Stan Grishin [Mon, 12 May 2025 01:55:03 +0000 (01:55 +0000)]
https-dns-proxy: update to 2025.05.11
* update to 2025.05.11 from upstream: https://github.com/aarond10/https_dns_proxy/commit/a34e20d6e24df603427d91bac8f58c2d3a8aa0a6
* update default config with default value for procd_fw_src_interfaces
Fabrice Fontaine [Wed, 26 Feb 2025 21:26:44 +0000 (22:26 +0100)]
libs/libuv: fix PKG_CPE_ID
libuv:libuv is a better CPE ID than libuv_project:libuv as this CPE ID
has the latest CVEs (whereas libuv_project:libuv only has a CVE from
2015):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:libuv:libuv
Fixes: f8ecbf529bad57970e4ff8f90484ba58d06b4a39 (libuv: update to 1.32.0) Signed-off-by: Fabrice Fontaine <redacted>
Fabrice Fontaine [Wed, 26 Feb 2025 18:40:36 +0000 (19:40 +0100)]
lang/tcl: fix PKG_CPE_ID
tcl:tcl is a better CPE ID than tcl_tk:tcl_tk as this CPE ID has the
latest CVE (whereas tcl_tk:tcl_tk only has CVEs up to 2008):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:tcl:tcl
Fabrice Fontaine [Wed, 26 Feb 2025 20:19:30 +0000 (21:19 +0100)]
utils/logrotate: fix PKG_CPE_ID
logrotate_project:logrotate is a better CPE ID than gentoo:logrotate as
this CPE ID has the latest CVE (whereas gentoo:logrotate only has CVEs
up to 2011):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:logrotate_project:logrotate
Joel Low [Sat, 8 Feb 2025 08:23:01 +0000 (16:23 +0800)]
strongswan: preserve changed configuration files
After reinstalling the packages with the preserved configuration files
after a sysupgrade, the reinstalled package config files overwrite what
is on disk rather than being placed as conf-opkg. Defining these config
files will preserve them appropriately.
Hannu Nyman [Sun, 11 May 2025 06:26:03 +0000 (09:26 +0300)]
libpng: Revert "libpng: add symlink to debug library" as unnecessary
This reverts commit 5313dd9be from PR #25324 , related to #25323 and
https://github.com/openwrt/openwrt/pull/16899
The additional symlink libpng16.so -> libpng16d.so is now unnecessary as
OpenWrt main repo PR https://github.com/openwrt/openwrt/pull/18709
commit https://github.com/openwrt/openwrt/commit/703e7d2d5b58e68528cb5fadfc1185bd3904b3d9
changed the cmake build type from 'Debug' to 'RelWithDebInfo', which
causes libpng .so to be compiled with the normal name libpng16.so
(instead of the debug-styled libpng16d.so).
George Sapkin [Tue, 6 May 2025 16:23:01 +0000 (19:23 +0300)]
syncthing: bump to 1.29.6
- chore(lib): expose model methods to obtain progress
- feat(gui): explanation to options enabled or disabled per folder type
- fix(gui): validate device ID in canonical form
- fix(config): remove discontinued primary STUN server
- fix(stun): better error handling
- chore(config): remove discontinued secondary STUN servers
- chore(fs): speed up case normalization
- build(deps): update dependencies
- feat(fs, config): add support for custom filesystem type construction
- build: replace underscore in Debian version
- chore(model): add metric for total number of conflicts
- fix(config): properly apply defaults when reading folder configuration
- fix(config): zero filesystemtype is "basic"
- build: push artifacts to Azure
- chore(config): resolve primary STUN servers via SRV record
- chore(fs): changes to allow Filesystem to be implemented externally
- fix(strings): differentiate setup(n) and set(v) up
- fix(gui): mark unseen disconnected devices as inactive
- fix(syncthing): use separate lock file instead of locking the
certificate
- feat(api, gui): allow authentication bypass for metrics
- chore: add missing copyright in new files from infra branch
- fix(osutil): give threads same I/O priority on Linux
- chore(syncthing): remove support for TLS 1.2 sync connections
- chore(gui): update dependency copyrights, add script for periodic
maintenance
- chore(api): log X-Forwarded-For
- feat(config): add option for audit file
- chore(gui): use go list --deps for dependency list
- fix(strelaysrv): make the session limiter session-dependent
Changelog: https://github.com/syncthing/syncthing/compare/v1.29.5...v1.29.6 Signed-off-by: George Sapkin <redacted>
George Sapkin [Tue, 6 May 2025 19:02:13 +0000 (22:02 +0300)]
golang: bump to 1.24.3
go1.24.3 (released 2025-05-06) includes security fixes to the os
package, as well as bug fixes to the runtime, the compiler, the linker,
the go command, and the crypto/tls and os packages.
perl: fix parallel build race condition in target build
We have received reports of builds of perl occasionally failing when
building with many parallel jobs, with a log like the following:
LD_LIBRARY_PATH=[...]/perl/perl-5.40.0 ./miniperl -Ilib make_ext.pl \
dist/constant/pm_to_blib MAKE="make" LIBPERL_A=libperl.so
File/Path.pm did not return a true value at [...]/hostpkg/usr/lib/perl5/5.40.0/ExtUtils/MakeMaker.pm line 13.
BEGIN failed--compilation aborted at [...]/hostpkg/usr/lib/perl5/5.40.0/ExtUtils/MakeMaker.pm line 13.
Compilation failed in require at Makefile.PL line 3.
BEGIN failed--compilation aborted at Makefile.PL line 3.
Unsuccessful Makefile.PL(dist/constant): code=65280 at make_ext.pl line 532.
The failing extension (dist/constant in the above log) would differ
between runs.
The cause of the issue is the `-Ilib` in the command line of miniperl.
In the host build, `./miniperl -I lib` will use the following include
path:
Various dependencies of the extension build scripts (Makefile.PL) -
including File-Path, which failed to be loaded in the error log - are
included in the path by buildcustomize.pl, as these extensions are only
installed to `lib` as the build proceeds.
However, in a target build, miniperl is just a symlink to the previously
built host perl. As the host perl does not implicitly load
`buildcustomize.pl`, we get the following include path for
`./miniperl -Ilib`:
The host perl's install location is used as the default include path
which provides File-Path etc. for the target build; however, as more
and more libraries get installed into `lib` during the extension build,
they may get loaded from there instead, as `lib` is at the beginning of
the include path. When multiple extensions are built in parallel, a
Makefile.PL may attempt to load File/Path from `lib` after the file has
been created, but before its contents have been written fully, resulting
in the build to fail.
In fact, we should not load anything from `lib` during the target build,
as it is the staging directory for the target, including native
extensions built for the target architecture - with one exception: The
build scripts expect to find target information in the `Config` module,
so simply removing `lib` from the include path completely would break
the build.
Solve the issue by creating an alternative lib directory `lib_build`,
symlinking `Config.pm` and its dependencies in it, and replacing the
`-Ilib` argument with `-Ilib_build` using a wrapper script around the
host perl executable. This is similar to the approach seen in perl's own
obsolete/broken cross compile scripts (`Cross/Makefile`).
The patch was introduced in commit 4c57844f0f04 ("lang/perl: Add hack to
make perl always use miniperl during build"), but it is not actually
necessary. By setting $perl to a non-empty value (using 'perl' as is
common on desktop distros), the logic works as intended and selects the
correct perl binary for host and target builds.
As miniperl just symlinks to host perl for target builds, the main
effect of this change is not unconditionally passing `-Ilib -I.`
anymore. This seems like a good thing; host libraries should be used
with host perl by default.
perl: replace 910-miniperl-needs-inc-dot.patch with smaller scope fix
The patch was first introduced in commit 4a94479f9652 ("perl: update to
5.26.1") to fix the target build when the host perl has
default_inc_excludes_dot enabled. It just added back the `-I`. to every
call of miniperl; this solution is questionable however, as it adds `.` to
the beginning of the search path, not as a final fallback like perl did
before default_inc_excludes_dot (and like miniperl does).
It is also not necessary - only two scripts, write_buildcustomize.pl and
configpm, expect to be able to include a file from `.` (in both cases a
file the script just generated). Just fix the two scripts instead.
Lunatic Kochiya [Sat, 3 May 2025 08:47:52 +0000 (16:47 +0800)]
aria2: fix aira2-openssl install failed
Description: fix in full compile a firmware
pkg_hash_check_unresolved: cannot find dependency aria2-openssl for aria2
pkg_hash_fetch_best_installation_candidate: Packages for aria2 found, but incompatible with the architectures configured
satisfy_dependencies_for: Cannot satisfy the following dependencies for luci-app-aria2:
aria2-openssl
opkg_install_cmd: Cannot install package luci-app-aria2.
George Sapkin [Thu, 1 May 2025 18:48:13 +0000 (21:48 +0300)]
yt-dlp: bump to 2025.04.30
Important changes
- New option --preset-alias/-t has been added
- This provides convenient predefined aliases for common use cases.
Available presets include mp4, mp3, mkv, aac, and sleep. See the
README for more details.
Core changes
- Add --preset-alias option
- utils
- _yield_json_ld: Make function less fatal
- url_or_none: Support WebSocket URLs
Extractor changes
- abematv: Fix thumbnail extraction
- atresplayer: Rework extractor
- bpb: Fix formats extraction
- cda: Fix formats extraction
- cdafolder: Extend _VALID_URL
- crowdbunker: Make format extraction non-fatal
- dacast: Support tokenized URLs
- dzen.ru: Rework extractors
- generic: Fix MPD extraction for file:// URLs
- getcourseru: Fix extractors
- ivoox: Add extractor
- kika: Add playlist extractor
- linkedin
- Support feed URLs
- events: Add extractor
- loco: Fix extractor
- lrtradio: Add extractor
- manyvids: Fix extractor
- mixcloud: Refactor extractor
- mlbtv: Fix device ID caching
- niconico
- Fix login support
- Remove DMC formats support
- live: Fix extractor
- panopto: Fix formats extraction
- parti: Add extractors
- raiplay: Fix DRM detection
- reddit: Support --ignore-no-formats-error
- royalive: Add extractor
- rtve: Rework extractors
- rumble: Improve format extraction
- tokfmpodcast: Fix formats extraction
- tv2dk: Fix extractor
- tvp: vod: Improve _VALID_URL
- tvw: tvchannels: Add extractor
- twitcasting: Fix livestream extraction
- twitch: clips: Fix uploader metadata extraction
- twitter
- Fix extraction when logged-in
- spaces: Improve metadata extraction
- vimeo: Extract from mobile API
- vk
- Fix chapters extraction
- Fix uploader extraction
- youtube
- Add context to video request rate limit error
- Add extractor arg to skip "initial_data" request
- Add warning on video captcha challenge
- Cache signature timestamps
- Detect and warn when account cookies are rotated
- Detect player JS variants for any locale
- Do not strictly deprioritize missing_pot formats
- Improve warning for SABR-only/SSAP player responses
- tab: Extract continuation from empty page
- zdf: Fix extractors
Downloader changes
- niconicodmc: Remove downloader
Networking changes
- Add PATCH request shortcut
Changelog: https://github.com/yt-dlp/yt-dlp/releases/tag/2025.04.30 Signed-off-by: George Sapkin <redacted>
Robert Marko [Thu, 1 May 2025 20:17:15 +0000 (22:17 +0200)]
lrzsz: fix compilation with GCC14
Trying to compile with GCC14 will fail on compiler sanity check with:
configure:1056:1: error: return type defaults to 'int' [-Wimplicit-int]
1056 | main(){return(0);}
| ^~~~
This is due to GCC14 not allowing implicit integer types anymore[1].
So, patch configure to avoid this and make it compile with GCC14.
Proper fix would be to use autoreconf to rebuild configure but configure.in
is completely outdated and would likely be more broken when regenerated.
chrony: enable support for non-MD5 keys in nts variant
gnutls and nettle are already required for NTS. Enable their use for
authentication with non-MD5 symmetric keys as the SECHASH feature
printed by the configure script.
Also drop the --enable,nts (typo) configure option. It's enabled by
default.
Michael Heimpold [Sun, 27 Apr 2025 14:18:02 +0000 (16:18 +0200)]
php8: pass configure hints for snmp extension
The 'snmp' extension module uses net-snmp as library, but fails
to detect whether the library uses openssl when cross-compiling.
Pass the according autoconf variables as hint - net-snmp is not
using openssl at the moment as defined in the Makefile.
Paul Donald [Tue, 29 Apr 2025 10:56:29 +0000 (12:56 +0200)]
chrony: add configuration parameters
The existing config sections were anonymous, implying multiple can
coexist. Those are now named so that only one shall exist.
Added:
- smoothtime (in case of large frequency offsets)
- systemclock parameters
- logchange (increase awareness of clock drift in syslog)
- maxsources (for peers; internal default: 4)
- prefer (one server over others)
- interleave (xleave - more accurate transmit timestamps - good to have)
Refactored handle_allow() to handle 'list interface' instead of option.
Then only a single section is required.
Christian Korber [Wed, 30 Apr 2025 09:28:16 +0000 (11:28 +0200)]
net-snmp: add system to trigger
In a previous commit (0b12bee) hostname was added to
snmpd.init. To track changes in system, the init file
needs to add 'system' to the trigger.
Therefore it is added in this commit.
Fixes: 0b12bee66a89 ("net-snmp: set hostname as sysname") Signed-off-by: Christian Korber <redacted>
Hannu Nyman [Wed, 30 Apr 2025 05:18:21 +0000 (08:18 +0300)]
coreutils: Fix gcc14 compilation via std=c17
Fix compilation with gcc 14 by applying the -std=c17 flag, as suggested
by lededev in https://github.com/openwrt/packages/commit/2d3f68cc8c165b1fa01308f566394cbd7d06766f#commitcomment-153860241
(also -c23 seems to work ok with gcc14, but that seems to break gcc13)
Kazuhiro Ito [Sat, 26 Apr 2025 16:24:42 +0000 (01:24 +0900)]
grep: fix that egrep and fgrep workaround doesn't work
Commit 07b6eec21f57c3cb391b0daf89240b7632b2a49f doesn't work at least
now, because package.mk initializes the variables to the default
values. You have to modify the variable after including package.mk.
Fabrice Fontaine [Wed, 26 Feb 2025 18:12:14 +0000 (19:12 +0100)]
libs/libupnp: fix PKG_CPE_ID
pupnp_project:pupnp is a better CPE ID than libupnp_project:libupnp as
this CPE ID has the latest CVEs from 2021 (whereas
libupnp_project:libupnp only has CVEs up to 2020):
https://nvd.nist.gov/products/cpe/search/results?keyword=cpe:2.3:a:pupnp_project:pupnp
Daniel Golle [Sat, 29 Mar 2025 00:40:10 +0000 (00:40 +0000)]
gnunet: update to 0.24.1
This is a new major release. It breaks protocol compatibility with the
0.23.x versions.
Please be aware that Git master is thus henceforth (and has been for a
while) INCOMPATIBLE with the 0.23.x GNUnet network, and interactions
between old and new peers will result in issues.
In terms of usability, users should be aware that there are still a
number of known open issues in particular with respect to ease of use,
but also some critical privacy issues especially for mobile users.
Also, the nascent network is tiny and thus unlikely to provide good
anonymity or extensive amounts of interesting information.
As a result, the 0.24.1 release is still only suitable for early
adopters with some reasonable pain tolerance.
v0.24.1:
- Fix crash in libgnunetpq when Postgresql database was restarted
- Add configure and make functionality for new meson build
(https://www.gnu.org/prep/standards/html_node/Configuration.html)
v0.24.0:
- Meson is new default build system
- JSON: split off libgnunetmhd from libgnunetjson, renaming various
GNUNET_JSON_-symbols to GNUNET_MHD_-. Removes dependency of
libgnunetjson on libmicrohttpd
OpenWrt package maintainer note:
Meson build is not yet fit for use in OpenWrt's cross build system.
boost: Updates package to version 1.88.0
This commit updates boost to version 1.88.0
New libraries in this release:
* Hash2 [2]: An extensible hashing framework, from Peter Dimov and
Christian Mazakas.
* MQTT5 [3]: MQTT5 client library built on top of Boost.Asio, from Ivica
Siladić, Bruno Iljazović, and Korina Šimičević.
More info about Boost 1.88.0 can be found at the usual place [1].
Kevin Locke [Sat, 30 Nov 2024 21:28:31 +0000 (14:28 -0700)]
strongswan: swanctl: make overtime local
$overtime has been used since swanctl.init was added in f9d91f1f47.
However, there's no need for it to be global. Make it local like the
other config variables to avoid polluting the global namespace and make
the code easier to reason about.
Fixes: f9d91f1f470a ("strongswan: migrate to swanctl configs") Signed-off-by: Kevin Locke <redacted>
Kevin Locke [Sat, 30 Nov 2024 21:23:08 +0000 (14:23 -0700)]
strongswan: swanctl: make send_cert local
When support for send_cert was added in 4b9453b9a4, the $send_cert
variable was inadvertently global. Make it local to avoid polluting the
global namespace and make the code easier to reason about.
Fixes: 4b9453b9a4c8 ("strongswan: Add support for send_cert option") Signed-off-by: Kevin Locke <redacted>
Kevin Locke [Sat, 30 Nov 2024 21:30:54 +0000 (14:30 -0700)]
strongswan: swanctl: Add support for encap
Support the [encap] connection configuration option to force UDP
encapsulation of ESP packets to work around connectivity issues with
middleboxes which block ESP packets.
This work is based on a patch by @aleks-mariusz in
https://forum.openwrt.org/t/confusion-regarding-setting-up-ikev2-vpn-service-with-strongswan-using-ipsec-and-swanctl/169587/9
Daniel Golle [Sat, 26 Apr 2025 03:20:24 +0000 (04:20 +0100)]
opensc: update to version 0.26.1
New in 0.26.1; 2025-01-14
General improvements
Align allocations of sc_mem_secure_alloc (OpenSC/OpenSC#3281)
Fix -O3 gcc optimization failure on amd64 and ppc64el (OpenSC/OpenSC#3299)
pkcs11-spy
Avoid crash while spying C_GetInterface() (OpenSC/OpenSC#3275)
TCOS
Fix reading certificate (OpenSC/OpenSC#3296)
New in 0.26.0; 2024-11-13
Security
CVE-2024-45615: Usage of uninitialized values in libopensc and pkcs15init (OpenSC/OpenSC#3225)
CVE-2024-45616: Uninitialized values after incorrect check or usage of APDU response values in libopensc (OpenSC/OpenSC#3225)
CVE-2024-45617: Uninitialized values after incorrect or missing checking return values of functions in libopensc (OpenSC/OpenSC#3225)
CVE-2024-45618: Uninitialized values after incorrect or missing checking return values of functions in pkcs15init (OpenSC/OpenSC#3225)
CVE-2024-45619: Incorrect handling length of buffers or files in libopensc (OpenSC/OpenSC#3225)
CVE-2024-45620: Incorrect handling of the length of buffers or files in pkcs15init (OpenSC/OpenSC#3225)
CVE-2024-8443: Heap buffer overflow in OpenPGP driver when generating key (OpenSC/OpenSC#3219)
General improvements
Fix reselection of DF after error in PKCSOpenSC/OpenSC#15 layer (OpenSC/OpenSC#3067)
Unify OpenSSL logging throughout code (OpenSC/OpenSC#2922)
Extend the p11test to support kryoptic (OpenSC/OpenSC#3141)
Fix for error in PCSC reconnection (OpenSC/OpenSC#3150)
Fixed various issues reported by OSS-Fuzz and Coverity in drivers, PKCS#11 and PKCS#15 layer
PKCS#15
Documentation for PKCS#15 profile files (OpenSC/OpenSC#3132)
minidriver
Support PinCacheAlwaysPrompt usable for PIV cards (OpenSC/OpenSC#3167)
pkcs11-tool
Show URI when listing token information (OpenSC/OpenSC#3125) and objects (OpenSC/OpenSC#3130)
Do not limit size of objects to 5000 bytes (OpenSC/OpenSC#3174)
Add support for AES CMAC (OpenSC/OpenSC#3184)
Add support for AES GCM encryption (OpenSC/OpenSC#3195)
Add support for RSA OAEP encryption (OpenSC/OpenSC#3175)
Add support for HKDF (OpenSC/OpenSC#3193)
Implement better support for wrapping and unwrapping (OpenSC/OpenSC#3198)
Add support for EdDSA sign and verify (OpenSC/OpenSC#2979)
pkcs15-crypt
Fix PKCS#1 encoding function to correctly detect padding type (OpenSC/OpenSC#3075)
piv-tool
Fix RSA key generation (OpenSC/OpenSC#3158)
Avoid possible state change when matching unknown card (OpenSC/OpenSC#3112)
sc-hsm-tool
Cleanse buffer with plaintext key share (OpenSC/OpenSC#3226)
pkcs11-register
Fix pkcs11-register defaults on macOS and Windows (OpenSC/OpenSC#3053)
IDPrime
Fix identification of IDPrime 840 cards (OpenSC/OpenSC#3146)
Fix container mapping for IDPrime 940 cards (OpenSC/OpenSC#3220)
Reorder ATRs for matching cards (OpenSC/OpenSC#3154)
OpenPGP
Fix state tracking after erasing card (OpenSC/OpenSC#3024)
Belpic
Disable Applet V1.8 (OpenSC/OpenSC#3109)
MICARDO
Deactivate driver (OpenSC/OpenSC#3152)
SmartCard-HSM
Fix signing with secp521r1 signature (OpenSC/OpenSC#3157)
eOI
Set model via sc_card_ctl function (OpenSC/OpenSC#3189)
Rutoken
increase the minimum PIN size to support Rutoken ECP BIO (OpenSC/OpenSC#3208)
JPKI
Adjust parameters for public key in PKCS#15 emulator (OpenSC/OpenSC#3182)
D-Trust
Add support for ECDSA signatures and ECDH key agreement for D-Trust Signatures Cards 4.1/4.4 (OpenSC/OpenSC#3240, OpenSC/OpenSC##3248)
git.99rst.org / openwrt-packages.git / log