[v3] package/chicken: security bump to 5.4.0

This release includes a fix for CVE-2022-45145

Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>

--
Changes v2 -> v3:
  - Add this changelog to commit message
  - Add Signed-off-by to commit message

Changes v1 -> v2:
  - Update version numbers in hash file

Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
---
 package/chicken/chicken.hash | 4 ++--
 package/chicken/chicken.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

On Wed, 21 Aug 2024 08:44:14 -0400
Woodrow Douglass via buildroot <buildroot@buildroot.org> wrote:

> This release includes a fix for CVE-2022-45145
> 
> Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
> 
> --
> Changes v2 -> v3:
>   - Add this changelog to commit message
>   - Add Signed-off-by to commit message
> 
> Changes v1 -> v2:
>   - Update version numbers in hash file
> 
> Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
> ---
>  package/chicken/chicken.hash | 4 ++--
>  package/chicken/chicken.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)

Sorry to be annoying, but this patch breaks the legal information for
this package:

>>> chicken 5.4.0 Patching
>>> chicken 5.4.0 Collecting legal info
ERROR: while checking hashes from package/chicken/chicken.hash
ERROR: LICENSE has wrong sha256 hash:
ERROR: expected: b434ac92e094214136a6b5032f0dc9da97f22cef084ac1d0131b02a09e2caa37
ERROR: got     : c0ed699d5c4a8687f90a6488244f7f57d48a7f2d42bb7461b08a0d69a07d4f58
ERROR: Incomplete download, or man-in-the-middle (MITM) attack
make: *** [package/chicken/chicken.mk:46: chicken-legal-info] Error 1

So the hash of the license file needs to be updated *and* an
explanation about the changes in the license files must be added in the
commit log.

Also, please note that updating from 5.3.0 to 5.4.0 is OK as the
package is new in 2024.08, but as it fixes a security issue, we need to
have this fix in master, and therefore a more minimal update to 5.3.1
would have been preferable for master (and the update to 5.4.0 in our
next branch). But again, as this package is new, I think it is OK to
upgrade to 5.4.0 even in our master branch.

Thomas

On 8/24/24 03:07, Thomas Petazzoni wrote:
> CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender.
>
>
> On Wed, 21 Aug 2024 08:44:14 -0400
> Woodrow Douglass via buildroot <buildroot@buildroot.org> wrote:
>
>> This release includes a fix for CVE-2022-45145
>>
>> Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
>>
>> --
>> Changes v2 -> v3:
>>    - Add this changelog to commit message
>>    - Add Signed-off-by to commit message
>>
>> Changes v1 -> v2:
>>    - Update version numbers in hash file
>>
>> Signed-off-by: Woodrow Douglass <wdouglass@carnegierobotics.com>
>> ---
>>   package/chicken/chicken.hash | 4 ++--
>>   package/chicken/chicken.mk   | 2 +-
>>   2 files changed, 3 insertions(+), 3 deletions(-)
> Sorry to be annoying, but this patch breaks the legal information for


Not annoying at all, it's my lack of diligence, I'm sorry. I'll add 
`make chicken-legal-info` to my list of things i do to test.


> this package:
>
>>>> chicken 5.4.0 Patching
>>>> chicken 5.4.0 Collecting legal info
> ERROR: while checking hashes from package/chicken/chicken.hash
> ERROR: LICENSE has wrong sha256 hash:
> ERROR: expected: b434ac92e094214136a6b5032f0dc9da97f22cef084ac1d0131b02a09e2caa37
> ERROR: got     : c0ed699d5c4a8687f90a6488244f7f57d48a7f2d42bb7461b08a0d69a07d4f58
> ERROR: Incomplete download, or man-in-the-middle (MITM) attack
> make: *** [package/chicken/chicken.mk:46: chicken-legal-info] Error 1
>
> So the hash of the license file needs to be updated *and* an
> explanation about the changes in the license files must be added in the
> commit log.
>
> Also, please note that updating from 5.3.0 to 5.4.0 is OK as the
> package is new in 2024.08, but as it fixes a security issue, we need to
> have this fix in master, and therefore a more minimal update to 5.3.1
> would have been preferable for master (and the update to 5.4.0 in our
> next branch). But again, as this package is new, I think it is OK to
> upgrade to 5.4.0 even in our master branch.
>
> Thomas
> --
> Thomas Petazzoni, CTO, Bootlin
> Embedded Linux and Kernel engineering
> https://bootlin.com


I'll send a revision of the patch soon


Thanks,
Woodrow Douglass