Georgi Valkov [Tue, 9 Jun 2026 10:56:30 +0000 (13:56 +0300)]
rust: fix host build on x64 Darwin
rust/host fails to compile on macOS running on Intel x64
because the host target triple is autogenerated to be
'arm64-unknown-linux-'. Rust doesn't have such a target triple, thus the
build fails because there are no pre-built artefacts for bootstrapping.
Fix this by setting RUSTC_HOST_ARCH to 'x86_64-apple-darwin' in case
our host is HOST_ARCH=x86_64 and HOST_OS=Darwin.
This fix is based on the existing fix for Apple silicon [1].
Fixes:
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/x.py", line 53, in <module>
bootstrap.main()
~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1418, in main
bootstrap(args)
~~~~~~~~~^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1366, in bootstrap
build.download_toolchain()
~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 697, in download_toolchain
download_component(download_info)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 529, in download_component
get(
~~~^
download_info.base_download_url,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
verbose=download_info.verbose,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 58, in get
raise RuntimeError(
...<6 lines>...
)
RuntimeError: src/stage0 doesn't contain a checksum for dist/2026-04-16/rust-std-1.95.0-x86_64-unknown-linux-darwin24.6.0.tar.xz. Pre-built artifacts might not be available for this target at this time, see https://doc.rust-lang.org/nightly/rustc/platform-support.html for more information.
Wei-Ting Yang [Tue, 9 Jun 2026 04:26:11 +0000 (12:26 +0800)]
bash: update to 5.3 patch level 12
- Fix loop in subshells calling wait builtin with inherited job list
- Fix mapfile problem when callback unsets the variable it is modifying
- Fix subshells inappropriately running the EXIT trap if they receive a
fatal signal before resetting traps
Andy Chiang [Sun, 7 Jun 2026 03:06:48 +0000 (10:06 +0700)]
ddns-scripts: add fallback for default values
In luci, the `interface` value has `o.default = 'wan'` configured.
Due to a behavior fix in 'o.default', values matching the default are
no longer saved. Currently, this is workedaround by disabling
'o.rmempty' in luci, but handling this compatibility fallback on the
backend is a cleaner and superior approach.
Andy Chiang [Sun, 7 Jun 2026 02:52:00 +0000 (09:52 +0700)]
ddns-scripts: fix log noise
When fetching the IP via a URL with `force_ipversion` enabled,
a `Busybox nslookup - no support to 'force IP Version' (ignored)`
log is generated periodically. This log is redundant, in this scenario
`force_ipversion` only affects the results fetched by wget/uclient-fetch/curl.
It is perfectly fine for nslookup to query both A/AAAA records simultaneously.
awscli 1.45.19 no longer exposes awscli.topics.TOPIC_TAGS, so the test
raised an AssertionError (silently, as the heredoc exit code was ignored).
Drop the brittle check and make the smoke test fail hard if the CLI driver
cannot be created.
The pyrsa-* command line tools use argparse and do not print the package
version with any of the flags probed by the CI generic version check, so it
reports "No executables in the package provided version" and fails. Add a
test-version.sh override; functionality remains covered by test.sh.
python-jmespath: install jp as a non-byte-compiled command
Upstream ships its jp command-line tool as a plain "jp.py" script. Under
that name OpenWrt byte-compiles it into a non-executable /usr/bin/jp.pyc
(and the -src package keeps a "#!/usr/bin/env python" jp.py, which has no
interpreter on OpenWrt), so it fails the CI generic executable check.
Install it as /usr/bin/jp instead: the missing .py extension stops it from
being byte-compiled and Python3/FixShebang rewrites the shebang to
/usr/bin/python3. Add a test-version.sh override since jp takes a required
expression argument and has no version flag for the generic check to probe.
onionshare-cli: drop dependency for python3-pysocks and python3-unidecode
- Python3-pysocks was removed as it was not maintained in commit 95fe4bf3327b316c9184f4f17e09266e979ecf17 ("python-pysocks: remove outdated and not maintained package")
- Python3-unidecode was removed in commit 09951a9cfdf47b560b5bd00db1dd92ceffd5724b ("python-unidecode: drop unmaintained package"), because there is no official support for Python 3.12 and it is still using setup.py, which is deprecated.
Fixes:
```
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-pysocks', which does not exist
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-unidecode', which does not exist
```
perl: install libperl.so using $(INSTALL_BIN) to enable stripping
Install libperl.so with executable permissions (0755) instead of copying
it as-is.
This allows the OpenWrt build system to recognize the library as a binary and
automatically run the "strip" utility on it. Stripping removes unnecessary
debugging metadata and helper symbols that are only needed for development but
not for running Perl on the router.
This change reduces the installed size of libperl.so on the device:
- Before (not stripped): 3.7 MB (3,929,652 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, with debug_info, not stripped
```
- After (stripped): 3.5 MB (3,674,081 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, no section header
```
Saving ~255 KB of flash storage space on target devices.
python3: fix host python extension compilation on macOS
On macOS (Darwin) hosts, building host Python C extensions (such as Cython) using the '-shared' flag and linking against '-lpython3.x' causes the host Python interpreter to load a duplicate copy of the Python runtime. This leads to type checking mismatches and segmentation faults (SIGSEGV) when importing the compiled extension.
For example, running:
./staging_dir/hostpkg/bin/python3 -c "import Cython.Utils"
crashes with:
Segmentation fault: 11
To build shared modules correctly on macOS, they must be compiled as bundles using the '-bundle -undefined dynamic_lookup' flags instead of '-shared', and they should not link against the Python library (no '-lpython3.x' in LDFLAGS).
Fix this by dynamically adjusting LDSHARED and LDFLAGS in python3-host.mk when the host OS is Darwin.
Enable version checking for the main perl package.
Previously, the version check for perl was skipped. Add a check
that runs perl -v and verifies that the output matches PKG_VERSION.
Seo Suchan [Thu, 28 May 2026 15:08:39 +0000 (00:08 +0900)]
nginx: update to 1.30.2
Large version jump from 1.26.3 to 1.30.2
(upstream stable).
changelogs at https://nginx.org/en/CHANGES-1.30,
https://nginx.org/en/CHANGES-1.28 .include security fixs.
3.11.8 failed to build against the SDK's stable rust 1.96.0: build.rs enabled
orjson's "cold_path" cargo feature for rustc >= 1.95.0, activating an unstable
feature gate that errors with E0554. 3.11.9 drops it; plain version bump.
John Audia [Sun, 31 May 2026 19:20:11 +0000 (15:20 -0400)]
nmap: update to version 7.99
- Patches automatically rebased
- Release notes: https://nmap.org/changelog.html#7.99
- Update Makefile due to ndiff dropped setup.py using pyproject.toml.
Remove PYTHON3_PKG_FORCE_DISTUTILS_SETUP and set PYTHON3_PKG_WHEEL_NAME
to match the ndiff package name rather than PKG_NAME (nmap).
Ho Kim [Wed, 14 Jan 2026 01:22:53 +0000 (10:22 +0900)]
liboqs: fix missing symbolic link installation
The current installation process fails to correctly install the
'liboqs.so' symbolic link due to an incorrect path syntax (extra dot).
This prevents other packages from linking against liboqs
(e.g., using -loqs) during development, which was discovered while
testing PQC key exchange implementations dependent on OQS.
Removes the trailing dot to ensure the symbolic link is preserved and
copied correctly to the destination directory.
Refresh sha256 from PyPI sdist. pyOpenSSL 26.2.0 dropped EC support
from the legacy crypto.PKey API (the call surfaces as "OpenSSL.crypto.Error:
No such key type"); drop the EC-key arm of test.sh accordingly. Upstream
points at the cryptography package for EC key generation.
Remaining patches automatically rebased and filenames renumbered.
Changelog:
Incompatibilities
- PCRE support is now PCRE2.
Changes
- POSIX real-time signals (SIGRTMIN etc) are now supported by the kill and trap builtins, TRAP* functions, and the signals parameter, where available.
- The kill builtin learnt a new option -q to send the signal via sigqueue(3) along with an arbitrary integer value, where available.
- The kill builtin also learnt a new -L option to print a list of all known signal numbers and their names.
-The new completion helper _as_if can be used to complete one command as if it were another command with particular arguments.
The wheel's /usr/bin/readelf.py collides with binutils' /usr/bin/readelf
and gets its shebang stripped by CompileAll + DeleteSourceFiles. Rename
to pyreadelf via the Py3Package install hook, matching Fedora's package.
Also depend on python3-asyncio and python3-codecs: elftools.construct.debug
imports pdb, and Python 3.14's pdb pulls in asyncio (via _pyrepl) and
unicodedata (via _pyrepl.utils) at import time.
python-pyelftools: add setuptools to host & target build deps
pyelftools 0.32 ships a PEP 517 build that requires setuptools as its
backend, so -m build fails with "BackendUnavailable: Cannot import
'setuptools.build_meta'" when only build, installer and wheel are staged.
meshtasticd: add python-pyelftools to host build deps
PlatformIO's SCons builder loads its tool modules at the start of
'pio run', including platformio/builder/tools/piosize.py which imports
elftools.elf. python-platformio's HOST_BUILD_DEPENDS already lists
python-pyelftools/host so it is installed alongside platformio in
staging_dir/hostpkg, but the dependency does not always reach
meshtasticd's compile step via that indirect chain, leading to:
ModuleNotFoundError: No module named 'elftools'
File ".../site-packages/platformio/builder/tools/piosize.py", line 22:
from elftools.elf.descriptions import describe_sh_flags
Declare python-pyelftools/host directly in meshtasticd's build deps so
the host install is guaranteed before 'pio run' is invoked.
Daniel Golle [Fri, 8 May 2026 17:52:10 +0000 (18:52 +0100)]
jose: disable man page generation via asciidoc
The asciidoc/a2x toolchain bundled with newer Python (3.14) is
incompatible with jose's docbook XSL configuration, causing the
build to fail with xsltproc returning non-zero status while
processing 'jose.1.xml'.
Since the man pages are not strictly required for OpenWrt (and
typically stripped from the final image anyway), unconditionally
disable a2x detection in meson.build via a disabler() so that the
'mans' list stays empty regardless of host tooling.
Upstream moved the install target from libexecdir/podman to bindir;
update Package/conmon/install accordingly and refresh
010-remove-libdl-dep.patch for the new context.
Daniel Golle [Fri, 22 May 2026 19:21:32 +0000 (20:21 +0100)]
gst1-plugins-base: pin GStreamer GL to the GLES2/EGL API
The 'gl_api' meson option was left at its 'auto' default, so the
GL plugin probed for desktop OpenGL. OpenWrt's Mesa is built with
-Dglx=disabled and -Dglvnd=disabled on every target, so it ships
no linkable desktop-GL library (no libGL.so, no gl.pc) - desktop
GL is only reachable through EGL. With nothing to satisfy the
probe in the sysroot, meson's cc.find_library('GL') fallback
escaped into the build host's /usr/lib and, on a host that has a
desktop libGL installed, put that foreign library on the link
line, breaking the cross link with:
mold: fatal: /usr/lib/libGL.so: incompatible file type:
riscv64 is expected but got x86_64
Pin -Dgl_api=gles2 and -Dgl_platform=egl to match what Mesa
actually provides (libGLESv2 + libEGL). This is correct on every
target, including x86_64: the desktop-GL link path was never
functional on OpenWrt and only ever "succeeded" by picking up a
host library.
kea: handle network reconfiguration without restarting
Currently if a dynamic interface changes (VLAN, tunnel, etc)
that Kea is listening on, it needs to be told externally to
restart. The re-detect option avoids this.
3.0.3 is a security/vulnerability release on the stable 3.0 series.
Notable fixes since 3.0.2:
* **CVE-2026-3608** — A large number of bracket pairs in a JSON payload
sent to any endpoint caused a stack overflow during recursive parsing.
The exploit does not need a syntactically valid command, so it bypasses
RBAC and the command filters on the High-Availability endpoints
(upstream #4275 / #4288 / #4387).
* Null dereference when configuring the Control Agent with a socket
entry that lacks the mandatory ``socket-name`` is now caught
(#4388, #4365).
* UNIX command sockets are created group-writable so Stork 2.4.0+ and
other tooling using the configured group can talk to the daemon
(#4398, #4260).
Upstream's release notes flag "no incompatible changes" and "no known
issues" for this bump.
Daniel Golle [Mon, 1 Jun 2026 02:19:22 +0000 (03:19 +0100)]
transmission: add p{read,write}v2 syscalls to seccomp filter
Tracing Transmission 4.11 showed the Transmission is started to use
the pwritev2 syscall for better write performance.
Add pwritev2 and preadv2 (which may be used as well, and anyway
doesn't hurt) to the list of allowed syscalls.
Maxim Storchak [Sat, 30 May 2026 17:57:16 +0000 (20:57 +0300)]
linenoise: update to 2026-03-02
- Add bracketed paste folding
- Add test for ANSI CSI escape sequences in the prompt.
- Treat ANSI CSI escape sequences as zero-width in utf8StrWidth().
- Fix tab handling when no completion is available.
- Fix ARM unsigned char warning.
aiosignal is a small aio-libs helper that provides a Signal class for
fan-out of coroutine callbacks. Its only practical use is as a runtime
dependency of aiohttp, which is not packaged in this repository, and no
other package here declares aiosignal as a runtime or build dependency.
Drop the package; users who pull in aiohttp via pip on the target will
get aiosignal as a transitive dependency anyway.
kea: add functional test.sh covering all subpackages
Smoke-test each subpackage with a real code path (config validators,
helper script sourcing, Python interpreter / module imports, hook .so
/ UCI file presence) instead of relying on the generic --version probe.
kea: ship admin-utils.sh and kea-shell Python modules
kea-admin and kea-shell were shipped without their helper script
and Python modules respectively, leaving both non-functional. Ship
the missing files, add +python3-light +python3-urllib +python3-openssl
to kea-shell, and rewrite its meson-baked host-absolute shebang and
sys.path.append to the on-target /usr/bin/python3 + $(PYTHON3_PKG_DIR).
git.99rst.org / openwrt-packages.git / log