Merge pull request #10203 from ynezz/upstream/19.07/cgi-io-backports

[openwrt-19.07] cgi-io backports

shinit: Add package

This package adds support for /etc/shinit and ~/.shinit files, which
contain commands to be run at the start of all interactive shells.
(/etc/profile and ~/.profile are read for login shells only.)

This is useful for those who regularly open non-login, interactive
shells, for example users of GNU Screen or tmux.

(This is based on a patch[1] I submitted for OpenWrt master, but there
does not appear to be much interest in merging the change.)

(This package uses the ENV shell variable, of which the POSIX standard
has a brief description[2]. The dash manpage[3] also describes how the
ENV variable is handled. (dash is the basis for busybox ash.))

[1]: https://patchwork.ozlabs.org/patch/1094493/
[2]: https://pubs.opengroup.org/onlinepubs/9699919799//utilities/V3_chap02.html#tag_18_05_03
[3]: https://manpages.debian.org/buster/dash/dash.1.en.html#Invocation

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry picked from c04dff7965ed84bc57ea957ecad81fb902b7f146)

cgi-io: iron out extra compiler warnings

Fixes following errors:

 main.c:458:37: error: comparison of integer expressions of different signedness: ‘int’ and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare]
 main.c:463:17: error: comparison of integer expressions of different signedness: ‘int’ and ‘long unsigned int’ [-Werror=sign-compare]
 main.c:518:35: error: comparison of integer expressions of different signedness: ‘ssize_t’ {aka ‘long int’} and ‘size_t’ {aka ‘long unsigned int’} [-Werror=sign-compare]
 main.c:157:3: error: ignoring return value of ‘read’, declared with attribute warn_unused_result [-Werror=unused-result]
 main.c:763:3: error: ignoring return value of ‘chdir’, declared with attribute warn_unused_result [-Werror=unused-result]

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit bb6cdb804cc4db12cca776f559baa6d989a992ec)

cgi-io: cmake: enable extra compiler warnings

Spotting issues during compilation is cheaper.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit 4e7411a8d0a46363f9946bff762eda70d5d5de6c)

cgi-io: cmake: fix libraries lookup

In order to make it compile properly in more environments.

Signed-off-by: Petr Štetiar <ynezz@true.cz>
(cherry picked from commit fd47e99be4fcd9b1261a4f359279d63199fff6c3)

cgi-io: fix read after end errors

Currently cgi-io try to read data after the data ended.
- Adds "-" to whitelist char
- In main_upload is tried to consume the buffer while it's already readed by the while loop before

Signed-off-by: Ansuel Smith <ansuelsmth@gmail.com>
(cherry picked from commit 535b2b6bd8a7f7a0a7a6914c8091619ea6f8961f)

cgi-io: use splice() to stream backup archive

This improves the I/O performance when outputting large backups.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit a8b4a28372645c93621008b2563c00ce6cdd739f)

cgi-io: pass appropriate HTTP error codes to failure()

Instead of always replying with a generic 500 internal server error code,
use more appropriate codes such as 403 to indicate denied permissions.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 8c22db653158e8c4edf4fdd0e0554a603b96a655)

cgi-io: add download operation

Add a new `cgi-download` applet which allows to retrieve the contents
of regular files or block devices.

In order to initiate a transfer, a POST request in x-www-form-urlencoded
format must be sent to the applet, with one field "sessionid" holding
the login session and another field "path" containing the file path to
download.

Further optional fields are "filename" which - if present - will cause
the download applet to set a Content-Dispostition header and "mimetype"
which allows to let the applet respond with a specific type instead of
the default "application/octet-stream".

Below is an example for the required acl rules to grant download access
to files or block devices:

    ubus call session grant '{
        "ubus_rpc_session": "...",
        "scope": "cgi-io",
        "objects": [
            [ "download", "read" ]
        ]
    }'

    ubus call session grant '{
        "ubus_rpc_session": "...",
        "scope": "file",
        "objects": [
            [ "/etc/config/*", "read" ],
            [ "/dev/mtdblock*", "read" ]
        ]
    }'

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit ab2a2b080d4143bfbbd8584a39999ef998905dd2)

cgi-io: use different acl scopes for path and command permissions

Use the `cgi-io` scope to check for permission to execute the requested
command (`upload`, `backup`) and the `file` scope to check path
permissions.

The reasoning of this change is that `cgi-io` is usually used in
conjunction with `rpcd-mod-file` to transfer large file data out
of band and `rpcd-mod-file` already uses the `file` scope to manage
file path access permissions. After this change, both `rpc-mod-file`
and `cgi-io` can share the same path acl rules.

Write access to a path can be granted by using an ubus call in the
following form:

    ubus call session grant '{
        "ubus_rpc_session": "...",
        "scope": "file",
        "objects": [
            [ "/var/lib/uploads/*", "write" ]
        ]
    }'

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit c8a86c8c8e1925eb7d84c52e702c4be5fc8ac76b)

cgi-io: require whitelisting upload locations

Introduce further ACL checks to verify that the request-supplied
upload location may be written to. This prevents overwriting things
like /bin/busybox and allows to confine uploads to specific directories.

To setup the required ACLs, the following ubus command may be used
on the command line:

ubus call session grant '{
  "ubus_rpc_session": "d41d8cd98f00b204e9800998ecf8427e",
  "scope": "cgi-io",
  "objects": [
    [ "/etc/certificates/*", "write" ],
    [ "/var/uploads/*", "write" ]
  ]
}'

Signed-off-by: Jo-Philipp Wich <jo@mein.io>
(cherry picked from commit 22be9a1c0173a232d651059d84145bb6f51d3f67)

Merge pull request #10183 from jefferyto/python-attrs-19.2.0-openwrt-19.07

[openwrt-19.07] python-attrs: Update to 19.2.0

banip: update 0.3.1

* the WAN auto detection now supports multiple interfaces, too
* no longer filter out possible LAN devices
* add a new DoH (DNS over HTTPS) blocklist source with public
  DoH DNS server addresses, to effectively block client side DoH
  communication, e.g. via Firefox or Chrome

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 70ab67649b6a96e7581048ec9c1a7a4debce005d)

banip: update 0.3.0

* new 'ca-bundle' dependency as all https connections
  are now validated by default
* automatically select the download utility: 'aria2', 'curl',
  'uclient-fetch' with libustream-* or wget are supported
* track & ban failed LuCI login attempts as well
* add a small log/banIP background monitor to block
  SSH/LuCI brute force attacks in realtime (disabled by default)
* add a config version check (please update your default config!)
* made the automatic wan detection more stable
* fix the IPv6 logfile parser
* fix the service status message
* update readme

Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit ff8b853a6dc91434a5bae1b58934a6d35472dafc)

net/mosquitto: drop obsolete libuuid dependency

libuuid was dropped as a dependency in mosquitto 1.6.0

Signed-off-by: Karl Palsson <karlp@etactica.com>

perl-www-curl: curl 7.66.0 compatibility

Signed-off-by: Alexander Ryzhov <github@ryzhov-al.ru>
(cherry-picked from 7910715d863c29a93343db838c9b4b2aafdb2a3f)

icu: update to 65.1

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 23adefbb7b5fca8ff473b11350330cb146e632df)

fbzmq: Update to 2019.10.07.00

Added patch that adds libfolly boost dependencies.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 7a5326dd29fabf2d405603e24159323b4f792759)

fbthrift: Update to 2019.10.07.00

Added patch to remove boost-thread dependency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from dbfea329d31ca699b3a5cbde311c59bde2473832)

librsocket-cpp: Update to 2019-10-07

Added patch to remove boost-thread dependency.

Added size optimizations.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 8ceee72c77f22b8cdfe3a372ebbe86094addb70f)

libwangle: Update to 2019.10.07.00

Added patch to remove boost-thread dependency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from caf1a153d379dffb023d2b6bb0a314cf028a8c15)

libfizz: Update to 2019.10.07.00

Add patch removing boost-thread dependency.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from cc1b52c44a89635cad2a864136275f1fe2567add)

libfolly: Update to 2019.10.07.00

Added patch to remove boost-thread.

Removed uClibc-ng patch. libfolly no longer builds there.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from b9000043bfb859cacc4fe8aefc3c0cbf1ca8cbb6)

python-attrs: Update to 19.2.0

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

nano: update to 4.5

Update nano editor to version 4.5.

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit bfd66f2d23483513f80e109df2e0e02de782e5b4)

Merge pull request #10165 from stangri/19.07-simple-adblock

[19.07] simple-adblock: bugfix: proper dnsmasq reload on stop, rework start/stop logic

unbound: Update to version 1.9.4

Fixes CVE-2019-16866

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 1caf170daffcb199e34d7584bcf5dc2a7ed138b4)

simple-adblock: bugfix: proper dnsmasq reload on stop, rework start/stop logic

Signed-off-by: Stan Grishin <stangri@melmac.net>

Merge pull request #10158 from gladiac1337/haproxy-2.0.7-openwrt-19.07

[openwrt-19.07] haproxy: Update HAProxy to v2.0.7

haproxy: Update HAProxy to v2.0.7

- Update haproxy download URL and hash
- Add new patches (see https://www.haproxy.org/bugs/bugs-2.0.7.html)

Signed-off-by: Christian Lachner <gladiac@gmail.com>

Merge pull request #10152 from jefferyto/python-bpo-38243-34155-openwrt-19.07

[openwrt-19.07] python,python3: Fix CVE-2019-16056, CVE-2019-16935

Merge pull request #10144 from stangri/19.07-simple-adblock

[19.07] simple-adblock: bugfix and improvements (check description)

python,python3: Fix CVE-2019-16056, CVE-2019-16935

These patches address issues:
CVE-2019-16056: email.utils.parseaddr mistakenly parse an email
CVE-2019-16935: A reflected XSS in python/Lib/DocXMLRPCServer.py (for
Python 2.7)

CVE-2019-16935 was fixed for python3 in #10109

Links to Python issues:
https://bugs.python.org/issue34155
https://bugs.python.org/issue38243

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

python-simplejson: Fix python[3]-decimal dependency

simplejson depends on the decimal module[1][2]. This adds
python[3]-decimal to the package's DEPENDS.

[1]: https://github.com/simplejson/simplejson/blob/v3.16.0/simplejson/__init__.py#L110
[2]: https://github.com/simplejson/simplejson/blob/v3.16.0/simplejson/encoder.py#L7

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

simple-adblock: bugfix and improvements (check description)

Signed-off-by: Stan Grishin <stangri@melmac.net>

haveged: convert to procd

Convert haveged init script to use procd

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit 4f717a6f65b5c495aec770b507913befa40b8997)

haveged: update to 1.9.8

Update haveged to 1.9.8

Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
(cherry picked from commit e5b308308b528b912ec1352b85bf2de13d94ce3f)

watchcat: make compatible with updated busybox ash array handling (closes #10127)

Signed-off-by: Nuno Goncalves <nunojpg@gmail.com>

python-certifi: bump to 2019.9.11

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit acf7c540ca6b924fd980acb0cdf0fb72d9979836)

oniguruma: update to release 6.9.3

This release incorporates fixes for CVE-2019-13224 and CVE-2019-13225,
and "fixed many problems (found by libfuzzer programs)."

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry picked from commit b7d0a82a7fe0829b9f2655627f383d13988d92e9)

python3: backport three security patches

Fixes: CVE-2019-16935
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 80def9e)

Merge pull request #10112 from commodo/django-sec-19.07

django: Update to 1.11.24

django: Update to 1.11.24

Fixes a whole bunchs of CVEs:

CVE-2019-3498
CVE-2019-6975
CVE-2019-12308
CVE-2019-12781
CVE-2019-14232
CVE-2019-14233
CVE-2019-14234
CVE-2019-14235

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry picked from commit 64a02079da18f24cea0234c8e9ff6e14ad1ee683)

yggdrasil: bump to 0.3.9

Signed-off-by: William Fleurant <meshnet@protonmail.com>
(cherry-picked from 7296ff1b5ce8661d6acd31fdbbc8f793a51a00e6)

golang: Update to version 1.13.1

Fixes CVE-2019-16276

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 65b7bd6cc04ba92fb573e8b98c72729baa70c1a9)

youtube-dl: Update to version 2019.9.28

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 9ed0d76b34f7584f13016a028b1208a8cef5fc71)

dnscrypt-proxy2: Update to version 2.0.27

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit b9fbb90fd4a75b33c9f14a2590c06961d638566a)

expat: update to version 2.2.7 (security fix)

Fixes:
CVE-2018-20843

Changes:
add PKG_CPE_ID
switch to xz
remove maintainer

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from commit 70c62ef2d77aef5d8a27ccca2b147bc2a69dc7f8)

adblock: More cosmetic changes and more detailed installation instructions to README.md

Signed-off-by: Claudius Ellsel <claudius.ellsel@live.de>
(cherry picked from commit 6121af755da85affdd172765e93915ca5414cf35)

adblock: Cosmetic changes to README.md

Add code blocks for easier reading and change "dns" to "DNS".

Signed-off-by: Claudius Ellsel <claudius.ellsel@live.de>
(cherry picked from commit 088a14e5cefdebd677c4f97aa49799f38cc82e88)

travelmate: add support for optional args in auto-login script

This can be helpful for example in hotels where you need to
enter a new user/password combination every week.

Signed-off-by: Johannes Rothe <mail@johannes-rothe.de>
(cherry picked from commit a7f87f939dda6855d4b727c29eb10a6f2f6ac150)

golang: Use new -trimpath option when compiling Go packages

Go 1.13 added a new -trimpath option to the "go build" command[1] that
removes system paths from compiled executables. This replaces the
previous -trimpath flags.

There are still system paths in the compiled executable (for crti.o and
crtn.o, when cross-compiling); these appear to be stripped during the
packaging process.

[1]: https://golang.org/doc/go1.13#trimpath

Signed-off-by: Jeffery To <jeffery.to@gmail.com>
(cherry-picked from commit 22ee6e86a08d1e59608c50495d25e49378174e5a)

golang: Update to 1.13

Signed-off-by: Xingwang Liao <kuoruan@gmail.com>
(cherry-picked from commit 0849e326590ab87e4368718d1b9a7554a93420c4)

netdata: Update to version 1.17.1

Patch 002 - Force Python3 is no longer applying, let's try to throw it
away to see if it is still necessary

Patch 003 - Was backported from the master branch and it was included in
Netdata version 1.17.0

Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry-picked from commit 5e89816)

Merge pull request #10097 from neheb/boooo

[19.07]Update boost and other fixes

dump1090: update to 3.7.2

and use GitHub release tarball instead of git

Signed-off-by: Richard Yu <yurichard3839@gmail.com>
(cherry-picked from a6a0f4edeef28ec6eca7cfad9b37f6fd996d0fa1)

dump1090: Update to version 3.7.1

Repository was moved.

Also cleaned up Makefile slightly.

Ran init script through shellcheck.

Added PKG_BUILD_PARALLEL for faster compilation.

Added several CFLAGS and LDFLAGS for smaller size.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from f3245e6c7dcd8e169fe67d7f3cd125a74b056627)

cmdpad: Fix compilation with musl

When passing -Wimplicit-function-declaration

Also got rid of std=gnu89. It's easy to patch out.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1b5e4883a4704835b67c7a16a158ed7bad981c4a)

gammu: Update to 1.40.0

Cleaned up Makefile for consistency between packages.

Switched to CMAKE_INSTALL to get rid of the InstallDev section.

Refreshed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2e2929366bf719531c6e4b1591cccfde58172d55)

ykpers: Update to 1.20.0

Cleaned up Makefile for consistency between packages.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from db6e6ac24a60377dd963be1aef1c1f48dea316d7)

zstd: Update to 1.4.3

Bugfix release.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 133a02a1153b2fbe9e00e0ec42109d021a533127)

mpd: Add SoundCloud support for full variant

The libyajl cleanup commit revealed that it was not being installed
correctly. Now that it is, mpd picks it up properly.

Enabled SoundCloud support for the full variant. Disabled for the mini.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 835bc1df0378d647e8393d910d7ee80541778d8a)

mpd: enable pulseaudio in full package

Signed-off-by: Michal Čihař <michal@cihar.com>
(cherry-picked from 2ed62adc5914aa62e5f2e7389cf278dc68bb273c)

yajl: Update to modern standards

Replaced git:// link with https:// which gets through firewalls easier.

Replaced archive with .xz. The one currently in the mirrors has the wrong
hash. .xz is also smaller than .gz.

Eliminated already default CMake option.

Eliminated Build/InstallDev with CMAKE_INSTALL.

Added PKG_BUILD_PARALLEL for faster compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2abbc83c9de765a058c3734deb849347452858e6)

node: fix http/2 DoS

This is a security release.

Node.js, as well as many other implementations of HTTP/2,
have been found
vulnerable to Denial of Service attacks.
See https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
for more information.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from 81bccf9068edc734ea904ecd63166630fcc69826)

node: fix host build error on macOS

fix host build error on macOS
reference: https://github.com/openwrt/packages/issues/9616

Related: https://github.com/openwrt/packages/issues/7171
(This correspondence is necessary to build with macOS.)

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>
(cherry-picked from c69d5a02413a35a3a25e6b42a3b467393705f97a)

opencv: Update to 4.1.1

Update Makefile to modern standards.

Switched to local tarballs..xz archives are smaller. The .gz archive that
codeload comes with is 85MB.

Replaced PKG_INSTALL with CMAKE_INSTALL to get rid of Build/InstallDev.

Added PKG_BUILD_PARALLEL for faster compilation.

Removed inactive maintainer.

Added uClibc-ng patches to fix compilation.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from f8cd4f094a6ab185034d95a77201f87064c55d62)

Merge pull request #10084 from BKPepe/sentrysdk-1907

[OpenWrt 19.07] python-sentry-sdk: Update to version 0.12.2

boost: Switch to blacklist of targets for context

Works around a buildbot bug.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from dc3220736d974bf12a00ece96b008e54579515bd)

boost: Update host libraries

It seems newer versions of fbthrift require more libraries.

Also added AR7, RB532, and Lantiq ASE to fiber exclusion.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1f77459acef49003529ce5bf26ed4c476648e097)

boost: Package Version Update (1.71.0) + bugfixes

This commit updates Boost to version 1.71.0 and disables Boost.Context
 for arc and mips64 architectures, since either jump_fcontext or
 getcontext are undefined for those architectures.

It also fixes a bug were Boost.Fiber was not properly disabled for
mips32 and mips64 architectures.

Boost.Coroutine2 option was removed since it was redundant. By selecting
the Coroutine package, Coroutine2 is also installed.

Boost.Fiber has been disabled for target brcm47xx_generic and brcm47xx_legacy
due to misssing opcode support from instruction set.

Boost 1.71.0 brings a new header-only library
 - Boost.Variant2 [1]
   -> A never-valueless, strong guarantee implementation of
      std::variant, from Peter Dimov.

More info about Boost 1.71.0 can be found at the usual place [2].

[1]: https://www.boost.org/doc/libs/1_71_0/libs/variant2/doc/html/variant2.html
[2]: https://www.boost.org/users/history/version_1_71_0.html

Signed-off-by: Carlos Miguel Ferreira <carlosmf.pt@gmail.com>
(cherry-picked from 0cd9824623375b11d9f005a0f2c3c8f44b480ef2)

jamvm: Don't compile on ARM64

Not supported.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from ccd2b767d)

fbzmq: Size optimizations

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 76b57b0e6cec6dc45a828aef2464ae4173efab11)

fbthrift: Update to 2019-09-22

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 7139cddccf73a6e67a80e808c8f760dd3da9e1f8)

libwangle: Update to 2019.09.22.00

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 43a8e02bb8f97cc88f5a4df9de7eaf7486bfef9b)

librsocket-cpp: Update to 2019-09-22

Added URLs.

Added needed Boost patch.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 164e706f9da9a14a9b283f2e07e117142a0968a9)

libfizz: Update to 2019.09.22.00

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 0f209e988c011f0df5da533a10576fb2384ab797)

libfolly: Update to 2019.09.22.00

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d28d9aa4dcf8d52bee0efb5593a31f094354a08a)

treewide: add PKG_CPE_ID for cvescanner

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from ceadbcbb64de727c3a974e552d9a723d532e4e40)

treewide: add PKG_CPE_ID for better cvescanner coverage

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from bf2f1a02636a9b74e1d824cab384b8f3f9e7d819)

libgd: Properly disable iconv support

HAVE_ICONV and HAVE_ICONV_H are two different headers that both need to
evaluate to false. Added the extra CONFIGURE_VARS.

This can be verified by passing -Werror=implicit-function-declaration

Added PKG_LICENSE_FILES

Updated homepage URL.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from bf2f1a02636a9b74e1d824cab384b8f3f9e7d819)

samba4: update to version 4.9.13 (security fix)

Fixes CVE-2019-10197

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from ad16f2a851aeab46856bbf812e7794cbcecf1a69)

samba4: remove double quotes for renice

The double quote thells the shell that the list returned from `pidof` is a
single argument, therefore, `renice` will cry about a malformed input.
With this commit, `renice` will be applied correctly to all the returned PIDs
from `pidof`.

The output of `renice` for the quoted list is as follows:
`renice: invalid number '6592 6587 6586 6574'`
`renice` does not show and does apply the nice value if the list is unquoted.

Signed-off-by: Oever González <notengobattery@gmail.com>
Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>
(cherry-picked from c45974d0a32498810f305cb26746f45045b38008)

samba4: add python2 host dependency

* add python2/host dependency

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from c02ef3ae7f0f0087e0ad5e0080d8e94d72c02de2)

samba4: Run init script through shellcheck

Some performance improvements by batching file writes.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from d03b88b5b0edcdf72a3f6ea0d58b5b39e5ad81e0)

samba4: revert to 4.9.11

* revert to 4.9.x series (4.10 needs too many unofficial patches and has weird waf bugs)
* cleanup patches
* enable AD_DC build option again

Signed-off-by: Andy Walsh <andy.walsh44+github@gmail.com>
(cherry-picked from 2f2a4bccd9fa1fdad7b001fad276ce485e76acbe)

logrotate: move config option to menu

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
(cherry-picked from f6c9e2bacd98741cdb0b231a40e8dc189084f2cb)

logrotate: Add ACL support

Various Makefile cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 788318625de9fecd924d4d413c9a9c8558ba3d66)

treewide: Change .*GPL.*+ licenses to SPDX compatible identifier

The CONTRIBUTING.md requests an (or multiple) SPDX identifier for GPL
licenses. But a lot of packages did use a different, non-SPDX style with a
"+" at the end instead of "-or-later".

Signed-off-by: Sven Eckelmann <sven@narfation.org>
(cherry-picked from bbb1ea7345f367ed675dcfe40e36ac32ddf8a2e1)

keepalived: update version to 2.0.18

Update version to 2.0.18

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 333324f973cac180ac34fee6867928bc64fba18f)

keepalived: fix shellcheck warnings

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 7a207f87afacb706021b8535b7cb85557bef8ed9)

ocserv: updated to 0.12.4

Signed-off-by: Nikos Mavrogiannopoulos <n.mavrogiannopoulos@gmail.com>
(cherry-picked from cefb2f03e256760087a9794f7a8d7ba129833891)

stunnel: fix some shellcheck warnings

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from 6713d1d771dbf29f640cc08271e01dfc97a6389f)

stunnel: update version to 5.55

Update version to 5.55

Signed-off-by: Florian Eckert <fe@dev.tdt.de>
(cherry-picked from a17e90591ccafde29e13acf0b8b5fd2c200b6824)

ap51-flash: upgrade package to latest release 2019.0

* improved Zyxel firmware detection
* introduced optional MAC address filtering
* added support for:

  - Plasma Cloud PA300
  - Plasma Cloud PA1200
  - Plasma Cloud PA2200

Signed-off-by: Sven Eckelmann <sven@narfation.org>
(cherry-picked from 22062b10c66b287597df5507173743683a85f9db)

hplip: bump to 3.19.6

Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
(cherry-picked from fdeb5f81718198c2602f59723ba3852c7176fa93)

geth: Update to 1.9.1

Remove Upstreamed patch.

Minor cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 03b1d7c4d46414345c7a7cc97a53966930046961)

jamvm: Add host build

Needed for classpath. GCJ is also needed but that can be dealt with
separately.

Fix compilation with musl by defining _GNU_SOURCE. What's funny here is
that if __USE_GNU gets replaced, the host build fails. The man page says
_GNU_SOURCE for pthread_getattr_np but glibc violates that statement.

Removed classpath dependency. classpaths must select jamvm, not the other
way around.

Removed target whitelist. Switched to blacklist.

Fixed License information.

Various other cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 2972cc98ebfb512d394ffe406410961545821936)

classpath: Add jamvm/host build dependency

This is needed for compilation. A Java compiler is also needed but that
must be handled elsewhere.

Fixed up license information.

URLs to HTTPS.

Other Makefile cleanups.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 1862f908ebdd68ce734f6ed29b83d5320cde06af)

libshout: Update to 2.4.3

Removed inactive maintainer.

Rearranged Makefile for consistency between packages.

Added --without-pic to avoid both -fPIC and -fpic.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
(cherry-picked from 9bacdfa9a2680d1a0e4da241a4b4ce399db77099)