kmod-v4l2loopback differs between builds, e.g. on apm821xx/nand, as
v4l2loopback.ko carries the absolute path of the kernel tree:
/builder/shared-workdir/build/build_dir/.../linux-6.18.52/include/linux/ucopysize.h
The module is built by calling make -C $(LINUX_DIR) directly, so none
of the OpenWrt prefix maps apply, and since Linux 6.13 kbuild includes
the kernel headers of external modules by their absolute path.
Build through $(KERNEL_MAKE), which passes KERNEL_MAKE_FLAGS and with
them the prefix maps of the build and staging directories, like the
kernel packages of the main repository do. ARCH and CROSS_COMPILE come
with KERNEL_MAKE_FLAGS as well.
Signed-off-by: Paul Spooren <mail@aparcar.org>
/dev/input/* is 0600 root:root unless input-support is installed to
allocate the input group and ship the hotplug rule, so a program reading
evdev has to run as root without it.
libinput depends on libevdev and inherits this, so both sides of the
evdev stack are covered by saying it once here.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
/dev/dri/card* is 0600 root:root unless video-support is installed to
allocate the video group and ship the hotplug rule that puts the nodes
into it, so anything talking to DRM needs that package present.
libdrm is where that is worth saying once. The dependency is a plain
one, and package-metadata.pl re-emits a selected package's own
conditions onto whatever selects it, so every consumer inherits the
requirement and none of them has to repeat it. That reaches the mesa
providers here and, through them, the video feed.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The package allocates a group named scanner with a dynamic id, while
openwrt.git's scanner-support package allocates it as gid 47. Two
different ids for one group name make the metadata scan fail.
Depend on scanner-support and pin the group to the same id. The hotplug
script stays here: it matches a scanner by vendor and product id against
the usbid lists this package ships, which scanner-support has no way to
do, and it already checks that the group exists before granting access.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The package allocates a group named dvb with a dynamic id, while
openwrt.git's dvb-support package allocates it as gid 49 together with
the hotplug rules that put the DVB adapter nodes into it. Two different
ids for one group name make the metadata scan fail.
Depend on dvb-support and pin the group to the same id.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The AUDIO_SUPPORT target feature is replaced in openwrt.git by an
audio-support package, which allocates the audio, audio-capture and midi
groups and installs the hotplug rules that put the ALSA nodes into them.
A target feature said only that the SoC family might have a sound card;
the package says that this image has one.
Depend on the package where the feature was tested, and read
CONFIG_PACKAGE_audio-support where mpd tested the feature at build time.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
libdvbcsa no longer requires BUILD_PATENTED, so enable dvbcsa
unconditionally and drop the BUILD_PATENTED dependency and config
toggle.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
libdvbcsa no longer requires BUILD_PATENTED, so drop the gate from the
libdvbcsa dependency and the configure args. Software descrambling is
now enabled via TVHEADEND_CSA alone.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Add a test-version.sh override because shineenc does not report its
version. Keep the remaining generic package checks enabled.
Signed-off-by: Marcin Maj <marcinmajsc@gmail.com>
get_bootdev() identifies the boot disk for a root=PARTUUID=xxxxxxxx-NN
command line by reading the four-byte signature at offset 440 of each
block device, but renders it with %x per byte, so a byte below 0x10 comes
out as a single digit and the string is too short to ever match. A disk
whose signature is cf0a3161 yields "cfa3161", get_bootdev() returns null,
and every backend's init fails: uvol then reports no backend at all and
no volume can be created on a perfectly good volume group.
Pad each byte to two digits, as the GPT branch of the same function
already does.
Fixes: 6350c7bc63 ("uvol: replace with re-write in ucode")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
setools reads its version through importlib.metadata, which imports
the email module. email is part of python3-urllib, so without it every
tool prints "unknown" for --version, and the generic version check
fails for all of them. Depend on python3-urllib.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
None of the selinux-python tools print the package version, so the
generic version check fails for all of them.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
start_service() runs chgrp and chmod on /dev/dvb/*. Without a DVB
adapter the pattern does not match, so every start, including the one
during a package upgrade, prints
chgrp: /dev/dvb/*: No such file or directory
chmod: /dev/dvb/*: No such file or directory
Only touch the entries that exist. The fix itself is still needed for
adapters that were plugged in before the package was installed, as no
hotplug event sets their group then.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
tinc --version prints "tinc version UNKNOWN", because the package runs
autoreconf, and the AC_INIT of configure.ac takes the version from git
describe, which fails in the build directory. The release tarball ships
a configure with the version. autoreconf is only left over from
packaging a git snapshot before 1.1pre18, so drop it together with the
patch it needed.
Add a test-version.sh, because PKG_VERSION is 1.1_pre18 for apk and the
generic version test cannot find it in the output.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Fixes GHSA-5qpq-xqfv-j9pg: after a failed memory allocation,
reinitializing an existing .lzma, .lz or MicroLZMA decoder to decode a
different file could access invalid memory and at least crash. It
affects all XZ Utils versions since 5.0.0.
The release also fixes a wrong error code in lzma_stream_buffer_decode()
and a slowdown of lzma_index_cat() with crafted files that made
"xz --list" appear to hang.
Release notes:
https://github.com/tukaani-project/xz/releases/tag/v5.8.4
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
dyndns.variomedia.de no longer accepts connections on port 80, so updates
fail unless the user enabled the use_https option. The HTTPS endpoint
works and answers with the usual dyndns2 status codes.
Switch both update URLs to HTTPS.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Remove the definitions of DDNS providers whose update endpoints no longer
work:
- system-ns.com: the domain now serves an unrelated online gambling site.
Keeping the entry would send the update token to a third party.
- xlhost.de: the domain has been a web hosting comparison site since 2017
and nsupdate.xlhost.de/nic/update returns 404.
- domopoli.de: the host does not answer on port 80 or 443. The update URL
also contains the scheme twice (http://[USERNAME]:[PASSWORD]@http://...),
so it could never have worked with ddns-scripts.
Drop their JSON files and their entries from the provider list.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
gpsd-clients/install only shipped cgps, gpsctl, gpsdecode, gpsmon,
gpspipe, gpxlogger and lcdgps, leaving out gps2udp even though it's
built by scons like the rest of the client tools. Install it too.
Signed-off-by: Jose Luis Sanroma Tato <joseluis.sanromatato@unwired.at>
Security release:
- Proxy protocol: fix an out-of-bounds read in V1 header parsing
(GCVE-25-2026-09-50-1).
- Proxy protocol: do not use uninitialised data as the length of an
incompletely received V2 header (GCVE-25-2026-09-55-1).
- GnuTLS: fix a use-after-free when a client closes the connection
during session startup (GCVE-25-2026-09-51-1).
- Block more SMTP smuggling variants, extending the fixes for
CVE-2023-51766 (GCVE-25-2026-09-56-1).
All patches apply without changes.
Link: https://code.exim.org/exim/exim/src/tag/exim-4.100.1/doc/doc-txt/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
downloads.exim.org keeps only the current release in exim4/ and moves
older tarballs to exim4/old/. Since 4.100.1 came out, the download of
4.100 from the primary URL fails with 404 and only works through the
OpenWrt mirror.
Add exim4/old/ as a second source URL.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* use RDAP startAddress/endAddress as a single interval element (one nft call per lookup)
* validate RDAP ranges, block nft command and log line injection
* always restart the procd instance (unique nonce via env)
* restart the log monitor if the log reader terminates (e.g. logd restart)
* f_rmpid clears the pidfile before killing child processes
* EXIT trap: route unexpected service exits through f_log "err"
* readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
Fix the netcup DDNS updater when comparing an existing
IPv6 record to the current address.
The previous logic relied on REGISTERED_IP and required it
to be set, but that value is not always available or reliable for
IPv6 records. As a result, the updater could wrongly skip or
fail to update AAAA entries.
This change:
- Removes the hard dependency on REGISTERED_IP
- Compares record type and hostname before evaluating the IP
- Normalizes IPv6 addresses before comparison
- Exits early when no update is required
Fixes#30387
Signed-off-by: Martin Brodbeck <martin@brodbeck-online.de>
Two packages provide librespeed-cli, and for a dependency written with a
leading plus, package-metadata.pl re-emits the chosen provider's
architecture gate under a condition that names the consuming package.
Kconfig reads that as a self-dependency, once for librespeed-common and
again for luci-app-librespeed. Naming the client without the plus emits
a plain either-or instead, and the user picks.
The provide also crosses package boundaries, where package-pack.mk asks
for an unversioned one: with a version the higher one wins, so a release
on either side would decide which client apk installs. Unversioned, the
package called librespeed-cli keeps the name, and a default variant
gives the Rust client the provider priority so it is still chosen where
the Go client is not built.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The mox-pkcs11 package was merged with a Makefile that fails during build,
specifically because of linking issues.
Example errors:
> mox-pkcs11.c:(.text+0x1e4): undefined reference to `find_key_by_type_and_desc'
> mox-pkcs11.c:(.text+0x109c): undefined reference to `keyctl_read'
> ERROR: package/feeds/packages/mox-pkcs11 failed to build.
The specific error is a missing '\'.
Reported-by: Robert Klink <rklink@ripe.net>
Signed-off-by: Trix Taiclet <git@trix.moe>
The LG Magic Remote MR24 pads a Read By Type response for the
characteristic declaration with junk entries once its attribute table
is exhausted, and bluetoothd then throws the whole GATT discovery away,
so the HID over GATT profile never attaches and the remote produces no
input device. Add a gatt-helpers fix that accepts only the ascending,
in-range prefix of such a response.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The DVB device nodes are created after the USB hotplug event, so the
existing USB hotplug script may run before the nodes exist. This leaves
newly connected tuners owned by root:root 0600 and inaccessible to
tvheadend.
Handle DVB hotplug events instead. On add, fix the group ownership and
permissions after procd creates the node. On remove, remove the empty
adapter directory so tvheadend can detect that the adapter disappeared.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
- Remove DDNS provider definitions for discontinued services:
DNSDynamic
DNSMax
DNS Park
Google Domains
ThatIP
TwoDNS
- None of these services can be used for DDNS updates anymore. Remove their
provider definitions and entries from the provider list to avoid exposing
obsolete and non-functional configurations.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Config parameters grabbed from standard libraries and existing Perl
build tree. Tested good on both glibc and musl with simple scripts.
Signed-off-by: Xinhui Yang <cyan@cyano.uk>
curl 8.22.0 removes TLS-SRP support. Explicitly set
PECL_cv_LIBCURL_TLSAUTH_SRP=no to prevent configure from
running a test that fails when cross-compiling.
Signed-off-by: Peter Polonec <polonec.devel@pm.me>
Update curl from 8.21.0 to 8.22.0
This fixes:
CVE-2026-82208
CVE-2026-82209
CVE-2026-80229
CVE-2026-80230
CVE-2026-80231
CVE-2026-80255
CVE-2026-80256
CVE-2026-19931
CVE-2026-18924
CVE-2026-13608
curl 8.22.0 removes TLS-SRP support, so the obsolete LIBCURL_TLS_SRP
configuration option and configure argument are removed as well.
Signed-off-by: Peter Polonec <polonec.devel@pm.me>
Commit 7885dff933 ("modemmanager: skip virtual net devices in hotplug
script") exited 25-modemmanager-net for every device under
/devices/virtual/* to stop the per-device "event processed" line from
spamming daemon.info on every boot and hotplug replay.
That blanket exit also dropped the QMAP/QMI/MBIM multiplexing netdevices
(qmapmux*, qmimux*, mbimmux*). Those live under /devices/virtual too,
but they are real modem data ports and mm_report_event() deliberately
keeps them (ModemManager then resolves their lower_* link back to the
physical modem). Skipping them in the hotplug script broke multiplexed
data connections.
Rather than duplicating that qmapmux/qmimux/mbimmux allow-list in the
hotplug script -- where it would drift out of sync with the copy in
mm_report_event() -- keep the filter in one place. mm_report_event()
now returns non-zero when it drops a virtual device, and the hotplug
scripts only emit their "event processed" info log when the event was
actually reported. The noisy log lines are gone for the dropped
devices, and the mux ports still reach ModemManager.
Fixes: 7885dff933 ("modemmanager: skip virtual net devices in hotplug script")
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Corrects the transfer accounting, the redirect and TLS handling, the
command line and the reports, sanitizes text a server supplies, and
holds the output to the Go client's with differential tests.
The upstream repository moved to the librespeed organisation, and the
version banner follows it, so the test greps for the new address.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The NEON audio resampler has been compiled out of every 32-bit ARM build
since 1.28. Its inline asm advances pointers with add.w, a Thumb-2 only
mnemonic that gas rejects in ARM (A32) state, which is how OpenWrt builds
ARM. The same add.w sits in the meson probe that gates HAVE_ARM_NEON, so
the probe fails first and hides the broken asm behind the generic C path.
Backport the upstream fix, which selects the operand form per ISA and
drops add.w from the probe. Thumb-2 code generation is unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream list of changes is available at
https://gstreamer.freedesktop.org/releases/1.28/#1.28.7.
Drop 001-gst-libav-Fix-build-failure-with-FFmpeg-9.0.patch. The fix it
carries is already in 1.28.7, so quilt refuses to apply it ("can be
reverse-applied") and the build fails before it starts.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Upstream list of changes is available at
https://gstreamer.freedesktop.org/releases/1.28/#1.28.7.
The y4m plugin is gone from gst-plugins-bad in 1.28: its y4mdec element
moved into the gst-plugins-good y4m plugin, and neither gst/y4m nor the
y4m meson option exists here any more. Drop the -Dy4m= argument, which
meson would now reject as unknown, together with the gst1-mod-y4mdec
package. The element stays available as gst1-mod-y4m from
gst-plugins-good.
Signed-off-by: W. Michael Petullo <mike@flyn.org>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
In 1.28 upstream merged the y4mdec element from gst-plugins-bad into the
gst-plugins-good y4m plugin, which now registers both y4mdec and y4menc
from a single libgsty4m. The Makefile has passed -Dy4m= since 1.16.2,
but the package line stayed commented out, so the plugin was never
built.
Enable it, so the y4mdec element dropped from gst-plugins-bad in this
series stays available. Anyone who selected gst1-mod-y4mdec needs to
select gst1-mod-y4m instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Paul Spooren
Daniel Golle
Rosen Penev
Marcin Maj
Martin Johansson
Josef Schlehofer
Jose Luis Sanroma Tato
Dirk Brenken
Niklas Thorild
Ivan Pavlov
Romain Isnel
Christian Lachner
Martin Brodbeck
Trix Taiclet
Xinhui Yang
Peter Polonec
Michael Pfeifroth
Javier Marcet
Alexandru Ardelean
W. Michael Petullo