Switch source fetch from git clone to the upstream release tarball
published for every tag, as recommended by the feed guidelines.
This replaces PKG_MIRROR_HASH with a plain PKG_HASH of the
codeload tarball.
Co-authored-by: Federico Capoano <f.capoano@openwisp.io>
Signed-off-by: Gagan Deep <pandafy.dev@gmail.com>
Handling uci-defaults scripts in package postinst is not needed in
modern OpenWrt and in fact results in error messages on install since
the common postinst processes and deletes uci-defaults scripts before
package-specific postinsts are executed.
Therefore remove the unneeded postinsts in this package.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
/etc/syslog-ng.conf is installed with INSTALL_DATA, so it ends up
world readable at 0644. The file holds the credentials of every
destination that needs them, so install it with INSTALL_CONF and
0600 instead, as the rest of the tree does for configuration under
/etc.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The script creates and updates the private Python virtualenv that the
Python module runs from, but the package is built with --disable-python,
so there is nothing for it to do. It cannot even parse its arguments on
a stock image:
/usr/bin/syslog-ng-update-virtualenv: line 30: getopt: not found
Error parsing arguments
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The package ships ten executables and only the daemon reports a
version, so the generic per-executable probe warns for the other nine:
syslog-ng: 9/10 executables are missing version 4.12.0
The tools next to the daemon print their usage instead, which the probe
cannot read a version from. Assert the version on syslog-ng itself.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
PKG_VERSION substitutes p->_p (1.9.17_p2) for a valid apk version, but the
binaries print the real 1.9.17p2, so the generic per-executable version
probe reports "no executables provided version" and fails. Add a
test-version.sh that matches the version string compiled into the binary.
Executing sudo under QEMU emulation (e.g. mips_24kc) hangs indefinitely, so
neither test-version.sh nor test.sh runs it any more: the version is read
from the binary and test.sh only checks the installed files.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The patch blanked INSTALL_OWNER in Makefile.in so the staged install does
not chown to install_uid/install_gid, which fails when building as an
unprivileged user. sudo already supports this: the top-level install rule
recurses with "INSTALL_OWNER=$(INSTALL_OWNER)" into every sub-make, and
sudo's own "package" target does "make install INSTALL_OWNER=" for exactly
this fakeroot case. Pass INSTALL_OWNER= via MAKE_INSTALL_FLAGS instead of
carrying a patch.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Add 'procd_set_param file' for both the base config and the generated
config file so procd detects config changes and restarts rsyslogd.
Without this, procd_add_reload_trigger fires on config changes but
procd does not restart the service because the command line is
identical. This leaves stale configuration active until a manual
restart.
Signed-off-by: Michael Pfeifroth <michael.pfeifroth@westermo.com>
Add a 'sudo' system group at package-install time using the USERID
mechanism.
Rationale: sudoers configurations that grant privileges to the 'sudo'
group -- the near-universal Debian/Ubuntu idiom, e.g.
%sudo ALL=(ALL:ALL) NOPASSWD: ALL
-- fail silently on OpenWrt today because no 'sudo' group exists in
/etc/group. sudo(8) logs 'unknown group: sudo' and the rule is skipped.
Users also cannot 'usermod -aG sudo <user>' without the group present,
so there is no straightforward way to delegate root without hand-editing
/etc/group or writing per-user sudoers snippets.
Seeding the group here matches how OpenWrt already handles other
service accounts (chrony, dbus, ntpd, ...): the USERID mechanism
creates them lazily via add_group_and_user in the postinst script.
No privileges are granted by default -- an administrator still has to
add users to the group and ship a sudoers rule that references it.
No numeric GID is pinned. The group name is what sudoers, addgroup(1),
and getgrnam() operate on; the numeric GID is invisible to sudo's
authorisation path and matters only for on-disk group ownership
metadata (e.g. 'chgrp sudo' persisted to shared storage) -- something
this package does not do. Letting add_group_and_user pick a dynamic
GID in the 32768+ range keeps sudo out of base-files' reserved
low-range group space and avoids any name-vs-number collision debate.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
Each output flush runs in a coroutine whose stack was forced to 4096 (one
page). The HTTP output plugin overflows it and crashes with SIGSEGV after
the flush (issue #30113). Pin FLB_CORO_STACK_SIZE to upstream's own 64K
floor (FLB_CORO_STACK_SIZE_MIN_BYTE), which the musl-shrunk default undercuts.
Also add a regression test: drive the dummy input into the http output and
assert fluent-bit survives a few flush cycles instead of dying from a signal
(no listener needed -- the overflow happens while composing the request).
Fixes: https://github.com/openwrt/packages/issues/30113
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
* Add config file patch for proxy
* Add initscript for proxy
* Update Makefile and support files to bring proxy to parity with
agentd and server.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
* Genericize zabbix_server initscript.
* Add shellcheck overrides where needed.
* Add a 'never_root' config option (default true) that determines
whether server starts as an unprivileged user or starts as root and
drops to an unprivileged user (unless config is changed so it always
runs as root).
* Bring zabbix_agentd initscript to parity with zabbix_server for the
initscript and configuration.
* Tweak Makefile to reduce repetition
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Tweak the agentd and server patch configurations and bring agentd and
server confgurations to parity.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
This is the upstream recommendation, and fits with our separation
of agent and server.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
While the frontend can mostly operate without php8-mod-simplexml, when
trying to import XML templates the user only gets unhelpful error
messages and is unlikely to realize the module is required for that
functionality. Therefore have the frontend depend on php8-mod-simplexml.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
The sysctl file increases max files to allow the default full
complement of discovery workers, however this is probably not a
hard requirement and such a conf not shipped elsewhere in tree, so
leave that to the user to configure. (The syslog messages from
zabbix-server and/or zabbix-proxy provided the needed information).
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Reorganize the extra files under the 'files' dir so that it is more
clear where they go and what they are for, and to avoid having a
disorganized mass of files.
Move the extra C source file out of files and into 'src-extra'.
Avoid treating openwrt-supplied params files as configuration data.
Instead have them in a separate directory under /usr/share which is
included in the zabbix_agentd configuration by default. This also better
follows the FHS.
Hopefully these changes make sense on their own, as well as helping the
CI accept the changes.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Add the user config file directories (/etc/zabbix_x.conf.d) to the
list of directories and files to preserve across sysupgrade.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Drop 001-configure-make-libyaml-default-on-explicit.patch; it was a backport
of upstream commit c5c24486 which is now part of this release, so configure.ac
already makes libyaml default-on and fails fast when yaml-0.1 is missing.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Now that post install is running properly, when CI executes the
tests the zabbix-extra-* packages that have a posinst exit the
post install with an error if ubusd is not running.
Drop the error code from killall with no usbd running to fix this.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Allow CI to pass the version check for packages with executables
with not version output.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
* Update version to latest upstream LTS version.
* The Makefile was using an overly clever means to be compact that the
CI webhook, and possibly the CI test container, didn't understand. We
unroll that logic, and have more usual install and conffiles sections.
In the process we fix a missing conffile install for zbbix-proxy*
packages.
* Whitespace fixups
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Update 4.2.0 -> 5.0.8 and adopt maintainership. fluent-bit segfaulted at
startup on every musl target: under GCC 14 the upstream C-TLS probe no longer
compiles (undeclared __tls_get_addr), so the pthread_key fallback calls
pthread_getspecific() before pthread_key_create() and derefs a NULL tsd array
on musl (glibc is unaffected). Force -DFLB_HAVE_C_TLS=Yes for __thread TLS.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
The way we use -lfts isn't particularly consistent. There's no reason
it shouldn't be. glibc users shouldn't have to deal with someone else's
lack of rigor.
Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
Generic version checks were introduced in actions-shared-workflows,
making these individual test.sh files obsolete.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
* New release, see the changelog [1] for what's new.
* Switch the download source from Bitbucket to the official release page (https://mmonit.com/monit/dist/). The source code archives on Bitbucket no longer use clear naming conventions like "monit-x.y.z". The Monit team has confirmed that downloading directly from their official distribution site is the recommended approach going forward.
[1] https://mmonit.com/monit/changes/
Signed-off-by: Yaroslav Petrov <info@lank.me>
Two packages (fluent-bit and nnn) don't properly gate musl-fts as
only required when using MUSL.
Signed-off-by: Philip A. Prindeville <philipp@redfish-solutions.com>
Add package for memtest86+ and ability to boot directly into it from
existing grub menu. Both legacy and EFI packages are available and each
will provide the needed memtest86+ images plus a postinst and postrm to
handle the grub.cfg menu entries.
The images are tiny, adding at worst 154 kB to the kernel partition.
I do not have x86 box for testing but the memtest86plus-efi package
works as expected on my test machine (ie booting into the image and the
setup and removal of the grub.cfg menu entry).
Build system: x86/64
Build-tested: x86/64-glibc
Run-tested: x86/64-glibc (Intel N150 based box)
Signed-off-by: John Audia <therealgraysky@proton.me>
The upstream rsyslog build links against libyaml-0.so.2 whenever
pkg-config detects yaml-0.1, which made libyaml a hard dependency
of the rsyslog binary without any way to opt out from OpenWrt
config. libyaml is only used for YAML (.yaml/.yml) configuration
files and for loading rate-limiting policies from external files;
RainerScript (.conf) installs do not need it.
Introduce a new RSYSLOG_libyaml Config.in switch, default off, and
gate the +libyaml DEPENDS entry on it. Pass --enable-libyaml or
--disable-libyaml to configure based on the switch.
The upstream configure script in 8.2604.0 does not understand a
--disable-libyaml flag (libyaml was unconditionally autodetected).
Backport upstream commit c5c244861 ("configure: make libyaml
default-on explicit") as 001-configure-make-libyaml-default-on-
explicit.patch, which adds the AC_ARG_ENABLE(libyaml) block. The
patch dissolves cleanly once the package is bumped to 8.2606.0+.
PKG_FIXUP:=autoreconf is added so the configure.ac change flows
into the generated configure script during the SDK build.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to latest upstream release.
Highlights of changes since 1.0.128:
* Added support for Debian 13 (trixie)
* Added support for many new Ubuntu releases (jammy through plucky)
* Improvements to keyring handling
* Various bug fixes and cleanups
Drop PKG_REAL_VERSION and the now-redundant PKG_BUILD_DIR override:
upstream and downstream versions match, so use PKG_VERSION directly
in PKG_SOURCE.
Link: https://salsa.debian.org/installer-team/debootstrap/-/blob/1.0.143/debian/changelog
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Changes since 2023.4:
* Add automatic signing keys for trixie
* Add Debian Stable Release Key (13/trixie) (ID: 762F67A0B2C39DE4)
* Clean up maintscript removal of ancient archive certificates
* Get rid of team-members/ and signature verification
* Remove buster keys
* Rename keyrings from .gpg to .pgp
* Use OpenPGP instead of GnuPG when referring to the specification
Link: https://salsa.debian.org/release-team/debian-archive-keyring/-/blob/debian/2025.1/debian/changelog
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
zabbix-sender and zabbix-get are only build if agentd is built.
Therefore do not allow selection them if the full agentd is not
being built.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
Version 8.2604.0 follows the YYYYMM.x versioning scheme (April 2026).
The 8.2604.0 release enables --enable-impstats-push by default, which
requires protobuf-c-compiler (protoc-c). Since we don't ship
protobuf-c in the SDK environment and the impstats push feature is
not essential for typical OpenWrt use, disable it explicitly with
--disable-impstats-push.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Gagan DeepandFederico Capoano
Daniel F. Dickinson
Josef Schlehofer
Alexandru Ardelean
Michael Pfeifroth
Michael Pfeifroth
Sebastian Hamann
Jon Henrik Bjørnstad
Philip A. Prindeville
Yaroslav Petrov
John Audia
Daniel Golle
Wei-Ting Yang
Tianling Shen