Package/erlang/install copies erts, kernel, sasl and stdlib into
/usr/lib/erlang/lib, and BuildModule builds erlang-sasl from the very
same sasl directory, so both packages own
usr/lib/erlang/lib/sasl-*/ebin/*.beam.
apk refuses to overwrite files owned by another package, so installing
erlang-sasl next to erlang fails:
ERROR: erlang-sasl-28.5-r1: trying to overwrite
usr/lib/erlang/lib/sasl-4.3.2/ebin/alarm_handler.beam
owned by erlang-28.5-r1.
That also takes down erlang-os-mon and erlang-reltool, which depend on
erlang-sasl. The overlap dates back to the import from the old packages
feed and only surfaced once CI started run-testing the subpackages.
Leave sasl to erlang-sasl, which is what that subpackage is for. The
base package keeps bin/start_sasl.boot: it is inert while the runtime
boots via start_clean, and it is needed once erlang-sasl is installed.
The binaries print the version as X.Y.Z-R while PKG_VERSION is X.Y.Z.R,
so the generic per-executable version probe never matches and the job
fails. Add a test-version.sh override that greps for the dashed form,
mirroring the conversion the runtime test.sh already does.
Exercise more gm subcommands and codecs on top of the existing PNG/JPEG,
resize, pixel, draw and composite checks: TIFF round-trip, PPM and GIF
encoders, crop, 90-degree rotate, horizontal append and in-place mogrify.
Exercise more of the toolchain on top of the existing PNG/JPEG/BMP,
resize, pixel-sampling, grayscale and composite checks: TIFF round-trip,
PPM and GIF encoders, crop, 90-degree rotate, horizontal append, the IM7
'magick' driver and in-place mogrify.
Update to the latest upstream stable release. Also fix PKG_SOURCE_URL:
imagemagick.org/archive no longer serves the release tarballs (404),
they live under download.imagemagick.org/archive/releases now.
The package ships checksec.bash, which upstream has discontinued. When
asked about the version the script reports, upstream answered that the
bash implementation is legacy, will be removed entirely in an upcoming
release and has been rewritten in Go:
https://github.com/slimm609/checksec.sh/issues/352
Dirk Brenken [Thu, 6 Aug 2026 13:56:40 +0000 (15:56 +0200)]
travelmate: release 2.4.7-1
* harden the connectivity check in f_net()
* drop the ineffective 'trm_netcheck' term from the minimum signal
quality branch in f_check()
* reset 'trm_connection' explicitly in the netcheck exit path
* log the affected uplink in the netcheck messages
* update and restructure the readme
Dirk Brenken [Wed, 5 Aug 2026 16:27:10 +0000 (18:27 +0200)]
adblock: report the last run timestamp as ISO 8601
The runtime status reported the last run as DD/MM/YYYY, which reads as a
different date entirely for anyone used to month first ordering.
Use YYYY-MM-DD instead. The DNS report already derives its timestamps from
tcpdump -tttt and is ISO 8601, so both views now agree, and the format is
unambiguous regardless of the reader's locale.
The 'swanctl.conf' has no 'privkeys' option in
'connections.<conn>.local<suffix>'. The only local-round keys documented
for authentication are 'certs', 'cert<suffix>' and 'pubkeys'. Strongswan
does not let a connection reference a private key by name at all - swanctl
auto-selects the matching private key from '/etc/swanctl/private'
(or rsa/ecdsa/pkcs8) by comparing it against the certificate configured
via 'certs' when credentials are loaded.
Writing 'privkeys = $local_key' into the generated swanctl.conf is
therefore a no-op at best: the option is unknown to the parser and
gets silently dropped, so it never had any effect on which key was
used.
Drop the bogus assignment. The existing local_key validation making
sure the referenced file exists under '/etc/swanctl/private'. Since that's
still useful to catch misconfiguration early, and add a comment explaining
why nothing is written to swanctl.conf for it.
The conditional nftables dependency causes Kconfig to select
PACKAGE_nftables-nojson from itself:
symbol PACKAGE_nftables-nojson is selected by PACKAGE_nftables-nojson
Split the firewall dependencies into nftables and iptables variants. Keep
trafficshaper as the default nftables variant and provide
trafficshaper-iptables for older systems.
modemmanager: skip virtual net devices in hotplug script
Every net uevent - eth ports, USB hubs, bridges, taps, SQM IFB,
GRE tunnels, veth, tun/tap - is handed to mmcli via
25-modemmanager-net's mm_report_event call, so ModemManager logs a
'not supported by any plugin' notice per device on every boot and
hotplug replay:
ModemManager[15132]: <msg> [base-manager] couldn't check support
for device '.../fsl-ehci.0/usb1/1-1/1-1.1':
not supported by any plugin
mm_report_event() already discards virtual devices internally, but
only after mm_log "info" has written a "hotplug: add network
interface XXX: event processed" line to daemon.info for every one
of them.
Mirror the same guard in the hotplug script by exiting early when
DEVPATH points under /devices/virtual/*, which covers SQM IFB, GRE,
bridges, veth, tun/tap. This never rejects a physical modem port
(kernel wwan, MHI, USB CDC/RNDIS/QMI/MBIM are all under real bus
subtrees).
modemmanager: skip live report when the service isn't up yet
At boot procd replays every previously-seen uevent before
/etc/init.d/modemmanager starts. Each replay walks the hotplug.d/
tree, which calls mm_report_event() in modemmanager.common. That
helper does two independent things:
1) appends the event to ${MODEMMANAGER_EVENTS_CACHE}, and
2) runs 'mmcli --report-kernel-event=...' to notify a live MM.
Step 1 is what matters for boot; step 2 exists so events fired
after MM is running get reported without waiting for the next
cache replay. The cache path is intentional: ModemManager-wrapper
starts MM, then mm_report_events_from_cache() polls 'mmcli -L'
until the bus is available and replays every cached event.
At boot the modemmanager service instance hasn't been spawned by
procd yet, so step 2 always fails with:
daemon.err ModemManager[NNN]: hotplug: Couldn't report kernel
event: error: couldn't get bus: Could not connect: No such
file or directory
That's one daemon.err line per hotplug script per port, per boot.
On a dual-modem board that's a dozen spurious errors before the
service even starts. Nothing is lost -- the wrapper's cache
replay picks them all up seconds later -- but the log noise makes
real ModemManager errors harder to spot.
Guard the live call with a cheap pidfile-based liveness check.
The pidfile is procd's, so it proves the service instance has
been spawned, not that MM is already reachable on the bus; the
brief wrapper-startup window (procd spawns the wrapper -> wrapper
execs MM -> MM reaches the bus) is not covered. In practice no
fresh uevents fire in that window on the boards this was tested
on, and events that do arrive there are still cached. If the
service hasn't been spawned yet, the event is silently cached and
the wrapper handles it. If it has, behavior is unchanged.
The 'local_key' UCI option was validated (checked for existence
under /etc/swanctl/private/) but never written to the generated
'swanctl.conf'. As a result, setting 'local_key' had no actual effect
on which private key was used for local authentication.
Add the corresponding "privkeys" line to the local{} section,
mirroring how local_cert is already written as "certs", so that
swanctl explicitly uses the configured private key.
The name 'local_sourceip' was misleading, since the option actually
refers to virtual IP addresses (VIPs) used for routing/binding,
not just a single local source IP. Renaming it to 'vips' better
reflects its purpose and makes the configuration more intuitive
for users, especially in setups with multiple virtual IPs.
Add a uci-defaults migration script to convert existing 'local_sourceip'
entries (whether stored as a plain option or as a list) to a
'vips' list on upgrade.
Rename the 'local_ip' UCI option to 'local_addrs' to match the
'swanctl.conf' 'local_addrs' directive, which accepts one or more
local addresses rather than implying a single fixed IP. The
previous name suggested only one address could be configured.
Store the option as a UCI list to allow specifying multiple local
addresses, consistent with how 'remote_addrs' is already handled.
If left empty, no 'local_addrs' line is written to 'swanctl.conf',
so strongswan falls back to its own default of '%any'.
Add a uci-defaults migration script to convert existing 'local_ip'
entries (whether stored as a plain option or as a list) to a
'local_addrs' list on upgrade.
strongswan: rename 'remote_gateway' to 'remote_addrs'
Rename the 'remote_gateway' UCI option to 'remote_addrs' to match
the 'swanctl.conf' 'remote_addrs' directive, which accepts one or
more peer addresses rather than a single gateway. The previous
name implied a single value and did not reflect that multiple
remote addresses can be configured for a connection.
Store the option as a UCI list to allow specifying multiple
remote addresses, consistent with how 'local_subnet' and
'remote_subnet' are already handled.
Add a uci-defaults migration script to convert existing
'remote_gateway' entries (whether stored as a plain option or as
a list) to a 'remote_addrs' list on upgrade.
If the 'remote_addrs' option is empty, strongswan implicitly uses the value
'%any'. In the `swanctl.conf` documentation, '%any' is already the default
value for 'remote_addrs' if the directive is not specified at all.
The UCI option 'gateway' in the ipsec config (consumed by
/etc/init.d/swanctl) is ambiguous. It is not clear from the name
alone whether it refers to the local or the remote IKE/IPsec
peer address, which has repeatedly led to misconfiguration.
Rename it to "remote_gateway" to make the direction explicit and
to match the existing "remote_subnet" naming. If the option is
unset, the init script now falls back to the strongSwan default
of '%any', so connections that accept any remote peer no longer
require an explicit placeholder value.
Add a uci-defaults migration script to rename existing 'gateway'
entries to 'remote_gateway' and remove the value 'any' on upgrade. This
is new default if 'remote_gateway' is not set.
strongswan: migration and merge local_nat into local_subnet
The UCI option 'local_nat' was a misleading legacy name for the
option that actually specifies the local traffic selector(s) used
by strongSwan/swanctl for a connection, i.e. the local subnet(s)
matched by the IPsec SA. It has nothing to do with NAT-T or NAT
detection, and the name repeatedly caused confusion when writing
or reviewing configs.
Merge it to 'local_subnet' to match its actual purpose and to
align with the naming already used for the corresponding
'local_subnet' option and with swanctl.conf's own 'local_ts/remote_ts'
terminology.
Add a uci-defaults migration script so existing installations are
upgraded automatically. It reads any existing 'local_nat' values
(whether stored as a plain option or as a list) and rewrites them
as a 'local_subnet' list.
strongswan: reorder local var in config_remote function
The local variables were completely jumbled. To keep track of them, they
have been sorted in the order in which the following 'config_get' calls
are made.
strongswan: reorder local var in config_child function
The local variables were completely jumbled. To keep track of them, they
have been sorted to the order in which the following 'config_get' calls
are made.
Dirk Brenken [Sun, 2 Aug 2026 18:32:12 +0000 (20:32 +0200)]
adblock: release 4.5.7-1
* add new 'adb_repfilter' option to pass an additional, user
defined tcpdump filter expression which is logically ANDed
to the internal port filter. This allows to exclude redundant
traffic upfront, e.g. DNS requests originating from the router
itself which are routed via a VPN client interface and which
are picked up again when 'adb_repiface' is set to 'any';
see the readme for details/examples.
fluent-bit: fix HTTP output SIGSEGV on too-small coroutine stack
Each output flush runs in a coroutine whose stack was forced to 4096 (one
page). The HTTP output plugin overflows it and crashes with SIGSEGV after
the flush (issue #30113). Pin FLB_CORO_STACK_SIZE to upstream's own 64K
floor (FLB_CORO_STACK_SIZE_MIN_BYTE), which the musl-shrunk default undercuts.
Also add a regression test: drive the dummy input into the http output and
assert fluent-bit survives a few flush cycles instead of dying from a signal
(no listener needed -- the overflow happens while composing the request).
Fixes: https://github.com/openwrt/packages/issues/30113 Signed-off-by: Alexandru Ardelean <redacted>
Also expand test.sh beyond the single loose configtest grep: assert the
daemon binary, init script and default config are installed, that
--configtest exits cleanly on the shipped config, and that it rejects an
explicitly-passed missing config file (so the positive check is real).
The daemon is never started, which would hang under QEMU emulation.
cifs-utils: update to 7.7 + more tests + add python3-light dep
Update to the latest upstream stable release.
Replace the version-only test.sh with checks that exercise the installed
binaries. smbinfo ships as a /usr/bin/python3 script, so add +python3-light
or it cannot exec; it also has no version flag, so add test-version.sh to
override the generic per-executable version probe (skipping smbinfo).
Paul Lipps [Fri, 31 Jul 2026 05:11:09 +0000 (00:11 -0500)]
dnscrypt-proxy2: update to 2.1.18
Update dnscrypt-proxy2 to version 2.1.18.
Fix the blocked_names_file substitution. The previous expression did not
match the upstream example configuration, leaving the bundled blocklist
disabled. This enables blocked-names.txt on fresh installations.
Declare blocked-names.txt as a configuration file so that
local changes are preserved during package upgrades.
Richard Muzik [Tue, 30 Jun 2026 09:17:01 +0000 (11:17 +0200)]
transmission: update to version 4.1.3
This is Transmission 4.1.3, a bugfix release. It fixes a potential
CRSF security issue for users who enable remote access to Transmission.
Users are encouraged to upgrade to this version.
zabbix: tweak server initscript and bring agentd to parity
* Genericize zabbix_server initscript.
* Add shellcheck overrides where needed.
* Add a 'never_root' config option (default true) that determines
whether server starts as an unprivileged user or starts as root and
drops to an unprivileged user (unless config is changed so it always
runs as root).
* Bring zabbix_agentd initscript to parity with zabbix_server for the
initscript and configuration.
* Tweak Makefile to reduce repetition
prosody: extend test.sh past the version string grep
The previous test only grepped prosody.version and ran `prosodyctl
about`, which still passes when the parts that actually differ per
target architecture are broken.
Drive the rest of the package instead:
- Assert `prosodyctl about` reports Lua 5.4. The wrapper silently falls
back to /usr/bin/lua (5.1 on OpenWrt) if --runwith is lost, and
prosody 13 refuses to run on it.
- Require loader.lua to be installed, since prosody(ctl) cannot resolve
any of its 'prosody.*' requires without it.
- Register and unregister an account on the sample VirtualHost. That is
the only path exercising util.datamanager storage together with the
internal_hashed SCRAM derivation, and it must not leave the cleartext
password on disk.
- Load each of the 13 compiled util/*.so extensions through their
luaopen_prosody_util_* entry points.
- Check known-answer vectors through util.hashes and an Ed25519
sign/verify round trip through util.crypto (both linked against
libopenssl), IDNA plus stringprep through util.encodings (libidn),
and XML parsing through util.xml (luaexpat).
- Require lfs, socket and ssl, so a missing luafilesystem5.4 /
luasocket5.4 / luasec5.4 runtime dependency fails here rather than on
a user's router.
The XMPP daemon is still never started: it would block forever under
QEMU emulation.
0.12.x is EOL upstream and accumulating CVEs. Bump to the current
stable 13.0.6, which carries the fix from security advisory
2026-04-29 / prosody.im/security/advisory_735dd9d3 that first shipped
in 13.0.5.
Prosody 13 requires Lua >= 5.2 (configure rejects 5.1). Switch the
build and runtime to Lua 5.4 and depend on the new
luafilesystem5.4 / luaexpat5.4 / luasec5.4 / luasocket5.4 variants.
Drop the now-unused luabitop dependency: bit operations are built in
since Lua 5.3.
Other notes:
- configure now needs an explicit --lua-version=5.4 and --runwith=lua5.4
because the wrapper script defaults to '/usr/bin/lua' (5.1 on OpenWrt).
- Install the new mod_debug_stanzas plugin directory. The commented-out
fallbacks/*.lua install is dropped rather than revived: upstream's
'make install' never copies that directory, and fallbacks/lxp.lua is
Lua 5.1 code using module(), which does not even load on 5.4.
- util-src/hashes.c now calls EVP_blake2{s256,b512}(), which libopenssl
does not provide unless OPENSSL_WITH_BLAKE2 is set, so compile those
two hashes out when libcrypto lacks them. Selecting the symbol instead
is not enough: the resulting util/hashes.so still fails to relocate
against a stock libcrypto, and prosody aborts at startup. Only the
COMPAT util.hmac table references them, and it tolerates nil entries.
- Install loader.lua. 13.x moved every internal require() to the
'prosody.*' namespace, and loader.lua is what maps those names back
onto the installed layout. It is the first file prosodyctl looks for,
so both prosody and prosodyctl abort at startup without it.
Add luasocket5.4 next to the existing luasocket (Lua 5.1) and
luasocket5.3 variants, installed via the upstream makefile's
'make install LUAV=5.4'.
That makefile defaults to prefix=/usr/local on linux, which is where
the luasocket5.3 variant still installs, so pass prefix=/usr explicitly
to land in /usr/share/lua/5.4 and /usr/lib/lua/5.4 like the other Lua
5.4 module packages.
Add luaexpat5.4, parallel to existing luaexpat (Lua 5.1, default).
Builds against the Lua 5.4 headers under /usr/include/lua5.4 and
installs to /usr/lib/lua/5.4/. Same pattern as the luasocket 5.3
variant already shipped.
Lua 5.1 is EOL and many downstream packages need 5.2+. Mirror the
luasocket multi-variant pattern: keep luafilesystem (Lua 5.1, default)
and add luafilesystem5.4 which builds the same source against
liblua5.4 and installs to /usr/lib/lua/5.4/.
Needed for the prosody 13.x upgrade (Lua 5.1 unsupported upstream).
lua: look for lua5.4 modules under /usr instead of /usr/local
luaconf.h hardcodes LUA_ROOT to "/usr/local/", and nothing in this
package overrides it for the target build, so the interpreter only ever
searches /usr/local/{share,lib}/lua/5.4. Nothing installs there on
OpenWrt, which leaves every Lua 5.4 module package unreachable:
# lua5.4 -e 'require "lfs"'
lua5.4: module 'lfs' not found:
no file '/usr/local/share/lua/5.4/lfs.lua'
no file '/usr/local/lib/lua/5.4/lfs.so'
[...]
# find / -name lfs.so
/usr/lib/lua/5.4/lfs.so
Point LUA_ROOT at /usr. LUA_LDIR and LUA_CDIR are derived from it and
keep the version suffix, so the search paths become /usr/share/lua/5.4
and /usr/lib/lua/5.4 - exactly where the Lua 5.4 module packages
install. The core lua (5.1) package carries an equivalent patch.
unbound: update to 1.25.2
From upstream: 1.25.2 consolidates security fixes for issues reported over
a period of time. There are fixes for CVE-2026-14586, CVE-2026-32665,
CVE-2026-40691, CVE-2026-41637, CVE-2026-42955, CVE-2026-44621,
CVE-2026-44687, CVE-2026-44690, CVE-2026-46582, CVE-2026-50045,
CVE-2026-50046, CVE-2026-50243, CVE-2026-50248, CVE-2026-50251,
CVE-2026-50252, CVE-2026-52863, CVE-2026-54478, CVE-2026-55708,
CVE-2026-55717, CVE-2026-55973, CVE-2026-55990, CVE-2026-55991,
CVE-2026-56416 and CVE-2026-56444.
LUA_ECO_CRASH_BACKTRACE declared "depends on PACKAGE_lua-eco" while
lua-eco's DEPENDS carries "+LUA_ECO_CRASH_BACKTRACE:libunwind", which the
generator turns into "select libunwind if LUA_ECO_CRASH_BACKTRACE". kconfig
then sees lua-eco and the symbol depending on each other:
error: recursive dependency detected!
symbol LUA_ECO_CRASH_BACKTRACE depends on PACKAGE_lua-eco
symbol PACKAGE_lua-eco depends on LUA_ECO_CRASH_BACKTRACE
Drop the redundant guard; the option only affects lua-eco's own build, so
nothing is pulled in when lua-eco itself is not selected.
Fixes: https://github.com/openwrt/packages/pull/30098#issuecomment-5113528752 Signed-off-by: Alexandru Ardelean <redacted>
Update to the latest upstream stable release and add a functional
test.sh that pipes a small text stream and a 256 KiB binary stream
through pv, checking both arrive unchanged.
ddns-scripts: fix root command injection through ddns_dateformat
The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps
DATE_PROG="date +'$ddns_dateformat'"
...
write_log 5 "PID '$$' started at $(eval $DATE_PROG)"
and for the "last update" timestamp in the updater
The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set
ddns_dateformat="%F'; touch /tmp/pwned; '"
and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.
Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.
luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.
Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house) Fixes: 1c20dcb71a69 ("ddns-scripts: update to 2.7.6-1") Assisted-by: Claude:claude-opus-5 Signed-off-by: Hauke Mehrtens <redacted>
Refresh "cmake-add-build-with-soxr-option"-patch.
The CI/CD pipeline checks whether patches are byte-identical to what
make package/$(PKG_NAME)/refresh produces.
While the patch applied cleanly, it contained the index-line and a
git-footer, which caused the CI/CD-pipeline's patch-check to bail out
Josef Schlehofer [Tue, 28 Jul 2026 06:28:02 +0000 (08:28 +0200)]
ci: add LLM review rules
Add `.github/llm-review-rules.md` to define project-specific patterns
and guidelines for the LLM review bot, alongside the equivalents in
openwrt/openwrt and openwrt/luci.
The rules cover what the review routine cannot infer from the diff
alone: quilt-managed patch refresh, the generic version check and the
test.sh / test-version.sh overrides, procd init scripts, conffiles
layout, source and mirror macro preferences, and Makefile indentation
per block type.
They also set the review posture. Formatting that changes what gets
built is treated as a defect, while cosmetic style is not worth
blocking a merge over; findings the formality bot already posts are
not repeated; and CI results are a reference rather than a gate.
Patches only need to be upstream-ready when they are candidates for
upstream, since many here are OpenWrt-specific hacks with nowhere to
go. Stable branches may carry a minor LTS update that has no
counterpart on master, so not every stable-branch PR is a cherry-pick.
Signed-off-by: Josef Schlehofer <redacted> Co-Authored-By: Claude Opus 5 <redacted>
freeradius3: fix recursive dependency from libopenssl-legacy
The 3.2.10 update made freeradius3-common select libopenssl-legacy, which
hard-depends on libopenssl; the generator propagates that onto common's
selectors (freeradius3, freeradius3-utils) as a FREERADIUS3_OPENSSL depends,
looping with the SSL choice. Declare the OpenSSL deps there too to break it.
Fixes: https://github.com/openwrt/packages/pull/30081#issuecomment-5100951400 Signed-off-by: Alexandru Ardelean <redacted>
Expose the optional C crash backtrace diagnostics through
CONFIG_LUA_ECO_CRASH_BACKTRACE. Depend on libunwind when enabled.
Keep the option unavailable on musl/powerpc, where OpenWrt's
libunwind package is not supported.
radsecproxy: add config options for UCI, fix escaping
This adds more config options for use in UCI, esp. new configuration
options that were introduced in newer radsecproxy versions and it fixes
an escaping issue in the init script where a string containing single
quotes would still be escaped using single quotes, causing radsecproxy
to reject the config.
apparmor: stage libapparmor headers via InstallDev
Add a Build/InstallDev so libapparmor's header (sys/apparmor.h), the
libapparmor.so link and the pkg-config file are copied into the staging
directory. Without this, packages cannot build against libapparmor even
though the runtime shared library is provided; e.g. stress-ng's AppArmor
stressors fall back to "built without sys/apparmor.h".
adblock: keep the GeoIP map usable without a local uplink
The map array anchor and the f_fetch call were placed inside the uplink branch, so a WAN
interface without a resolvable address left adb_map.jsn empty. That skipped the blocked domain
lookup as well and dropped the entire map, not just the local marker.
banip: fix the local uplink lookup of the GeoIP map
- better extract Uplink addresses
- the map array anchor was written inside the runtime file branch,
so a missing runtime file dropped the entire map instead of just the local marker
travelmate: fix loss of configured uplink mac address
- pass the station details to the "rev" call so the uplink section
stays resolved, fixes #30099
- the same empty trm_uplinkcfg also silently skipped disabling the uplink
after trm_maxretry was reached - fixed that too with this oneliner
Daniel Golle [Sat, 25 Jul 2026 17:46:50 +0000 (18:46 +0100)]
uvol: bump version to 1.1
manage volume state over ubus instead of the rootfs
Rework the volume lifecycle around blockd's ubus API, so volume state
lives entirely on the self-describing LVM/UBI backing store and never
leaks into the firmware rootfs.
- register active volumes with blockd over ubus (mount.uc) instead of
spooling mounts into /etc/config/fstab (uci.uc)
- bootstrap .meta from 'uvol boot' and drop the broken 90-uvol-init
uci-default
- run 'uvol boot' straight from the mount.ready trigger, and query
'ubus call block status' at service start to cover storage already
being ready
- defer removal of a volume whose backing device is still held, and
reap it from the mount.umount trigger once it is free
- enforce content-addressed "<algo>-<hexdigest>" volumes in the
dispatcher: reuse an existing volume of the same digest, verify
every write
- verify a content-addressed write in place while the volume is still
incomplete, reporting EBADMSG on mismatch instead of flipping
volume state
- purge incomplete wo/wp leftovers on boot and reclaim an exactly
matching one on create
- serialise mutating commands with a device-wide lock, plus a
per-volume lock ordered after it so a slow write cannot stall other
volumes
- add a grow-only 'resize' verb to both backends: lvextend plus the
matching fs-grow tool for lvm, ubirsvol for ubi
- create ext4 volumes with a journal (was ext2) and request check_fs
when registering a read-write volume
- declare read-only mounts to blockd rather than letting block guess
from the filesystem
- reject non-numeric and non-positive sizes in create and resize
- report its own version
- simplify command line parsing (drop compatibility with ancient ucode)
Requires the matching fstools changes from
openwrt/openwrt@9b11fa4088c6a.
Fixes several security issues:
- CVE-2026-11331 Fix handling of rpz CNAME expansion that returns name too long.
- CVE-2026-11721 Invalid signed wildcard records were being accepted.
- CVE-2026-13321 Fix DNSSEC validation bypass via out-of-zone NSEC Next Field.
- CVE-2026-10723 Correct verification of NSEC3 signer name.
- CVE-2026-12617 Do no assert for some specifics CNAME and DNAME queries.
- CVE-2026-10822 Malformed DNSKEY records could trigger an assertion.
- CVE-2026-11605 Prevent excessive validation work from crafted negative responses.
- CVE-2026-11622 Prevent cache exhaustion under sustained attack.
Full release notes are available upstream at
https://ftp.isc.org/isc/bind9/9.20.26/doc/arm/html/changelog.html
git.99rst.org / openwrt-packages.git / log