kernel: update to 5.2.1

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iperf3: update to 3.7

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Fix configuration diff generation

New kernels add a new line into the configuration files
that ends a section. The script recognised that as a new
section which was wrong and is corrected in this patch.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: udpate to 5.2

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Update to 5.1

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sysctl: improve KASLR effectiveness for mmap

By feeding more random bits into mmap allocation, the
effectiveness of KASLR will be improved, making attacks
trying to bypass address randomisation more difficult.

Changed sysctl values are:

vm.mmap_rnd_bits = 32 (default: 28)
vm.mmap_rnd_compat_bits = 16 (default: 8)

This patch backports the same change made in IPFire 2.x into
IPFire 3.x .

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Disable llvm support

When enabled, LLVM provides the capability to just-in-time compile ClamAV bytecode signatures.
Without LLVM, ClamAV uses a built-in bytecode interpreter to execute bytecode signatures.
The mechanism is different, but the results are same and the performance overall is comparable.

At present only LLVM versions up to LLVM 3.6.2 are supported by ClamAV, and LLVM 3.6.2 is old enough
that newer distributions no longer provide it. Therefore, the ClamAV Devs recommend using the
--disable-llvm configure option.

Fixes #11601

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

llvm: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libedit: Update to 3.1-20190324

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cmake: Update to 3.14.5

This is a minor update to the latest stable version of cmake.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: Update to 2019b

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

boost: Update to 1.70.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge remote-tracking branch 'stevee/master'

libyaml: Update to 0.2.2

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

python-yaml: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

less: Update to 551

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

suricata-update: New package

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

ncurses: Update to 6.1

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

compat-ncurses: New package

This package is used to keep compatibility for
binaries which are linked to the series 5 of
ncurses.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

nftables: Update to latest snaphot (20190622).

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

gawk: Update to 5.0.1

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

dhcp: Update to 4.4.1

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

xfsprogs: Update to 5.0.0

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>

strongswan: Update to 5.8.0

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: add dependency to intel-microcode

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.65.1

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

intel-microcode: add new package

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssh: Update to 8.0p1

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Enable libseccomp support

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Drop systemd-units package.

* Rework build process to use meson and ninja macros.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

coreutils: Update to 8.31

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bash: Update to 5.0

This is a major update to the latest version of bash.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bash-completion: Remove file for rfkill.

This is now shipped by util-linux.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcengines-apu-firmware: update to 4.9.0.6

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grubby: drop package

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: remove grubby from dependencies

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: Import patches and bugfixes from IPFire 2.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

linux-firmware: update to 20190620 (git-7ae3a09)

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

sed: Update to 4.7

This is a major update to the latest available version of sed.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel-updater: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

glib2: Update to 2.61

glib2 now uses meson as build system

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: libmount-devel now requires libblkid-devel

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

meson: Update to 0.50.1

* Also add macro file for pakfire.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ninja: Update to 1.9.0

* Also add macro file for pakfire.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

liboping: Fix build with GCC 9

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

util-linux: Update to 2.34

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

python-lxml: Update to 4.3.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cython: New package

Makes writing Python C-API programs easier

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Conflict setup < 3.0-13 for /etc/environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

setup: Drop /etc/environment

This is going to be shipped by systemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

systemd: Update to 242

This is a major update to the latest stable version.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kmod: Update to 26

This is a major update to the latest stable version of kmod.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libnftnl: Update to 1.1.3

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libmnl: Update to 1.0.4

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 5.0

fixes #12028

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.8

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update ca-certificates CA bundle

Update the CA certificates list to what Mozilla NSS ships currently.

The original file can be retrieved from:
https://hg.mozilla.org/mozilla-central/raw-file/tip/security/nss/lib/ckfw/builtins/certdata.txt

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gcc: Update to 9.1.0

This patch also removes libmpx which has been removed from GCC.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ccache: Update to 3.7.1

The project also moved to a new home at https://ccache.dev.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

qemu: Update to 3.1.0

Also use libseccomp for sandboxing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libseccomp: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

automake: Update to 1.16.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

binutils: Update to 2.32

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

screen: Update to 4.6.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tmux: Update to 2.8

The project has also moved to GitHub.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ncurses: Install in base system

This package has tools like reset in it that I use often
and therefore I think it should be installed in the base system.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hyperscan: Drop cmake parameters that are passed anyways

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

cmake: Update to 3.14.1

The testsuite does not run through any more and has
therefore been disabled.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

oinkmaster: Drop package

This will be replaced by suricata-update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Update to 7.64.1

Also fixes linking issues with the library. Development packages
that libcurl was linking against were not pulled in.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iperf3: New package

iPerf3 is a tool for active measurements of the maximum achievable
bandwidth on IP networks. It supports tuning of various parameters
related to timing, buffers and protocols (TCP, UDP, SCTP with IPv4
and IPv6). For each test it reports the bandwidth, loss, and other
parameters.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iperf: Update to 2.0.13

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libuv: New package

libuv is a multi-platform support library with a focus on
asynchronous I/O.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rhash: New package

RHash (Recursive Hasher) is a console utility for calculation and
verification of magnet links and various hash sums, including CRC32,
CRC32C, MD4, MD5, SHA1, SHA256, SHA512, SHA3, AICH, ED2K, DC++ TTH,
BitTorrent BTIH, Tiger, GOST R 34.11-94, GOST R 34.11-2012, RIPEMD-160,
HAS-160, EDON-R, and Whirlpool.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hyperscan: Build only on x86

This package does not compile on ARM

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

suricata: Enable hyperscan

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hyperscan: New package

Hyperscan is a high-performance multiple regex matching library. It
follows the regular expression syntax of the commonly-used libpcre
library, but is a standalone library with its own C API.

Hyperscan uses hybrid automata techniques to allow simultaneous
matching of large numbers (up to tens of thousands) of regular
expressions and for the matching of regular expressions across
streams of data.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ragel: New package

Ragel compiles executable finite state machines from regular languages.

Ragel targets C, C++ and ASM. Ragel state machines can not only
recognize byte sequences as regular expression machines do, but can
also execute code at arbitrary points in the recognition of a regular
language. Code embedding is done using inline operators that do not
disrupt the regular language syntax.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnutls: Update to 3.6.7

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

wget: Update to 1.20.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Drop radvd package

This is being replaced by bird

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Enable 802.11ax and SAE (aka WPA3)

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Ensure that we compile the kernel with GCC >= 8

The kernel cannot be compiled with a compiler that does
not support retpoline.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pcengines-apu-firmware: New package

This is the latest firmware for PC Engines APU boards

This can now be updated with firmware-update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

firmware-update: New package

This tools makes it easy to update the firmware on various
boards.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Drop ld.so placeholder files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

spectre-meltdown-checker: New package

Handy to have this available to check how well a system is protected
against Spectre & Meltdown

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

.gitignore: Ignore any files edited by vim

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

flashrom: New package

This tool can flash firmware on various chipsets and BIOSes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: Enable /dev/mem

This is required to be able to flash any firmware.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

tzdata: Update to 2019a

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

lua: Update to 5.3

This drops the autotool patch which is unnecessary and hard
to carry around.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ntp: Drop package

ntp is not really fit for purpose any more.

It fails to sync time on my systems all the time, is full
of (security) bugs and offers loads of features that we
potentially do not need.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rrdtool: Update to 1.7.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ca-certificates: Update to version from Jan 23, 2019

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

chrony: Update to 3.4

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

iw: Update to 5.0.1

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hostapd: Update to 2.7

Enable to get randomness from getrandom() syscall instead
of opening /dev/random directly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

less: update to 530

Backporting package updates to IPFire 3.x, too...

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>