[Buildroot] package/expat: please backport to 2021.11.x

[Buildroot] package/expat: please backport to 2021.11.x

[Christian Stewart via buildroot]

[-- Attachment #1.1: Type: text/plain, Size: 221 bytes --]

Hi all,

Expat v2.4.4 (vulnerable) download has been removed from sourceforge.

So 2021.11.x build is broken with the older expat.

Please backport the expat security fixes to 2021.11.x.

Thanks & best,
Christian Stewart

[-- Attachment #1.2: Type: text/html, Size: 368 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] package/expat: please backport to 2021.11.x

[Thomas Petazzoni via buildroot]

On Mon, 21 Feb 2022 21:21:16 -0800
Christian Stewart <christian@paral.in> wrote:

> Expat v2.4.4 (vulnerable) download has been removed from sourceforge.
> 
> So 2021.11.x build is broken with the older expat.

This is strange: if the expat tarball is no longer available from
sourceforge, Buildroot should fallback to sources.buildroot.net, which
contains the expat-2.4.4.tar.xz tarball, at
http://sources.buildroot.net/expat/.

Of course, it is better to update since there is a security issue in
2.4.4, but I'm wondering why you're saying that the build is broken: it
should not.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] package/expat: please backport to 2021.11.x

[Christian Stewart via buildroot]

Hi Thomas,



On Tue, Feb 22, 2022 at 12:33 AM Thomas Petazzoni
<thomas.petazzoni@bootlin.com> wrote:
> On Mon, 21 Feb 2022 21:21:16 -0800
> Christian Stewart <christian@paral.in> wrote:
>
> > Expat v2.4.4 (vulnerable) download has been removed from sourceforge.
> >
> > So 2021.11.x build is broken with the older expat.
>
> This is strange: if the expat tarball is no longer available from
> sourceforge, Buildroot should fallback to sources.buildroot.net, which
> contains the expat-2.4.4.tar.xz tarball, at
> http://sources.buildroot.net/expat/.

It does, my mistake, I had an alternate mirror configured.

> Of course, it is better to update since there is a security issue in
> 2.4.4,

Best regards,
Christian
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot