In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Set PKG_SUBDIRS in the package Makefile instead of patching Makefile.in
to exclude doc, tests, and gnulib-tests.
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Brings the client in line with the fixes merged into the Go client: --json and
--csv end with a newline, --debug names the address each ICMP ping reached and
the spread of the samples, and the User-Agent carries the operating system and
architecture. Also tolerates a backend that answers getIP.php with an empty
rawIspInfo, which previously discarded the whole response.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
001-disable-doc.patch dropped the doc subdir (which needs makeinfo) from
SUBDIRS in Makefile.in. Use PKG_SUBDIRS:=lib bc dc, OpenWrt's wired-in knob
for restricting the build, to skip doc without patching.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Carry fixes for a data race, a goroutine leak, output escaping, JSON and CSV
termination, and sub-millisecond ping precision, plus additional --debug
output. All patches are under review upstream.
Set the version through GO_PKG_LDFLAGS_X. The package never passed one, so
--version reported neither a name nor a version.
Drop the serverIdx patch: 1.0.13 resolves the same problem by checking the map
lookup rather than reading a possibly absent key.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Rust port of librespeed-cli for 32-bit PowerPC targets not supported by
the Go implementation, such as CZ.NIC Turris 1.x.
The CLI output of --list and --csv-header matches the Go client, so it
can be used as a drop-in replacement. Both implementations install
/usr/bin/librespeed-cli and therefore PROVIDES/CONFLICTS are set
accordingly.
Use libopenssl instead of rustls' ring backend, which has significantly
better AES-GCM performance on big-endian PowerPC.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Create a dedicated 'gpsd' system user at package-install time (via
USERID) and pin gpsd's built-in privilege-separation identity to it
via the SConstruct 'gpsd_user' option.
Background: gpsd needs to start as root to open the underlying tty /
serial device but then internally setuid()s to a configured
unprivileged identity for the rest of its lifetime -- a built-in
privilege-separation feature of the daemon.
The current package leaves 'gpsd_user' at scons' default 'nobody'.
Sharing 'nobody' across daemons is a hardening anti-pattern:
a compromise of any one 'nobody'-owned process can trivially
interfere with any other, and audit trails become ambiguous.
Group choice: gpsd_group is a device-access knob rather than an
identity knob -- once gpsd has setuid()d away from root it still
needs to open() tty / serial nodes, which OpenWrt exposes as
root:dialout mode 0660 (see procd hotplug.json and base-files
/etc/group). What actually keeps that access working post-drop is
the setgid() target that gpsd_group selects: gpsd calls
setgroups(0, NULL) immediately before dropping privileges, so any
supplementary groups on the target user are discarded and cannot
carry the permission.
scons' gpsd_group default is not 'nobody' but 'dialout' (uucp on
Gentoo build hosts), so on OpenWrt buildbots the daemon already
lands in 'dialout' today. Pin gpsd_group=dialout explicitly so the
resulting binary no longer depends on the builder's /etc/gentoo-release:
a Gentoo builder would otherwise bake in 'uucp', a group base-files
does not ship, and gpsd's getgrnam() fallback silently keeps root's
gid in that case.
USERID's third field ('dialout=20') still adds the gpsd user to the
dialout group in /etc/group. This does not affect the running
daemon (setgroups() strips it) but matches Debian's gpsd packaging
and lets an operator run gpsdctl / gpsmon as 'gpsd' by hand against
device nodes. GID 20 is the value already frozen into base-files.
Giving gpsd its own primary user:
* confines a hypothetical gpsd RCE (there have been NMEA / UBX
parsing bugs historically) to files owned by 'gpsd' rather than
to the shared 'nobody' identity;
* matches the long-standing Debian gpsd packaging convention
(adduser --system gpsd, member of dialout);
* is a no-op for correctly-configured installations that never
referenced 'nobody' as an intentional identity.
No numeric UID is pinned for the primary 'gpsd' user -- dynamic
assignment via USERID is sufficient here since no cross-distro
NFS/sudoers-style muscle memory depends on a specific number.
Bump PKG_RELEASE.
Signed-off-by: Michael Pfeifroth <micpf@westermo.com>
The package ships checksec.bash, which upstream has discontinued. When
asked about the version the script reports, upstream answered that the
bash implementation is legacy, will be removed entirely in an upcoming
release and has been rewritten in Go:
https://github.com/slimm609/checksec.sh/issues/352
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Update to the latest upstream stable release and add a functional
test.sh that pipes a small text stream and a 256 KiB binary stream
through pv, checking both arrive unchanged.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add a Build/InstallDev so libapparmor's header (sys/apparmor.h), the
libapparmor.so link and the pkg-config file are copied into the staging
directory. Without this, packages cannot build against libapparmor even
though the runtime shared library is provided; e.g. stress-ng's AppArmor
stressors fall back to "built without sys/apparmor.h".
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
manage volume state over ubus instead of the rootfs
Rework the volume lifecycle around blockd's ubus API, so volume state
lives entirely on the self-describing LVM/UBI backing store and never
leaks into the firmware rootfs.
- register active volumes with blockd over ubus (mount.uc) instead of
spooling mounts into /etc/config/fstab (uci.uc)
- bootstrap .meta from 'uvol boot' and drop the broken 90-uvol-init
uci-default
- run 'uvol boot' straight from the mount.ready trigger, and query
'ubus call block status' at service start to cover storage already
being ready
- defer removal of a volume whose backing device is still held, and
reap it from the mount.umount trigger once it is free
- enforce content-addressed "<algo>-<hexdigest>" volumes in the
dispatcher: reuse an existing volume of the same digest, verify
every write
- verify a content-addressed write in place while the volume is still
incomplete, reporting EBADMSG on mismatch instead of flipping
volume state
- purge incomplete wo/wp leftovers on boot and reclaim an exactly
matching one on create
- serialise mutating commands with a device-wide lock, plus a
per-volume lock ordered after it so a slow write cannot stall other
volumes
- add a grow-only 'resize' verb to both backends: lvextend plus the
matching fs-grow tool for lvm, ubirsvol for ubi
- create ext4 volumes with a journal (was ext2) and request check_fs
when registering a read-write volume
- declare read-only mounts to blockd rather than letting block guess
from the filesystem
- reject non-numeric and non-positive sizes in create and resize
- report its own version
- simplify command line parsing (drop compatibility with ancient ucode)
Requires the matching fstools changes from
openwrt/openwrt@9b11fa4088.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Replace the 'Public-Domain' not SPDX valid license identifier with the
valied SPDX 'Unlicense' indentifiert.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The value 'Public-Domain' is not a correct SPDX identifier so remove
them. In addition, the SPDX license GPL-2.0 is still missing, which is
hereby corrected.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Updated procs package to 0.14.12
Updated procs.toml (config file) to match default config file from upstream
Signed-off-by: Facundo Acevedo <facevedo@disroot.org>
The devlink plugin allows updating firmware of network devices
implementing the kernel devlink interface. It is gated on libmnl,
which was hard-disabled so far. Wire the libmnl meson option to a
new FWUPD_PLUGIN_DEVLINK config symbol, enabled by default, and add
the corresponding libmnl runtime dependency to fwupd-libs.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Backport upstream e0c4d324a, which lets a LIB_* variable be emptied to skip
that library's check. Drop 001-disable-extra-stressors.patch, which hardcoded
the same choice, and drive it from a Config.in menu instead. Defaults keep the
previously built set of stressors: only crypt, aio, bsd, jpeg, kmod, sctp and
zlib are probed. apparmor, EGL, GBM, GLES2, IPSec_MB and Judy have no OpenWrt
package, so they are never probed. Drop the backport once it is in a release.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Drop 002-disable-atomics-mips-and-ppc.patch. It papered over link errors for
64-bit atomics on MIPS and PPC, which happen because stress-ng strips -latomic
whenever $(CC) matches "musl-gcc" -- as our cross toolchains do. Pass
LIB_ATOMIC=-latomic instead; libatomic is already in DEPENDS. Its stress-fractal
hunk was in any case dead since upstream 24c30b7fa narrowed the row counter back
to int32_t, which MIPS32 and PPC32 increment atomically inline.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
OpenWrt's .config support declaring qemu-* packages as part of the
Rockchip devices OpenWrt images.
Maintainer: @yousong
Compile tested: snapshot
Run tested: NanoPi R4S
Signed-off-by: David Andreoletti <david.andreoletti.dev@gmail.com>
Both patches still apply unchanged and remain necessary: upstream's library
list is unchanged, and stress-misaligned.c still only disables atomics on PPC
for gcc < 5.0 while stress-fractal.c has no arch guard at all.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
List Daniel F. Dickinson and Dharmik Parmar as watchcat maintainers.
This gives future package issues and reviews active contacts.
Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com>
Josef Schlehofer
Wei-Ting Yang
Alexandru Ardelean
Niklas Thorild
George Sapkin
Michael Pfeifroth
Andy Chiang
Rosen Penev
Hannu Nyman
Lukas Voegl
Facundo Acevedo
Daniel Golle
Florian Eckert
Ismail Kundakci
John Audia
Fabrice Fontaine
Vladimir Ulrich
Eric Fahlgren
nantayo dev
Joshua Covington
David Andreoletti
Fabian Lipken
Javier Marcet
Dharmik Parmar