Add a common backend for running librespeed-cli measurements on a router.
The package provides a locked measurement runner, live progress state, and
an rpcd ucode plugin exposing start/stop/status/result/history/config over
ubus. Scheduled measurements are managed through cron and can run within a
configurable time window. Optional daily aggregation keeps longer-term
history compact.
Raw measurements are kept in JSONL for a configurable retention period.
When persistent archive storage is configured, completed days are reduced
to daily min/avg/max values.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
conmon learns a container's exit status by waiting for the pid it reads from
the runtime's --container-pidfile, which only works while the container is
conmon's own child. With ujail the container belongs to procd, so conmon has
nothing to wait for: it probes the pid with kill(pid, 0), finds it gone and
settles for a status of zero, as its own comment admits. podman then reports
0 for a container that exited 42, and an exec session that succeeded looks
like a failure.
Add a patch letting the runtime supply what conmon cannot observe: ujail
writes the status to an exit_status file beside the pid file, and conmon
adopts it in the one place it would otherwise guess. A runtime whose
container conmon does reap is unaffected, since no such file exists there.
020-fall-back-to-runtime-exit-status-file.patch also picks up two
fixes review caught: the fallback to a status of 0 now waits up to a
tenth of a second in 10ms steps for the runtime to finish writing the
file, since the runtime can only write it after the kernel has
already reaped the container and made the pid stop answering conmon's
probe, so either order is possible; and a status file is only trusted
if it is at least as new as the pid file, so a stale one left by an
earlier container in the same directory is ignored. Its header also
lost the `diff --git`/`index` lines and `git format-patch` version
trailer that don't survive `make package/conmon/refresh`, which is
what CI's "Dirty patches detected" check was catching on every
architecture. Verified via a scratch quilt tree against the pristine
2.2.1 source that the refreshed patch applies cleanly and stays
stable under a second refresh, and that the patched ctr_exit.c and
ctr_stdio.c both syntax-check clean against host glib.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
LVM2 2.03.42:
- add --lockopt retries=N / removeretry=SECONDS to lvmlockd
- use lockd_lv lock probes for pvmove holder availability in shared VGs
- auto-revert metadata when initial pvmove mirror activation fails
- refuse activation of a pvmove-locked LV when pvmove runs on another
node; allow pvmove --abort without args when using lvmlockd
- add cluster lock lifecycle for pvmove LV in shared VGs, and support
for pvmove in a shared VG
- allow lvremove -f to remove pvmove-locked LVs after an interrupted
pvmove; handle active pvmove during vgchange -an with force flags
- fix pvmove completion to use suspend+resume for DM table reload; fix
deactivation cascade during active pvmove
- support inactive LVs in pvmove with metadata-only mirror insertion;
kill orphaned polling process on pvmove --abort
- support formatting vdo volumes with the kernel vdo target (>=9.2);
fix VDO index_memory_size_mb quantisation and report the minimum
required pool size
- add --enable-asan/--enable-tsan build options
device-mapper 1.02.216:
- make libdm thread safe
- add use_kernel_format to dm_vdo_target_params
- introduce libdevmapper-san with --enable-asan/--enable-tsan
- parent table force reload when child device table changes
Refreshed 002-const-stdio.patch and 003-no-mallinfo.patch against the
new upstream source (make package/lvm2/refresh; hunk offsets only, no
content change) and gave both a proper git-am header block (From/Date/
Subject/Signed-off-by), crediting their original authorship (Daniel
Golle, 2015) with an accurate subject/body; they previously had none,
which the CI formality bot flagged. The header block was drafted via
git format-patch against a scratch commit of the pristine source, then
the whole patch re-refreshed through quilt so the diff body matches
what make package/lvm2/refresh actually produces byte for byte -
format-patch output alone does not survive OpenWrt's own refresh
(diff --git/index lines and full @@ context get stripped, the
trailing signature dropped), which is what the CI patch-format check
was rejecting before this.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This allows to save some bytes, while preserving the scripts's
copyright and license information.
In owut at current ref db17536ec5cbcc6a76a51e65f3d192b6a2184abb
the reduction in the size applied to the source code is (e.g. without
the computed "s/%%VERSION%%/$(PKG_VERSION)-r$(PKG_RELEASE)/"):
from:
74330 /usr/bin/owut
10541 /usr/share/ucode/utils/argparse.uc
to:
58640 /usr/bin/owut
8630 /usr/share/ucode/utils/argparse.uc
Signed-off-by: Samuele Longhi <agave@dracaena.it>
Co-authored-by: Eric Fahlgren <ericfahlgren@gmail.com>
Changelog:
- Upgraded various dependencies, including golang.org/x/crypto to resolve the usual
CVEs in it (but as usual, not actually affecting fscrypt's use of it).
- When selecting password hashing parameters, fscrypt now takes cgroup limitations
into consideration.
- fscrypt encrypt no longer follows trailing symlinks when writing the recovery
instructions.
- fscrypt unlock no longer enters an infinite loop when an incorrect key file is
specified using --key=FILE, --quiet isn't specified, and standard input is a terminal.
- fscrypt unlock no longer enters an infinite loop when an incorrect password is specified,
--quiet isn't specified, and standard input isn't a terminal.
- The error message when multiple protectors are available now mentions --unlock-with in
addition to --protector.
- Documented the udev dependency for /dev/disk/by-uuid/ links.
Signed-off-by: John Audia <therealgraysky@proton.me>
Refresh PKG_HASH from the release tarball. Drop
001-allow-external-library-checks-to-be-disabled.patch: its check_lib /
check_lib_apparmor mechanism is upstream as of 0.21.04, so emptying a
LIB_* variable already skips that library check and the Makefile's
LIB_*= opt-out keeps working without the patch.
Pin the new LIB_NL and LIB_GENL probes off: 0.21.04 added netlink
stressors that would otherwise link libnl from staging_dir without a
corresponding DEPENDS, making the build non-deterministic.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Refresh PKG_HASH from the release tarball.
Drop expiry, groupmems and logoutd from SHADOW_APPLETS: shadow 4.20
removed these applets (their sources are gone from the tarball and
src/Makefile.am no longer builds them), so shadow-expiry,
shadow-groupmems and shadow-logoutd have no binary to install.
Update the login.defs bcrypt sed: 4.20's etc/login.defs ships the
commented default "#ENCRYPT_METHOD SHA512" instead of
"#ENCRYPT_METHOD DES", so the old pattern matched nothing and left
ENCRYPT_METHOD unset.
Refresh 004-fix-su-controoling-term.patch for the shifted su.c line
numbers and add the missing git-am header.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Move the storage backend probe, the ctx construction, the locking
helpers and the volume-name check out of the CLI script into
/usr/lib/uvol/common.uc, so a second entry point can reuse them
without duplicating the logic.
Publish ubus object 'uvol' with the volume operations and a readiness
query. Consumers such as uxc are pure ubus frontends and must not exec
the command line tool. Ship an rpcd exec plugin, installed by the uvol
package itself, taking the same locks as the CLI so both entry points
stay serialised. As stdout is the plugin's reply channel, point file
descriptor 1 at stderr for the duration of a call.
Send a 'uvol.ready' ubus event at the end of 'uvol boot', carrying the
active backend name and whether the .meta volume is ready. Consumers
such as uxc can wait for this event instead of polling volume state.
Sending is best-effort: boot keeps its exit code even when ubusd is
not reachable.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Volume names were interpolated into shell command lines at every
backend call site, so a name containing shell metacharacters ran
arbitrary commands as root. ucode's system() takes an array and execs
it directly, so every call site that interpolates a name, a device or
a path now passes an argument vector instead. Three sites genuinely
want a shell and keep it, with their arguments quoted: the lvm()
helper reads its JSON report via popen(), the content-addressed digest
pipeline quotes the volume path, and taking a volume down attempts a
umount whether or not anything mounted it, so that one keeps its
redirection and is now shared by both backends instead of spelt out
per call site. Suppressed errors that were only hiding a useless
diagnostic are dropped, and the filesystem grow tool is now located by
searching PATH instead of asking a shell.
lvm matches lvname with its own regular expression, and a volume name
was placed in that expression raw, so a dot in a name matched any
character instead of itself: a volume called a.b resolved to an
unrelated axb. Dotted names are the norm, since uxc composes a data
volume as <container>.<volname>; the name is now escaped where the
selection expression is built.
Every lvs, vgs and pvs caller dereferenced straight into the JSON
report, so an lvm invocation that failed to produce one, or failed to
run at all, crashed with a reference error instead of an error code.
Both now report through the .retval every caller already checks.
Volume names reaching the command line are now restricted to
^[A-Za-z0-9_][A-Za-z0-9._-]*$: a leading dot is reserved for uvol's
own volumes such as .meta, and a leading dash would be read as an
option by the backend tools. Only the read-only verbs may name an
internal volume, closing remove, down and resize being able to target
the metadata volume, which the backends never rejected the way mount
registration does; uvol's own boot path calls the backend directly
and is unaffected. The check runs before the per-volume lock, which is
keyed on the volume name too, which is why the -j flag is now consumed
before both. A rejected name exits 22 rather than falling off the end
of the script, which reports success.
Reachable only by root today, through the command line or a volume
name composed by uxc from an author-controlled registration; fixed as
defence in depth.
Fixes: 6350c7bc6 ("uvol: replace with re-write in ucode")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
runtimetest and the ~60 validation/*.go binaries oci-runtime-tests
installs are OCI compliance tests, not user-facing tools, and none
of them has a version flag. Probing one runs the test it implements
instead: CI's generic check reported 58 of 60 missing the version
string and failed the build, and the one it did run tried to read
rootfs-386.tar.gz relative to the probe's working directory rather
than /usr/libexec/oci-runtime-test, so it also failed outright.
Add a test.sh: skip oci-runtime-tests outright, since none of its
binaries can report a version, and keep the generic check for
oci-runtime-tool by replicating it directly now that --version
reports the right string.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
main.version was linked to PKG_SOURCE_VERSION, the upstream commit
hash, rather than PKG_VERSION, the human-readable string everything
else (the tarball name, the package version, CI's own version probe)
actually means by "version". oci-runtime-tool --version therefore
printed the commit hash twice ("<hash>, commit: <hash>") and never
the string 1.3.0.20260316, which is what CI's generic runtime test
greps stdout for, so the check failed on every push regardless of
this PR's actual content.
gitCommit stays on PKG_SOURCE_VERSION, since that is genuinely what
it is; only version was wrong.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The install recipe guarded both archives with CONFIG_x86, a symbol OpenWrt
never defines: the target symbol is CONFIG_TARGET_x86 and the architecture
symbols are CONFIG_i386 and CONFIG_x86_64. No archive was therefore packaged
and every validation test stopped at "rootfs-amd64.tar.gz: Cannot open".
Key each archive off the architecture symbol that matches it, i686 included,
so the package's own architecture guard and the archive it installs cannot
disagree.
The choice moves out of the install recipe, since a conditional inside a
define has to start at the beginning of the line to be a directive at all,
which leaves no way to indent it as the packaging guidelines ask for.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
runtimetest is copied into the validation bundle, whose rootfs carries a
static busybox and no dynamic loader, so the dynamically linked binary the
generic Go recipe produces fails to execute and every validation test that
inspects the container from the inside aborts.
Build that one command again as the static binary upstream's own runtimetest
target produces. Upstream gets there by asking the external linker for a
static link, while disabling cgo reaches the same result without fighting the
-linkmode external that the generic Go recipe would otherwise impose.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
New and extended features:
- gpg, gpgsm: use a partial file on decryption, remove on failure
(disable with --compatibility-flags=no-partial-file-guard)
- gpg: use the INT_RCP_FPR subpacket in revocation signatures
- create a pkgversioninfo.txt file when building with the speedo build
system
Bug fixes:
- gpg: fixed a potential use-after-free in batch key generation when
handling the keyserver URL option
- gpgsm: fixed a regression in gpgsm_verify with expired certificates
- gpgsm: require a minimum tag length for GCM decryption
(CVE-2026-34182)
- scd: limit the size of returned APDU objects from faulty cards; fixed
the condition to retrieve ATR
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Changes from 5.4.0 to 5.4.1:
1. Fixed a performance problem in PMA with backing store files 1G or
more in size, by disabling assertions in support/pma.c.
2. Fixed a bug in gensub() when using MinRX.
3. Revised all files that referred to the FSF's old address.
4. Confirmed MinRX case-insensitive matching behaviour is correct per
POSIX even where one character has multiple alternative case
variants; documented and added tests for it.
5. Unary plus and minus now force their operands to be numeric.
6. Documented the intdiv extension (man page and manual description).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
exfatprogs 1.4.2 - released 2026-06-15
CHANGES:
- install lsdosattr and chdosattr in /bin instead of /sbin
BUG FIXES:
- dump.exfat: prevent heap buffer overflow in name parsing
exfatprogs 1.4.3 - released 2026-08-14
CHANGES:
- honor the user's full locale for diagnostic messages and date formatting
- mkfs.exfat: report final fsync errors and suppress completion messages
with "-q"
- fsck.exfat: increase scan speed when scanning large unused directory
tails
BUG FIXES:
- fix building DOS attribute utilities with non-Bash shells
- dump.exfat/fsck.exfat: ignore reserved allocation-bitmap bits when
counting clusters
- fsck.exfat: reject invalid sector sizes without crashing
- mkfs.exfat: notify the kernel after creating partition tables; generate
GUIDs with correct version/variant fields
- mkfs.exfat/tune.exfat: use standard GUID byte order for GUID input/output
- libexfat: fix directory iterator alignment for large offsets
- prevent allocation bitmap size overflow near the maximum cluster count
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Build with jemalloc on macOS to avoid what appears to be a bug in calloc (issue 5385).
* Fix scrollbar initial state so they appear on new windows (issue 5339).
* Check time periodically in loops rather than every one (issue 5367).
* Use message-style again as default for message-format.
* Unzoom before creating floating panes to avoid a crash.
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
1.8.1:
- Correctly close the slots of a multi-slots reader
- Fix 3 minor issues found by AISLE in partnership with Red Hat
- Correctly report IFD_NO_SUCH_DEVICE in InterruptRead
1.8.2:
- Fix initialisation of composite devices (like Yubico tokens)
- Correctly close the slots of a multi-slots reader (serial)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2.5.1: Ludovic Rousseau
10 June 2026
- Fix a bug (introduced in 2.5.0) with multi-slots readers
- Add support of Haiku Operating System
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
MinOZW reports "OpenZWave Version 1.6-1965-g3fff11d2" while PKG_VERSION
is 1.6.1965, so the generic probe never matches and fails the package
for not providing the version. As the only executable in the package it
takes the whole run down; the presence check was already there for that
reason, it just could not suppress the probe from test.sh. Record that
in the file: the format mismatch is not evident from the code.
Give libopenzwave and openzwave-config arms of their own as well, so
that an unknown sub-package fails loudly instead of falling off the end
of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
The script only asserts that the binary is present, because domoticz
reports no version; say so in the file, so that a later reader does not
'fix' the override by adding a version probe.
Add a default arm as well, so that an unknown sub-package fails loudly
instead of falling off the end of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
While moving it, assert the version where it can be asserted. The
package installs attr, getfattr and setfattr, and the latter two do
implement --version:
printf("%s " VERSION "\\n", progname);
so only attr itself needs the presence check; its getopt string is
"s:V:g:r:lqLRS", where -V takes a value rather than printing a version.
The greps carry an explicit || exit 1: the harness uses only the exit
status of the whole script, so without it a failed match would be
discarded by the [ -x ] that ends the arm and the assertion would never
report anything.
Give libattr an arm of its own as well, so that an unknown sub-package
fails loudly instead of falling off the end of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
btrfs-progs have a no-mold flag since 2025. With latest mold 2.42.0
released a few days ago, the changes from #26541 can be reverted as
btrfs-progs compiles fine with mold.
Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Set PKG_SUBDIRS in the package Makefile instead of patching Makefile.in
to exclude doc, tests, and gnulib-tests.
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Brings the client in line with the fixes merged into the Go client: --json and
--csv end with a newline, --debug names the address each ICMP ping reached and
the spread of the samples, and the User-Agent carries the operating system and
architecture. Also tolerates a backend that answers getIP.php with an empty
rawIspInfo, which previously discarded the whole response.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
001-disable-doc.patch dropped the doc subdir (which needs makeinfo) from
SUBDIRS in Makefile.in. Use PKG_SUBDIRS:=lib bc dc, OpenWrt's wired-in knob
for restricting the build, to skip doc without patching.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Carry fixes for a data race, a goroutine leak, output escaping, JSON and CSV
termination, and sub-millisecond ping precision, plus additional --debug
output. All patches are under review upstream.
Set the version through GO_PKG_LDFLAGS_X. The package never passed one, so
--version reported neither a name nor a version.
Drop the serverIdx patch: 1.0.13 resolves the same problem by checking the map
lookup rather than reading a possibly absent key.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Rust port of librespeed-cli for 32-bit PowerPC targets not supported by
the Go implementation, such as CZ.NIC Turris 1.x.
The CLI output of --list and --csv-header matches the Go client, so it
can be used as a drop-in replacement. Both implementations install
/usr/bin/librespeed-cli and therefore PROVIDES/CONFLICTS are set
accordingly.
Use libopenssl instead of rustls' ring backend, which has significantly
better AES-GCM performance on big-endian PowerPC.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Create a dedicated 'gpsd' system user at package-install time (via
USERID) and pin gpsd's built-in privilege-separation identity to it
via the SConstruct 'gpsd_user' option.
Background: gpsd needs to start as root to open the underlying tty /
serial device but then internally setuid()s to a configured
unprivileged identity for the rest of its lifetime -- a built-in
privilege-separation feature of the daemon.
The current package leaves 'gpsd_user' at scons' default 'nobody'.
Sharing 'nobody' across daemons is a hardening anti-pattern:
a compromise of any one 'nobody'-owned process can trivially
interfere with any other, and audit trails become ambiguous.
Group choice: gpsd_group is a device-access knob rather than an
identity knob -- once gpsd has setuid()d away from root it still
needs to open() tty / serial nodes, which OpenWrt exposes as
root:dialout mode 0660 (see procd hotplug.json and base-files
/etc/group). What actually keeps that access working post-drop is
the setgid() target that gpsd_group selects: gpsd calls
setgroups(0, NULL) immediately before dropping privileges, so any
supplementary groups on the target user are discarded and cannot
carry the permission.
scons' gpsd_group default is not 'nobody' but 'dialout' (uucp on
Gentoo build hosts), so on OpenWrt buildbots the daemon already
lands in 'dialout' today. Pin gpsd_group=dialout explicitly so the
resulting binary no longer depends on the builder's /etc/gentoo-release:
a Gentoo builder would otherwise bake in 'uucp', a group base-files
does not ship, and gpsd's getgrnam() fallback silently keeps root's
gid in that case.
USERID's third field ('dialout=20') still adds the gpsd user to the
dialout group in /etc/group. This does not affect the running
daemon (setgroups() strips it) but matches Debian's gpsd packaging
and lets an operator run gpsdctl / gpsmon as 'gpsd' by hand against
device nodes. GID 20 is the value already frozen into base-files.
Giving gpsd its own primary user:
* confines a hypothetical gpsd RCE (there have been NMEA / UBX
parsing bugs historically) to files owned by 'gpsd' rather than
to the shared 'nobody' identity;
* matches the long-standing Debian gpsd packaging convention
(adduser --system gpsd, member of dialout);
* is a no-op for correctly-configured installations that never
referenced 'nobody' as an intentional identity.
No numeric UID is pinned for the primary 'gpsd' user -- dynamic
assignment via USERID is sufficient here since no cross-distro
NFS/sudoers-style muscle memory depends on a specific number.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
The package ships checksec.bash, which upstream has discontinued. When
asked about the version the script reports, upstream answered that the
bash implementation is legacy, will be removed entirely in an upcoming
release and has been rewritten in Go:
https://github.com/slimm609/checksec.sh/issues/352
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Andy Chiang
Josef Schlehofer
Tianling Shen
Daniel Golle
Eric Fahlgren
Samuele LonghiandEric Fahlgren
Peter Polonec
John Audia
Alexandru Ardelean
Jeffery To
Maxim Storchak
Javier Marcet
Carsten Schuette
Wei-Ting Yang
Niklas Thorild
George Sapkin
Michael Pfeifroth
Rosen Penev
Hannu Nyman
Lukas Voegl