[Buildroot] [PATCH v2 1/2] package/p11-kit: security bump to version 0.26.5

[Buildroot] [PATCH v2 1/2] package/p11-kit: security bump to version 0.26.5

[Fiona Klute via buildroot]

Security fixes by versions:

0.26.5
* CVE-2026-18938: rpc: guard against overflow when decoding nested
  attributes
  https://github.com/advisories/GHSA-6x8p-h5fj-5ppr

0.26.3
* CVE-2026-13757: server: fixed stack exhaustion via unbounded
  recursion in RPC attribute parsing by enforcing a recursion depth
  limit
  https://github.com/advisories/GHSA-p2wm-69qx-x25w
* various memory management fixes (including memory leaks) without
  CVE or details on possible security impact

Full upstream changelog:
https://github.com/p11-glue/p11-kit/blob/0.26.5/NEWS

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
---
 package/p11-kit/p11-kit.hash | 2 +-
 package/p11-kit/p11-kit.mk   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/p11-kit/p11-kit.hash b/package/p11-kit/p11-kit.hash
index 943ad9c22f..ca76eddae6 100644
--- a/package/p11-kit/p11-kit.hash
+++ b/package/p11-kit/p11-kit.hash
@@ -1,4 +1,4 @@
 # From https://github.com/p11-glue/p11-kit/releases/tag/0.26.2
-sha256  09fd9f44da4813a3141e73d5e7cf7008e5660d0405f13d56c15e1da9dcecf828  p11-kit-0.26.2.tar.xz
+sha256  f2cc09111e44bf3fea58f023180b33acea90aa82d042d6fbb623fbc5ba033bb7  p11-kit-0.26.5.tar.xz
 # Locally computed
 sha256  2e1ba993904df807a10c3eda1e5c272338edc35674b679773a8b3ad460731054  COPYING
diff --git a/package/p11-kit/p11-kit.mk b/package/p11-kit/p11-kit.mk
index 60133223ce..b3bb3e1263 100644
--- a/package/p11-kit/p11-kit.mk
+++ b/package/p11-kit/p11-kit.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-P11_KIT_VERSION = 0.26.2
+P11_KIT_VERSION = 0.26.5
 P11_KIT_SOURCE = p11-kit-$(P11_KIT_VERSION).tar.xz
 P11_KIT_SITE = https://github.com/p11-glue/p11-kit/releases/download/$(P11_KIT_VERSION)
 P11_KIT_INSTALL_STAGING = YES
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 2/2] package/p11-kit: switch to meson build system

[Fiona Klute via buildroot]

P11-kit has been offering a meson build since 0.23.17 (see upstream
NEWS [1]), and it is the build system described in the upstream
README.

Changes in the switch to meson:

* Explicitly enable/disable NLS.
* Explicitly enable/disable bash-completion.
* The meson build has no explicit option for libtasn1, it is required
  if trust_module is enabled.
* Add patch for meson configuration to avoid depending on systemd to
  discover install location for units, which would create a dependency
  loop.
* Check for BR2_INIT_SYSTEMD instead of BR2_PACKAGE_SYSTEMD to decide
  whether to install systemd units.

[1] https://github.com/p11-glue/p11-kit/blob/0.26.5/NEWS#L164

Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
---
Changes v1 -> v2:
* new patch

 ...ing-systemduserunitdir-to-break-depe.patch | 61 ++++++++++++++++
 package/p11-kit/p11-kit.mk                    | 70 +++++++++++--------
 2 files changed, 100 insertions(+), 31 deletions(-)
 create mode 100644 package/p11-kit/0001-meson-allow-setting-systemduserunitdir-to-break-depe.patch

diff --git a/package/p11-kit/0001-meson-allow-setting-systemduserunitdir-to-break-depe.patch b/package/p11-kit/0001-meson-allow-setting-systemduserunitdir-to-break-depe.patch
new file mode 100644
index 0000000000..050bc3533b
--- /dev/null
+++ b/package/p11-kit/0001-meson-allow-setting-systemduserunitdir-to-break-depe.patch
@@ -0,0 +1,61 @@
+From 709e37f781e50ef981d337249c574a9255691665 Mon Sep 17 00:00:00 2001
+From: Fiona Klute <fiona.klute@gmx.de>
+Date: Sat, 17 Oct 2026 14:33:02 +0200
+Subject: [PATCH] meson: allow setting systemduserunitdir to break dependency
+ loop
+
+The dependency on systemd is only used to retrieve systemduserunitdir,
+not otherwise needed during build. However, p11-kit is also an
+(optional) dependency of systemd, creating a dependency loop.
+
+This patch allows setting systemduserunitdir directly to break the
+dependency loop. If set, the given value is used unconditionally
+without checking for systemd, otherwise systemd is detected as before.
+
+Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
+Upstream: https://github.com/p11-glue/p11-kit/pull/788
+---
+ meson.build       | 11 ++++++++---
+ meson_options.txt |  4 ++++
+ 2 files changed, 12 insertions(+), 3 deletions(-)
+
+diff --git a/meson.build b/meson.build
+index 38cf81b..9e76d62 100644
+--- a/meson.build
++++ b/meson.build
+@@ -456,9 +456,14 @@ conf.set_quoted('TRUST_PATHS', trust_paths)
+ # systemd
+ 
+ with_systemd = false
+-systemd = dependency('systemd', required: get_option('systemd'))
+-if systemd.found()
+-  systemduserunitdir = systemd.get_variable(pkgconfig : 'systemduserunitdir')
++systemduserunitdir = get_option('systemduserunitdir')
++if systemduserunitdir == ''
++  systemd = dependency('systemd', required: get_option('systemd'))
++  if systemd.found()
++    systemduserunitdir = systemd.get_variable(pkgconfig : 'systemduserunitdir')
++    with_systemd = true
++  endif
++else
+   with_systemd = true
+ endif
+ 
+diff --git a/meson_options.txt b/meson_options.txt
+index c1f2362..a7c0553 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -46,6 +46,10 @@ option('systemd', type : 'feature',
+        value : 'auto',
+        description : 'Use systemd socket activation')
+ 
++option('systemduserunitdir', type : 'string',
++       value : '',
++       description : 'Override default location for systemd user units')
++
+ option('bashcompdir', type : 'string',
+        value : '',
+        description : 'Override default location for bash completion files')
+-- 
+2.55.0
+
diff --git a/package/p11-kit/p11-kit.mk b/package/p11-kit/p11-kit.mk
index b3bb3e1263..17efff7b16 100644
--- a/package/p11-kit/p11-kit.mk
+++ b/package/p11-kit/p11-kit.mk
@@ -7,57 +7,65 @@
 P11_KIT_VERSION = 0.26.5
 P11_KIT_SOURCE = p11-kit-$(P11_KIT_VERSION).tar.xz
 P11_KIT_SITE = https://github.com/p11-glue/p11-kit/releases/download/$(P11_KIT_VERSION)
+P11_KIT_DEPENDENCIES = host-pkgconf
 P11_KIT_INSTALL_STAGING = YES
-P11_KIT_CONF_OPTS = --disable-static
-P11_KIT_CONF_ENV = ac_cv_have_decl_program_invocation_short_name=yes \
-	ac_cv_have_decl___progname=no
 P11_KIT_LICENSE = BSD-3-Clause
 P11_KIT_LICENSE_FILES = COPYING
 P11_KIT_CPE_ID_VALID = YES
-# Needed because the pre-generated ./configure script has an old
-# broken expansion of AC_HEADER_STDBOOL, which incorrectly detects
-# that <stdbool.h> cannot be used, causing breakage down the road.
-P11_KIT_AUTORECONF = YES
-# Needed for autoreconf
-P11_KIT_DEPENDENCIES = host-pkgconf
+
+P11_KIT_CONF_OPTS = -Dtest=false
+
+ifeq ($(BR2_SYSTEM_ENABLE_NLS),y)
+P11_KIT_CONF_OPTS += -Dnls=true
+P11_KIT_DEPENDENCIES += $(TARGET_NLS_DEPENDENCIES)
+else
+P11_KIT_CONF_OPTS += -Dnls=false
+endif
 
 ifeq ($(BR2_PACKAGE_LIBFFI),y)
 P11_KIT_DEPENDENCIES += host-pkgconf libffi
-P11_KIT_CONF_OPTS += --with-libffi
+P11_KIT_CONF_OPTS += -Dlibffi=enabled
 else
-P11_KIT_CONF_OPTS += --without-libffi
+P11_KIT_CONF_OPTS += -Dlibffi=disabled
 endif
 
 ifeq ($(BR2_PACKAGE_LIBTASN1),y)
-P11_KIT_DEPENDENCIES += host-pkgconf libtasn1
-P11_KIT_CONF_OPTS += \
-	--enable-trust-module \
-	--with-libtasn1
+# host-libtasn1 is needed to provide asn1Parser
+P11_KIT_DEPENDENCIES += host-pkgconf host-libtasn1 libtasn1
+P11_KIT_CONF_OPTS += -Dtrust_module=enabled
 ifeq ($(BR2_PACKAGE_CA_CERTIFICATES),y)
-P11_KIT_CONF_OPTS += --with-trust-paths=/etc/ssl/certs/ca-certificates.crt
+P11_KIT_CONF_OPTS += -Dtrust_paths=/etc/ssl/certs/ca-certificates.crt
 else
-P11_KIT_CONF_OPTS += --without-trust-paths
+P11_KIT_CONF_OPTS += -Dtrust_paths=
 endif
 else
+P11_KIT_CONF_OPTS += -Dtrust_module=disabled
+endif
+
+ifeq ($(BR2_INIT_SYSTEMD),y)
 P11_KIT_CONF_OPTS += \
-	--disable-trust-module \
-	--without-libtasn1
+	-Dsystemd=enabled \
+	-Dsystemduserunitdir=/usr/lib/systemd/user
+else
+P11_KIT_CONF_OPTS += -Dsystemd=disabled
 endif
 
-ifeq ($(BR2_PACKAGE_SYSTEMD),y)
-P11_KIT_CONF_OPTS += --with-systemd
+ifeq ($(BR2_PACKAGE_BASH_COMPLETION),y)
+P11_KIT_DEPENDENCIES += bash-completion
+P11_KIT_CONF_OPTS += -Dbash_completion=enabled
 else
-P11_KIT_CONF_OPTS += --without-systemd
+P11_KIT_CONF_OPTS += -Dbash_completion=disabled
 endif
 
 HOST_P11_KIT_DEPENDENCIES = host-pkgconf
-
 HOST_P11_KIT_CONF_OPTS = \
-	--without-libffi \
-	--without-trust-paths \
-	--disable-trust-module \
-	--without-libtasn1 \
-	--without-systemd
-
-$(eval $(autotools-package))
-$(eval $(host-autotools-package))
+	-Dtest=false \
+	-Dnls=false \
+	-Dlibffi=disabled \
+	-Dtrust_paths= \
+	-Dtrust_module=disabled \
+	-Dsystemd=disabled \
+	-Dbash_completion=disabled
+
+$(eval $(meson-package))
+$(eval $(host-meson-package))
-- 
2.55.0

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 1/2] package/p11-kit: security bump to version 0.26.5

[Julien Olivain via buildroot]

On 17/10/2026 16:00, Fiona Klute via buildroot wrote:
> Security fixes by versions:
> 
> 0.26.5
> * CVE-2026-18938: rpc: guard against overflow when decoding nested
>   attributes
>   https://github.com/advisories/GHSA-6x8p-h5fj-5ppr
> 
> 0.26.3
> * CVE-2026-13757: server: fixed stack exhaustion via unbounded
>   recursion in RPC attribute parsing by enforcing a recursion depth
>   limit
>   https://github.com/advisories/GHSA-p2wm-69qx-x25w
> * various memory management fixes (including memory leaks) without
>   CVE or details on possible security impact
> 
> Full upstream changelog:
> https://github.com/p11-glue/p11-kit/blob/0.26.5/NEWS
> 
> Signed-off-by: Fiona Klute <fiona.klute@gmx.de>

Series applied to master, thanks.
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot