sbin/nginx -g 'pid /var/run/nginx.pid; daemon on; master_process on;'
-ExecReload=/usr/sbin/nginx -g 'pid /var/run/nginx.pid; daemon on; master_process on;' -s reload
-ExecStop=/usr/sbin/nginx -g 'pid /var/run/nginx.pid;' -s quit
+ExecStartPre=/usr/sbin/nginx -t -q -g 'daemon on; master_process on;'
+ExecStart=/usr/sbin/nginx -g 'daemon on; master_process on;'
+ExecReload=/usr/sbin/nginx -g 'daemon on; master_process on;' -s reload
+ExecStop=/usr/sbin/nginx -s quit
 PrivateDevices=yes

 [Install]
@@ -10,5 +10,6 @@ NUMACTL_LICENSE = LGPL-2.1 (libnuma), GPL-2.0 (programs)
 NUMACTL_LICENSE_FILES = README.md
 NUMACTL_INSTALL_STAGING = YES
 NUMACTL_AUTORECONF = YES
+NUMACTL_CONF_ENV = CFLAGS="$(TARGET_CFLAGS) -fPIC"

 $(eval $(autotools-package))
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  2f25cc3165e6da4b12dcabdb6b77c48f436d835e127ec2e3cad7abae9ea8e9a6  onig-6.9.5.tar.gz
+sha256  bd0faeb887f748193282848d01ec2dad8943b5dfcb8dc03ed52dcc963549e819  onig-6.9.6.tar.gz
 sha256  6c7038393e8f30fee16257e713f77e383712f1465d6d25929596746b10b42bd3  COPYING
@@ -4,7 +4,7 @@
 #
 ################################################################################

-ONIGURUMA_VERSION = 6.9.5
+ONIGURUMA_VERSION = 6.9.6
 ONIGURUMA_SITE = \
 	https://github.com/kkos/oniguruma/releases/download/v$(ONIGURUMA_VERSION)
 ONIGURUMA_SOURCE = onig-$(ONIGURUMA_VERSION).tar.gz
@@ -13,6 +13,11 @@ OPENCV3_SUPPORTS_IN_SOURCE_BUILD = NO

 OPENCV3_CXXFLAGS = $(TARGET_CXXFLAGS)

+# Uses __atomic_fetch_add_4
+ifeq ($(BR2_TOOLCHAIN_HAS_LIBATOMIC),y)
+OPENCV3_CXXFLAGS += -latomic
+endif
+
 # Fix c++11 build with missing std::exception_ptr
 ifeq ($(BR2_TOOLCHAIN_HAS_GCC_BUG_64735),y)
 OPENCV3_CXXFLAGS += -DCV__EXCEPTION_PTR=0
@@ -48,7 +53,7 @@ OPENCV3_CONF_OPTS += \
 	-DENABLE_OMIT_FRAME_POINTER=ON \
 	-DENABLE_PRECOMPILED_HEADERS=OFF \
 	-DENABLE_PROFILING=OFF \
-	-DOPENCV3_WARNINGS_ARE_ERRORS=OFF
+	-DOPENCV_WARNINGS_ARE_ERRORS=OFF

 # OpenCV link options
 OPENCV3_CONF_OPTS += \
@@ -334,16 +339,21 @@ OPENCV3_CONF_OPTS += \
 endif

 # Installation hooks:
-define OPENCV3_CLEAN_INSTALL_DOC
-	$(RM) -fr $(TARGET_DIR)/usr/share/OpenCV/doc
+define OPENCV3_CLEAN_INSTALL_LICENSE
+	$(RM) -fr $(TARGET_DIR)/usr/share/licenses/opencv3
 endef
-OPENCV3_POST_INSTALL_TARGET_HOOKS += OPENCV3_CLEAN_INSTALL_DOC
+OPENCV3_POST_INSTALL_TARGET_HOOKS += OPENCV3_CLEAN_INSTALL_LICENSE

 define OPENCV3_CLEAN_INSTALL_CMAKE
-	$(RM) -f $(TARGET_DIR)/usr/share/OpenCV/OpenCVConfig*.cmake
+	$(RM) -f $(TARGET_DIR)/usr/share/OpenCV/OpenCV*.cmake
 endef
 OPENCV3_POST_INSTALL_TARGET_HOOKS += OPENCV3_CLEAN_INSTALL_CMAKE

+define OPENCV3_CLEAN_INSTALL_VALGRIND
+	$(RM) -f $(TARGET_DIR)/usr/share/OpenCV/valgrind*
+endef
+OPENCV3_POST_INSTALL_TARGET_HOOKS += OPENCV3_CLEAN_INSTALL_VALGRIND
+
 ifneq ($(BR2_PACKAGE_OPENCV3_INSTALL_DATA),y)
 define OPENCV3_CLEAN_INSTALL_DATA
 	$(RM) -fr $(TARGET_DIR)/usr/share/OpenCV/haarcascades \
@@ -0,0 +1,43 @@
+From bc2cd89715155fe1fead19338dac5f4059917dfe Mon Sep 17 00:00:00 2001
+From: Michael Forney <mforney@mforney.org>
+Date: Thu, 20 Jun 2019 13:52:22 -0700
+Subject: [PATCH] Provide fallback definition for __packed
+
+Otherwise, systems that don't support it will treat it as a name for a
+global `struct ntp_msg` variable.
+
+[Retrieved from:
+https://github.com/openntpd-portable/openntpd-portable/commit/bc2cd89715155fe1fead19338dac5f4059917dfe]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ include/sys/types.h    | 4 ++++
+ m4/check-os-options.m4 | 1 +
+ 2 files changed, 5 insertions(+)
+
+diff --git a/include/sys/types.h b/include/sys/types.h
+index 86821c7..5492e20 100644
+--- a/include/sys/types.h
+++ b/include/sys/types.h
+@@ -22,6 +22,10 @@
+ # define __bounded__(x, y, z)
+ #endif
+ 
+#if !defined(HAVE_ATTRIBUTE__PACKED) && !defined(__packed)
+# define __packed	__attribute__((__packed__))
+#endif
+
+ /*
+  * Define BSD-style unsigned bits types for systems that do not have them.
+  */
+diff --git a/m4/check-os-options.m4 b/m4/check-os-options.m4
+index d4d02d9..4883d1f 100644
+--- a/m4/check-os-options.m4
+++ b/m4/check-os-options.m4
+@@ -69,6 +69,7 @@ case $host_os in
+ 		HOST_ABI=elf
+ 		AC_DEFINE([HAVE_ATTRIBUTE__BOUNDED__], [1], [OpenBSD gcc has bounded])
+ 		AC_DEFINE([HAVE_ATTRIBUTE__DEAD], [1], [OpenBSD gcc has __dead])
+		AC_DEFINE([HAVE_ATTRIBUTE__PACKED], [1], [OpenBSD gcc has __packed])
+ 		;;
+ 	*solaris*)
+ 		HOST_OS=solaris
@@ -0,0 +1,54 @@
+From 956b4239d919d6922b9ba6ef39be0d1753f8ff34 Mon Sep 17 00:00:00 2001
+From: otto <>
+Date: Sat, 11 Apr 2020 07:49:48 +0000
+Subject: [PATCH] Zap double definition of conf and make ibuf_dns static to
+ avoid double definition; from Michael Forney
+
+[Retrieved (and backported by updating paths and dropping date and
+version updates) from:
+https://github.com/openntpd-portable/openntpd-openbsd/commit/956b4239d919d6922b9ba6ef39be0d1753f8ff34]
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+---
+ src/usr.sbin/ntpd/ntp.c     | 4 ++--
+ src/usr.sbin/ntpd/ntp_dns.c | 4 ++--
+ src/usr.sbin/ntpd/parse.y   | 3 +--
+ 3 files changed, 5 insertions(+), 6 deletions(-)
+
+diff --git a/src/ntp.c b/src/ntp.c
+index ea9a4e922..ec3d6bc43 100644
+--- a/src/ntp.c
+++ b/src/ntp.c
+@@ -42,7 +42,7 @@
+ 
+ volatile sig_atomic_t	 ntp_quit = 0;
+ struct imsgbuf		*ibuf_main;
+-struct imsgbuf		*ibuf_dns;
+static struct imsgbuf	*ibuf_dns;
+ struct ntpd_conf	*conf;
+ struct ctl_conns	 ctl_conns;
+ u_int			 peer_cnt;
+diff --git a/src/ntp_dns.c b/src/ntp_dns.c
+index 2e1a97833..88391801c 100644
+--- a/src/ntp_dns.c
+++ b/src/ntp_dns.c
+@@ -39,7 +39,7 @@
+ #include "ntpd.h"
+ 
+ volatile sig_atomic_t	 quit_dns = 0;
+-struct imsgbuf		*ibuf_dns;
+static struct imsgbuf	*ibuf_dns;
+ 
+ void	sighdlr_dns(int);
+ int	dns_dispatch_imsg(struct ntpd_conf *);
+diff --git a/src/parse.y b/src/uparse.y
+index 8d7ab09de..81d19bbff 100644
+--- a/src/parse.y
+++ b/src/parse.y
+@@ -57,7 +57,6 @@ int		 lgetc(int);
+ int		 lungetc(int);
+ int		 findeol(void);
+ 
+-struct ntpd_conf		*conf;
+ struct sockaddr_in		 query_addr4;
+ struct sockaddr_in6		 query_addr6;
+ int				 poolseqnum;
@@ -8,6 +8,7 @@ OPENNTPD_VERSION = 6.2p3
 OPENNTPD_SITE = http://ftp.openbsd.org/pub/OpenBSD/OpenNTPD
 OPENNTPD_LICENSE = MIT-like, BSD-2-Clause, BSD-3-Clause
 OPENNTPD_LICENSE_FILES = COPYING
+OPENNTPD_DEPENDENCIES = host-bison
 # Need to autoreconf for our libtool patch to apply properly
 OPENNTPD_AUTORECONF = YES

@@ -0,0 +1,176 @@
+From 79c093226e609b99fa889f6e37480b92b399610d Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Tue, 7 Mar 2017 21:08:34 +0000
+Subject: [PATCH] Avoid inflating file sizes needlessly and allow binaries to
+ be stripped
+
+The current approach to changing sections in ET_DYN executables is to move
+the INTERP section to the end of the file. +This means changing PT_PHDR to
+add an extra PT_LOAD section so that the new section is mmaped into memory
+by the elf loader in the kernel. In order to extend PHDR, this means moving
+it to the end of the file.
+
+Its documented in BUGS there is a kernel 'bug' which means that if you have holes
+in memory between the base load address and the PT_LOAD segment that contains PHDR,
+it will pass an incorrect PHDR address to ld.so and fail to load the binary, segfaulting.
+
+To avoid this, the code currently inserts space into the binary to ensure that when
+loaded into memory there are no holes between the PT_LOAD sections. This inflates the
+binaries by many MBs in some cases. Whilst we could make them sparse, there is a second
+issue which is that strip can fail to process these binaries:
+
+$ strip fixincl
+Not enough room for program headers, try linking with -N
+[.note.ABI-tag]: Bad value
+
+This turns out to be due to libbfd not liking the relocated PHDR section either
+(https://github.com/NixOS/patchelf/issues/10).
+
+Instead this patch implements a different approach, leaving PHDR where it is but extending
+it in place to allow addition of a new PT_LOAD section. This overwrites sections in the
+binary but those get moved to the end of the file in the new PT_LOAD section.
+
+This is based on patches linked from the above github issue, however whilst the idea
+was good, the implementation wasn't correct and they've been rewritten here.
+
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+
+Fetch from: https://github.com/NixOS/patchelf/commit/c4deb5e9e1ce9c98a48e0d5bb37d87739b8cfee4
+
+Backported to v0.9
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 71 ++++++++++++++++++++++++++++---------------------
+ 1 file changed, 40 insertions(+), 31 deletions(-)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index 1d58061..c2147af 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -209,6 +209,8 @@ private:
+     string & replaceSection(const SectionName & sectionName,
+         unsigned int size);
+ 
+    bool haveReplacedSection(const SectionName & sectionName);
+
+     void writeReplacedSections(Elf_Off & curOff,
+         Elf_Addr startAddr, Elf_Off startOffset);
+ 
+@@ -632,6 +634,15 @@ void ElfFile<ElfFileParamNames>::writeReplacedSections(Elf_Off & curOff,
+     replacedSections.clear();
+ }
+ 
+template<ElfFileParams>
+bool ElfFile<ElfFileParamNames>::haveReplacedSection(const SectionName & sectionName)
+{
+    ReplacedSections::iterator i = replacedSections.find(sectionName);
+
+    if (i != replacedSections.end())
+        return true;
+    return false;
+}
+ 
+ template<ElfFileParams>
+ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+@@ -648,52 +659,53 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+ 
+     debug("last page is 0x%llx\n", (unsigned long long) startPage);
+ 
+    /* Because we're adding a new section header, we're necessarily increasing
+       the size of the program header table.  This can cause the first section
+       to overlap the program header table in memory; we need to shift the first
+       few segments to someplace else. */
+    /* Some sections may already be replaced so account for that */
+    unsigned int i = 1;
+    Elf_Addr pht_size = sizeof(Elf_Ehdr) + (phdrs.size() + 1)*sizeof(Elf_Phdr);
+    while( shdrs[i].sh_addr <= pht_size && i < rdi(hdr->e_shnum) ) {
+        if (not haveReplacedSection(getSectionName(shdrs[i])))
+            replaceSection(getSectionName(shdrs[i]), shdrs[i].sh_size);
+        i++;
+    }
+ 
+-    /* Compute the total space needed for the replaced sections and
+-       the program headers. */
+-    off_t neededSpace = (phdrs.size() + 1) * sizeof(Elf_Phdr);
+    /* Compute the total space needed for the replaced sections */
+    off_t neededSpace = 0;
+     for (ReplacedSections::iterator i = replacedSections.begin();
+          i != replacedSections.end(); ++i)
+         neededSpace += roundUp(i->second.size(), sectionAlignment);
+     debug("needed space is %d\n", neededSpace);
+ 
+-
+     size_t startOffset = roundUp(fileSize, getPageSize());
+ 
+     growFile(startOffset + neededSpace);
+ 
+-
+     /* Even though this file is of type ET_DYN, it could actually be
+        an executable.  For instance, Gold produces executables marked
+-       ET_DYN.  In that case we can still hit the kernel bug that
+-       necessitated rewriteSectionsExecutable().  However, such
+-       executables also tend to start at virtual address 0, so
+       ET_DYN as does LD when linking with pie. If we move PT_PHDR, it
+       has to stay in the first PT_LOAD segment or any subsequent ones
+       if they're continuous in memory due to linux kernel constraints
+       (see BUGS). Since the end of the file would be after bss, we can't
+       move PHDR there, we therefore choose to leave PT_PHDR where it is but
+       move enough following sections such that we can add the extra PT_LOAD
+       section to it. This PT_LOAD segment ensures the sections at the end of
+       the file are mapped into memory for ld.so to process.
+       We can't use the approach in rewriteSectionsExecutable()
+       since DYN executables tend to start at virtual address 0, so
+        rewriteSectionsExecutable() won't work because it doesn't have
+-       any virtual address space to grow downwards into.  As a
+-       workaround, make sure that the virtual address of our new
+-       PT_LOAD segment relative to the first PT_LOAD segment is equal
+-       to its offset; otherwise we hit the kernel bug.  This may
+-       require creating a hole in the executable.  The bigger the size
+-       of the uninitialised data segment, the bigger the hole. */
+       any virtual address space to grow downwards into. */
+     if (isExecutable) {
+         if (startOffset >= startPage) {
+             debug("shifting new PT_LOAD segment by %d bytes to work around a Linux kernel bug\n", startOffset - startPage);
+-        } else {
+-            size_t hole = startPage - startOffset;
+-            /* Print a warning, because the hole could be very big. */
+-            fprintf(stderr, "warning: working around a Linux kernel bug by creating a hole of %zu bytes in ‘%s’\n", hole, fileName.c_str());
+-            assert(hole % getPageSize() == 0);
+-            /* !!! We could create an actual hole in the file here,
+-               but it's probably not worth the effort. */
+-            growFile(fileSize + hole);
+-            startOffset += hole;
+         }
+         startPage = startOffset;
+     }
+ 
+ 
+-    /* Add a segment that maps the replaced sections and program
+-       headers into memory. */
+    /* Add a segment that maps the replaced sections into memory. */
+     phdrs.resize(rdi(hdr->e_phnum) + 1);
+     wri(hdr->e_phnum, rdi(hdr->e_phnum) + 1);
+     Elf_Phdr & phdr = phdrs[rdi(hdr->e_phnum) - 1];
+@@ -706,15 +718,12 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+ 
+ 
+     /* Write out the replaced sections. */
+-    Elf_Off curOff = startOffset + phdrs.size() * sizeof(Elf_Phdr);
+    Elf_Off curOff = startOffset;
+     writeReplacedSections(curOff, startPage, startOffset);
+     assert(curOff == startOffset + neededSpace);
+ 
+-
+-    /* Move the program header to the start of the new area. */
+-    wri(hdr->e_phoff, startOffset);
+-
+-    rewriteHeaders(startPage);
+    /* Write out the updated program and section headers */
+    rewriteHeaders(hdr->e_phoff);
+ }
+ 
+ 
+-- 
+2.17.1
+
@@ -0,0 +1,55 @@
+From 5df4791bf077127684faceeeea8bfab063e43774 Mon Sep 17 00:00:00 2001
+From: Richard Purdie <richard.purdie@linuxfoundation.org>
+Date: Wed, 3 Jun 2020 12:14:58 +0100
+Subject: [PATCH] Fix shared library corruption when rerunning patchelf
+
+When running patchelf on some existing patchelf'd binaries to change to longer
+RPATHS, ldd would report the binaries as invalid. The output of objdump -x on
+those libraryies should show the top of the .dynamic section is getting trashed,
+something like:
+
+0x600000001 0x0000000000429000
+0x335000 0x0000000000335000
+0xc740 0x000000000000c740
+0x1000 0x0000000000009098
+SONAME libglib-2.0.so.0
+
+(which should be RPATH and DT_NEEDED entries)
+
+This was tracked down to the code which injects the PT_LOAD section.
+
+The issue is that if the program headers were previously relocated to the end
+of the file which was how patchelf operated previously, the relocation code
+wouldn't work properly on a second run as it now assumes they're located after
+the elf header. This change forces them back to immediately follow the elf
+header which is where the code has made space for them.
+
+Should fix https://github.com/NixOS/patchelf/issues/170
+and https://github.com/NixOS/patchelf/issues/192
+
+Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
+
+Fetch from: https://github.com/NixOS/patchelf/commit/ad5f1f078b716802dfb8f7226cb1d5c720348a78
+
+Backported to v0.9
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index c2147af..1224a89 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -706,6 +706,7 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+ 
+ 
+     /* Add a segment that maps the replaced sections into memory. */
+    wri(hdr->e_phoff, sizeof(Elf_Ehdr));
+     phdrs.resize(rdi(hdr->e_phnum) + 1);
+     wri(hdr->e_phnum, rdi(hdr->e_phnum) + 1);
+     Elf_Phdr & phdr = phdrs[rdi(hdr->e_phnum) - 1];
+-- 
+2.17.1
+
@@ -0,0 +1,45 @@
+From 4a82c97e8a0677706d1d532812daaa73249768a8 Mon Sep 17 00:00:00 2001
+From: Ed Bartosh <ed.bartosh@linux.intel.com>
+Date: Fri, 21 Jul 2017 12:33:53 +0300
+Subject: [PATCH] fix adjusting startPage
+
+startPage is adjusted unconditionally for all executables.
+This results in incorrect addresses assigned to INTERP and LOAD
+program headers, which breaks patched executable.
+
+Adjusting startPage variable only when startOffset > startPage
+should fix this.
+
+This change is related to the issue NixOS#10
+
+Signed-off-by: Ed Bartosh <ed.bartosh@linux.intel.com>
+
+Fetch from: https://github.com/NixOS/patchelf/commit/1cc234fea5600190d872329aca60e2365cefc39e
+
+Backported to v0.9
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index 1224a89..4676157 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -697,10 +697,8 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+        since DYN executables tend to start at virtual address 0, so
+        rewriteSectionsExecutable() won't work because it doesn't have
+        any virtual address space to grow downwards into. */
+-    if (isExecutable) {
+-        if (startOffset >= startPage) {
+-            debug("shifting new PT_LOAD segment by %d bytes to work around a Linux kernel bug\n", startOffset - startPage);
+-        }
+    if (isExecutable && startOffset > startPage) {
+        debug("shifting new PT_LOAD segment by %d bytes to work around a Linux kernel bug\n", startOffset - startPage);
+         startPage = startOffset;
+     }
+ 
+-- 
+2.17.1
+
@@ -0,0 +1,38 @@
+From cb8326de54ad7a56658b0dc8efb7da5e71684a7c Mon Sep 17 00:00:00 2001
+From: Pablo Galindo <pablogsal@gmail.com>
+Date: Tue, 22 Sep 2020 01:33:47 +0100
+Subject: [PATCH] Use sh_offset instead of sh_addr when checking already
+ replaced libs
+
+When checking for already replaced libs, the check against the size must
+be done using the section header offset, not the section file address.
+This was not crashing in many situations because normally sh_address and
+sh_offset have the same value but these two may differ and using the
+sh_address value instead can cause library corruption in these
+situations.
+
+Fetch from: https://github.com/NixOS/patchelf/commit/83aa89addf8757e2d63aa73222f2fa9bc6d7321a
+
+Backported to v0.9
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index 4676157..c025ae2 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -666,7 +666,7 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+     /* Some sections may already be replaced so account for that */
+     unsigned int i = 1;
+     Elf_Addr pht_size = sizeof(Elf_Ehdr) + (phdrs.size() + 1)*sizeof(Elf_Phdr);
+-    while( shdrs[i].sh_addr <= pht_size && i < rdi(hdr->e_shnum) ) {
+    while( shdrs[i].sh_offset <= pht_size && i < rdi(hdr->e_shnum) ) {
+         if (not haveReplacedSection(getSectionName(shdrs[i])))
+             replaceSection(getSectionName(shdrs[i]), shdrs[i].sh_size);
+         i++;
+-- 
+2.17.1
+
@@ -0,0 +1,41 @@
+From e22ca2f593aa8fd392f1ac4f8dd104bc56d0d100 Mon Sep 17 00:00:00 2001
+From: Ezra Cooper <ezra@qumulo.com>
+Date: Thu, 21 Jun 2018 11:07:35 -0700
+Subject: [PATCH] Fix issue #66 by ignoring the first section header when
+ sorting, and not overwriting NOBITS entries.
+
+Fetch from: https://github.com/NixOS/patchelf/commit/52ab908394958a2a5d0476e306e2cad4da4fdeae
+
+Backported to v0.9
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index c025ae2..fa2945e 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -435,7 +435,7 @@ void ElfFile<ElfFileParamNames>::sortShdrs()
+     /* Sort the sections by offset. */
+     CompShdr comp;
+     comp.elfFile = this;
+-    sort(shdrs.begin(), shdrs.end(), comp);
+    sort(shdrs.begin() + 1, shdrs.end(), comp);
+ 
+     /* Restore the sh_link mappings. */
+     for (unsigned int i = 1; i < rdi(hdr->e_shnum); ++i)
+@@ -586,7 +586,8 @@ void ElfFile<ElfFileParamNames>::writeReplacedSections(Elf_Off & curOff,
+     {
+         string sectionName = i->first;
+         Elf_Shdr & shdr = findSection(sectionName);
+-        memset(contents + rdi(shdr.sh_offset), 'X', rdi(shdr.sh_size));
+        if (shdr.sh_type != SHT_NOBITS)
+            memset(contents + rdi(shdr.sh_offset), 'X', rdi(shdr.sh_size));
+     }
+ 
+     for (ReplacedSections::iterator i = replacedSections.begin();
+-- 
+2.17.1
+
@@ -0,0 +1,80 @@
+From c61c2960d782c67566790b210163ff9c799f018a Mon Sep 17 00:00:00 2001
+From: Conrad Ratschan <ratschance@gmail.com>
+Date: Sat, 3 Oct 2020 20:17:24 -0500
+Subject: [PATCH] Fix endianness issues for powerpc PIE
+
+Previously when running `patchelf --set-rpath "/usr/sbin" my_bin` on a
+PIE ppc32 binary that had no RPATH a few issues were encountered.
+
+This commit fixes:
+
+1. The PT_PHDR being sorted improperly due to the type being read in
+   incorrect endianness
+
+3. The interpreter being clobbered due to the replace sections routine
+   reading sh_offset and sh_size in incorrect endianness
+
+4. The PHDR segment having an incorrect virt and phys address due to
+   reading the e_phoff in the incorrect endianness
+
+This also fixes a read of the shdr.sh_type in writeReplacedSections but
+this was not encountered during testing.
+
+Fetch from: https://github.com/NixOS/patchelf/commit/884eccc4f061a3dbdbe63a4c73f1cc9bbf77fa7d
+
+Backported to v0.9. Removed item 2 from the fix list as it is not
+applicable to v0.9.
+
+Signed-off-by: Conrad Ratschan <conrad.ratschan@rockwellcollins.com>
+---
+ src/patchelf.cc | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/patchelf.cc b/src/patchelf.cc
+index fa2945e..e60b17c 100644
+--- a/src/patchelf.cc
+++ b/src/patchelf.cc
+@@ -173,8 +173,8 @@ private:
+         ElfFile * elfFile;
+         bool operator ()(const Elf_Phdr & x, const Elf_Phdr & y)
+         {
+-            if (x.p_type == PT_PHDR) return true;
+-            if (y.p_type == PT_PHDR) return false;
+            if (elfFile->rdi(x.p_type) == PT_PHDR) return true;
+            if (elfFile->rdi(y.p_type) == PT_PHDR) return false;
+             return elfFile->rdi(x.p_paddr) < elfFile->rdi(y.p_paddr);
+         }
+     };
+@@ -586,7 +586,7 @@ void ElfFile<ElfFileParamNames>::writeReplacedSections(Elf_Off & curOff,
+     {
+         string sectionName = i->first;
+         Elf_Shdr & shdr = findSection(sectionName);
+-        if (shdr.sh_type != SHT_NOBITS)
+        if (rdi(shdr.sh_type) != SHT_NOBITS)
+             memset(contents + rdi(shdr.sh_offset), 'X', rdi(shdr.sh_size));
+     }
+ 
+@@ -667,9 +667,9 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+     /* Some sections may already be replaced so account for that */
+     unsigned int i = 1;
+     Elf_Addr pht_size = sizeof(Elf_Ehdr) + (phdrs.size() + 1)*sizeof(Elf_Phdr);
+-    while( shdrs[i].sh_offset <= pht_size && i < rdi(hdr->e_shnum) ) {
+    while( rdi(shdrs[i].sh_offset) <= pht_size && i < rdi(hdr->e_shnum) ) {
+         if (not haveReplacedSection(getSectionName(shdrs[i])))
+-            replaceSection(getSectionName(shdrs[i]), shdrs[i].sh_size);
+            replaceSection(getSectionName(shdrs[i]), rdi(shdrs[i].sh_size));
+         i++;
+     }
+ 
+@@ -723,7 +723,7 @@ void ElfFile<ElfFileParamNames>::rewriteSectionsLibrary()
+     assert(curOff == startOffset + neededSpace);
+ 
+     /* Write out the updated program and section headers */
+-    rewriteHeaders(hdr->e_phoff);
+    rewriteHeaders(rdi(hdr->e_phoff));
+ }
+ 
+ 
+-- 
+2.17.1
+
@@ -1,5 +1,5 @@
 # From https://www.php.net/downloads.php
-sha256  5d31675a9b9c21b5bd03389418218c30b26558246870caba8eb54f5856e2d6ce  php-7.4.11.tar.xz
+sha256  e82d2bcead05255f6b7d2ff4e2561bc334204955820cabc2457b5239fde96b76  php-7.4.12.tar.xz

 # License file
 sha256  0967ad6cf4b7fe81d38709d7aaef3fecb3bd685be7eebb37b864aa34c991baa7  LICENSE
@@ -4,7 +4,7 @@
 #
 ################################################################################

-PHP_VERSION = 7.4.11
+PHP_VERSION = 7.4.12
 PHP_SITE = http://www.php.net/distributions
 PHP_SOURCE = php-$(PHP_VERSION).tar.xz
 PHP_INSTALL_STAGING = YES
@@ -0,0 +1,95 @@
+From 45824f58b10575d8d88d4bce934aedee821a6df0 Mon Sep 17 00:00:00 2001
+From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+Date: Thu, 15 Oct 2020 22:26:55 +0200
+Subject: [PATCH] CMakeLists.txt: respect BUILD_SHARED_LIBS
+
+Don't build and install pistache_shared if the standard cmake
+BUILD_SHARED_LIBS is set to OFF
+
+Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
+[Backport from upstream:
+  https://github.com/oktal/pistache/commit/c04166ca9e6420a8fbc93fef4055ee2eccdcebe4
+]
+---
+ src/CMakeLists.txt | 43 +++++++++++++++++++++++++------------------
+ 1 file changed, 25 insertions(+), 18 deletions(-)
+
+diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
+index 6521b20..c5b049f 100644
+--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
+@@ -26,31 +26,36 @@ set(include_install_dir ${CMAKE_INSTALL_INCLUDEDIR})
+ set(lib_install_dir ${CMAKE_INSTALL_LIBDIR})
+ set(bin_install_dir ${CMAKE_INSTALL_BINDIR})
+ 
+-add_library(pistache_shared SHARED $<TARGET_OBJECTS:pistache>)
+-add_library(pistache_static STATIC $<TARGET_OBJECTS:pistache>)
+if (BUILD_SHARED_LIBS)
+    add_library(pistache_shared SHARED $<TARGET_OBJECTS:pistache>)
+    target_link_libraries(pistache_shared PRIVATE Threads::Threads ${CMAKE_REQUIRED_LIBRARIES})
+    target_include_directories(pistache_shared INTERFACE ${PISTACHE_INCLUDE})
+endif ()
+ 
+-target_link_libraries(pistache_shared PRIVATE Threads::Threads ${CMAKE_REQUIRED_LIBRARIES})
+add_library(pistache_static STATIC $<TARGET_OBJECTS:pistache>)
+ target_link_libraries(pistache_static PRIVATE Threads::Threads ${CMAKE_REQUIRED_LIBRARIES})
+-
+-target_include_directories(pistache_shared INTERFACE ${PISTACHE_INCLUDE})
+ target_include_directories(pistache_static INTERFACE ${PISTACHE_INCLUDE})
+ 
+ if (PISTACHE_USE_SSL)
+     target_compile_definitions(pistache PUBLIC PISTACHE_USE_SSL)
+-    target_compile_definitions(pistache_shared PUBLIC PISTACHE_USE_SSL)
+     target_compile_definitions(pistache_static PUBLIC PISTACHE_USE_SSL)
+ 
+     target_include_directories(pistache PRIVATE ${OPENSSL_INCLUDE_DIR})
+-    target_link_libraries(pistache_shared PUBLIC OpenSSL::SSL OpenSSL::Crypto)
+     target_link_libraries(pistache_static PUBLIC OpenSSL::SSL OpenSSL::Crypto)
+    if (BUILD_SHARED_LIBS)
+        target_compile_definitions(pistache_shared PUBLIC PISTACHE_USE_SSL)
+        target_link_libraries(pistache_shared PUBLIC OpenSSL::SSL OpenSSL::Crypto)
+    endif ()
+ endif ()
+ 
+ set(Pistache_OUTPUT_NAME "pistache")
+-set_target_properties(pistache_shared PROPERTIES
+-    OUTPUT_NAME ${Pistache_OUTPUT_NAME}
+-    VERSION ${version}
+-    SOVERSION ${VERSION_MAJOR}
+-)
+if (BUILD_SHARED_LIBS)
+    set_target_properties(pistache_shared PROPERTIES
+        OUTPUT_NAME ${Pistache_OUTPUT_NAME}
+        VERSION ${version}
+        SOVERSION ${VERSION_MAJOR}
+    )
+endif ()
+ 
+ set_target_properties(pistache_static PROPERTIES 
+     OUTPUT_NAME ${Pistache_OUTPUT_NAME}
+@@ -60,13 +65,15 @@ if (PISTACHE_INSTALL)
+     set(Pistache_CONFIG_FILE "PistacheConfig.cmake")
+     set(Pistache_CONFIG_VERSION_FILE "PistacheConfigVersion.cmake")
+ 
+-    install(
+-      TARGETS pistache_shared
+-      EXPORT PistacheTargets
+-      ARCHIVE DESTINATION ${lib_install_dir}
+-      LIBRARY DESTINATION ${lib_install_dir}
+-      RUNTIME DESTINATION ${bin_install_dir}
+-      INCLUDES DESTINATION ${include_install_dir})
+    if (BUILD_SHARED_LIBS)
+        install(
+          TARGETS pistache_shared
+          EXPORT PistacheTargets
+          ARCHIVE DESTINATION ${lib_install_dir}
+          LIBRARY DESTINATION ${lib_install_dir}
+          RUNTIME DESTINATION ${bin_install_dir}
+          INCLUDES DESTINATION ${include_install_dir})
+    endif()
+ 
+     install(
+       DIRECTORY "${PROJECT_SOURCE_DIR}/include/pistache"
+-- 
+2.28.0
+
@@ -1,7 +1,7 @@
-# From https://ftp.postgresql.org/pub/source/v12.4/postgresql-12.4.tar.bz2.md5
-md5  80ebbf0e55193b123760e5f8e48c6cff  postgresql-12.4.tar.bz2
-# From https://ftp.postgresql.org/pub/source/v12.4/postgresql-12.4.tar.bz2.sha256
-sha256  bee93fbe2c32f59419cb162bcc0145c58da9a8644ee154a30b9a5ce47de606cc  postgresql-12.4.tar.bz2
+# From https://ftp.postgresql.org/pub/source/v12.5/postgresql-12.5.tar.bz2.md5
+md5  f19e48090bbd59ea81826b5fd99e7e97  postgresql-12.5.tar.bz2
+# From https://ftp.postgresql.org/pub/source/v12.5/postgresql-12.5.tar.bz2.sha256
+sha256  bd0d25341d9578b5473c9506300022de26370879581f5fddd243a886ce79ff95  postgresql-12.5.tar.bz2

 # License file, Locally calculated
 sha256  739e5d454d81d31a482469338b7c856f1f5c6b4cdda1551cea6f0f6d18eef62c  COPYRIGHT
@@ -4,7 +4,7 @@
 #
 ################################################################################

-POSTGRESQL_VERSION = 12.4
+POSTGRESQL_VERSION = 12.5
 POSTGRESQL_SOURCE = postgresql-$(POSTGRESQL_VERSION).tar.bz2
 POSTGRESQL_SITE = https://ftp.postgresql.org/pub/source/v$(POSTGRESQL_VERSION)
 POSTGRESQL_LICENSE = PostgreSQL
@@ -39,6 +39,12 @@ endif
 ifeq ($(BR2_PACKAGE_QT5BASE_TEST),y)
 PYTHON_PYQT5_MODULES += QtTest
 endif
+
+# QtSvg needs QtWidgets
+ifeq ($(BR2_PACKAGE_QT5SVG),y)
+PYTHON_PYQT5_DEPENDENCIES += qt5svg
+PYTHON_PYQT5_MODULES += QtSvg
+endif
 endif

 ifeq ($(BR2_PACKAGE_QT5CONNECTIVITY),y)
@@ -88,11 +94,6 @@ PYTHON_PYQT5_DEPENDENCIES += qt5serialport
 PYTHON_PYQT5_MODULES += QtSerialPort
 endif

-ifeq ($(BR2_PACKAGE_QT5SVG),y)
-PYTHON_PYQT5_DEPENDENCIES += qt5svg
-PYTHON_PYQT5_MODULES += QtSvg
-endif
-
 ifeq ($(BR2_PACKAGE_QT5WEBCHANNEL),y)
 PYTHON_PYQT5_DEPENDENCIES += qt5webchannel
 PYTHON_PYQT5_MODULES += QtWebChannel
--- a/Show More
+++ b/Show More