summaryrefslogtreecommitdiff
path: root/meta/recipes-support/curl
AgeCommit message (Collapse)AuthorFiles
2018-11-09curl: actually apply latest CVE patchesRoss Burton1
Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-11-06curl: fix for CVE-2018-16839/CVE-2018-16840/CVE-2018-16842Changqing Li3
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-29curl: extend CVE_PRODUCTGrygorii Tertychnyi1
There are both "curl" and "libcurl" CPEs in NVD. All "curl" CVEs are now missed in the reports. Hence, switch "CVE_PRODUCT" to a space separated list of the items. Signed-off-by: Grygorii Tertychnyi <gtertych@cisco.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-10-09curl: Include the complete license informationPeter Kjellerstedt1
For some reason, the copyright part was left out of the license information included in LIC_FILES_CHKSUM, preventing it from being used in, e.g., documentation to satisfy the requirements of the license. License-Update: Include the complete license information Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-09-20curl: CVE-2018-14618Zhixiong Chi2
Backport the CVE patch from the upstream https://github.com/curl/curl/commit/57d299a499155d4b327e341c6024e293b0418243.patch https://curl.haxx.se/docs/CVE-2018-14618.html https://nvd.nist.gov/vuln/detail/CVE-2018-14618 Signed-off-by: Zhixiong Chi <zhixiong.chi@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-08-14curl: support multilib installation of curl-configChangqing Li1
Signed-off-by: Changqing Li <changqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-07-30curl: enable libidnRoss Burton1
Now that oe-core has libidn2 we can enable it by default in target curl builds. Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-26curl: disable C source code generatorAndre McCurdy1
The --libcurl command line option causes curl to generate C source code which, when compiled and linked with libcurl, creates a binary which behaves in the same way as curl when run with the other options passed on the curl command line. https://curl.haxx.se/docs/manpage.html#--libcurl It's a development tool and not generally useful on the target, especially if the target doesn't contain a toolchain etc. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-18curl: add PACKAGECONFIG options for brotli, built-in manpages, etcAndre McCurdy1
- Add PACKAGECONFIG option for brotli (disable by default) - Add PACKAGECONFIG option for built-in manpages (disabled by default). Embedding a copy of the manpages within the curl binary adds approx 60k of gzipped data and duplicates the contents of the curl-doc package. - Add PACKAGECONFIG option for verbose error messages (enabled by default) - Disable legacy NTLM http authentication via delegation to the external winbind ntlm_auth helper (which isn't going to work without a runtime dependency on samba). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-18curl: update 7.60.0 -> 7.61.0Andre McCurdy1
https://curl.haxx.se/changes.html#7_61_0 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-07-06curl: support mbedtls in PACKAGECONFIGBinghua Guan1
Signed-off-by: Binghua Guan <freebendy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-29curl: update 7.59.0 -> 7.60.0Andre McCurdy3
https://curl.haxx.se/changes.html#7_60_0 Also refresh 0001-replace-krb5-config-with-pkg-config.patch and drop configure_ac.patch, which we've apparently been dragging along unnecessarily for the past 5 years: https://github.com/curl/curl/commit/c277bd6ce7069819484eb3dc30b5858735fde377 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-05-04curl: update to 7.59.0Armin Kuster1
Signed-off-by: Armin Kuster <akuster@mvista.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-04-06curl: DEPENDS on libidn2 (not libidn)André Draszik1
Since v7.51.0, libidn2 is the only available option, libidn support was dropped. The configure option was renamed as of v7.53.0 Therefore, curl unconditionally tries to build against libidn2, which in particular is a problem for curl-native, as that might or might not build against the build-machine's libidn2 now, which furthermore causes problems when trying to share sstate between multiple build machines. We therefore see the following in the config log: ... checking whether to build with libidn2... (assumed) yes ... checking for libidn2 options with pkg-config... no configure: IDN_LIBS: "-lidn2" configure: IDN_LDFLAGS: "" configure: IDN_CPPFLAGS: "" configure: IDN_DIR: "" checking if idn2_lookup_ul can be linked... yes checking idn2.h usability... yes checking idn2.h presence... yes checking for idn2.h... yes ... IDN support: enabled (libidn2) ... even though this recipe tries to disable that. While libidn2 isn't available in OE, this change at least: * prevents curl-native to silently build against libidn2 if that is installed on build machine, even if not requested * alerts people who use the PACKAGECONFIG option that it's not actually doing what they intend to do Signed-off-by: André Draszik <andre.draszik@jci.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2018-02-24curl: upgrade to 7.58.0Oleksandr Kravchuk1
Signed-off-by: Oleksandr Kravchuk <open.source@oleksandr-kravchuk.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2018-01-26curl: 7.54.1 -> 7.57.0Huang Qiyu6
1.Upgrade curl from 7.54.1 to 7.57.0. 2.Delete CVE-2017-1000099.patch, CVE-2017-1000100.patch, CVE-2017-1000101.patch, CVE-2017-1000254.patch, reproducible-mkhelp.patch, since it is integrated upstream. 3.Remove "do_install_append()" from curl_7.57.0.bb, since curl/curlbuild.h has been removed. Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-08curl_7.54.1.bb: improve reproducibilityJuro Bystricky2
Improve reproducible build of curl-dev and curl-dbg packages. curl-dev: Correctly remove build host references from curl-config curl-dbg: Do not generate time stamps in files generated by mkhelp.pl Signed-off-by: Juro Bystricky <juro.bystricky@intel.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-05curl: Security Advisory - curl - CVE-2017-1000254Li Zhou2
Porting patch from <https://github.com/curl/curl/commit/ 5ff2c5ff25750aba1a8f64fbcad8e5b891512584> to solve CVE-2017-1000254. Signed-off-by: Li Zhou <li.zhou@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-11-05curl: add 'enable-ares' packageconfig optionJavier Viguera1
This build time option is needed to use the '--dns-interface' runtime parameter to instruct 'curl' to use a specific interface for DNS resolution. Not enabled by default, as it depends on 'c-ares' package from meta-openembedded (meta-networking). Signed-off-by: Javier Viguera <javier.viguera@digi.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-09-26curl: Added option to enable http2 protocol.baali1
With default --without-nghttp2 flag set there was no way to get http2 protocol support using nghttp2 library. Instead moved it to PACKAGECONFIG options Signed-off-by: baali <shantanu@senic.com> Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-05curl: fix CVE-2017-1000099, 1000100, 1000101Wenzong Fan4
Backport upstream commits to fix: - CVE-2017-1000099 https://curl.haxx.se/docs/adv_20170809C.html https://curl.haxx.se/CVE-2017-1000099.patch - CVE-2017-1000100 https://curl.haxx.se/docs/adv_20170809B.html https://curl.haxx.se/CVE-2017-1000100.patch - CVE-2017-1000101 https://curl.haxx.se/docs/adv_20170809A.html https://curl.haxx.se/CVE-2017-1000101.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-09-05curl: enable threaded resolverAndré Draszik1
Multi-threaded applications using libcurl crash on DNS timeouts when built using OE. The reason is as follows: By default, libcurl implements DNS timeouts using a timer (alarm()) and a pair of setjmp()/longjmp(). This approach is unsafe in multi-threaded applications for various reasons, as e.g. explained in the relevant man-pages. To avoid this, libcurl can be compiled with a built-in threaded resolver, or against the c-ares asynchronous resolver library. To keep extra dependencies to a minimum, and to mimic other distributions (debian at least), and because c-ares is not available in OE-core, add a PACKAGECONFIG to be able to enable use of of the built-in threaded resolver and enable it by default. Signed-off-by: André Draszik <adraszik@tycoint.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-06-28curl: update to 7.54.1Oleksandr Kravchuk1
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-05-12curl: upgrade to 7.54.0Oleksandr Kravchuk1
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-11curl: upgrade to 7.53.1Fan Xin1
Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01curl: upgrade to 7.53.0Oleksandr Kravchuk1
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2017-03-01recipes: Make use of the new bb.utils.filter() functionPeter Kjellerstedt1
Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2017-01-09curl: upgrade to 7.52.1Oleksandr Kravchuk1
Signed-off-by: Oleksandr Kravchuk <oleksandr.kravchuk@pelagicore.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-12-13curl: set CVE_PRODUCTRoss Burton1
This is 'libcurl' in NVD. Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-11-15curl: Update to version 7.51.0Fabio Berton1
CVE fixed in 7.51.0: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curl_maprintf CVE-2016-8619: double-free in krb5 code CVE-2016-8620: glob parser write/read out of bounds CVE-2016-8621: curl_getdate read out of bounds CVE-2016-8622: URL unescape heap overflow via integer truncation CVE-2016-8623: Use-after-free via shared cookies CVE-2016-8624: invalid URL parsing with '#' CVE-2016-8625: IDNA 2003 makes curl use wrong host To see complete log access link bellow: https://curl.haxx.se/changes.html#7_51_0 Signed-off-by: Fabio Berton <fabio.berton@ossystems.com.br> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-17curl: upgrade to 7.50.1Ross Burton1
This fixes 3 CVES: CVE-2016-5419 CVE-2016-5420 CVE-2016-5421 Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-08-10curl: upgrade to 7.50.0Fan Xin1
Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-06-14curl: upgrade to 7.49.1Chen Qi1
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-05-06curl: add krb5 to PACKAGECONFIGRoy Li2
krb5 is needed to enables GSS-Negotiate authentication Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-04-11meta: remove redundant ac_cv_sizeof_off_t assignmentsRoss Burton1
ac_cv_sizeof_off_t was previously in the site cache files, which was breaking large file support and required a workaround in each recipe that actually wanted to use large files. Now that the entry has been removed from the site cache, we can remove the workarounds. Signed-off-by: Ross Burton <ross.burton@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-18curl: re-enable proxy support by defaultAndre McCurdy1
Proxy support is a feature, so should not have been disabled in the previous commit (which disabled support for legacy protocols): http://git.openembedded.org/openembedded-core/commit/?id=b26634900d487a22eef41e9e077d35fb347d4c29 Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-11curl: add PACKAGECONFIG options for less common / legacy protocolsAndre McCurdy1
As a result of this commit, the following protocols will now be disabled by default: DICT GOPHER IMAP IMAPS POP3 POP3S RTSP SMTP SMTPS TELNET TFTP Also add a PACKAGECONFIG option for libidn (previously disabled unconditionally). Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2016-02-11curl: drop obsolete pkgconfig_fix.patchAndre McCurdy2
This patch has been carried around in oe-core for a long time. It contains two unrelated changes and neither seem to be required any more. Drop the patch. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-02-11curl: update 7.47.0 -> 7.47.1Andre McCurdy1
Adjust LIC_FILES_CHKSUM beginline due to changes to the Copyright to acknowledge additional contributors. No change to the license text. Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-29curl: update 7.46.0 -> 7.47.0 ( CVE-2016-0754 CVE-2016-0755 )Andre McCurdy1
Full changelog: http://curl.haxx.se/changes.html#7_47_0 Security fixes: http://curl.haxx.se/docs/vulnerabilities.html CVE-2016-0754 : remote file name path traversal in curl tool for Windows CVE-2016-0755 : NTLM credentials not-checked for proxy connection re-use Signed-off-by: Andre McCurdy <armccurdy@gmail.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2016-01-13curl: upgrade to 7.46Chen Qi1
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-12-16curl: upgrade to 7.45Fan Xin1
Signed-off-by: Fan Xin <fan.xin@jp.fujitsu.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-10-01curl: cleanup buildpaths from curl-configWenzong Fan1
curl-config will be installed to target, cleanup buildpaths in it: * remove ${STAGING_DIR_HOST} from CC, CFLAGS ... Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-08-16curl: upgrade to 7.44Maxin B. John1
Bump to version 7.44 Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Ross Burton <ross.burton@intel.com>
2015-07-01curl: upgrade to 7.43.0Chen Qi1
Signed-off-by: Chen Qi <Qi.Chen@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-05-07curl: upgrade to 7.42.1Roy Li1
Upgrade to include a security fixes for CVE-2015-3153 Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-30curl: Fix wrong assumption about sizeof off_t on largefile systemsKhem Raj1
This issue was reported on poky ml as well see https://lists.yoctoproject.org/pipermail/poky/2013-December/009435.html Change-Id: Iedf22467889893111fde0433e411fd0546a38546 Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-27curl: upgrade to 7.42.0Maxin B. John1
Upgrade include these security fixes: 1. CVE-2015-3143 2. CVE-2015-3144 3. CVE-2015-3145 4. CVE-2015-3148 Signed-off-by: Maxin B. John <maxin.john@enea.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-21curl: remove extra dev and staticdev from PACKAGESRobert Yang1
There should be only one dev and dbg package. Signed-off-by: Robert Yang <liezhi.yang@windriver.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
2015-04-09curl: upgrade to 7.41.0Chen Qi1
Signed-off-by: Chen Qi <Qi.Chen@windriver.com>
generated by cgit v1.2.3 (git 2.25.1) at 2025-03-19 21:41:15 +0000