package/{containerd,docker-compose,runc}: security bumps

.github/buildroot-upstream

@@ -0,0 +1 @@
+upstream/master

.github/renovate.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    ":semanticPrefixFixDepsChoreOthers",
+    ":ignoreModulesAndTests",
+    "group:all",
+    "workarounds:all"
+  ],
+  "forkProcessing": "enabled",
+  "branchConcurrentLimit": 0,
+  "ignorePaths": [
+    "docs/**"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["gomod"],
+      "matchDepTypes": ["replace"],
+      "enabled": false
+    }
+  ]
+}

.github/workflows/buildroot-e2e.yml

@@ -0,0 +1,65 @@
+name: CI
+
+# Controls when the action will run.
+on:
+  push:
+    branches: [master, skiff, skiff-next]
+  pull_request:
+    branches: [skiff, skiff-next, upstream-master]
+
+# A workflow run is made up of one or more jobs that can run sequentially or in parallel
+jobs:
+  # This workflow contains a single job called "build"
+  build:
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+
+    env:
+      # for add-env below
+      ACTIONS_ALLOW_UNSECURE_COMMANDS: 'true'
+
+    # Steps represent a sequence of tasks
+    steps:
+      # Checks-out the repo under $GITHUB_WORKSPACE
+      - uses: actions/checkout@v5
+
+      - name: Cache build cache and downloads
+        uses: actions/cache@v4
+        env:
+          cache-name: cache-buildroot
+        with:
+          path: ~/br-cache/
+          key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('Makefile') }}
+          restore-keys: |
+            ${{ runner.os }}-build-${{ env.cache-name }}-
+            ${{ runner.os }}-build-
+            ${{ runner.os }}-
+
+      # Detect changes vs upstream-master
+      - name: Detect changes vs upstream
+        run: |
+          cd $GITHUB_WORKSPACE
+          git fetch
+          git remote add upstream https://github.com/buildroot/buildroot.git
+          git fetch upstream
+          export BUILDROOT_UPSTREAM=$(cat .github/buildroot-upstream)
+          echo "::set-env name=CHANGED_VS_UPSTREAM::$(git diff --diff-filter=ACM --name-only $BUILDROOT_UPSTREAM | xargs)"
+
+      # Installing buildroot deps
+      - name: Install buildroot apt deps
+        run: |
+          sudo apt-get install -y libelf-dev python3-magic python3-flake8
+
+      # Run check-package on changed files
+      - name: Run check-package on all changed files and setup env
+        run: |
+          cd $GITHUB_WORKSPACE
+          ./utils/check-package $CHANGED_VS_UPSTREAM
+
+      # Test a build
+      - name: Run a generic build
+        run: |
+          cd $GITHUB_WORKSPACE
+          make defconfig BR2_DEFCONFIG=$(pwd)/.github/workflows/buildroot-e2e_defconfig
+          make -s all legal-info BR2_CCACHE_DIR=${HOME}/br-cache/ccache BR2_DL_DIR=${HOME}/br-cache/dl
+

.github/workflows/buildroot-e2e_defconfig

@@ -0,0 +1,21 @@
+BR2_x86_64=y
+BR2_x86_core_avx2=y
+BR2_CCACHE=y
+BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
+BR2_GCC_ENABLE_LTO=n
+BR2_INIT_SYSTEMD=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_SYSTEM_BIN_SH_BASH=y
+BR2_ENABLE_LOCALE_WHITELIST="C en_US en_US.UTF-8"
+BR2_GENERATE_LOCALE="en_US.UTF-8"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_DELVE=y
+BR2_PACKAGE_DOCKER_CLI=y
+BR2_PACKAGE_DOCKER_CLI_STATIC=y
+BR2_PACKAGE_DOCKER_ENGINE_EXPERIMENTAL=y
+BR2_PACKAGE_MENDER=y
+BR2_PACKAGE_HOST_MENDER_ARTIFACT=y

.gitignore

@@ -14,3 +14,4 @@
 *~
 *.pyc
 /br.log
+*.swp

Config.in

@@ -296,6 +296,16 @@ config BR2_BACKUP_SITE
 	  buildroot will fall back to download package sources from here
 	  if the normal location fails.
 
+config BR2_SKIFFOS_BACKUP_SITE
+	string "SkiffOS backup download site"
+	default "https://github.com/skiffos/mirror/raw/master"
+	help
+	  Backup site to download from. If this option is set then
+	  buildroot will fall back to download package sources from here
+	  if the normal location fails.
+
+	  This is an additional mirror used by SkiffOS.
+
 config BR2_KERNEL_MIRROR
 	string "Kernel.org mirror"
 	default "https://cdn.kernel.org/pub"
@@ -326,6 +336,21 @@ config BR2_GNU_MIRROR
 	     http://ftp.gnu.org/pub/gnu
 	     http://mirror.aarnet.edu.au/pub/gnu
 
+config BR2_GOPROXY
+	string "Go module proxy"
+	default "https://proxy.golang.org,direct"
+	depends on BR2_PACKAGE_HOST_GO_TARGET_ARCH_SUPPORTS
+	help
+	  The Go module proxy URL used to download Go modules. By
+	  default, it uses the official Go module mirror, falling
+	  back to direct downloads if the module is not found in the
+	  mirror. The value can be one of:
+	    - Comma-separated list of proxy URLs
+	    - "off" to disable all downloads
+	    - "direct" to download directly from source repositories
+
+	  See https://go.dev/ref/mod#module-proxy
+
 config BR2_LUAROCKS_MIRROR
 	string "LuaRocks mirror"
 	default "http://rocks.moonscript.org"

DEVELOPERS

@@ -635,6 +635,7 @@ F:	package/python-pylibftdi/
 N:	Christian Stewart <christian@aperture.us>
 F:	package/balena-engine/
 F:	package/batman-adv/
+F:	package/buildah/
 F:	package/catatonit/
 F:	package/cni-plugins/
 F:	package/conmon/
@@ -1566,6 +1567,7 @@ F:	package/microchip-hss-payload-generator/
 N:	Jan Havran <havran.jan@email.cz>
 F:	board/pine64/pinecube/
 F:	configs/pine64_pinecube_defconfig
+F:	package/rtklib/
 
 N:	Jan Kraval <jan.kraval@gmail.com>
 F:	board/orangepi/orangepi-lite

arch/Config.in

@@ -266,6 +266,14 @@ config BR2_x86_64
 	  architecture compatible microprocessor).
 	  http://en.wikipedia.org/wiki/X86_64
 
+config BR2_wasm32
+	bool "WebAssembly (wasm32)"
+	select BR2_ARCH_HAS_NO_TOOLCHAIN_BUILDROOT
+	select BR2_USE_MMU
+	help
+	  WebAssembly 32-bit target using wasi-sdk external toolchain.
+	  Produces .wasm binaries for WASI-compatible runtimes.
+
 config BR2_xtensa
 	bool "Xtensa"
 	depends on !BR2_HIDE_SECONDARY_TARGET_OPTIONS
@@ -464,13 +472,18 @@ if BR2_i386 || BR2_x86_64
 source "arch/Config.in.x86"
 endif
 
+if BR2_wasm32
+source "arch/Config.in.wasm32"
+endif
+
 if BR2_xtensa
 source "arch/Config.in.xtensa"
 endif
 
 # Set up target binary format
 choice
 	prompt "Target Binary Format"
+	default BR2_BINFMT_WASM if BR2_wasm32
 	default BR2_BINFMT_ELF if BR2_USE_MMU
 	default BR2_BINFMT_FLAT
 
@@ -501,6 +514,12 @@ config BR2_BINFMT_FLAT
 	  format based on the original a.out format. It is widely used
 	  in environment where no MMU is available.
 
+config BR2_BINFMT_WASM
+	bool "WASM"
+	depends on BR2_wasm32
+	help
+	  WebAssembly binary format. WASM binaries are executed by a
+	  host runtime (e.g. wazero) rather than the OS kernel directly.
 endchoice
 
 endmenu # Target options

arch/Config.in.arm

@@ -479,6 +479,14 @@ config BR2_cortex_a76_a55
 	select BR2_ARM_CPU_HAS_FP_ARMV8
 	select BR2_ARM_CPU_ARMV8A
 	select BR2_ARCH_NEEDS_GCC_AT_LEAST_9
+config BR2_cortex_a77
+	bool "cortex-A77"
+	select BR2_ARM_CPU_HAS_ARM if !BR2_ARCH_IS_64
+	select BR2_ARM_CPU_HAS_NEON if !BR2_ARCH_IS_64
+	select BR2_ARM_CPU_HAS_THUMB2 if !BR2_ARCH_IS_64
+	select BR2_ARM_CPU_HAS_FP_ARMV8
+	select BR2_ARM_CPU_ARMV8A
+	select BR2_ARCH_NEEDS_GCC_AT_LEAST_11
 config BR2_cortex_a78
 	bool "cortex-A78"
 	select BR2_ARM_CPU_HAS_ARM if !BR2_ARCH_IS_64

arch/Config.in.wasm32

@@ -0,0 +1,11 @@
+config BR2_ARCH
+	default "wasm32"
+
+config BR2_NORMALIZED_ARCH
+	default "wasm32"
+
+config BR2_ENDIAN
+	default "LITTLE"
+
+config BR2_READELF_ARCH_NAME
+	default "WebAssembly"

arch/arch.mk.wasm32

@@ -0,0 +1,133 @@
+# wasi-libc emulation flags for wasm32-wasi targets.
+ifeq ($(BR2_wasm32),y)
+ARCH_TOOLCHAIN_WRAPPER_OPTS += \
+	-D_WASI_EMULATED_SIGNAL \
+	-D_WASI_EMULATED_MMAN \
+	-D_WASI_EMULATED_PROCESS_CLOCKS \
+	-D_WASI_EMULATED_GETPID \
+	-include wasi-posix-fixups.h
+
+# Export __errno_location so host runtimes can set errno in WASM memory.
+# Add usr/lib to search path (wasi-sdk sysroot only has lib/wasm32-wasi).
+TARGET_LDFLAGS += -Wl,--export=__errno_location -L$(STAGING_DIR)/usr/lib
+
+# Autoconf function detection cache overrides for wasm32-wasi.
+#
+# wasi-posix-fixups.h is force-included via -include into every compilation
+# unit, including autoconf test programs. Autoconf detects functions by
+# compiling `char FUNC(void); int main() { return FUNC(); }` -- which
+# conflicts with the proper prototypes in wasi-posix-fixups.h and the
+# wasi-libc headers. Pre-seeding these cache variables tells configure
+# the functions exist without running the (broken) compile test.
+TARGET_CONFIGURE_ARGS += \
+	ac_cv_func__exit=yes \
+	ac_cv_func_accept=yes \
+	ac_cv_func_access=yes \
+	ac_cv_func_bind=yes \
+	ac_cv_func_chdir=yes \
+	ac_cv_func_chown=yes \
+	ac_cv_func_chroot=yes \
+	ac_cv_func_clock_gettime=yes \
+	ac_cv_func_clock_settime=yes \
+	ac_cv_func_connect=yes \
+	ac_cv_func_dup=yes \
+	ac_cv_func_dup2=yes \
+	ac_cv_func_dup3=yes \
+	ac_cv_func_execl=yes \
+	ac_cv_func_execle=yes \
+	ac_cv_func_execlp=yes \
+	ac_cv_func_execv=yes \
+	ac_cv_func_execve=yes \
+	ac_cv_func_execvp=yes \
+	ac_cv_func_fchdir=yes \
+	ac_cv_func_fchown=yes \
+	ac_cv_func_fork=yes \
+	ac_cv_func_fpathconf=yes \
+	ac_cv_func_ftruncate=yes \
+	ac_cv_func_getcwd=yes \
+	ac_cv_func_getegid=yes \
+	ac_cv_func_geteuid=yes \
+	ac_cv_func_getgid=yes \
+	ac_cv_func_getgroups=yes \
+	ac_cv_func_gethostname=yes \
+	ac_cv_func_getpeername=yes \
+	ac_cv_func_getpgid=yes \
+	ac_cv_func_getpgrp=yes \
+	ac_cv_func_getppid=yes \
+	ac_cv_func_getpriority=yes \
+	ac_cv_func_getrlimit=yes \
+	ac_cv_func_getsid=yes \
+	ac_cv_func_getsockname=yes \
+	ac_cv_func_getsockopt=yes \
+	ac_cv_func_gettimeofday=yes \
+	ac_cv_func_getuid=yes \
+	ac_cv_func_initgroups=yes \
+	ac_cv_func_isatty=yes \
+	ac_cv_func_kill=yes \
+	ac_cv_func_killpg=yes \
+	ac_cv_func_lchown=yes \
+	ac_cv_func_link=yes \
+	ac_cv_func_listen=yes \
+	ac_cv_func_mkdtemp=yes \
+	ac_cv_func_mkfifo=yes \
+	ac_cv_func_mknod=yes \
+	ac_cv_func_mkstemp=yes \
+	ac_cv_func_nice=yes \
+	ac_cv_func_pathconf=yes \
+	ac_cv_func_pause=yes \
+	ac_cv_func_pipe=yes \
+	ac_cv_func_pipe2=yes \
+	ac_cv_func_readlink=yes \
+	ac_cv_func_recv=yes \
+	ac_cv_func_recvfrom=yes \
+	ac_cv_func_select=yes \
+	ac_cv_func_send=yes \
+	ac_cv_func_sendto=yes \
+	ac_cv_func_setegid=yes \
+	ac_cv_func_seteuid=yes \
+	ac_cv_func_setgid=yes \
+	ac_cv_func_setgroups=yes \
+	ac_cv_func_sethostname=yes \
+	ac_cv_func_setpgid=yes \
+	ac_cv_func_setpgrp=yes \
+	ac_cv_func_setpriority=yes \
+	ac_cv_func_setregid=yes \
+	ac_cv_func_setreuid=yes \
+	ac_cv_func_setrlimit=yes \
+	ac_cv_func_setsid=yes \
+	ac_cv_func_setsockopt=yes \
+	ac_cv_func_settimeofday=yes \
+	ac_cv_func_setuid=yes \
+	ac_cv_func_shutdown=yes \
+	ac_cv_func_sigaction=yes \
+	ac_cv_func_sigaddset=yes \
+	ac_cv_func_sigdelset=yes \
+	ac_cv_func_sigemptyset=yes \
+	ac_cv_func_sigfillset=yes \
+	ac_cv_func_sigismember=yes \
+	ac_cv_func_sigpending=yes \
+	ac_cv_func_sigprocmask=yes \
+	ac_cv_func_sigaltstack=yes \
+	ac_cv_func_setitimer=yes \
+	ac_cv_func_getitimer=yes \
+	ac_cv_func_socket=yes \
+	ac_cv_func_symlink=yes \
+	ac_cv_func_sync=yes \
+	ac_cv_func_sysconf=yes \
+	ac_cv_func_tcgetpgrp=yes \
+	ac_cv_func_tcsetpgrp=yes \
+	ac_cv_func_truncate=yes \
+	ac_cv_func_ttyname=yes \
+	ac_cv_func_ttyname_r=yes \
+	ac_cv_func_tzset=yes \
+	ac_cv_func_umask=yes \
+	ac_cv_func_vfork=yes \
+	ac_cv_func_wait=yes \
+	ac_cv_func_waitpid=yes
+
+# Functions falsely detected due to -Wl,--allow-undefined (link always
+# succeeds). These do NOT exist in wasi-libc or our host imports.
+TARGET_CONFIGURE_ARGS += \
+	ac_cv_func_tcgetwinsize=no \
+	ac_cv_func_tcsetwinsize=no
+endif

boot/Config.in

@@ -21,6 +21,7 @@ source "boot/mxs-bootlets/Config.in"
 source "boot/optee-os/Config.in"
 source "boot/opensbi/Config.in"
 source "boot/palo/Config.in"
+source "boot/refind-bin/Config.in"
 source "boot/shim/Config.in"
 source "boot/syslinux/Config.in"
 source "boot/ti-k3-boot-firmware/Config.in"