Move the storage backend probe, the ctx construction, the locking
helpers and the volume-name check out of the CLI script into
/usr/lib/uvol/common.uc, so a second entry point can reuse them
without duplicating the logic.
Publish ubus object 'uvol' with the volume operations and a readiness
query. Consumers such as uxc are pure ubus frontends and must not exec
the command line tool. Ship an rpcd exec plugin, installed by the uvol
package itself, taking the same locks as the CLI so both entry points
stay serialised. As stdout is the plugin's reply channel, point file
descriptor 1 at stderr for the duration of a call.
Send a 'uvol.ready' ubus event at the end of 'uvol boot', carrying the
active backend name and whether the .meta volume is ready. Consumers
such as uxc can wait for this event instead of polling volume state.
Sending is best-effort: boot keeps its exit code even when ubusd is
not reachable.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Volume names were interpolated into shell command lines at every
backend call site, so a name containing shell metacharacters ran
arbitrary commands as root. ucode's system() takes an array and execs
it directly, so every call site that interpolates a name, a device or
a path now passes an argument vector instead. Three sites genuinely
want a shell and keep it, with their arguments quoted: the lvm()
helper reads its JSON report via popen(), the content-addressed digest
pipeline quotes the volume path, and taking a volume down attempts a
umount whether or not anything mounted it, so that one keeps its
redirection and is now shared by both backends instead of spelt out
per call site. Suppressed errors that were only hiding a useless
diagnostic are dropped, and the filesystem grow tool is now located by
searching PATH instead of asking a shell.
lvm matches lvname with its own regular expression, and a volume name
was placed in that expression raw, so a dot in a name matched any
character instead of itself: a volume called a.b resolved to an
unrelated axb. Dotted names are the norm, since uxc composes a data
volume as <container>.<volname>; the name is now escaped where the
selection expression is built.
Every lvs, vgs and pvs caller dereferenced straight into the JSON
report, so an lvm invocation that failed to produce one, or failed to
run at all, crashed with a reference error instead of an error code.
Both now report through the .retval every caller already checks.
Volume names reaching the command line are now restricted to
^[A-Za-z0-9_][A-Za-z0-9._-]*$: a leading dot is reserved for uvol's
own volumes such as .meta, and a leading dash would be read as an
option by the backend tools. Only the read-only verbs may name an
internal volume, closing remove, down and resize being able to target
the metadata volume, which the backends never rejected the way mount
registration does; uvol's own boot path calls the backend directly
and is unaffected. The check runs before the per-volume lock, which is
keyed on the volume name too, which is why the -j flag is now consumed
before both. A rejected name exits 22 rather than falling off the end
of the script, which reports success.
Reachable only by root today, through the command line or a volume
name composed by uxc from an author-controlled registration; fixed as
defence in depth.
Fixes: 6350c7bc6 ("uvol: replace with re-write in ucode")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
runtimetest and the ~60 validation/*.go binaries oci-runtime-tests
installs are OCI compliance tests, not user-facing tools, and none
of them has a version flag. Probing one runs the test it implements
instead: CI's generic check reported 58 of 60 missing the version
string and failed the build, and the one it did run tried to read
rootfs-386.tar.gz relative to the probe's working directory rather
than /usr/libexec/oci-runtime-test, so it also failed outright.
Add a test.sh: skip oci-runtime-tests outright, since none of its
binaries can report a version, and keep the generic check for
oci-runtime-tool by replicating it directly now that --version
reports the right string.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
main.version was linked to PKG_SOURCE_VERSION, the upstream commit
hash, rather than PKG_VERSION, the human-readable string everything
else (the tarball name, the package version, CI's own version probe)
actually means by "version". oci-runtime-tool --version therefore
printed the commit hash twice ("<hash>, commit: <hash>") and never
the string 1.3.0.20260316, which is what CI's generic runtime test
greps stdout for, so the check failed on every push regardless of
this PR's actual content.
gitCommit stays on PKG_SOURCE_VERSION, since that is genuinely what
it is; only version was wrong.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The install recipe guarded both archives with CONFIG_x86, a symbol OpenWrt
never defines: the target symbol is CONFIG_TARGET_x86 and the architecture
symbols are CONFIG_i386 and CONFIG_x86_64. No archive was therefore packaged
and every validation test stopped at "rootfs-amd64.tar.gz: Cannot open".
Key each archive off the architecture symbol that matches it, i686 included,
so the package's own architecture guard and the archive it installs cannot
disagree.
The choice moves out of the install recipe, since a conditional inside a
define has to start at the beginning of the line to be a directive at all,
which leaves no way to indent it as the packaging guidelines ask for.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
runtimetest is copied into the validation bundle, whose rootfs carries a
static busybox and no dynamic loader, so the dynamically linked binary the
generic Go recipe produces fails to execute and every validation test that
inspects the container from the inside aborts.
Build that one command again as the static binary upstream's own runtimetest
target produces. Upstream gets there by asking the external linker for a
static link, while disabling cgo reaches the same result without fighting the
-linkmode external that the generic Go recipe would otherwise impose.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
New and extended features:
- gpg, gpgsm: use a partial file on decryption, remove on failure
(disable with --compatibility-flags=no-partial-file-guard)
- gpg: use the INT_RCP_FPR subpacket in revocation signatures
- create a pkgversioninfo.txt file when building with the speedo build
system
Bug fixes:
- gpg: fixed a potential use-after-free in batch key generation when
handling the keyserver URL option
- gpgsm: fixed a regression in gpgsm_verify with expired certificates
- gpgsm: require a minimum tag length for GCM decryption
(CVE-2026-34182)
- scd: limit the size of returned APDU objects from faulty cards; fixed
the condition to retrieve ATR
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Changes from 5.4.0 to 5.4.1:
1. Fixed a performance problem in PMA with backing store files 1G or
more in size, by disabling assertions in support/pma.c.
2. Fixed a bug in gensub() when using MinRX.
3. Revised all files that referred to the FSF's old address.
4. Confirmed MinRX case-insensitive matching behaviour is correct per
POSIX even where one character has multiple alternative case
variants; documented and added tests for it.
5. Unary plus and minus now force their operands to be numeric.
6. Documented the intdiv extension (man page and manual description).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
exfatprogs 1.4.2 - released 2026-06-15
CHANGES:
- install lsdosattr and chdosattr in /bin instead of /sbin
BUG FIXES:
- dump.exfat: prevent heap buffer overflow in name parsing
exfatprogs 1.4.3 - released 2026-08-14
CHANGES:
- honor the user's full locale for diagnostic messages and date formatting
- mkfs.exfat: report final fsync errors and suppress completion messages
with "-q"
- fsck.exfat: increase scan speed when scanning large unused directory
tails
BUG FIXES:
- fix building DOS attribute utilities with non-Bash shells
- dump.exfat/fsck.exfat: ignore reserved allocation-bitmap bits when
counting clusters
- fsck.exfat: reject invalid sector sizes without crashing
- mkfs.exfat: notify the kernel after creating partition tables; generate
GUIDs with correct version/variant fields
- mkfs.exfat/tune.exfat: use standard GUID byte order for GUID input/output
- libexfat: fix directory iterator alignment for large offsets
- prevent allocation bitmap size overflow near the maximum cluster count
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* Build with jemalloc on macOS to avoid what appears to be a bug in calloc (issue 5385).
* Fix scrollbar initial state so they appear on new windows (issue 5339).
* Check time periodically in loops rather than every one (issue 5367).
* Use message-style again as default for message-format.
* Unzoom before creating floating panes to avoid a crash.
Signed-off-by: Maxim Storchak <m.storchak@gmail.com>
1.8.1:
- Correctly close the slots of a multi-slots reader
- Fix 3 minor issues found by AISLE in partnership with Red Hat
- Correctly report IFD_NO_SUCH_DEVICE in InterruptRead
1.8.2:
- Fix initialisation of composite devices (like Yubico tokens)
- Correctly close the slots of a multi-slots reader (serial)
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2.5.1: Ludovic Rousseau
10 June 2026
- Fix a bug (introduced in 2.5.0) with multi-slots readers
- Add support of Haiku Operating System
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
MinOZW reports "OpenZWave Version 1.6-1965-g3fff11d2" while PKG_VERSION
is 1.6.1965, so the generic probe never matches and fails the package
for not providing the version. As the only executable in the package it
takes the whole run down; the presence check was already there for that
reason, it just could not suppress the probe from test.sh. Record that
in the file: the format mismatch is not evident from the code.
Give libopenzwave and openzwave-config arms of their own as well, so
that an unknown sub-package fails loudly instead of falling off the end
of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
The script only asserts that the binary is present, because domoticz
reports no version; say so in the file, so that a later reader does not
'fix' the override by adding a version probe.
Add a default arm as well, so that an unknown sub-package fails loudly
instead of falling off the end of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
While moving it, assert the version where it can be asserted. The
package installs attr, getfattr and setfattr, and the latter two do
implement --version:
printf("%s " VERSION "\\n", progname);
so only attr itself needs the presence check; its getopt string is
"s:V:g:r:lqLRS", where -V takes a value rather than printing a version.
The greps carry an explicit || exit 1: the harness uses only the exit
status of the whole script, so without it a failed match would be
discarded by the [ -x ] that ends the arm and the assertion would never
report anything.
Give libattr an arm of its own as well, so that an unknown sub-package
fails loudly instead of falling off the end of the case and returning 0.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
btrfs-progs have a no-mold flag since 2025. With latest mold 2.42.0
released a few days ago, the changes from #26541 can be reverted as
btrfs-progs compiles fine with mold.
Signed-off-by: Carsten Schuette <schuettecarsten@googlemail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Set PKG_SUBDIRS in the package Makefile instead of patching Makefile.in
to exclude doc, tests, and gnulib-tests.
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Brings the client in line with the fixes merged into the Go client: --json and
--csv end with a newline, --debug names the address each ICMP ping reached and
the spread of the samples, and the User-Agent carries the operating system and
architecture. Also tolerates a backend that answers getIP.php with an empty
rawIspInfo, which previously discarded the whole response.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
001-disable-doc.patch dropped the doc subdir (which needs makeinfo) from
SUBDIRS in Makefile.in. Use PKG_SUBDIRS:=lib bc dc, OpenWrt's wired-in knob
for restricting the build, to skip doc without patching.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Carry fixes for a data race, a goroutine leak, output escaping, JSON and CSV
termination, and sub-millisecond ping precision, plus additional --debug
output. All patches are under review upstream.
Set the version through GO_PKG_LDFLAGS_X. The package never passed one, so
--version reported neither a name nor a version.
Drop the serverIdx patch: 1.0.13 resolves the same problem by checking the map
lookup rather than reading a possibly absent key.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Rust port of librespeed-cli for 32-bit PowerPC targets not supported by
the Go implementation, such as CZ.NIC Turris 1.x.
The CLI output of --list and --csv-header matches the Go client, so it
can be used as a drop-in replacement. Both implementations install
/usr/bin/librespeed-cli and therefore PROVIDES/CONFLICTS are set
accordingly.
Use libopenssl instead of rustls' ring backend, which has significantly
better AES-GCM performance on big-endian PowerPC.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Create a dedicated 'gpsd' system user at package-install time (via
USERID) and pin gpsd's built-in privilege-separation identity to it
via the SConstruct 'gpsd_user' option.
Background: gpsd needs to start as root to open the underlying tty /
serial device but then internally setuid()s to a configured
unprivileged identity for the rest of its lifetime -- a built-in
privilege-separation feature of the daemon.
The current package leaves 'gpsd_user' at scons' default 'nobody'.
Sharing 'nobody' across daemons is a hardening anti-pattern:
a compromise of any one 'nobody'-owned process can trivially
interfere with any other, and audit trails become ambiguous.
Group choice: gpsd_group is a device-access knob rather than an
identity knob -- once gpsd has setuid()d away from root it still
needs to open() tty / serial nodes, which OpenWrt exposes as
root:dialout mode 0660 (see procd hotplug.json and base-files
/etc/group). What actually keeps that access working post-drop is
the setgid() target that gpsd_group selects: gpsd calls
setgroups(0, NULL) immediately before dropping privileges, so any
supplementary groups on the target user are discarded and cannot
carry the permission.
scons' gpsd_group default is not 'nobody' but 'dialout' (uucp on
Gentoo build hosts), so on OpenWrt buildbots the daemon already
lands in 'dialout' today. Pin gpsd_group=dialout explicitly so the
resulting binary no longer depends on the builder's /etc/gentoo-release:
a Gentoo builder would otherwise bake in 'uucp', a group base-files
does not ship, and gpsd's getgrnam() fallback silently keeps root's
gid in that case.
USERID's third field ('dialout=20') still adds the gpsd user to the
dialout group in /etc/group. This does not affect the running
daemon (setgroups() strips it) but matches Debian's gpsd packaging
and lets an operator run gpsdctl / gpsmon as 'gpsd' by hand against
device nodes. GID 20 is the value already frozen into base-files.
Giving gpsd its own primary user:
* confines a hypothetical gpsd RCE (there have been NMEA / UBX
parsing bugs historically) to files owned by 'gpsd' rather than
to the shared 'nobody' identity;
* matches the long-standing Debian gpsd packaging convention
(adduser --system gpsd, member of dialout);
* is a no-op for correctly-configured installations that never
referenced 'nobody' as an intentional identity.
No numeric UID is pinned for the primary 'gpsd' user -- dynamic
assignment via USERID is sufficient here since no cross-distro
NFS/sudoers-style muscle memory depends on a specific number.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
The package ships checksec.bash, which upstream has discontinued. When
asked about the version the script reports, upstream answered that the
bash implementation is legacy, will be removed entirely in an upcoming
release and has been rewritten in Go:
https://github.com/slimm609/checksec.sh/issues/352
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Update to the latest upstream stable release and add a functional
test.sh that pipes a small text stream and a 256 KiB binary stream
through pv, checking both arrive unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add a Build/InstallDev so libapparmor's header (sys/apparmor.h), the
libapparmor.so link and the pkg-config file are copied into the staging
directory. Without this, packages cannot build against libapparmor even
though the runtime shared library is provided; e.g. stress-ng's AppArmor
stressors fall back to "built without sys/apparmor.h".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
manage volume state over ubus instead of the rootfs
Rework the volume lifecycle around blockd's ubus API, so volume state
lives entirely on the self-describing LVM/UBI backing store and never
leaks into the firmware rootfs.
- register active volumes with blockd over ubus (mount.uc) instead of
spooling mounts into /etc/config/fstab (uci.uc)
- bootstrap .meta from 'uvol boot' and drop the broken 90-uvol-init
uci-default
- run 'uvol boot' straight from the mount.ready trigger, and query
'ubus call block status' at service start to cover storage already
being ready
- defer removal of a volume whose backing device is still held, and
reap it from the mount.umount trigger once it is free
- enforce content-addressed "<algo>-<hexdigest>" volumes in the
dispatcher: reuse an existing volume of the same digest, verify
every write
- verify a content-addressed write in place while the volume is still
incomplete, reporting EBADMSG on mismatch instead of flipping
volume state
- purge incomplete wo/wp leftovers on boot and reclaim an exactly
matching one on create
- serialise mutating commands with a device-wide lock, plus a
per-volume lock ordered after it so a slow write cannot stall other
volumes
- add a grow-only 'resize' verb to both backends: lvextend plus the
matching fs-grow tool for lvm, ubirsvol for ubi
- create ext4 volumes with a journal (was ext2) and request check_fs
when registering a read-write volume
- declare read-only mounts to blockd rather than letting block guess
from the filesystem
- reject non-numeric and non-positive sizes in create and resize
- report its own version
- simplify command line parsing (drop compatibility with ancient ucode)
Requires the matching fstools changes from
openwrt/openwrt@9b11fa4088.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Replace the 'Public-Domain' not SPDX valid license identifier with the
valied SPDX 'Unlicense' indentifiert.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The value 'Public-Domain' is not a correct SPDX identifier so remove
them. In addition, the SPDX license GPL-2.0 is still missing, which is
hereby corrected.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Updated procs package to 0.14.12
Updated procs.toml (config file) to match default config file from upstream
Signed-off-by: Facundo Acevedo <facevedo@disroot.org>
Daniel Golle
Jeffery To
Maxim Storchak
Javier Marcet
Josef Schlehofer
Carsten Schuette
Wei-Ting Yang
Alexandru Ardelean
Niklas Thorild
George Sapkin
Michael Pfeifroth
Andy Chiang
Rosen Penev
Hannu Nyman
Lukas Voegl
Facundo Acevedo
Florian Eckert