Commit Graph

11192 Commits

Author SHA1 Message Date
Adolf Belka
4bcda9e4da harfbuzz: Update to version 8.0.1
- Update from version 7.3.0 to 8.0.1
- Update of rootfile
- Changelog
    Overview of changes leading to 8.0.1
	- Build fix on 32-bit arm.
	- More speed optimizations:
	  - 60% speedup in retaingids subsetting SourceHanSans-VF.
	  - 38% speed up in subsetting (beyond-64k) mega-merged Noto.
	  - 16% speed up in retain-gid (used for IFT) subsetting of NotoSansCJKkr.
    Overview of changes leading to 8.0.0
	- New, experimental, WebAssembly (WASM) shaper, that provides greater
	   flexibility over OpenType/AAT/Graphite shaping, using WebAssembly embedded
	   inside the font file. Currently WASM shaper is disabled by default and needs
	   to be enabled at build time. For details, see:
	    https://github.com/harfbuzz/harfbuzz/blob/main/docs/wasm-shaper.md
	  For example fonts making use of the WASM shaper, see:
	    https://github.com/simoncozens/wasm-examples
	- Improvements to Experimental features introduced in earlier releases:
	  - Support for subsetting beyond-64k and VarComposites fonts.
	  - Support for instancing variable fonts with cubic “glyf” table.
	- Many big speed optimizations:
	  - Up to 89% speedup loading variable fonts for shaping.
	  - Up to 88% speedup in small subsets of large (eg. CJK) fonts (both TTF and
	    OTF), essential for Incremental Font Transfer (IFT).
	  - Over 50% speedup in loading Roboto font for shaping.
	  - Up to 40% speed up in loading (sanitizing) complex fonts.
	  - 30% speed up in shaping Gulzar font.
	  - Over 25% speedup in glyph loading Roboto font.
	  - 10% speed up loading glyph shapes in VarComposite Hangul font.
	  - hb-hashmap optimizations & hashing improvements.
	- New macro HB_ALWAYS_INLINE. HarfBuzz now inlines functions more aggressively,
	   which results in some speedup at the expense of bigger code size. To disable
	   this feature define the macro to just inline.
	- New API:
	  +HB_CODEPOINT_INVALID
	  +hb_ot_layout_get_baseline2()
	  +hb_ot_layout_get_baseline_with_fallback2()
	  +hb_ot_layout_get_font_extents()
	  +hb_ot_layout_get_font_extents2()
	  +hb_subset_input_set_axis_range()

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
a6937c22a7 core178: Ship udev
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Adolf Belka
648ffde1ca udev: Update to version 3.2.12
- Update from version 3.2.11 to 3.2.12
- Update of rootfile
- Changelog
    3.2.12
	-rules/50-udev-default.rules: add PTP entry for Hyper-V/Azure by @dermotbradley
          in #218
	-Add the BUILD instructions for Gentoo by @lu-zero in #224
	-Fix warnings by @bbonev in #222
	-udev: add udev_dir as synonym of udevdir by @oreo639 in #225
	-build: Remove dead g-i-r configuration by @akiernan in #231
	-Hwdb.7 by @bbonev in #221
	-Precompiled hwdb by @bbonev in #223
	-Merge suitable rules changes from systemd by @bbonev in #220
	-Merge hwdb from systemd by @bbonev in #219
	-Fix problems detected by fortified builds by @bbonev in #232
	-Avoid warning on 32bit by @bbonev in #233
	-Systemd PR 24353 by @bbonev in #239
	-Do not free a static string by @bbonev in #238
	-man: udev.7, mention /usr/lib with split-usr by @omnivagant in #246
	-Missing tools by @bbonev in #240
	-Fix compile-time issue on very old kernels by @cockroach in #247

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
03fb7526a6 libxml2: Fix extra newline at end of rootfile
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Adolf Belka
7bf6f900df libxml2: Update to version 2.11.4
- Update from version 2.11.1 to 2.11.4
- Update of rootfile
- Changelog
    v2.11.4: May 18 2023
	Fixes a serious regression.
		- parser: Fix regression when push parsing UTF-8 sequences
    v2.11.3: May 11 2023
	Fixes more regressions.
		- xinclude: Fix false positives in inclusion loop detection
		- autotools: Fix ICU detection
		- parser: Fix "huge input lookup" error with push parser
		- xpath: Fix build without LIBXML_XPATH_ENABLED
		- hash: Fix possible startup crash with old libxslt versions
		- autoconf: fix iconv library paths (Mike Dalessio)
    v2.11.2: May 5 2023
	Fix regressions.
		- threads: Fix startup crash with weak symbol hack
		- win32: Don't depend on removed .def file
		- schemas: Fix memory leak in xmlSchemaValidateStream

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
a2ecde369d core178: Ship libxcrypt
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
7a3c808f4c core178: Ship large parts of the OS again because of IBT
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
46e91ccc33 Start Core Update 178
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:59 +00:00
Michael Tremer
84a3246be9 alsa: Fix rootfile after moving linux-firmware
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:08:49 +00:00
Arne Fitzenreiter
50c07b4938 kernel: update to 6.1.41
fix for CVE-2023-20593 (Zenbleed)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-26 16:01:20 +00:00
Michael Tremer
5c4faba67b linux-firmware: Fix AMD microcode updates for Zenbleed
https://lock.cmpxchg8b.com/zenbleed.html

Fixes: CVE-2023-20593
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-25 11:15:45 +00:00
Arne Fitzenreiter
719864d37e kernel: update to 6.1.40
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-25 10:39:22 +00:00
Matthias Fischer
ee4123d2c8 ghostscript: Update to 10.01.2
For details see:
https://git.ghostscript.com/?p=ghostpdl.git;a=shortlog;h=refs/tags/ghostpdl-10.01.2

Fixes CVE-2023-36664:
=> https://www.cvedetails.com/cve/CVE-2023-36664/
=> https://www.kroll.com/en/insights/publications/cyber/ghostscript-cve-2023-36664-remote-code-execution-vulnerability

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-24 14:27:12 +00:00
Arne Fitzenreiter
f2d5cb7c99 kernel: update to 6.1.39
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-21 09:34:12 +00:00
Arne Fitzenreiter
f6615f3025 kernel: fix rootfile
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-21 09:34:09 +00:00
Michael Tremer
69d7702dde core177: Ship & restart OpenSSH
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-21 09:33:34 +00:00
Michael Tremer
2e63b7128e dehydrated: Keep going if re-issuing one certificate fails
This change will make sure that dehydrated will continue if (re-)issuing
one or more certificate fails.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:29:13 +00:00
Michael Tremer
a1836ab120 core177: Do not ship location database extracted in ipset format
Since the update is not built on the day when people install it, we will
ship an outdated database. For updates, where the firewall is being
reloaded or rebooted, we will have an old database in place until the
next database update job runs.

Secondly, the data is 33 MiB in size, which is useless data shipped as
every system will already have a database that is very likely to be more
recent.

In this update, we are not shipping the location database again, but I
wanted to add this change so it does not get lost next time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:29:03 +00:00
Peter Müller
16c82f31aa Core Update 177: Ship unbound-dhcp-leases-bridge
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:28:44 +00:00
Michael Tremer
f20ca78eff unbound-dhcp-leases-bridge: Reload unbound to import leases
This changes the old "diff" algorithm that we needed to have before
Unbound was able to reload its own configuration.

Now, it can do this even without dropping the cache. This should
hopefully perform much better and be more reliable than the old way.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Acked-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:26:52 +00:00
Peter Müller
1b6b4118b2 Core Update 177: Ship fireinfo
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:26:34 +00:00
Jon Murphy
525e575e04 pmacct: fix bug 13159
- changes `interface` to `pcap_interface` in pmacct.conf file.
- thank you to @iptom for finding and reporting the issue and
   to many others for pitching in and helping debug!

Signed-off-by: Jon Murphy <jon.murphy@ipfire.org>
2023-07-13 14:22:04 +00:00
Peter Müller
cc78ea658d Core Update 177: Delete OpenSSL 1.1.1 files
Originally announced for Core Update 176, this step was postponed until
Core Update 177 due to my fault of having shipped all necessary
dependencies for OpenSSL 3.x in Core Update 175 properly.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-13 14:21:35 +00:00
Peter Müller
e08399ddd3 linux: Trigger a BUG() when corruption of kernel data structures is detected
Given that this will merely log such an incident, this can be safely
enabled.

Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-13 14:20:48 +00:00
Peter Müller
c084d8f970 linux: Enable Indirect Branch Tracking by default
This became upstream default (see
https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media
coverage), and given its security-relevance, we should adopt this
setting as well.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-13 14:20:32 +00:00
Arne Fitzenreiter
f7447b1b8e kernel: update to 6.1.38
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-13 14:20:18 +00:00
Peter Müller
46c8316642 Core Updte 177: Ship and restart Squid
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-09 15:11:34 +00:00
Peter Müller
8e82fd2187 Core Update 177: Remove dropped squidclamav add-on, if installed
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-09 15:07:07 +00:00
Adolf Belka
a6039dc9d1 squidclamav: Remove package from IPFire as agreed in dev video call 3rd Jul 2023
- Removal of lfs file
- Removal of rootfile
- Removal of backup includes file
- Removal of three patches
- Removal of paks files
- Adjustment of make.sh to remove squidclamav

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-09 15:05:06 +00:00
Peter Müller
97b155a15c Core Update 177: Ship kernel and regenerate initial ramdisks locally
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-09 15:00:17 +00:00
Arne Fitzenreiter
1a44c7a638 kernel: update to 6.1.37
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
2023-07-09 14:57:38 +00:00
Peter Müller
271e3b6a0e util-linux: Hrmpf, fix aarch64 rootfile again
My fault, again. :-/

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-09 10:21:24 +00:00
Peter Müller
00ff498eb5 util-linux: Update aarch64 rootfile
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-06 23:20:51 +00:00
Peter Müller
84476785e2 Core Update 177: Remove superflous line from files
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-03 21:07:49 +00:00
Peter Müller
ee9476348b Core Update 177: Rebuild initial ramdisk to apply AMD microcode updates
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-03 17:50:36 +00:00
Peter Müller
5ea686072b Core Update 177: Ship relevant changes of linux-firmware and require a reboot
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-03 17:49:14 +00:00
Adolf Belka
6fb7d35b49 linux-firmware: Update to version 20230625
- Update from version 20230404 to 20230625
- Update of rootfile carried out based on Peter Mueller's description from last
   linux-firmware update.
- It would be good to have it checked that my results are in line with what they should be.
- Changelog
   For changes see the commits in the git repo
   https://git.kernel.org/pub/scm/linux/kernel/git/firmware/linux-firmware.git/log/

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
2023-07-03 17:38:36 +00:00
Peter Müller
1842f3dccb Core Update 177: Ship squid-asnbl and restart Squid
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:31:45 +00:00
Peter Müller
81ed7573b1 Core Update 177: Ship util-linux
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:25:43 +00:00
Adolf Belka
230c81622a util-linux: Update to version 2.39.1
- Update from version 2.38.1 to 2.39.1
- Update of rootfile made for x86_64 but not for aarch64 or riscv64
- Changelog can only be reviewed by looking at the commits in the git repo
   https://github.com/util-linux/util-linux/commits/master

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:19:12 +00:00
Peter Müller
3dd626fefd Core Update 177: Ship iproute2
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:13:27 +00:00
Peter Müller
0cb1687b21 Core Update 177: Ship sudo
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:10:54 +00:00
Peter Müller
8ebb8091d9 Core Update 177: Ship and restart ntp
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 19:09:20 +00:00
Peter Müller
384302344c Start Core Update 177
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-07-01 18:55:36 +00:00
Michael Tremer
36ab906de4 core176: Re-ship libssh
This was also linked against OpenSSL 1.1.1.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-06-28 18:46:01 +00:00
Michael Tremer
87d0d07bbc core176: Re-ship lots of stuff that is still linked against OpenSSL 1.1.1
There are no functional changes in these files, but they are however
linked against OpenSSL 1.1.1 and need to be re-shipped before we remove
the legacy library.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-06-27 10:06:45 +00:00
Michael Tremer
08bd9a5a94 Revert "Core Update 176: Delete OpenSSL 1.1.1 files"
This reverts commit aa8a659ab7.

This cannot be done, yet, because an updated system still has hundreds
of files using the old libraries. Those will have to be re-shipped first
before we actually remove OpenSSL 1.1.1.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
2023-06-27 09:46:48 +00:00
Peter Müller
3a86abcf49 Core Update 176: Ship and restart strongSwan
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-06-25 20:59:55 +00:00
Peter Müller
b35bbd2ba2 Core Update 176: Ship freetype
Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-06-25 20:57:03 +00:00
Peter Müller
9270456fa2 freetype: Update to 2.13.1
Changelog is too long to include it here, please refer to the ChangeLog
file in the sourcecode tarball.

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
2023-06-25 20:53:42 +00:00