Josef Schlehofer [Wed, 12 Aug 2026 06:00:03 +0000 (08:00 +0200)]
librespeed-cli-rust: update to 0.1.1
Brings the client in line with the fixes merged into the Go client: --json and
--csv end with a newline, --debug names the address each ICMP ping reached and
the spread of the samples, and the User-Agent carries the operating system and
architecture. Also tolerates a backend that answers getIP.php with an empty
rawIspInfo, which previously discarded the whole response.
The upstream Naive outbound feature is intentionally not enabled in this update.
Naive outbound requires additional build system integration because it depends on
Chromium Network Stack (Cronet). Depending on target and build mode, it requires
either the Cronet runtime library or a Chromium-based toolchain.
Upstream documentation:
https://sing-box.sagernet.org/configuration/outbound/naive/#structure
Changes:
1. Add upstream linker flags and compatibility build tags
Add linker flags required by the sing-box upstream release build:
- -checklinkname=0
-checklinkname=0 is required by the sing-box 1.13.x build configuration due to its use of
low-level go:linkname functionality and the stricter linkname validation in newer Go toolchains.
These tags are part of the upstream sing-box release build configuration:
https://sing-box.sagernet.org/installation/build-from-source/#build-tags
2. Add optional CCM and OCM build options
Add new optional OpenWrt configuration options:
- CONFIG_SINGBOX_WITH_CCM
Build with Claude Code Multiplexer service support
- CONFIG_SINGBOX_WITH_OCM
Build with OpenAI Codex Multiplexer service support
Both options are disabled by default and are only enabled when explicitly
selected by the user.
The corresponding upstream build tags are:
- with_ccm
- with_ocm
Documentation: https://sing-box.sagernet.org/installation/build-from-source/#build-tags Signed-off-by: Sergei S. <redacted>
001-disable-doc.patch dropped the doc subdir (which needs makeinfo) from
SUBDIRS in Makefile.in. Use PKG_SUBDIRS:=lib bc dc, OpenWrt's wired-in knob
for restricting the build, to skip doc without patching.
/etc/bird4.conf and /etc/bird6.conf are left over from the bird1
packages, which shipped a separate configuration file per address
family. bird3 is a single daemon handling both and installs
/etc/bird.conf only, so the two entries refer to files this package
never creates.
Reported-by: openwrt-ai[bot] Signed-off-by: Josef Schlehofer <redacted> Co-authored-by: Claude Fable 5 <redacted>
BIRD is an internet routing daemon with support of modern
routing protocols (BGP, OSPF, RIP, Babel) for IPv4 and IPv6. This is
the 3.x branch, a multithreaded rewrite.
Moved from the openwrt/routing feed, as discussed in
https://github.com/openwrt/routing/issues/184.
Signed-off-by: Josef Schlehofer <redacted> Co-authored-by: Claude Fable 5 <redacted>
The patch carried only a subject line and a placeholder commit id, so
nothing recorded why marking struct top_hash_entry as PACKED fixes a
bus error, or whether it can be dropped.
Restore the description and the sign-off from the commit that
introduced it in the routing feed, keeping the original author's
wording, and record the upstream status. Verified that BIRD 2.19.2
still declares the structure without any alignment attribute, so the
patch is still needed.
The header keeps the "---" separator the sibling patch uses, and
orders Signed-off-by last among the trailers.
Signed-off-by: Josef Schlehofer <redacted> Co-authored-by: Claude Fable 5 <redacted>
/etc/bird4.conf and /etc/bird6.conf are left over from the bird1
packages, which shipped a separate configuration file per address
family. bird2 is a single daemon handling both and installs
/etc/bird.conf only, so the two entries refer to files this package
never creates.
Reported-by: openwrt-ai[bot] Signed-off-by: Josef Schlehofer <redacted> Co-authored-by: Claude Fable 5 <redacted>
Josef Schlehofer [Mon, 10 Aug 2026 08:46:16 +0000 (10:46 +0200)]
librespeed-cli: update to 1.0.13
Carry fixes for a data race, a goroutine leak, output escaping, JSON and CSV
termination, and sub-millisecond ping precision, plus additional --debug
output. All patches are under review upstream.
Set the version through GO_PKG_LDFLAGS_X. The package never passed one, so
--version reported neither a name nor a version.
Drop the serverIdx patch: 1.0.13 resolves the same problem by checking the map
lookup rather than reading a possibly absent key.
Refresh sha256 from PyPI sdist. Drop the macOS cross-compile patch;
2.1.1 already carries the sysconfig.get_platform() fix upstream.
Add test-version.sh: 2.1.1 ships the cffi-gen-src console tool, a
subcommand CLI with no version flag, so the generic per-executable
version probe fails the package ("No executables in the package
provided version"). test-version.sh skips that probe, and test.sh now
asserts cffi.__version__ against the packaged version.
Refresh sha256 from the PyPI sdist and refresh 003 for the shifted line.
Retarget 002-pip-runner-pyc-fix.patch instead of dropping it: in 26.2.1
get_runnable_pip() moved from build_env.py (now a package) to
_internal/utils/misc.py. The function is otherwise unchanged and still
returns __pip-runner__.py, so the .pyc fallback is still required. We ship
pip byte-compiled only (the .py sources live in the -src package), so
without it build isolation cannot locate the runner and every PEP 517
install fails on target. This is a packaging workaround, not an upstream
bug, so upstream has no reason to carry it.
Pillow uses pybind11 only for pybind11.setup_helpers.ParallelCompile,
which parallelises the C extension build; it ships no runtime bindings.
Patch setup.py to remove that import and call and drop pybind11 from
build-system.requires, then remove python-pybind11/host from
PKG_BUILD_DEPENDS. The C extensions are compiled serially instead, with
no functional change to the package.
flit-core 4.0.2 breaks the whole python feed. flit-core is a host-only
build backend, but nearly everything built with it caps flit_core<4 (the
host tools wheel/installer/pyproject-hooks/typing-extensions and dozens of
leaf packages like marshmallow, click, pip), so their host builds fail with
"Missing dependencies: flit_core<4" against 4.0.2. Nothing needs
flit_core>=4; 3.12.0 satisfies every cap and has no runtime impact. Revert
until the ecosystem's upper bounds catch up.
Kel Modderman [Sat, 8 Aug 2026 10:46:57 +0000 (20:46 +1000)]
squeezelite: add version test override
The generic package test greps executable output for PKG_VERSION, which
cannot match here: PKG_VERSION separates the build number with a dot for
apk, while squeezelite reports it with a hyphen.
Derive the expected string from PKG_VERSION rather than hardcoding it, so
the check keeps working on later updates.
Update from the 6.2.x series to the current 8.x line. The 8.x releases
are tri-licensed (RSALv2 / SSPLv1 / AGPL-3.0); set PKG_LICENSE to
AGPL-3.0-only and follow upstream renaming COPYING to LICENSE.txt.
Drop 020-fix-atomicvar.patch, no longer needed, and keep
030-skip-module-tests.patch. Add a functional test.sh.
Dirk Brenken [Mon, 10 Aug 2026 17:35:56 +0000 (19:35 +0200)]
banip: fix cpu core calculation
- only cap the cpu core count by available memory if it was auto-detected,
a manually set 'ban_cores' is now authoritative and no longer lowered
- readme update: clarify that the auto-cap does not apply to a manually
set core count
The script greps for "uradvd $PKG_SOURCE_DATE", but the test harness
only exports PKG_NAME, PKG_VERSION and CI_HELPERS. PKG_SOURCE_DATE is a
build time Makefile variable and is empty in the test container, so the
grep -Fx pattern is "uradvd " and never matches.
The binary is built with VERSION=$(PKG_SOURCE_DATE) and prints
"uradvd 2025-09-20", while PKG_VERSION is 2025.09.20~<short hash>, so
derive the date from the version instead.
Rename it to test-version.sh in the process: the generic probe looks for
PKG_VERSION verbatim and cannot match the dashed date either, and uradvd
is the only executable in the package, so without an override the whole
package fails. The shebang goes back to /bin/sh, which is what the
harness runs the script with.
sudo: add test-version.sh and stop running sudo in tests
PKG_VERSION substitutes p->_p (1.9.17_p2) for a valid apk version, but the
binaries print the real 1.9.17p2, so the generic per-executable version
probe reports "no executables provided version" and fails. Add a
test-version.sh that matches the version string compiled into the binary.
Executing sudo under QEMU emulation (e.g. mips_24kc) hangs indefinitely, so
neither test-version.sh nor test.sh runs it any more: the version is read
from the binary and test.sh only checks the installed files.
sudo: drop 020-no-owner-change.patch for a make override
The patch blanked INSTALL_OWNER in Makefile.in so the staged install does
not chown to install_uid/install_gid, which fails when building as an
unprivileged user. sudo already supports this: the top-level install rule
recurses with "INSTALL_OWNER=$(INSTALL_OWNER)" into every sub-make, and
sudo's own "package" target does "make install INSTALL_OWNER=" for exactly
this fakeroot case. Pass INSTALL_OWNER= via MAKE_INSTALL_FLAGS instead of
carrying a patch.
python-installer: allow flit_core 4.x as the build backend
installer caps flit_core<4 in its build-system, so its /host build fails
with "Missing dependencies: flit_core<4" against flit-core 4.0.2. flit_core
4 builds it unchanged; relax the upper bound.
python-pyproject-hooks: allow flit_core 4.x as the build backend
pyproject-hooks caps flit_core<4 in its build-system, so its /host build
fails with "Missing dependencies: flit_core<4" against flit-core 4.0.2.
flit_core 4 builds it unchanged; relax the upper bound.
Dirk Brenken [Mon, 10 Aug 2026 17:15:09 +0000 (19:15 +0200)]
adblock: fix cpu core calculation
- only cap the cpu core count by available memory if it was auto-detected,
a manually set 'adb_cores' is now authoritative and no longer lowered
- readme update: clarify that the auto-cap does not apply to a manually
set core count
Patch removed due to fixed in Makefile:
012-fix-gnutls-version-check.patch
Patch removed because of no longer needed:
005-musl_uintptr.patch
Makefile:
Fixed gnutls sed related things.
Fixed compile_et & asn1_compile linkage at build time to fixes build error
Dropped NONE from bundled-libraries as to fix compilation errors, NONE
now seems meaning not to bundle any libraries.
Added RSTRIP from gcc Makefile to reduce compiled samba4 binaries and
libraries filesize by around 15%, tested, --private-libraries rpath
seems intact or identical with not-stripped binaries and libraries
one.
samba's cross_answer() returns on the *first* message matching a check in
cross-answers.txt, and Build/Configure copies the per-arch answers file
before appending its own answers. Up to samba 4.16 the check message
itself carried a "setting/geting hints" typo, which the generated answers
files inherited; samba fixed its spelling later, so the file entries
stopped matching and configure started aborting with
Cross answers file ... is incomplete
The 'Checking whether fcntl supports setting/getting hints: OK' line
appended by Build/Configure was added to paper over that, not because the
targets answer OK.
Now that the spelling in the answers files is fixed, the generated
(-11, "") entry matches first and the appended OK is dead code. Keep the
generated answer -- samba's test uses F_SET_FILE_RW_HINT/F_GET_FILE_RW_HINT,
which the kernel no longer implements, so the check legitimately fails on
every target -- and drop the unreachable echo so each check has exactly
one answer.
smb.conf.template:
Added SMB2 as default minimum protocol for client, also enabled server
& client encryption by default. Use smbpasswd -a username to add a
username & password for samba. To connect into samba from Windows 10
and above, it need to be done by this guide : https://www.asus.com/support/faq/1054736/ .
python-typing-extensions: allow flit_core 4.x as the build backend
Like python-wheel, typing-extensions caps its build backend at
"flit_core >=3.11,<4", so python-typing-extensions/host fails with
"Missing dependencies: flit_core<4,>=3.11" now that the feed ships
flit-core 4.0.2. flit_core 4 builds it unchanged; relax the upper bound.
python-wheel: allow flit_core 4.x as the build backend
wheel 0.47.0 caps its build requirement at "flit_core >=3.11,<4", but the
feed now ships flit-core 4.0.2, so python-wheel/host (and the whole python
host build-chain that depends on it) fails with "Missing dependencies:
flit_core<4,>=3.11". flit_core 4 builds wheel unchanged, so relax the upper
bound.
1.4.1 ships as a .tar.xz (the .tar.gz is gone), so switch PKG_SOURCE to
.tar.xz; the @GNU mirror still serves it. Replace 001-only-src.patch
(SUBDIRS = src) with PKG_SUBDIRS:=src so tests/doc/tools stay unbuilt.
Josef Schlehofer [Mon, 10 Aug 2026 02:07:12 +0000 (04:07 +0200)]
librespeed-cli-rust: add new package
Rust port of librespeed-cli for 32-bit PowerPC targets not supported by
the Go implementation, such as CZ.NIC Turris 1.x.
The CLI output of --list and --csv-header matches the Go client, so it
can be used as a drop-in replacement. Both implementations install
/usr/bin/librespeed-cli and therefore PROVIDES/CONFLICTS are set
accordingly.
Use libopenssl instead of rustls' ring backend, which has significantly
better AES-GCM performance on big-endian PowerPC.
Josef Schlehofer [Wed, 29 Jul 2026 05:47:46 +0000 (07:47 +0200)]
sscep: rename test.sh to test-version.sh
The script only performs a version check, which is what test-version.sh
is meant for. As a version check override it also replaces the generic
per-executable probing, which warns about mkrequest not reporting the
version.
Josef Schlehofer [Wed, 29 Jul 2026 05:47:42 +0000 (07:47 +0200)]
tree-wide: remove quiet mode from grep in test version checks
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
libsndfile: drop cmake4 patch for a policy override
001-cmake4.patch backported the unreleased upstream commit 52b803f. The
buildroot's CMake 4 only needs the raised minimum (FindPythonInterp still
resolves), so replace it with -DCMAKE_POLICY_VERSION_MINIMUM=3.5.
Add a CI test.sh that imports google.protobuf and round-trips the
Timestamp and Struct well-known types through SerializeToString and
ParseFromString, covering the descriptor pool, encoder and decoder
without needing a compiled .proto. Modelled on python-rpds-py's test.
Sergei S. [Sun, 2 Aug 2026 15:56:02 +0000 (19:56 +0400)]
hev-socks5-tunnel: allow multiple instances
Add support for running multiple service instances.
- switch UCI config from a single named section to "instance" sections
- update the procd init script to start multiple instances
- migrate existing single-instance configurations during package upgrade (uci-defaults script)
- bump PKG_RELEASE
setup.py picks the macOS-only -iwithsysroot/usr/include/ffi flag from
sys.platform, which describes the interpreter running the build rather than
the target, so cross-compiling from a macOS host hands an Apple clang flag to
the GNU cross compiler and the build fails. Use sysconfig.get_platform(),
which honours the _PYTHON_HOST_PLATFORM that python3-package.mk exports.
Neither prosody nor prosodyctl reports its version on any flag the
generic tests probe, so the version check fails without an override.
Drop the now duplicate check from the functional test.sh.
Dirk Brenken [Sat, 8 Aug 2026 15:50:24 +0000 (17:50 +0200)]
travelmate: update 2.4.7-3
- fixed the shipped captive portal login scripts,
corrected the curl call to 'trm_fetchcmd'
- fixed the return code handling within the login scripts
- added a generic portal login script recipe to the readme
Dirk Brenken [Sat, 8 Aug 2026 12:20:50 +0000 (14:20 +0200)]
travelmate: treat an unresolvable captive portal as an error
'trm_netcheck' only ever fired on "net nok", but f_net() reports a detected
portal as "net cp" regardless of 'trm_captive' - the option gates the portal
handling, not the detection. With 'trm_captive' disabled travelmate neither
adds the portal domain to the dhcp rebind allowlist nor runs a login script,
so that state can never resolve on its own: the uplink stayed connected as
"net cp '<domain>'" forever, the vpn was never brought up (it requires "net
ok") and 'trm_netcheck' never kicked in - travelmate stuck to exactly the
uplink the option is meant to get rid of.
Downgrade "net cp" to "net nok" in f_net() when the portal handling is off.
With 'trm_captive' enabled nothing changes.
openssh: reindent Package/<name> metadata blocks to 2 spaces
FormalityCheck expects package metadata lines inside 'define Package/<name>'
blocks to be indented with exactly 2 spaces. Historically this file used
tabs, which triggers the audit on any newly-touched line. Convert all
metadata lines in the plain 'define Package/<name>' blocks to 2 spaces so
future edits don't repeatedly trip the check.
No functional change: recipe blocks (/install, /conffiles, /description)
retain their tab indentation as required by make.
openssh: make libfido2 dependency conditional on sk-helper
The openssh-sk-helper package unconditionally depends on libfido2,
which causes the build system to pull in libfido2 and its dependencies
(libcbor, libudev) even when openssh-sk-helper is not selected.
Use the PACKAGE_openssh-sk-helper:libfido2 conditional dependency
pattern so libfido2 is only required when the sk-helper sub-package
is actually selected.
Create a dedicated 'gpsd' system user at package-install time (via
USERID) and pin gpsd's built-in privilege-separation identity to it
via the SConstruct 'gpsd_user' option.
Background: gpsd needs to start as root to open the underlying tty /
serial device but then internally setuid()s to a configured
unprivileged identity for the rest of its lifetime -- a built-in
privilege-separation feature of the daemon.
The current package leaves 'gpsd_user' at scons' default 'nobody'.
Sharing 'nobody' across daemons is a hardening anti-pattern:
a compromise of any one 'nobody'-owned process can trivially
interfere with any other, and audit trails become ambiguous.
Group choice: gpsd_group is a device-access knob rather than an
identity knob -- once gpsd has setuid()d away from root it still
needs to open() tty / serial nodes, which OpenWrt exposes as
root:dialout mode 0660 (see procd hotplug.json and base-files
/etc/group). What actually keeps that access working post-drop is
the setgid() target that gpsd_group selects: gpsd calls
setgroups(0, NULL) immediately before dropping privileges, so any
supplementary groups on the target user are discarded and cannot
carry the permission.
scons' gpsd_group default is not 'nobody' but 'dialout' (uucp on
Gentoo build hosts), so on OpenWrt buildbots the daemon already
lands in 'dialout' today. Pin gpsd_group=dialout explicitly so the
resulting binary no longer depends on the builder's /etc/gentoo-release:
a Gentoo builder would otherwise bake in 'uucp', a group base-files
does not ship, and gpsd's getgrnam() fallback silently keeps root's
gid in that case.
USERID's third field ('dialout=20') still adds the gpsd user to the
dialout group in /etc/group. This does not affect the running
daemon (setgroups() strips it) but matches Debian's gpsd packaging
and lets an operator run gpsdctl / gpsmon as 'gpsd' by hand against
device nodes. GID 20 is the value already frozen into base-files.
Giving gpsd its own primary user:
* confines a hypothetical gpsd RCE (there have been NMEA / UBX
parsing bugs historically) to files owned by 'gpsd' rather than
to the shared 'nobody' identity;
* matches the long-standing Debian gpsd packaging convention
(adduser --system gpsd, member of dialout);
* is a no-op for correctly-configured installations that never
referenced 'nobody' as an intentional identity.
No numeric UID is pinned for the primary 'gpsd' user -- dynamic
assignment via USERID is sufficient here since no cross-distro
NFS/sudoers-style muscle memory depends on a specific number.
The powerpc64.config file incorrectly sets arch=powerpc instead of
arch=powerpc64. This causes Perl to misidentify the architecture on
64-bit PowerPC targets.
Fixes: efc7ce461577 ("perl: add powerpc64 support") Signed-off-by: Michael Pfeifroth <redacted>
Add 'procd_set_param file' for both the base config and the generated
config file so procd detects config changes and restarts rsyslogd.
Without this, procd_add_reload_trigger fires on config changes but
procd does not restart the service because the command line is
identical. This leaves stale configuration active until a manual
restart.
git.99rst.org / openwrt-packages.git / log