Re: [Buildroot] [PATCH v7 26/66] package/resiprocate: security bump version to 1.14.0

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

On Tue, Sep 29, 2026 at 08:35:25PM +0200, Bernd Kuhls wrote:
> https://github.com/resiprocate/resiprocate/releases/tag/resiprocate-1.14.0
> 
> Fixes the following security problems:
> 
> Use CSPRNG for security-sensitive SIP/STUN/TURN tokens (CWE-338)
>     Use crypto RNG when generating certificates and nonce
>     Use crypto RNG to generate various IDs that are supposed to be unique
>     Improve transaction ID uniqueness
> Authenticate STUN Binding responses (CWE-345)
> Add Digest Authentication Support for SHA256 and SHA512/256 algorithms
> Add new DigestStream class, capable of MD5, SHA1, SHA256, SHA512 and SHA512/256 hash algorithms
> TLS handshake fixes
>     Avoid using undefined client verification mode in TLS connection
>     Disable TLS compression by default
>     Correct TLS logging
> Allow applications to get TLS connection/handshake errors
> Propagate SSL Certificate Validation errors to ConnectionTerminated event/message
> Cleanup SecurityAttributes
> WinSecurity: expand constructors to allow setting of defaultPrivateKeyPassPhrase and DHParamsFilename
> WinSecurity: perform normal preload process so that domain certificates can be loaded
> 
> Signed-off-by: Bernd Kuhls <bernd@kuhls.net>

I've applied... but in fact it breaks the build:

CMake Error at media/samples/CMakeLists.txt:9 (message):
  The sox utility cannot be found.
Call Stack (most recent call first):
  media/samples/CMakeLists.txt:23 (wav_to_header)

Build:

BR2_aarch64=y
BR2_TOOLCHAIN_EXTERNAL=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_AARCH64_GLIBC_STABLE=y
BR2_FORCE_HOST_BUILD=y
BR2_INIT_NONE=y
BR2_SYSTEM_BIN_SH_NONE=y
# BR2_PACKAGE_BUSYBOX is not set
BR2_PACKAGE_RESIPROCATE=y
# BR2_TARGET_ROOTFS_TAR is not set

in our Docker container.

Also, not related to the bump, but the CMake in our Docker container
by default segfaults at the build step on resiprocate (reproducible
before/after the version bump).

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot