staging/pepe2k/scripts, branch v23.05.4

scripts: Add GNU ftp mirror redirector for GNU and Savannah

2024-07-08T19:13:26Z

Add GNU's redirector which automatically redirect user to nearby online mirror. Signed-off-by: Sahil Dhiman Link: https://github.com/openwrt/openwrt/pull/15557 Signed-off-by: Robert Marko (cherry picked from commit 6510eb3b5d612ea7a70c4a8d9b83639e3b46e221) Link: https://github.com/openwrt/openwrt/pull/15898 Signed-off-by: Hauke Mehrtens

scripts/ext-toolchain: add missing libc library specs

2024-07-08T19:13:25Z

Add missing libc library spec that weren't added to the ext-toolchain script when the library were introduced in the packages libs toolchain Makefile. Signed-off-by: Christian Marangi (cherry picked from commit 8cad52a267bffe384a119f3e5ae1892e8580a981) Link: https://github.com/openwrt/openwrt/pull/15898 Signed-off-by: Hauke Mehrtens

build: add explicit timezone in CycloneDX SBOM

2024-06-20T12:58:17Z

The sender domain has a DMARC Reject/Quarantine policy which disallows sending mailing list messages using the original "From" header. To mitigate this problem, the original message has been wrapped automatically by the mailing list software. Per the CycloneDX 1.4 spec, the `metadata.timestamp` field contains the date/time when the BOM was created [1]. Before the change, the value generated by the package-metadata.pl script would look like this: 2024-06-03T15:51:10 CycloneDX 1.4 relies on the JSON Schema specification version draft-07, which defines the `date-time` format [2] as derived from RFC 3339, section 5.6 [3]. In this format, the `time-offset` component is required, however in the original version of package-metadata.pl it is omitted. This is causing problems with OWASP Dependency-Track version 4.11.0 or newer, where it now validates submitted SBOMs against the JSON schema by default [4]. SBOMs with incorrect timestamp values are rejected with the following error: { "detail": "Schema validation failed", "errors": [ "$.metadata.timestamp: 2024-06-03T15:51:10 is an invalid date-time" ], "status": 400, "title": "The uploaded BOM is invalid" } Add explicit `Z` (UTC) timezone offset in the `timestamp` field to satisfy the CycloneDX schema. [1]: https://github.com/CycloneDX/specification/blob/1.4/schema/bom-1.4.schema.json#L116-L121 [2]: https://json-schema.org/draft-07/draft-handrews-json-schema-validation-01#rfc.section.7.3.1 [3]: https://datatracker.ietf.org/doc/html/rfc3339#section-5.6 [4]: https://github.com/DependencyTrack/dependency-track/pull/3522 Signed-off-by: Roman Azarenko (cherry picked from commit 2ded629864de779df8ddd0224a875edf17f9fea5) Link: https://github.com/openwrt/openwrt/pull/15693 Signed-off-by: Christian Marangi

build: fix kernel component in CycloneDX SBOM

2024-04-17T04:34:36Z

As stated in the cycloneDX documentation, the field "type" is mandatory for all components. More details here (https://cyclonedx.org/docs/1.5/json/#components_items_type) Signed-off-by: Cedric DOURLENT (cherry picked from commit 84331215e57090a9cdae4af75af2539c39cd7de7)

build: add explicit --no-show-signature for git

2024-02-20T19:58:41Z

When `log.showSignature` is set, it causes the `SOURCE_DATE_EPOCH` to include a textual signature description on OpenPGP-signed commits, because Git prints the description into stdout. This then causes some scripts to fail because they cannot parse the date from the variable. Adding an explicit `--no-show-signature` prevents the signatures from being displayed even when one has Git configured to show them by default, fixing the scripts. Signed-off-by: Oto Šťáva (cherry picked from commit 1e93208bd2c605704b19fe8b04025c20c17e808d)

scripts: sercomm-pid.py: use uppercase hwid in pid

2023-11-27T01:02:35Z

scripts/dump-target-info.pl: add new function to DUMP devices

2023-11-15T10:00:19Z

Add new function to dump-targer-info.pl to DUMP devices provided a matching target/subtarget. Example: ./scripts/dump-targer-info.pl devices ipq806x/generic will produce the sorted list of devices defined in the following format: device_id device_name Devices may have alternative names, the script will dump each alternative name in the same line of device_id. Following the pattern: device_id "PRIMARY DEVICE NAME" "ALT0 DEVICE NAME" "ALT1 DEVICE NAME" ... Example: tplink_ad7200 "TP-Link AD7200 v1/v2" "TP-Link Talon AD7200 v1/v2" Signed-off-by: Christian Marangi (cherry picked from commit 943c153cdd695904b9b7fe44800fc3546644973e)

scripts/getver.sh: prevent asking for negative rev-parse

2023-11-12T15:19:39Z

With the case of asking an invalid version that is too big, getver.sh might return an invalid output in the form of HEAD~-2260475641. This is caused by BASE_REV - GET_REV using a negative number. Prevent this by checking if BASE_REV - GET_REV actually return 0 or a positive number and set REV variable accordingly. With the following change, invalid revision number will result in unknown printed instead of the invalid HEAD~-NUMBERS output. Signed-off-by: Christian Marangi (cherry picked from commit 9e49e0a6c4535d345084cc62c594be5cad23b911)

build: add CycloneDX SBOM JSON support

2023-11-02T14:44:47Z

CycloneDX is an open source standard developed by the OWASP foundation. It supports a wide range of development ecosystems, a comprehensive set of use cases, and focuses on automation, ease of adoption, and progressive enhancement of SBOMs (Software Bill Of Materials) throughout build pipelines. So lets add support for CycloneDX SBOM for packages and images manifests. Signed-off-by: Petr Štetiar (cherry picked from commit d604a07225c5c82b942cd3374cc113ad676a2519)

package-dumpinfo,metadata: add ABI version information to package index

2023-11-02T14:44:46Z

There is no standard for ABI versioning, so its not possible to find out from `libext2fs2`, `libiwinfo20230701` or `libss2` package names if thats just package name or package name with ABI version included. To help with the decision, lets make ABI version aviable in package index. Signed-off-by: Petr Štetiar (cherry picked from commit 649655f427932fe79b96a41f883c8054b1806191)