Correctly detect write errors while creating CMS objects.
+ commit 9ced7706f2738128aa5068727ea348c44f42e16e
* src/cms.c (write_encrypted_cont): Take care of write errors.
Fix an integer overflow in the CRL signature parser.
+ commit f61a5ea4e0f6a80fd4b28ef0174bee77793cf070
* src/crl.c (parse_signature): N+N2 now checked for overflow.
* src/ocsp.c (parse_response_extensions): Do not accept too large
values.
(parse_single_extensions): Ditto.
build: Prefer gpgrt-config when available.
+ commit 13307b22882a220d206341e1196e74fd37418c2f
* src/ksba.m4: Overriding the decision by --with-libksba-prefix, use
gpgrt-config ksba when gpgrt-config is available.
Daniel Golle [Sat, 5 Aug 2023 01:32:24 +0000 (02:32 +0100)]
cryptsetup: update to version 2.6.1
Cryptsetup 2.6.1 Release Notes
==============================
Stable bug-fix release with minor extensions.
All users of cryptsetup 2.6.0 should upgrade to this version.
Changes since version 2.6.0
~~~~~~~~~~~~~~~~~~~~~~~~~~~
* bitlk: Fixes for BitLocker-compatible on-disk metadata parser
(found by new cryptsetup OSS-Fuzz fuzzers).
- Fix a possible memory leak if the metadata contains more than
one description field.
- Harden parsing of metadata entries for key and description entries.
- Fix broken metadata parsing that can cause a crash or out of memory.
* Fix possible iteration overflow in OpenSSL2 PBKDF2 crypto backend.
OpenSSL2 uses a signed integer for PBKDF2 iteration count.
As cryptsetup uses an unsigned value, this can lead to overflow and
a decrease in the actual iteration count.
This situation can happen only if the user specifies
--pbkdf-force-iterations option.
OpenSSL3 (and other supported crypto backends) are not affected.
* Fix compilation for new ISO C standards (gcc with -std=c11 and higher).
* fvault2: Fix compilation with very old uuid.h.
* verity: Fix possible hash offset setting overflow.
* bitlk: Fix use of startup BEK key on big-endian platforms.
* Fix compilation with latest musl library.
Recent musl no longer implements lseek64() in some configurations.
Use lseek() as 64-bit offset is mandatory for cryptsetup.
* Do not initiate encryption (reencryption command) when the header and
data devices are the same.
If data device reduction is not requsted, this leads to data corruption
since LUKS metadata was written over the data device.
* Fix possible memory leak if crypt_load() fails.
* Always use passphrases with a minimal 8 chars length for benchmarking.
Some enterprise distributions decided to set an unconditional check
for PBKDF2 password length when running in FIPS mode.
This questionable change led to unexpected failures during LUKS format
and keyslot operations, where short passwords were used for
benchmarking PBKDF2 speed.
PBKDF2 benchmark calculations should not be affected by this change.
Daniel Golle [Sat, 5 Aug 2023 00:47:18 +0000 (01:47 +0100)]
lvm2: update LVM2 to 2.03.22 and DM to 1.02.196
Remove downstream patch 004-missing-includes.patch which was merged
upstream in version 2.03.19
LVM2 changelog since version 2.03.17
version 2.03.22 - 02nd August 2023
==================================
Fix pv_major/pv_minor report field types so they are integers, not strings.
Add lvmdevices --delnotfound to delete entries for missing devices.
Always use cachepool name for metadata backup LV for lvconvert --repair.
Make metadata backup LVs read-only after pool's lvconvert --repair.
Improve VDO and Thin support with lvmlockd.
Handle 'lvextend --usepolicies' for pools for all activation variants.
Fix memleak in vgchange autoactivation setup.
Update py-compile building script.
Support conversion from thick to fully provisioned thin LV.
Cache/Thin-pool can use error and zero volumes for testing.
Individual thin volume can be cached, but cannot take snapshot.
Better internal support for handling error and zero target (for testing).
Resize COW above trimmed maximal size is does not return error.
Support parsing of vdo geometry format version 4.
Add lvm.conf thin_restore and cache_restore settings.
Handle multiple mounts while resizing volume with a FS.
Handle leading/trailing spaces in sys_wwid and sys_serial used by deivce_id.
Enhance lvm_import_vdo and use snapshot when converting VDO volume.
Fix parsing of VDO metadata.
Fix failing -S|--select for non-reporting cmds if using LV info/status fields.
Allow snapshots of raid+integrity LV.
Fix multisegment RAID1 allocator to prevent using single disk for more legs.
version 2.03.21 - 21st April 2023
=================================
Fix activation of vdo-pool for with 0 length headers (converted pools).
Avoid printing internal init messages when creation integration devices.
Allow (write)cache over raid+integrity LV.
version 2.03.20 - 21st March 2023
=================================
Fix segfault if using -S|--select with log/report_command_log=1 setting.
Configure now fails when requested lvmlockd dependencies are missing.
Add some configure Gentoo enhancements for static builds.
version 2.03.19 - 21st February 2023
====================================
Configure supports --with-systemd-run executed from udev rules.
Enhancement for build with MuslC systemd and non-bash system shells (dash).
Do not reset SYSTEMD_READY variable in udev for PVs on MD and loop devices.
Ensure udev is processing origin LV before its thick snapshots LVs.
Fix and improve runtime memory size detection for VDO volumes.
version 2.03.18 - 22nd December 2022
====================================
Fix issues reported by coverity scan.
Fix warning for thin pool overprovisioning on lvextend (2.03.17).
Add support for writecache metadata_only and pause_writeback settings.
Fix missing error messages in lvmdbusd.
DM changelog since version 1.02.187:
Version 1.02.196 - 02nd August 2023
===================================
Version 1.02.195 - 21st April 2023
==================================
Version 1.02.193 - 21st March 2023
==================================
Version 1.02.191 - 21st February 2023
=====================================
Improve parallel creation of /dev/mapper/control device node.
Import previous ID_FS_* udev records in 13-dm-disk.rules for suspended DM dev.
Remove NAME="mapper/control" rule from 10-dm.rules to avoid udev warnings.
Version 1.02.189 - 22nd December 2022
=====================================
Improve 'dmsetup create' without given table line with new kernels.
Florian Eckert [Fri, 4 Aug 2023 07:48:59 +0000 (09:48 +0200)]
collectd: unify configure args handling for collectd-mod-smart
If 'collectd-mod-smart' is not enabled, the use of lubudev does not need
to be explicitly disabled. This library could be a dependency for other
modules in the future. If this is explicitly disabled, then the other
module cannot be built.
isc-dhcp: some IoTs need forced rebinding/renewal times
I've noticed my AppleTV's refresh their leases ever minute unless
I explicitly force their renewal time higher, because it doesn't
default to 50% of the lease time.
mqtt plugin is already built and shipped in
collectd-mod-mqtt, however it is not possible to configure it via
uci currently, instead having to rely on populating the config file manually.
Add support by adding 2 functions, process_mqtt() and
process_mqtt_block(). First one just enables/disables the plugin.
The second one, in the spirit of the curl plugin, adds support for
populating multiple <Publish> and <Subscribe> blocks under <Plugin mqtt>
with support for some parameters. Those are:
* blocktype. Publish or Subscribe. Mandatory
* name. The name of the block. Mandatory
* Host. Mandatory
* Port. Optional
* User. Optional
* Password. Optional
* ClientId. Optional
* QoS. Optional
* Prefix. Optional
* Retain. Optional
* StoreRates. Optional
* CleanSession. Optional
* Topic. Optional
OpenVPN 2.6.2+ changes the way OpenVPN control packets are handled on
Linux when DCO is active, fixing the lockups observed with 2.6.0/2.6.1
under high client connect/disconnect activity. This is an INCOMPATIBLE
change and therefore an ovpn-dco kernel module older than v0.2.20230323
(commit ID 726fdfe0fa21) will not work anymore and must be upgraded.
The kernel module was renamed to "ovpn-dco-v2.ko" in order to highlight
this change and ensure that users and userspace software could easily
understand which version is loaded. Attempting to use the old ovpn-dco
with 2.6.2+ will lead to disabling DCO at runtime.
Jeffery To [Thu, 20 Jul 2023 07:41:25 +0000 (15:41 +0800)]
python-frozenlist: Add new package
From the README:
frozenlist.FrozenList is a list-like structure which implements
collections.abc.MutableSequence. The list is mutable until
FrozenList.freeze is called, after which list modifications raise
RuntimeError.
Jeffery To [Thu, 20 Jul 2023 07:39:57 +0000 (15:39 +0800)]
python-charset-normalizer: Add new package
From the README:
A library that helps you read text from an unknown charset encoding.
Motivated by chardet, I'm trying to resolve the issue by taking a new
approach. All IANA character set names for which the Python core library
provides codecs are supported.
The line to generate the argument list for 'simple connect' is quite
long and is not maintainable. To improve the handling a function
'append_param' was added for appending the 'simple connect' options.
modemmanager: do not set proto_notify_error on teardown
If on teardown the 'proto_notify_error' is set to 'MM_TEARDOWN_IN_PROGRESS',
then an error which is set on 'setup' is not visible in the ubus
network.interface.<iface> status output.
Notable Changes:
*Ada 2.0
Node.js v18.17.0 comes with the latest version of the URL parser, Ada. This update brings significant performance improvements to URL parsing, including enhancements to the url.domainToASCII and url.domainToUnicode functions in node:url.
*Web Crypto API
Web Crypto API functions' arguments are now coerced and validated as per their WebIDL definitions like in other Web Crypto API implementations. This further improves interoperability with other implementations of Web Crypto API.
* fix permission to dnsmasq files for ad-blocking
* add pause function to pause the ad-blocking temporarily
* introduce pause_timeout option to control default pause time
* update default config and config-update file
* use $param instead of $1 in adb_start()
When user runs `make clean` command, everything in `$(STAGING_DIR)`
(where we installed rust) will be removed, but `$(BUILD_DIR_HOST)`
(where we compiled rust and stored build stage) is untouched.
So when user starts a new build after that, OpenWrt buildroot will
still consider `rust` is installed already, resulting the build error
"cargo: command not found".
Description:
Easylogging++ is single header efficient logging library for C++ applications. It is extremely powerful,
highly extendable and configurable to user's requirements.
Nick Hainke [Tue, 27 Jun 2023 07:58:08 +0000 (09:58 +0200)]
snowflake: update to 2.6.0
Tor projects tries to migrate away from git.torproject.org [0,1]. We
need to adjust PKG_SOURCE and GO_PKG name. Further, we need to backport
patches to fix compiling on riscv64, so add:
- 0001-Bump-minimum-required-version-of-go.patch
- 0002-Update-dependencies.patch
While the compiled binaries are intended to run on the host system, the
rust/host package does include the target matching the configured
OpenWrt target.
If using (for example) ./scripts/env to switch between different
OpenWrt configurations, this will cause issues if the different
configuration is for a different target. In such case there will be a
mismatch between the available Rust target and OpenWrt target and the
following error will be printed:
> error[E0463]: can't find crate for `core`
> note: the `XXX` target may not be installed
This fix will add the RUSTC_TARGET_ARCH as HOST_BUILD_DIR and CARGO_HOME
suffix, such that rust/host will be compiled in case an OpenWrt
configuration change causes the RUSTC_TARGET_ARCH to change.
Fixes: #21530 Signed-off-by: Orne Brocaar <redacted>
[Applied Jeffery To's suggestion for build and install path] Signed-off-by: Tianling Shen <redacted>
jq: remove _GNU_SOURCE from Makefile and instead backport patch
Commit 4bb18b04 added _GNU_SOURCE to jq's Makefile to fix a segfault.
This has since been fixed upstream, so this commit backports the upstream
patch instead. This keeps things closer to upstream, and it will prevent
the Makefile from containing a redundant fix once upstream releases the
next version.
git.99rst.org / openwrt-packages.git / log