Re: [Buildroot] [PATCH 2/4] package/wpewebkit: security bump to version 2.44.2

[Adrian Perez de Castro <aperez@igalia.com>]

[-- Attachment #1.1: Type: text/plain, Size: 2264 bytes --]

Hi Peter, all,

On Wed, 29 May 2024 08:16:17 +0200 Peter Korsgaard <peter@korsgaard.com> wrote:
> >>>>> "Adrian" == Adrian Perez de Castro <aperez@igalia.com> writes:
> 
>  > Update to the most recent stable release of WPE WebKit. As this is a
>  > change to a newer release series, there are a few changes in the CMake
>  > build options. Dependencies mostly remain the same. The main changes
>  > are:
> 
>  >  - The new ENABLE_WEB_CODECS option is set along with ENABLE_VIDEO and
>  >    ENABLE_WEB_RTC depending on BR2_PACKAGE_WPEWEBKIT_MULTIMEDIA.
>  >  - The new USE_LIBBACKTRACE option is set accordingly, depending on
>  >    BR2_PACKAGE_LIBBACKTRACE.
>  >  - WebAssembly does not work with ENABLE_C_LOOP, so it needs to be
>  >    disabled alongside it for MIPSr6, ARMv5 and ARMv6; not that building
>  >    WebAssembly support is enabled by default.
>  >  - ENABLE_ACCESSIBILITY has been removed, instead the new USE_ATK option
>  >    can be used to the same effect.
>  >  - JPEG2000 is no longer supported, the openjpeg dependency is removed.
> 
>  > Release notes and announcement:
> 
>  >   - https://wpewebkit.org/blog/2024-wpewebkit-2.44.html
> 
>  >   - https://wpewebkit.org/release/wpewebkit-2.44.0.html
>  >   - https://wpewebkit.org/release/wpewebkit-2.44.1.html
>  >   - https://wpewebkit.org/release/wpewebkit-2.44.2.html
> 
>  > Relevant security advisories:
> 
>  >   - https://wpewebkit.org/security/WSA-2024-0002.html
>  >   - https://wpewebkit.org/security/WSA-2024-0003.html
> 
>  > Signed-off-by: Adrian Perez de Castro <aperez@igalia.com>
>  
>  >  WPEWEBKIT_SITE = https://wpewebkit.org/releases
>  > -WPEWEBKIT_SOURCE = wpewebkit-$(WPEWEBKIT_VERSION).tar.xz
>  > +WPEWEBKIT_SOURCE = wpewebkit-$(WPEWEBKIT_VERSION).tar.lz
> 
> I know of the xz backdoor issue, but we use .xz in a LOT of packages and
> upstream provides .tar.xz, so I prefer to use that here as well to not
> have to pull in host-lzip.

Yes, I've been following the discussion, and how Buildroot wasn't
affected due to being somewhat slow picking updates =)

Good to know that you prefer to keep using .xz packages, I have just
submitted a version bump to Cog and kept using .xz as well there.

> Committed with that changed, thanks.

Thank you!

Cheers,
—Adrián

[-- Attachment #1.2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]

[-- Attachment #2: Type: text/plain, Size: 150 bytes --]

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot