cryptography_project:cryptography has been deprecated in favour of
cryptography.io:cryptography:
https://nvd.nist.gov/products/cpe/detail/2EBA50FC-F3F9-40D5-82BD-EFB67F761153
gnuplot_project:gnuplot has been deprecated in favour of
gnuplot:gnuplot:
https://nvd.nist.gov/products/cpe/detail/DB68C9F5-3330-4749-A6F5-61FF041037CC
rom_walton:boinc has been deprecated in favour of
universityofcalifornia:boinc_client:
https://nvd.nist.gov/products/cpe/detail/DAC161C5-2154-44BF-916A-EACB524E8B8F
- Fix GCC 15 build with 2 patches from Gentoo [1][2]
- Refresh existing patch
- Extend 010-enable-nonroot-install.patch to remove "-o U -g G" from
more install targets (fixes 'invalid user buildbot' in CI)
John Audia [Thu, 4 Sep 2025 20:38:22 +0000 (16:38 -0400)]
snort3: add patch to unambiguously show vectorscan
When snort is run with the --version option, it advertises components'
versions in the output. Add a patch to modify the output to clearly
show vectorscan is in use.
John Audia [Tue, 2 Sep 2025 10:21:37 +0000 (06:21 -0400)]
snort3: replace hyperscan with vectorscan in deps
* Replacement of hyperscan-runtime reference with vectorscan-runtime
* Added support for all aarch64 targets which I believe is exhaustive
For x86 and x86/64, I found that vectorscan is truly a drop-in
replacement for hyperscan as assessed by speedtests with snort3 running
on my Intel N150 PC. CPU load during the test with each condition was
nearly saturating on a single core for both cases on a symmetrical
Gbps line.
John Audia [Tue, 2 Sep 2025 18:02:58 +0000 (14:02 -0400)]
hyperscan: remove package
Remove hyperscan since Intel announced a proprietary/closed source
license beginning with hyperscan 5.5[1,2] and a general lock of support
for the 5.4.x branch which has not seen a commit since 19-Apr-2023[3].
John Audia [Tue, 9 Sep 2025 23:41:00 +0000 (19:41 -0400)]
snort3: remove hyperscan specific patch
Drop 100-remove-HAVE_HS_COMPILE_LIT-to-work-around-upstream-b.patch as
it was only needed to fix the build against hyperscan. Vectorscan
builds fine without it.
John Audia [Sun, 21 May 2023 12:04:37 +0000 (08:04 -0400)]
vectorscan: new package for speeding up regex ops
Vectorscan is fork of Hyperscan, a high-performance multiple regex
matching library. It follows the regular expression syntax of the
commonly-used libpcre library, but is a standalone library with
its own C API.
Currently ARM NEON/ASIMD and Power VSX are 100% functional. ARM
SVE2 support is in ongoing with access to hardware now. More
platforms will follow in the future.
The performance difference of snort3 compiled against this is
sizable for aarch64 confirmed on two different SoCs:
Test SoC #1 flogic/glinet_gl-mt6000
IDS mode:
Download speed wo/ vectorscan: 91.2 ±0.21 Mbit/s (n=3)
Download speed using vectorscan: 331.0 ±27.34 Mbit/s (n=3)
Gain of 3.6x
IPS mode:
Download speed wo/ vectorscan: 30.0 ±0.06 Mbit/s (n=3)
Download speed using vectorscan: 52.9 ±0.78 Mbit/s (n=3)
Gain of 1.8x
Notes:
* Data generated on snapshot build on 12-Apr-2024 using kernel
6.6.26, snort 3.1.84.0, vectorscan 5.4.11.
* Speedtest script hitting the same server.
* Snort rules file of was 37,917 lines/22 MB.
* In all cases, single core CPU saturation occurred which
speaks to the efficiency gains supplied by vectorscan.
Test Soc #2 bcm2712/RPi5B
IPS mode:
Download speed wo/ vectorscan: 164.3 ±0.64 Mbit/s (n=3)
Download speed using vectorscan: 232.8 ±0.26 Mbit/s (n=3)
Gain of 1.4x
Notes:
* Data generated on snapshot build on 13-Apr-2024 using kernel
6.1.86, snort 3.1.84.0, vectorscan 5.4.11.
* Google fiber speedtest (https://fiber.google.com/speedtest/)
hitting the same server.
* Snort rules contained 39,801 rules/22 MB.
* In all cases, single core CPU saturation occurred which
speaks to the efficiency gains supplied by vectorscan.
David Härdeman [Thu, 18 Sep 2025 07:55:29 +0000 (09:55 +0200)]
bind: don't break IPv6 support
What started in #20183 as a attempt to clean up noise in the logfiles,
turned out to be causing denial-of-service for dual-stack and especially
IPv6-only environments.
Breaking core network functionality cannot possibly be less important
than cosmetic issues, and those affected by log spam can avoid it via
other means (e.g. "query-source-v6 none;" in named.conf).
There's no reliable heuristic for determining whether there's IPv6
connectivity at the time bind is started which will catch any and all
corner cases, as discussed in #26327.
So, remove this logic for now. If a suitable heuristic can be devised,
it can always be added in a subsequent patch, but I have my doubts.
(Also, quote one variable to make shellcheck happy)
Closes: #26327 Closes: #20468 Signed-off-by: David Härdeman <redacted>
- Remove obsolete patch
- Add patch replace NPN with ALPN for client connections \
because the default OpenSSL library does not enable NPN.
- Add newly libstdcpp dependency
Ruby 3.4.0 is a major release that introduces several changes:
- Adds `it` block parameter reference
- Switches default parser to Prism
- Implements Happy Eyeballs Version 2 in the socket library
- Improves YJIT
- Adds Modular GC
- And more (see changelog for full details)
- The project was archived on Mar 22, 2024.
- The maintainer of the package and the upstream maintainer are the
same person, who has expressed their intention not to maintain the
package/project. See the quote[1] below:
> I haven't been maintaining this and I don't plan to spend any more
> time on it. Happy to hand it off, if someone is willing to take it on.
- The latest significant commit for the package (no treewide changes)
is commit 2c71d5bcd4e09b926d63d0fbba39534fd2c587f7 from Mar 29, 2020.
- The latest upstream commit[2] is from Mar 22, 2024, but it is a
documentation or cosmetic change. After this, the latest commits[3]
are from Apr 6, 2019.
John Audia [Sun, 14 Sep 2025 12:00:10 +0000 (08:00 -0400)]
nfs-kernel-server: update to v2.8.4
Update to v2.8.4
Shortlog:
Anna Schumaker (4):
rpcctl: Add support for `rpcctl switch add-xprt`
rpcctl: Display new rpc_clnt sysfs attributes
rpcctl: Add support for the xprtsec sysfs attribute
rpcctl: Rename {read,write}_addr_file()
Antonio Alvarez Feijoo (3):
nfsroot-generator: do not fail if nfsroot is not configured
systemd: Add a generator to mount /sysroot via NFSv4 in the initrd
systemd: Allow nfs-idmapd.service to be started without the server
Scott Mayhew (3):
rpc-statd.service: define dependency on both rpcbind.service and rpcbind.socket
nfsdctl: fix lockd config during autostart
nfsdctl: debug logging fixups
Steve Dickson (3):
Release: 2.8.4
configure.ac: AC_PROG_GCC_TRADITIONAL is obsolete.
nfsdctl: Warning Clean Up
zhangyaqi (2):
gssd:fix the possible buffer overflow in get_full_hostname
nfsdcld:Fix a memory leak
While testing my integration of Snapcast, I didn't test with CONFIG_ALL*
and CONFIG_BUILDBOT flags, but the buildbots did and failed with a lot
of undefined reference to PulseAudio.
Fix it with preventing PulseAudio detection.
While at it, prevent Avahi detection too to save more flash space.
These features will be available later, through flavours.
David Härdeman [Sun, 27 Jul 2025 20:33:38 +0000 (22:33 +0200)]
bind: fix build and bump PKG_RELEASE
bind9 builds for me on 24.10, but it doesn't build on master with or without my
patches.
The build already dies on the configure stage (without my patches applied),
because the autoconf magic manages to mix up the host gcc and the
cross-compiling gcc.
Removing PKG_FIXUP:=autoreconf from the Makefile fixes that, but compilation chokes later instead on libtool magic:
make[7]: Entering directory '/home/build/openwrt/build_dir/target-arm_cortex-a9+vfpv3-d16_musl_eabi/bind-9.20.11/bin/rndc'
...
/bin/bash ../../libtool --tag=CC --mode=link arm-openwrt-linux-muslgnueabi-gcc ...
libtool: link: arm-openwrt-linux-muslgnueabi-gcc ...
.../bin/ld.bfd: warning: libns-9.20.11.so, needed by ../../lib/isccfg/.libs/libisccfg.so, not found (try using -rpath or -rpath-link)
...
collect2: error: ld returned 1 exit status
Which I did a (compile-tested only) quick and dirty fix for.
Also, BUILD_CC isn't defined anywhere in the current bind sources, so I removed
that as well.
David Härdeman [Sun, 3 Aug 2025 20:10:53 +0000 (22:10 +0200)]
isc-dhcp: create zones using rndc
This changes isc-dhcp's init script to create bind zones using the tools
bind provides for that scenario instead of crafting separate zone
configuration by hand.
At the same time, remove the use of /tmp/bind/named.conf.local and add
permissions for dynamic zone creation to bind.
David Härdeman [Sun, 27 Jul 2025 01:50:50 +0000 (03:50 +0200)]
bind: update conffiles list
The previous patches removed a number of conffiles that weren't necessary,
meaning we can now assume that any changes or additional files in /etc/bind
are things that the user wants to keep.
Since /var/lib/bind is the standard location for longer-lived zone data
(i.e. not zones that secondary servers have obtained via XFER), we symlink
it to /etc/bind/zones so that it survives a sysupgrade.
Temporary files (such as XFER:ed zones for secondaries) stay in
/var/cache/bind.
David Härdeman [Sun, 27 Jul 2025 01:02:31 +0000 (03:02 +0200)]
bind: use default rndc control channel
The present logic recreates what is already the default in bind [1], and writes
the rndc key twice to two different files. In addition, the rndc key is
regenerated every time bind is restarted. Simplify this by relying on the
default behaviour instead.
David Härdeman [Sat, 26 Jul 2025 22:39:22 +0000 (00:39 +0200)]
bind: update named.conf
First, change the "directory" to point to /var/cache/bind, which ensures that
e.g. simple file "something" statements for secondary servers will create files
there (the directory is created by the init script, so we're sure that it
exists). This behaviour matches e.g. what Debian does.
Second, remove the "auth-nxdomain" stanza which is the default in bind since
9.0 was released.
Third, change "master" to "primary" (the wording used in the bind reference
docs)
- Takeover maintainership
- Enable parallel build
- Depend from libstdcpp only on JIT-enabled platforms (x86_64 and aarch64)
- Add SCTP support (off by default)
- Remove OTP-internal versions and rely on package versions for sub-packages
- Remove obsolete configure vars
- Move out sasl from erlang package into separate erlang-sasl
- Add more sub-packages
- erlang-diameter
- erlang-eldap
- erlang-ftp
- erlang-odbc
- erlang-parsetools
- erlang-tftp
- Rename erlang-os_mon to erlang-os-mon
- Clean-up descriptions text
- Disable MIPS16 again to fix mips* targets
Wesley Gimenes [Tue, 26 Aug 2025 20:01:14 +0000 (17:01 -0300)]
netbird: switch to profile-based configuration
Add support for `netbird` profiles feature [1] (introduced in 0.52.2). Use
`NB_STATE_DIR="/root/.config/netbird"` in the init file instead of the
previous `NB_CONFIG="/etc/netbird/config.json"`, and update Makefile
configuration paths accordingly.
Rationale: `netbird` saves state/configuration under `/var` by default. On
OpenWrt, `/var` is a symlink to `/tmp` (a volatile location), which would
cause config loss after reboot or reflash. Using `/root/.config/netbird`
avoids this, it's a valid upstream directory not used by default.
`netbird` will migrate existing configurations.
This change will not be backported to preserve the current meaning of
"stable" in OpenWrt and to avoid (unlikely but possible) breakage of
existing installations.
Update init file to include `NB_CONFIG="/etc/netbird/config.json"`
variable, ensuring configuration compatibility as before (fixes issue
introduced by profiles feature in 0.52.2). Existing configurations remain
compatible.
Note: license for some components (`management`, `relay`, `signal`) changed
to **AGPLv3**. These components aren't packaged for OpenWrt, so there's no
immediate effect, but record the change for future reference.
`netbird` now supports profiles [1]. The configuration file has been
moved from `/etc/netbird/config.json` to `/var/lib/netbird/`. The
migration is handled by `netbird` itself.
However, in OpenWrt, the `/var` directory is a symbolic link to
`/tmp`, which is a temporary directory. This can result in
configuration loss after rebooting or flashing a new image. This
issue will be fixed in the next release, 0.53.0.
**I reported this behavior upstream [2].**
Wesley Gimenes [Tue, 5 Aug 2025 12:53:05 +0000 (09:53 -0300)]
netbird: cleanup init script
Remove parameters added in commit 7b3d033ab651dd11e0db5fb099d106c9e09a2dc6
that were intended to reestablish the `netbird` connection when the
`wan` state changes. This functionality is already handled by
`netbird`. If it fails, it should be reported as a bug upstream.
John Audia [Sun, 7 Sep 2025 10:57:17 +0000 (06:57 -0400)]
snort3: switch from git proto to tarballs
Use upstream tarballs for source rather than using git. If we ever need
to build from git we can cherry pick and make a patch. This gives a
cleaner Makefile and faster build.
Szabolcs Hubai [Mon, 23 Jun 2025 17:45:00 +0000 (19:45 +0200)]
snapcast: fix compilation with boost 1.88.0
Boost upgrade hit Snapcast hard again: the process needs to be updated!
This patch is a patchset from badaix/snapcast@develop.
It is based on the following upstream commits:
badaix/snapcast@901b79a213b1 ("Build failure with boost 1.88.0 #1367")
badaix/snapcast@ffb086b4b331 ("Define BOOST_PROCESS_VERSION=1 globally")
badaix/snapcast@c37a76a4aba9 ("Add missing includes")
badaix/snapcast@571f6a8f6953 ("Include process v1 headers for Boost version >= v1.88.0")
Refs: 3585ddfc446c ("boost: Updates package to version 1.88.0")
Snapcast [1] is a multiroom client-server audio player, where all
clients are time synchronized with the server to play perfectly synced
audio.
It's not a standalone player, but an extension that turns your existing
audio player into a Sonos-like multiroom solution.
Audio is captured by the server and routed to the connected clients.
Several players can feed audio to the server in parallel and clients can
be grouped to play the same audio stream.
One of the most generic ways to use Snapcast is in conjunction with the
music player daemon (MPD) [2] or Mopidy [3].
The inclusion starts with version 0.28.0 because of OpenSSL dependency
issues of version 0.29.0. Newer versions (e.g. 0.32.3, see [4])
with optional OpenSSL support, will be incorporated with flavours,
like "-mini" and "-full" in the upcoming PRs.
More about this topic please check the inclusion PR at [5]!
Florian Eckert [Mon, 30 Oct 2023 14:12:55 +0000 (15:12 +0100)]
unzip: add valid patche headers and missing CVE informations
This commit adds a valid git patch header for each patch, so that
additional information can be stored. This is in this case and 'CVE:' tag.
This can be used by CVE scanner to find out if the patch fixes a CVE.
This patch fixes the following compilation build error for gcc14:
tftpd_pcre.c:109:37: error: passing argument 1 of 'pcre2_substring_list_free_8' from incompatible p
109 | pcre2_substring_list_free((const PCRE2_UCHAR **)substrlist);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
| |
| const PCRE2_UCHAR8 ** {aka const unsigned char **}
In file included from tftpd_pcre.h:24,
from tftpd_pcre.c:35:
I have also submitted the change to the upstream project:
https://github.com/madmartin/atftp/pull/2
John Audia [Fri, 18 Jul 2025 13:46:45 +0000 (09:46 -0400)]
snort3: fix logic in gpertools-runtime depends
The logic in e57cc9898a362d81e8dec5dd779293e6ff3d4710 was flawed causing
gperftools-runtime to fail to get detected when building resulting in:
...
ninja: Entering directory `/scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0'
ninja: error: '/scratch/union/staging_dir/target-x86_64_glibc/usr/lib/libtcmalloc.so', needed by 'src/snort', missing and no known rule to make it
make[2]: *** [Makefile:161: /scratch/union/build_dir/target-x86_64_glibc/snort3-3.9.1.0/.built] Error 1
It was missed due testing in build root that already had gperftools-runtime
built only discovered when building from a clean build root.
git.99rst.org / openwrt-packages.git / log