OpenSSH reports "10.4p1" but PKG_VERSION is "10.4_p1", so the forced generic
probe never matches and fails. Verify via ssh/sshd where the subpackage ships
one and accept the subpackages that carry no version-reporting binary.
libpam's helper binaries have no version flag, so the forced generic probe
fails with "No executables provided version". Accept the version here; the
library version is already covered by the SONAME checks.
Cover ripe-atlas-common, -probe and -anchor: the busybox measurement
applets resolve and run without crashing, the shell libraries parse, the
capabilities grant CAP_NET_RAW, uci parses the config, and each variant
ships its registration servers and host keys.
test-version.sh overrides the generic per-executable version probe, which
would otherwise run the /usr/sbin/ripe-atlas wrapper -- it has no version
flag and boots the probe instead.
Tiago Gaspar [Mon, 16 Jun 2025 16:02:14 +0000 (17:02 +0100)]
ripe-atlas: add new package
Replace atlas-probe and atlas-sw-probe with ripe-atlas, built from the
upstream ripe-atlas-software-probe release tarball (tag 5110) so future
bumps only touch PKG_VERSION and PKG_HASH. Provide atlas-probe and
atlas-sw-probe so existing installs and sysupgrade keep resolving across
the rename.
Run the probe as the ripe-atlas user instead of root, with ujail granting
the measurement applets CAP_NET_RAW from capabilities.json. Drop the unused
e2fsprogs dependency; keep OPENSSL_WITH_DEPRECATED, which upstream tcputil.c
still needs.
wget: rank wget-nossl below uclient-fetch for the wget alternative
apk uses whatever /usr/bin/wget resolves to for HTTPS index downloads.
wget-nossl's alternative was ranked 300, above the HTTPS-capable
uclient-fetch (200), so pulling it in transitively silently broke
apk update. Lower it to 100 so uclient-fetch keeps the default while
wget-nossl stays selectable. wget-ssl (400) is unchanged.
Fixes: https://github.com/openwrt/openwrt/issues/24270 Signed-off-by: Alexandru Ardelean <redacted>
Drop 001-configure-make-libyaml-default-on-explicit.patch; it was a backport
of upstream commit c5c24486 which is now part of this release, so configure.ac
already makes libyaml default-on and fails fast when yaml-0.1 is missing.
David Connolly [Fri, 17 Jul 2026 11:54:58 +0000 (12:54 +0100)]
udpspeeder: pass the timeout option to the binary
The timeout UCI option is validated and documented but never appended to
the command, so setting it had no effect. Pass it through with the schema
default of 8, which matches the binary's own default.
Fixes: https://github.com/openwrt/packages/issues/18955 Signed-off-by: David Connolly <redacted>
David Connolly [Sun, 5 Jul 2026 20:44:44 +0000 (21:44 +0100)]
udpspeeder: build with the toolchain CXX and flags
Patch the upstream makefile to build the cross target with $(CXX) and the
toolchain $(CXXFLAGS)/$(LDFLAGS), and take the version from an overridable
variable. This replaces the Build/Prepare sed rewrites, and the binary now
picks up the hardening flags.
Honouring CXXFLAGS turns on -mips16 for the mips_24kc targets, where the
C++ atomics compile to a sync instruction MIPS16 cannot encode, so build
them with no-mips16.
strongswan: move strongswan ignore_routing_tables check into subfunction
This makes the generation process clearer and more extensible.
While we're at it, the option 'ignore_routing_tables' is changed to a list of
elements. For the migration, the '/etc/uci-defaults/strongswan' migration
script is be extended with the new function 'migrate_ignore_routing_tables',
which handles the migration from an 'option' element to a 'list' elements.
strongswan: move uci-defaults migration into subfunction
To make the migration script more organized, the migration for the 'ipsec'
unamed section to 'ipsec' named section 'globals' has been moved to a
subfunction.
The change prepares the new migration script to migrate other areas.
strongswan: do not use config_foreach named section globals
In a previous commit, the anonymous 'ipsec' section was changed to a named
section called 'globals'. The reason for this is that this is where the
'strongswan.conf' configuration option are saved. This should only occur
once. Since only one strongswan service can be running on the system.
Therefore, in this commit, the 'config_foreach' loop is removed and
the section is permanently set to 'globals'.
This commit does not change the function and is a preparatory commit.
Assuming there is a global section named 'ipsec'.
strongswan: move strongswan.conf generation to its own function
The cross-file handling of variables that are populated in 'config_ipsec' but
then written to 'strongswan.conf' in the 'do postamble' section is prone
to errors, as variables are often overlooked. The config file
'strongswan.conf' is now generated in a single function without the need to
use global variables.
This commit does not change the function and is a preparatory commit.
strongswan: merging the swanctl and strongswan configurations block by block
In the 'prepare_env' function, the configuration setup for 'swanctl' and
'strongswan' is not grouped into blocks, so it is not clear which functions
depend on each other.
With this change, the 'strongswan' configuration is set up first,
followed by the 'swanctl' configuration.
This commit does not change the function and is a preparatory commit.
Now that post install is running properly, when CI executes the
tests the zabbix-extra-* packages that have a posinst exit the
post install with an error if ubusd is not running.
Drop the error code from killall with no usbd running to fix this.
There are no longer packages that need this.
This offers advanced SSH functions in Python.
But for OpenWrt's context it may work with just using ssh commands
with the subprocess package.
mdns-repeater: pass through CFLAGS/LDFLAGS and package version
Before the change, the feed Makefile would not rely on the predefined
logic of building Makefile-based packages, rather it defined its own
`Build/Compile` step that explicitly called `make`. This didn't play
along well with the upstream Makefile, which doesn't respect the CFLAGS
that come from the environment.
The effect of that was that, for example, `CONFIG_PKG_ASLR_PIE_ALL=y`
was not respected: a non-PIE binary was generated regardless. Other
compiler flags were ignored too in the same manner.
Also it would try to determine the mdns-repeater version by calling to
git, which wouldn't work, since the build system downloaded a pre-made
source tarball without a bundled `.git` directory. The result is an
empty version string when calling `mdns-repeater -h`.
To address all of the above, switch to the built-in logic for
Makefile-type projects. Append to MAKE_FLAGS to completely override
upstream CFLAGS/LDFLAGS and pass through the package version. Set a
dummy HGVERSION variable value to prevent the upstream Makefile from
calling `git` unnecessarily.
modemmanager: make building builtin options optional
This commit enables to choose whether to compile the plugins into the
binary or not. If not included, it moves the plugins to
`/usr/lib/ModemManager/`.
Using add_interface_triggers and check_interface_up is a
better separation of concerns and the code has little in
common (no duplication of code concerns).
While we are at it make both nut-monitor and nut-server failure of
add_interface_triggers non-fatal with a logged error message.
nut: simplify/improve consistency for RUNAS and STATEPATH
We claimed we only supported a single upsd section named 'upsd' and a
single uspmon section named 'upsmon', but when determining RUNAS
and STATEPATH we were using overly-complex functions as we were
attempting to support multiple upsd and upsmon sections.
Simplify the logic by adhering to our stated support.
While were are at it we make RUNAS handling more consistent between
nut-server (upsd) and nut-monitor (upsmon).
We no longer try to limp along if RUNAS is not set by find_runas; to do
this properly would require over-complicated logic when setting file
and directory permissions and ownership.
nut: do not trigger on interface activity by default
The defaults were triggiering on any activity on the network, which
caused excessive restarts. So default to no interface trigger, with
'all' (or specific interfaces) as an option.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463553192
While driverpath is could in theory be configurable, this was not implemented
in the OpenWrt NUT package, and there is not need for it. Therefore remove the
sample configuration for it, and setting that configuration in the upsd.conf file.
See https://github.com/openwrt/packages/pull/29607#discussion_r3463526037
We should fallback to the default if one is not specified. In addition
find_statepath is the wrong place to check for its existence - it should
be created by the initscript if it does not exist.
See https://github.com/openwrt/packages/pull/29607#discussion_r3462976647
Fabrice Fontaine [Wed, 17 Jun 2026 15:23:39 +0000 (17:23 +0200)]
utils/hplip: fix CPE ID
hp:linux_imaging_and_printing is a better CPE ID than
hp:linux_imaging_and_printing_project as this CPE ID has the latest CVE
(whereas hp:linux_imaging_and_printing_project only has CVEs up to
2013):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:hp:linux_imaging_and_printing
Daniel Golle [Mon, 13 Jul 2026 11:45:18 +0000 (12:45 +0100)]
fwupd: allow enabling the devlink plugin
The devlink plugin allows updating firmware of network devices
implementing the kernel devlink interface. It is gated on libmnl,
which was hard-disabled so far. Wire the libmnl meson option to a
new FWUPD_PLUGIN_DEVLINK config symbol, enabled by default, and add
the corresponding libmnl runtime dependency to fwupd-libs.
stress-ng: add config menu to select external libraries
Backport upstream e0c4d324a, which lets a LIB_* variable be emptied to skip
that library's check. Drop 001-disable-extra-stressors.patch, which hardcoded
the same choice, and drive it from a Config.in menu instead. Defaults keep the
previously built set of stressors: only crypt, aio, bsd, jpeg, kmod, sctp and
zlib are probed. apparmor, EGL, GBM, GLES2, IPSec_MB and Judy have no OpenWrt
package, so they are never probed. Drop the backport once it is in a release.
stress-ng: link libatomic instead of disabling atomics
Drop 002-disable-atomics-mips-and-ppc.patch. It papered over link errors for
64-bit atomics on MIPS and PPC, which happen because stress-ng strips -latomic
whenever $(CC) matches "musl-gcc" -- as our cross toolchains do. Pass
LIB_ATOMIC=-latomic instead; libatomic is already in DEPENDS. Its stress-fractal
hunk was in any case dead since upstream 24c30b7fa narrowed the row counter back
to int32_t, which MIPS32 and PPC32 increment atomically inline.
nantayo dev [Thu, 2 Jul 2026 03:09:35 +0000 (11:09 +0800)]
podman: update to 5.8.4
- fix PKG_SOURCE_URL
Podman repository has been transferred from containers to podman-container-tools
- update package version
changelog see: https://github.com/podman-container-tools/podman/releases/tag/v5.8.4
zabbix: remove dependency on symbol ZABBIX_ENABLE_ZABBIX
It results a failure to build due to
https://github.com/openwrt/gh-action-sdk/issues/70. This means there will be some
ZABBIX symbols in .config eveen when ZABBIX is not selected, but this is a
necessary tradeoff. See
https://github.com/openwrt/packages/pull/29803#issuecomment-4882201182.
* The Makefile was using an overly clever means to be compact that the
CI webhook, and possibly the CI test container, didn't understand. We
unroll that logic, and have more usual install and conffiles sections.
In the process we fix a missing conffile install for zbbix-proxy*
packages.
Changelog:
Changes from 1.5 to 1.5.1
-------------------------
* Rename public register definitions on x86 and x86_64 to avoid clashing
with glibc definitions when built in freestanding mode.
Patch contributed by Daan De Meyer.
Changes from 1.4 to 1.5
-----------------------
* Workaround various header compatibility issues in glibc and bionic.
* Allow ppc64 target to be built in freestanding mode.
Changes from 1.3.3 to 1.4
-------------------------
* Add hard-float support to most architectures where relevant.
Some patches contributed by Richard Campbell.
Changes from 1.3.2 to 1.3.3
---------------------------
* Use `bl` instruction instead of explicit GOT lookup for `exit`
in 64-bit PowerPC assembly.
* Fix installation path for standalone libucontext headers.
Patch contributed by Marian Buschsieweke.
* Fix missing includes for freestanding builds.
Patch contributed by David Leeds.
Makefile:
Disabled documents.
Added glibc supports, and remove hardcoded musl dependency.
Put test_libucontext_posix only available in musl runtime.
Both patches still apply unchanged and remain necessary: upstream's library
list is unchanged, and stress-misaligned.c still only disables atomics on PPC
for gcc < 5.0 while stress-fractal.c has no arch guard at all.
fluent-bit: update to 5.0.8, adopt maintainer, fix musl startup segfault
Update 4.2.0 -> 5.0.8 and adopt maintainership. fluent-bit segfaulted at
startup on every musl target: under GCC 14 the upstream C-TLS probe no longer
compiles (undeclared __tls_get_addr), so the pthread_key fallback calls
pthread_getspecific() before pthread_key_create() and derefs a NULL tsd array
on musl (glibc is unaffected). Force -DFLB_HAVE_C_TLS=Yes for __thread TLS.
strongswan: add one default named ipsec uci section 'globals'
The UCI section 'ipsec' should only be available once, as these are
general settings for 'strongswan.conf'. It makes no sense to configure them
more than once. To ensure that the general settings can also be configured
via LuCI, this section must be present at least once.
For configurations already in the field, a uci-default script is added
that assigns the name 'globals' to the last ipsec section type.
Florian Eckert [Thu, 25 Jun 2026 11:13:27 +0000 (13:13 +0200)]
strongswan: use procd running check
Instead of using the standard procd check, the function is overridden, and
the check to see if the service is running is performed using the command
'swanctl --stats > /dev/null 2>&1'. The problem with this is, that this
call is blocking if the strongswan charon socket is not available. The call
does not return until the timeout has expired.
This block does not occur if we use the standard behavior of procd, which
checks whether the service it started is actually running. This change
therefore uses the standard call via procd, which returns the value without
blocking.
libdrm: skip the generic version check for the whole package
libdrm-tests ships DRM tools (modetest, proptest, ...) with no --version flag,
so the generic probe aborts with "No executables in the package provided
version" and fails CI. test-version.sh is shared by every subpackage built from
this directory and a non-zero exit fails it, so it must accept the whole family
(the libraries ship no executables either) -- hence libdrm*, not just libdrm-tests.
- convert the patch to a make option
- Add -J/-j options for JSON and JSON Lines output format.
- lsof_free_result(): handle result == NULL
- Fix missing parenthesis in lstat error message format
- Fix use-after-free in lsof_select_process_regex
- Fix truncated fd numbers in -F field output
- Display connection state for UDP sockets with -T option
git.99rst.org / openwrt-packages.git / log