[Buildroot] [PATCH v2 0/4] Update fail2ban to 1.1.0, add dependencies

[Buildroot] [PATCH v2 0/4] Update fail2ban to 1.1.0, add dependencies

[Fiona Klute via buildroot]

From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>

This patch series (unfortunately still not merged) by Angelo
Compagnucci fixed the fail2ban 1.0.2 build:
https://patchwork.ozlabs.org/project/buildroot/list/?series=403756

However it broke again with Python 3.12 due to incompatibilities in
upstream code. The 1.1.0 release fixes those, unfortunately it still
requires ported asyncore and asynchat modules. This series builds on
Angelo's (must be merged after) and updates fail2ban to 1.1.0 after
adding the required compatibility packages.

I hope the combined fixes (Angelo's and mine) can be merged soon. The
fail2ban build has been broken at least since April,
http://autobuild.buildroot.net/results/470/4709367a39a8ceb41b58454fc9638441a40624e0//
is the oldest example I can find in the autobuild output. I could add
a Fixes tag, but I'm not sure if that'd be appropriate here because
it's only correct when combined with Angelo's patches.

Changes v1 -> v2:
* Add patch 4 to fix the sshd filter with OpenSSH 9.8

Fiona Klute (WIWA) (4):
  package/python-pyasyncore: new package
  package/python-pyasynchat: new package
  package/fail2ban: bump version to 1.1.0
  package/fail2ban: fix sshd filter with OpenSSH 9.8

 package/Config.in                             |  2 ++
 ...lter-for-openssh-9.8-new-daemon-name.patch | 24 +++++++++++++++++++
 ...shd.conf-ungroup-unneeded-for-daemon.patch | 24 +++++++++++++++++++
 package/fail2ban/Config.in                    |  1 +
 package/fail2ban/fail2ban.hash                |  2 +-
 package/fail2ban/fail2ban.mk                  | 15 ++++++------
 package/python-pyasynchat/Config.in           | 11 +++++++++
 .../python-pyasynchat/python-pyasynchat.hash  |  5 ++++
 .../python-pyasynchat/python-pyasynchat.mk    | 15 ++++++++++++
 package/python-pyasyncore/Config.in           | 10 ++++++++
 .../python-pyasyncore/python-pyasyncore.hash  |  5 ++++
 .../python-pyasyncore/python-pyasyncore.mk    | 14 +++++++++++
 12 files changed, 120 insertions(+), 8 deletions(-)
 create mode 100644 package/fail2ban/0002-adjust-sshd-filter-for-openssh-9.8-new-daemon-name.patch
 create mode 100644 package/fail2ban/0003-filter.d-sshd.conf-ungroup-unneeded-for-daemon.patch
 create mode 100644 package/python-pyasynchat/Config.in
 create mode 100644 package/python-pyasynchat/python-pyasynchat.hash
 create mode 100644 package/python-pyasynchat/python-pyasynchat.mk
 create mode 100644 package/python-pyasyncore/Config.in
 create mode 100644 package/python-pyasyncore/python-pyasyncore.hash
 create mode 100644 package/python-pyasyncore/python-pyasyncore.mk

--
2.45.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 1/4] package/python-pyasyncore: new package

[Fiona Klute via buildroot]

From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>

pyasyncore is a compatibility package that provides the asyncore
module removed from the standard library in Python 3.12. It is needed
to support fail2ban without a bundled copy and should be removed as
soon as nothing in Buildroot depends on it.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
---
 package/Config.in                                |  1 +
 package/python-pyasyncore/Config.in              | 10 ++++++++++
 package/python-pyasyncore/python-pyasyncore.hash |  5 +++++
 package/python-pyasyncore/python-pyasyncore.mk   | 14 ++++++++++++++
 4 files changed, 30 insertions(+)
 create mode 100644 package/python-pyasyncore/Config.in
 create mode 100644 package/python-pyasyncore/python-pyasyncore.hash
 create mode 100644 package/python-pyasyncore/python-pyasyncore.mk

diff --git a/package/Config.in b/package/Config.in
index 48ef1a6fdc..38ebf13dbf 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -1253,6 +1253,7 @@ menu "External python modules"
 	source "package/python-pyalsa/Config.in"
 	source "package/python-pyasn1/Config.in"
 	source "package/python-pyasn1-modules/Config.in"
+	source "package/python-pyasyncore/Config.in"
 	source "package/python-pybind/Config.in"
 	source "package/python-pycairo/Config.in"
 	source "package/python-pycares/Config.in"
diff --git a/package/python-pyasyncore/Config.in b/package/python-pyasyncore/Config.in
new file mode 100644
index 0000000000..ad1376a243
--- /dev/null
+++ b/package/python-pyasyncore/Config.in
@@ -0,0 +1,10 @@
+config BR2_PACKAGE_PYTHON_PYASYNCORE
+	bool "python-pyasyncore"
+	help
+	  Make asyncore available for Python 3.12 onwards.
+
+	  This is a compatibility package using the code removed from
+	  the standard libary, upstream does not intend any
+	  maintenance.
+
+	  https://github.com/simonrob/pyasyncore
diff --git a/package/python-pyasyncore/python-pyasyncore.hash b/package/python-pyasyncore/python-pyasyncore.hash
new file mode 100644
index 0000000000..ee4665fe5e
--- /dev/null
+++ b/package/python-pyasyncore/python-pyasyncore.hash
@@ -0,0 +1,5 @@
+# md5, sha256 from https://pypi.org/pypi/pyasyncore/json
+md5  f97e2b69f1fa11470867b395c2fabf84  pyasyncore-1.0.4.tar.gz
+sha256  2c7a8b9b750ba6260f1e5a061456d61320a80579c6a43d42183417da89c7d5d6  pyasyncore-1.0.4.tar.gz
+# Locally computed sha256 checksums
+sha256  f4f80c98161f5632004d44713b5cb95e400145b40cbc0297f1f50c27b54befdb  LICENSE
diff --git a/package/python-pyasyncore/python-pyasyncore.mk b/package/python-pyasyncore/python-pyasyncore.mk
new file mode 100644
index 0000000000..9d08d493c4
--- /dev/null
+++ b/package/python-pyasyncore/python-pyasyncore.mk
@@ -0,0 +1,14 @@
+################################################################################
+#
+# python-pyasyncore
+#
+################################################################################
+
+PYTHON_PYASYNCORE_VERSION = 1.0.4
+PYTHON_PYASYNCORE_SOURCE = pyasyncore-$(PYTHON_PYASYNCORE_VERSION).tar.gz
+PYTHON_PYASYNCORE_SITE = https://github.com/simonrob/pyasyncore/releases/download/v$(PYTHON_PYASYNCORE_VERSION)
+PYTHON_PYASYNCORE_SETUP_TYPE = setuptools
+PYTHON_PYASYNCORE_LICENSE = Python Software Foundation License
+PYTHON_PYASYNCORE_LICENSE_FILES = LICENSE
+
+$(eval $(python-package))
--
2.45.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 2/4] package/python-pyasynchat: new package

[Fiona Klute via buildroot]

From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>

pyasynchat is a compatibility package that provides the asynchat
module removed from the standard library in Python 3.12. It is needed
to support fail2ban without a bundled copy and should be removed as
soon as nothing in Buildroot depends on it.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
---
 package/Config.in                                |  1 +
 package/python-pyasynchat/Config.in              | 11 +++++++++++
 package/python-pyasynchat/python-pyasynchat.hash |  5 +++++
 package/python-pyasynchat/python-pyasynchat.mk   | 15 +++++++++++++++
 4 files changed, 32 insertions(+)
 create mode 100644 package/python-pyasynchat/Config.in
 create mode 100644 package/python-pyasynchat/python-pyasynchat.hash
 create mode 100644 package/python-pyasynchat/python-pyasynchat.mk

diff --git a/package/Config.in b/package/Config.in
index 38ebf13dbf..faf8dd7d7e 100644
--- a/package/Config.in
+++ b/package/Config.in
@@ -1253,6 +1253,7 @@ menu "External python modules"
 	source "package/python-pyalsa/Config.in"
 	source "package/python-pyasn1/Config.in"
 	source "package/python-pyasn1-modules/Config.in"
+	source "package/python-pyasynchat/Config.in"
 	source "package/python-pyasyncore/Config.in"
 	source "package/python-pybind/Config.in"
 	source "package/python-pycairo/Config.in"
diff --git a/package/python-pyasynchat/Config.in b/package/python-pyasynchat/Config.in
new file mode 100644
index 0000000000..bf11cc5b39
--- /dev/null
+++ b/package/python-pyasynchat/Config.in
@@ -0,0 +1,11 @@
+config BR2_PACKAGE_PYTHON_PYASYNCHAT
+	bool "python-pyasynchat"
+	select BR2_PACKAGE_PYTHON_PYASYNCORE # runtime
+	help
+	  Make asynchat available for Python 3.12 onwards.
+
+	  This is a compatibility package using the code removed from
+	  the standard libary, upstream does not intend any
+	  maintenance.
+
+	  https://github.com/simonrob/pyasynchat
diff --git a/package/python-pyasynchat/python-pyasynchat.hash b/package/python-pyasynchat/python-pyasynchat.hash
new file mode 100644
index 0000000000..232f936bcc
--- /dev/null
+++ b/package/python-pyasynchat/python-pyasynchat.hash
@@ -0,0 +1,5 @@
+# md5, sha256 from https://pypi.org/pypi/pyasynchat/json
+md5  9fa7e3822f689b1236ca59c5f1b71415  pyasynchat-1.0.4.tar.gz
+sha256  3f5333df649e46c56d48c57e6a4b7163fd07f626bfd884e22ef373ab3c3a4670  pyasynchat-1.0.4.tar.gz
+# Locally computed sha256 checksums
+sha256  f4f80c98161f5632004d44713b5cb95e400145b40cbc0297f1f50c27b54befdb  LICENSE
diff --git a/package/python-pyasynchat/python-pyasynchat.mk b/package/python-pyasynchat/python-pyasynchat.mk
new file mode 100644
index 0000000000..8bd87af5c4
--- /dev/null
+++ b/package/python-pyasynchat/python-pyasynchat.mk
@@ -0,0 +1,15 @@
+################################################################################
+#
+# python-pyasynchat
+#
+################################################################################
+
+PYTHON_PYASYNCHAT_VERSION = 1.0.4
+PYTHON_PYASYNCHAT_SOURCE = pyasynchat-$(PYTHON_PYASYNCHAT_VERSION).tar.gz
+PYTHON_PYASYNCHAT_SITE = https://github.com/simonrob/pyasynchat/releases/download/v$(PYTHON_PYASYNCHAT_VERSION)
+PYTHON_PYASYNCHAT_SETUP_TYPE = setuptools
+PYTHON_PYASYNCHAT_LICENSE = Python Software Foundation License
+PYTHON_PYASYNCHAT_LICENSE_FILES = LICENSE
+PYTHON_PYASYNCHAT_DEPENDENCIES = python-pyasyncore
+
+$(eval $(python-package))
--
2.45.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Fiona Klute via buildroot]

From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>

Fail2ban 1.1.0 brings Python 3.12 compatibility, and removes support
for 2.x. This means 2to3 handling can be dropped.

Unfortunately fail2ban 1.1.0 still relies on asynchat and asyncore,
which have been removed from the Python standard library in
3.12. Depend on the compatibility package python-pyasynchat (which
pulls in python-pyasyncore) and remove copies bundled in upstream
code.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
---
 package/fail2ban/Config.in     |  1 +
 package/fail2ban/fail2ban.hash |  2 +-
 package/fail2ban/fail2ban.mk   | 15 ++++++++-------
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/package/fail2ban/Config.in b/package/fail2ban/Config.in
index 8a48a8c1d0..33228c3103 100644
--- a/package/fail2ban/Config.in
+++ b/package/fail2ban/Config.in
@@ -1,6 +1,7 @@
 config BR2_PACKAGE_FAIL2BAN
 	bool "fail2ban"
 	depends on BR2_PACKAGE_PYTHON3
+	select BR2_PACKAGE_PYTHON_PYASYNCHAT
 	select BR2_PACKAGE_PYTHON_SYSTEMD if BR2_PACKAGE_SYSTEMD
 	help
 	  Fail2ban scans log files (e.g. /var/log/apache/error_log) and
diff --git a/package/fail2ban/fail2ban.hash b/package/fail2ban/fail2ban.hash
index b40922e70a..8627e01f05 100644
--- a/package/fail2ban/fail2ban.hash
+++ b/package/fail2ban/fail2ban.hash
@@ -1,3 +1,3 @@
 # sha256 locally computed
-sha256  ae8b0b41f27a7be12d40488789d6c258029b23a01168e3c0d347ee80b325ac23  fail2ban-1.0.2.tar.gz
+sha256  474fcc25afdaf929c74329d1e4d24420caabeea1ef2e041a267ce19269570bae  fail2ban-1.1.0.tar.gz
 sha256  a75fec0260742fe6275d63ff6a5d97b924b28766558306b3fa4069763096929b  COPYING
diff --git a/package/fail2ban/fail2ban.mk b/package/fail2ban/fail2ban.mk
index 0c1208c6fe..9ab084b576 100644
--- a/package/fail2ban/fail2ban.mk
+++ b/package/fail2ban/fail2ban.mk
@@ -4,21 +4,22 @@
 #
 ################################################################################

-FAIL2BAN_VERSION = 1.0.2
+FAIL2BAN_VERSION = 1.1.0
 FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
 FAIL2BAN_LICENSE = GPL-2.0+
 FAIL2BAN_LICENSE_FILES = COPYING
 FAIL2BAN_CPE_ID_VENDOR = fail2ban
 FAIL2BAN_SELINUX_MODULES = fail2ban
 FAIL2BAN_SETUP_TYPE = setuptools
+FAIL2BAN_DEPENDENCIES = host-python3 python-pyasynchat

-define FAIL2BAN_PYTHON_2TO3
-	$(HOST_DIR)/bin/2to3 --write --nobackups --no-diffs $(@D)/bin/* $(@D)/fail2ban
+# fail2ban contains bundled copies of pyasyncore and pyasynchat,
+# remove them so only the packaged versions are installed.
+define FAIL2BAN_REMOVE_BUNDLED_COMPAT
+	$(SED) '/fail2ban\.compat/d' $(@D)/setup.py
+	rm -rf $(@D)/fail2ban/compat
 endef
-FAIL2BAN_DEPENDENCIES = host-python3
-# We can't use _POST_PATCH_HOOKS because dependencies are not guaranteed
-# to build and install before _POST_PATCH_HOOKS run.
-FAIL2BAN_PRE_CONFIGURE_HOOKS += FAIL2BAN_PYTHON_2TO3
+FAIL2BAN_POST_PATCH_HOOKS += FAIL2BAN_REMOVE_BUNDLED_COMPAT

 define FAIL2BAN_FIX_DEFAULT_CONFIG
 	$(SED) '/^socket/c\socket = /run/fail2ban.sock' $(TARGET_DIR)/etc/fail2ban/fail2ban.conf
--
2.45.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Thomas Petazzoni via buildroot]

Hello Fiona,

On Thu,  4 Jul 2024 14:13:51 +0200
Fiona Klute via buildroot <buildroot@buildroot.org> wrote:

> From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>
> 
> Fail2ban 1.1.0 brings Python 3.12 compatibility, and removes support
> for 2.x. This means 2to3 handling can be dropped.
> 
> Unfortunately fail2ban 1.1.0 still relies on asynchat and asyncore,
> which have been removed from the Python standard library in
> 3.12. Depend on the compatibility package python-pyasynchat (which
> pulls in python-pyasyncore) and remove copies bundled in upstream
> code.

Thanks for the detailed commit log. One question below, though.

> -FAIL2BAN_VERSION = 1.0.2
> +FAIL2BAN_VERSION = 1.1.0
>  FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
>  FAIL2BAN_LICENSE = GPL-2.0+
>  FAIL2BAN_LICENSE_FILES = COPYING
>  FAIL2BAN_CPE_ID_VENDOR = fail2ban
>  FAIL2BAN_SELINUX_MODULES = fail2ban
>  FAIL2BAN_SETUP_TYPE = setuptools
> +FAIL2BAN_DEPENDENCIES = host-python3 python-pyasynchat

Why are you adding host-python3 in the dependencies here?

Also, are you sure python-pyasynchat is a build time dependency, and
not just a runtime dependency? If that's the case, then you need to
kept the select in the Config.in file (with a comment # runtime), but
not have it as a build-time dependency in fail2ban.mk.

Thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Fiona Klute via buildroot]

Am 08.07.24 um 23:56 schrieb Thomas Petazzoni:
> Hello Fiona,
>
> On Thu,  4 Jul 2024 14:13:51 +0200
> Fiona Klute via buildroot <buildroot@buildroot.org> wrote:
>
>> From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>
>>
>> Fail2ban 1.1.0 brings Python 3.12 compatibility, and removes support
>> for 2.x. This means 2to3 handling can be dropped.
>>
>> Unfortunately fail2ban 1.1.0 still relies on asynchat and asyncore,
>> which have been removed from the Python standard library in
>> 3.12. Depend on the compatibility package python-pyasynchat (which
>> pulls in python-pyasyncore) and remove copies bundled in upstream
>> code.
>
> Thanks for the detailed commit log. One question below, though.
>
>> -FAIL2BAN_VERSION = 1.0.2
>> +FAIL2BAN_VERSION = 1.1.0
>>   FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
>>   FAIL2BAN_LICENSE = GPL-2.0+
>>   FAIL2BAN_LICENSE_FILES = COPYING
>>   FAIL2BAN_CPE_ID_VENDOR = fail2ban
>>   FAIL2BAN_SELINUX_MODULES = fail2ban
>>   FAIL2BAN_SETUP_TYPE = setuptools
>> +FAIL2BAN_DEPENDENCIES = host-python3 python-pyasynchat
>
> Why are you adding host-python3 in the dependencies here?

I saw a build failure because host Python hadn't been built before
without it. I now suspect that was the result of adding a runtime-only
dependency to build-time dependencies (see below), I guess it broke some
implicit dependency handling? After completely removing that line the
build passes, too.

> Also, are you sure python-pyasynchat is a build time dependency, and
> not just a runtime dependency? If that's the case, then you need to
> kept the select in the Config.in file (with a comment # runtime), but
> not have it as a build-time dependency in fail2ban.mk.

That's indeed a runtime dependency.

Thanks for the review! I've just sent an updated version of the series
with the runtime comment added and the build time dependency removed. If
it's good to merge now, please keep in mind that it's only going to fix
the fail2ban build if merged after Angelo's fixes to the config file
handling (linked in the cover letter).

Best regards,
Fiona

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Thomas Petazzoni via buildroot]

Hello Fiona,

On Tue, 9 Jul 2024 12:19:49 +0200
Fiona Klute <fiona.klute@gmx.de> wrote:

> >> -FAIL2BAN_VERSION = 1.0.2
> >> +FAIL2BAN_VERSION = 1.1.0
> >>   FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
> >>   FAIL2BAN_LICENSE = GPL-2.0+
> >>   FAIL2BAN_LICENSE_FILES = COPYING
> >>   FAIL2BAN_CPE_ID_VENDOR = fail2ban
> >>   FAIL2BAN_SELINUX_MODULES = fail2ban
> >>   FAIL2BAN_SETUP_TYPE = setuptools
> >> +FAIL2BAN_DEPENDENCIES = host-python3 python-pyasynchat  
> >
> > Why are you adding host-python3 in the dependencies here?  
> 
> I saw a build failure because host Python hadn't been built before
> without it. I now suspect that was the result of adding a runtime-only
> dependency to build-time dependencies (see below), I guess it broke some
> implicit dependency handling? After completely removing that line the
> build passes, too.

Adding a runtime dependency to build-time dependencies cannot break
dependency handling. It just enforces a "strong" dependency that
doesn't exist, but it clearly cannot be responsible for a build
failure. So it looks like we haven't figured out why the build was at
some point failing for you.

A good practice when testing a package:

$ make clean
$ ./utils/docker-run make fail2ban

This will only build fail2ban and its build dependencies, and nothing
else. This will therefore make sure that you properly captured all
dependencies. And it does so in a minimal docker container, to ensure
no tools from your host machine are used.

> > Also, are you sure python-pyasynchat is a build time dependency, and
> > not just a runtime dependency? If that's the case, then you need to
> > kept the select in the Config.in file (with a comment # runtime), but
> > not have it as a build-time dependency in fail2ban.mk.  
> 
> That's indeed a runtime dependency.
> 
> Thanks for the review! I've just sent an updated version of the series
> with the runtime comment added and the build time dependency removed. If
> it's good to merge now, please keep in mind that it's only going to fix
> the fail2ban build if merged after Angelo's fixes to the config file
> handling (linked in the cover letter).

ACK, thanks!

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Fiona Klute via buildroot]

Am 09.07.24 um 13:55 schrieb Thomas Petazzoni:
> Hello Fiona,
>
> On Tue, 9 Jul 2024 12:19:49 +0200
> Fiona Klute <fiona.klute@gmx.de> wrote:
>
>>>> -FAIL2BAN_VERSION = 1.0.2
>>>> +FAIL2BAN_VERSION = 1.1.0
>>>>    FAIL2BAN_SITE = $(call github,fail2ban,fail2ban,$(FAIL2BAN_VERSION))
>>>>    FAIL2BAN_LICENSE = GPL-2.0+
>>>>    FAIL2BAN_LICENSE_FILES = COPYING
>>>>    FAIL2BAN_CPE_ID_VENDOR = fail2ban
>>>>    FAIL2BAN_SELINUX_MODULES = fail2ban
>>>>    FAIL2BAN_SETUP_TYPE = setuptools
>>>> +FAIL2BAN_DEPENDENCIES = host-python3 python-pyasynchat
>>>
>>> Why are you adding host-python3 in the dependencies here?
>>
>> I saw a build failure because host Python hadn't been built before
>> without it. I now suspect that was the result of adding a runtime-only
>> dependency to build-time dependencies (see below), I guess it broke some
>> implicit dependency handling? After completely removing that line the
>> build passes, too.
>
> Adding a runtime dependency to build-time dependencies cannot break
> dependency handling. It just enforces a "strong" dependency that
> doesn't exist, but it clearly cannot be responsible for a build
> failure. So it looks like we haven't figured out why the build was at
> some point failing for you.
>
> A good practice when testing a package:
>
> $ make clean
> $ ./utils/docker-run make fail2ban
>
> This will only build fail2ban and its build dependencies, and nothing
> else. This will therefore make sure that you properly captured all
> dependencies. And it does so in a minimal docker container, to ensure
> no tools from your host machine are used.

Thanks for the hint! That passes with the v3 of the patch series I sent
earlier.

Is there a recommended way to run that with an out-of-tree build? I'm
not seeing any option for that in utils/docker-run.

Best regards,
Fiona

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Thomas Petazzoni via buildroot]

On Tue, 9 Jul 2024 18:25:02 +0200
Fiona Klute <fiona.klute@gmx.de> wrote:

> Thanks for the hint! That passes with the v3 of the patch series I sent
> earlier.
> 
> Is there a recommended way to run that with an out-of-tree build? I'm
> not seeing any option for that in utils/docker-run.

Hm, I'm not sure to see the problem with using docker-run and
out-of-tree build.

$ mkdir /tmp/foo
$ cd /tmp/foo
$ ~/buildroot/utils/docker-run make -C ~/buildroot O=$(pwd) qemu_arm_vexpress_defconfig
$ ~/buildroot/utils/docker-run make

and that's it?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Fiona Klute via buildroot]

Am 09.07.24 um 20:35 schrieb Thomas Petazzoni:
> On Tue, 9 Jul 2024 18:25:02 +0200
> Fiona Klute <fiona.klute@gmx.de> wrote:
>
>> Thanks for the hint! That passes with the v3 of the patch series I sent
>> earlier.
>>
>> Is there a recommended way to run that with an out-of-tree build? I'm
>> not seeing any option for that in utils/docker-run.
>
> Hm, I'm not sure to see the problem with using docker-run and
> out-of-tree build.
>
> $ mkdir /tmp/foo
> $ cd /tmp/foo
> $ ~/buildroot/utils/docker-run make -C ~/buildroot O=$(pwd) qemu_arm_vexpress_defconfig
> $ ~/buildroot/utils/docker-run make
>
> and that's it?

If you just use a fresh defconfig, yes, but that doesn't quite work for
fail2ban (there isn't one that enables it, it needs Python, and I'd like
to build with musl to match my target). I guess it'd be easy enough to
create a snippet with the required config, append it after defconfig,
and run "make oldconfig".

But then I still wouldn't get to reuse BR2_DL_DIR (though
utils/docker-run can use that from environment) and the CCache setup.

I could use a defconfig from my external tree, but then I'd need to get
utils/docker-run to mount it. That might actually be an option: Make
utils/docker-run honor BR2_EXTERNAL the same way it does BR2_DL_DIR.
Would such a patch be welcome? If yes I'm going to give it a try.

Best regards,
Fiona

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Thomas Petazzoni via buildroot]

Hello Fiona,

On Wed, 10 Jul 2024 13:17:58 +0200
Fiona Klute <fiona.klute@gmx.de> wrote:

> If you just use a fresh defconfig, yes, but that doesn't quite work for
> fail2ban (there isn't one that enables it, it needs Python, and I'd like
> to build with musl to match my target). I guess it'd be easy enough to
> create a snippet with the required config, append it after defconfig,
> and run "make oldconfig".
> 
> But then I still wouldn't get to reuse BR2_DL_DIR (though
> utils/docker-run can use that from environment) and the CCache setup.

Not sure what's the problem here. Here is another example, where I
start from a simple config for an ARMv7 toolchain:

$ mkdir /tmp/foo
$ cp ~/buildroot/support/config-fragments/autobuild/bootlin-armv7-glibc.config .config
$ ~/buildroot/utils/docker-run make -C ~/buildroot O=$(pwd) menuconfig

enable BR2_PACKAGE_PYTHON3=y and BR2_PACKAGE_FAIL2BAN=y in menuconfig, exit

$ ~/buildroot/utils/docker-run make

and that's it. No need to have an existing defconfig.

Regarding BR2_DL_DIR: it re-uses the one defined in your environment
outside the docker container, so it just works. Regarding BR2_CCACHE,
you can set the option in menuconfig, but indeed it wouldn't re-use the
cache that's available outside the container.

> I could use a defconfig from my external tree, but then I'd need to get
> utils/docker-run to mount it. That might actually be an option: Make
> utils/docker-run honor BR2_EXTERNAL the same way it does BR2_DL_DIR.
> Would such a patch be welcome? If yes I'm going to give it a try.

See above: you don't need an existing defconfig to test things.

However, it would indeed perhaps make sense for docker-run to mount
BR2_EXTERNAL trees inside the container.

Best regards,

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Fiona Klute via buildroot]

Hi Thomas!

Am 10.07.24 um 13:47 schrieb Thomas Petazzoni:
> On Wed, 10 Jul 2024 13:17:58 +0200
> Fiona Klute <fiona.klute@gmx.de> wrote:
>
>> If you just use a fresh defconfig, yes, but that doesn't quite work for
>> fail2ban (there isn't one that enables it, it needs Python, and I'd like
>> to build with musl to match my target). I guess it'd be easy enough to
>> create a snippet with the required config, append it after defconfig,
>> and run "make oldconfig".
>>
>> But then I still wouldn't get to reuse BR2_DL_DIR (though
>> utils/docker-run can use that from environment) and the CCache setup.
>
> Not sure what's the problem here. Here is another example, where I
> start from a simple config for an ARMv7 toolchain:
>
> $ mkdir /tmp/foo
> $ cp ~/buildroot/support/config-fragments/autobuild/bootlin-armv7-glibc.config .config
> $ ~/buildroot/utils/docker-run make -C ~/buildroot O=$(pwd) menuconfig
>
> enable BR2_PACKAGE_PYTHON3=y and BR2_PACKAGE_FAIL2BAN=y in menuconfig, exit

Having to manually edit the config is exactly what I was trying to
avoid, whether by using an existing .config or a defconfig that enables
the options I need. Minimizing friction. ;-)

> $ ~/buildroot/utils/docker-run make
>
> and that's it. No need to have an existing defconfig.
>
> Regarding BR2_DL_DIR: it re-uses the one defined in your environment
> outside the docker container, so it just works. Regarding BR2_CCACHE,
> you can set the option in menuconfig, but indeed it wouldn't re-use the
> cache that's available outside the container.
>
>> I could use a defconfig from my external tree, but then I'd need to get
>> utils/docker-run to mount it. That might actually be an option: Make
>> utils/docker-run honor BR2_EXTERNAL the same way it does BR2_DL_DIR.
>> Would such a patch be welcome? If yes I'm going to give it a try.
>
> See above: you don't need an existing defconfig to test things.
>
> However, it would indeed perhaps make sense for docker-run to mount
> BR2_EXTERNAL trees inside the container.

I've just sent a patch. :-)

Best regards,
Fiona

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH v2 3/4] package/fail2ban: bump version to 1.1.0

[Thomas Petazzoni via buildroot]

Hello,

On Wed, 10 Jul 2024 20:41:17 +0200
Fiona Klute <fiona.klute@gmx.de> wrote:

> > $ mkdir /tmp/foo
> > $ cp ~/buildroot/support/config-fragments/autobuild/bootlin-armv7-glibc.config .config
> > $ ~/buildroot/utils/docker-run make -C ~/buildroot O=$(pwd) menuconfig
> >
> > enable BR2_PACKAGE_PYTHON3=y and BR2_PACKAGE_FAIL2BAN=y in menuconfig, exit  
> 
> Having to manually edit the config is exactly what I was trying to
> avoid, whether by using an existing .config or a defconfig that enables
> the options I need. Minimizing friction. ;-)

Well, then:

$ mkdir /tmp/foo
$ cd /tmp/foo
$ cp ~/buildroot/support/config-fragments/autobuild/bootlin-armv7-glibc.config .config
$ cat > .config<<EOF
BR2_PACKAGE_PYTHON3=y
BR2_PACKAGE_FAIL2BAN=y
EOF
$ ~/buildroot/utils/docker-run make olddefconfig
$ ~/buildroot/utils/docker-run make

done.

> > However, it would indeed perhaps make sense for docker-run to mount
> > BR2_EXTERNAL trees inside the container.  
> 
> I've just sent a patch. :-)

Seen. I'll probably wait for the review from Yann E. Morin on this
change though.

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

[Buildroot] [PATCH v2 4/4] package/fail2ban: fix sshd filter with OpenSSH 9.8

[Fiona Klute via buildroot]

From: "Fiona Klute (WIWA)" <fiona.klute@gmx.de>

The filter needs to consider the new sshd-session binary, patches
already merged upstream.

Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
---
Changes v1 -> v2:
* Add this patch to fix the sshd filter with OpenSSH 9.8

 ...lter-for-openssh-9.8-new-daemon-name.patch | 24 +++++++++++++++++++
 ...shd.conf-ungroup-unneeded-for-daemon.patch | 24 +++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 package/fail2ban/0002-adjust-sshd-filter-for-openssh-9.8-new-daemon-name.patch
 create mode 100644 package/fail2ban/0003-filter.d-sshd.conf-ungroup-unneeded-for-daemon.patch

diff --git a/package/fail2ban/0002-adjust-sshd-filter-for-openssh-9.8-new-daemon-name.patch b/package/fail2ban/0002-adjust-sshd-filter-for-openssh-9.8-new-daemon-name.patch
new file mode 100644
index 0000000000..026cef9693
--- /dev/null
+++ b/package/fail2ban/0002-adjust-sshd-filter-for-openssh-9.8-new-daemon-name.patch
@@ -0,0 +1,24 @@
+From 2fed408c05ac5206b490368d94599869bd6a056d Mon Sep 17 00:00:00 2001
+From: Fabian Dellwing <fabian.dellwing@mbconnectline.de>
+Date: Tue, 2 Jul 2024 07:54:15 +0200
+Subject: [PATCH] Adjust sshd filter for OpenSSH 9.8 new daemon name
+
+Upstream: https://github.com/fail2ban/fail2ban/commit/2fed408c05ac5206b490368d94599869bd6a056d
+Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
+---
+ config/filter.d/sshd.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
+index 1c8a02deb5..a1fd749aed 100644
+--- a/config/filter.d/sshd.conf
++++ b/config/filter.d/sshd.conf
+@@ -16,7 +16,7 @@ before = common.conf
+
+ [DEFAULT]
+
+-_daemon = sshd
++_daemon = (?:sshd(?:-session)?)
+
+ # optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
+ __pref = (?:(?:error|fatal): (?:PAM: )?)?
diff --git a/package/fail2ban/0003-filter.d-sshd.conf-ungroup-unneeded-for-daemon.patch b/package/fail2ban/0003-filter.d-sshd.conf-ungroup-unneeded-for-daemon.patch
new file mode 100644
index 0000000000..597df667f0
--- /dev/null
+++ b/package/fail2ban/0003-filter.d-sshd.conf-ungroup-unneeded-for-daemon.patch
@@ -0,0 +1,24 @@
+From 50ff131a0fd8f54fdeb14b48353f842ee8ae8c1a Mon Sep 17 00:00:00 2001
+From: "Sergey G. Brester" <serg.brester@sebres.de>
+Date: Wed, 3 Jul 2024 19:35:28 +0200
+Subject: [PATCH] filter.d/sshd.conf: ungroup (unneeded for _daemon)
+
+Upstream: https://github.com/fail2ban/fail2ban/commit/50ff131a0fd8f54fdeb14b48353f842ee8ae8c1a
+Signed-off-by: Fiona Klute (WIWA) <fiona.klute@gmx.de>
+---
+ config/filter.d/sshd.conf | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
+index a1fd749aed..3a84b1ba52 100644
+--- a/config/filter.d/sshd.conf
++++ b/config/filter.d/sshd.conf
+@@ -16,7 +16,7 @@ before = common.conf
+
+ [DEFAULT]
+
+-_daemon = (?:sshd(?:-session)?)
++_daemon = sshd(?:-session)?
+
+ # optional prefix (logged from several ssh versions) like "error: ", "error: PAM: " or "fatal: "
+ __pref = (?:(?:error|fatal): (?:PAM: )?)?
--
2.45.2

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot