The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 5264f85e22)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
None of the selinux-python tools print the package version, so the
generic version check fails for all of them.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 17283f7e83)
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9274fde0ba)
[take the new file, openwrt-25.12 does not have the package list from 9d69e4fa2]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Move existing version checks into override and add explicit package checks.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit b5d3a38e45)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The generic package version check invokes ksmbd.tools directly, but the
multicall binary rejects that basename and fails the test.
Check the version through ksmbd.mountd and skip subpackages without
versioned executables.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 4ce49b0a9d)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 7cb0c183a9)
alsa-lib ships only a shared library and aserver has no --version, so
neither can satisfy the generic version probe. Add a test-version.sh
that exits 0 for both arms and exits 1 for unknown subpackages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit c9f4980023)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Override generic version checks to skip them altogether because none of the
tools report their versions.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 3a41106cdc)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
aserver does not implement --version so the generic CI version check
fails for it. Add a test.sh case that verifies it is present and
executable instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 0f34c18d65)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Several bluez utilities do not implement --version so the generic CI
version check fails for them. Add test.sh cases that verify the
binaries are present and executable instead.
bluez-daemon: obexd
bluez-utils: bdaddr, ciptool, hciattach, hciconfig, l2ping, l2test, rctest
bluez-utils-extra: gatttool
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 3298822f8d)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This commit updates the PowerDNS authoritative server to 4.9.17,
the latest release in the 4.9.x LTS branch.
This fixes several security issues, including but not limited to:
CVE-2026-33257, CVE-2026-33260, CVE-2026-33611, CVE-2026-33610,
CVE-2026-33609, CVE-2026-33608, CVE-2026-42002, CVE-2026-42001,
CVE-2026-42000, CVE-2026-41999, CVE-2026-42396, CVE-2026-42005,
CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 259eb5fc32)
This commit updates PowerDNS Recursor to 5.2.13, the latest release
on the 5.2.x LTS branch.
This includes security fixes for the following issues and more:
CVE-2026-24027, CVE-2026-0398, CVE-2026-33256, CVE-2026-33257,
CVE-2026-33258, CVE-2026-33259, CVE-2026-33260, CVE-2026-33261,
CVE-2026-33262, CVE-2026-33601, CVE-2026-33600, CVE-2026-33612,
CVE-2026-40012, CVE-2026-42005, CVE-2026-42390, CVE-2026-42389,
CVE-2026-42388, CVE-2026-42387, CVE-2026-52690, CVE-2026-52688,
CVE-2026-52686, CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 5867544afd)
Support configuring major version series as host-only (i.e. no target
packages) to reduce strain on buildbots in release branches. The goal is to
have one major target series and multiple host-only ones. E.g. 25.12 uses
1.26 as the default host/target series and 1.27 and beyond as host-only for
packages that require these.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 4335f00bdd)
Fix stripping when using previous version as a bootstrap.
Fixes: 5657eb0e2 ("golang: split src into separate packages")
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 591422e869)
Security release:
- Proxy protocol: fix an out-of-bounds read in V1 header parsing
(GCVE-25-2026-09-50-1).
- Proxy protocol: do not use uninitialised data as the length of an
incompletely received V2 header (GCVE-25-2026-09-55-1).
- GnuTLS: fix a use-after-free when a client closes the connection
during session startup (GCVE-25-2026-09-51-1).
- Block more SMTP smuggling variants, extending the fixes for
CVE-2023-51766 (GCVE-25-2026-09-56-1).
All patches apply without changes.
Link: https://code.exim.org/exim/exim/src/tag/exim-4.100.1/doc/doc-txt/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ce188c6505)
downloads.exim.org keeps only the current release in exim4/ and moves
older tarballs to exim4/old/. Since 4.100.1 came out, the download of
4.100 from the primary URL fails with 404 and only works through the
OpenWrt mirror.
Add exim4/old/ as a second source URL.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a983abe730)
xsltproc doesn't say it's own version but only dependcies it compiled on
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 14d197418d)
dyndns.variomedia.de no longer accepts connections on port 80, so updates
fail unless the user enabled the use_https option. The HTTPS endpoint
works and answers with the usual dyndns2 status codes.
Switch both update URLs to HTTPS.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 0f85be35c6)
Remove the definitions of DDNS providers whose update endpoints no longer
work:
- system-ns.com: the domain now serves an unrelated online gambling site.
Keeping the entry would send the update token to a third party.
- xlhost.de: the domain has been a web hosting comparison site since 2017
and nsupdate.xlhost.de/nic/update returns 404.
- domopoli.de: the host does not answer on port 80 or 443. The update URL
also contains the scheme twice (http://[USERNAME]:[PASSWORD]@http://...),
so it could never have worked with ddns-scripts.
Drop their JSON files and their entries from the provider list.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 019ce1b87c)
Fix the netcup DDNS updater when comparing an existing
IPv6 record to the current address.
The previous logic relied on REGISTERED_IP and required it
to be set, but that value is not always available or reliable for
IPv6 records. As a result, the updater could wrongly skip or
fail to update AAAA entries.
This change:
- Removes the hard dependency on REGISTERED_IP
- Compares record type and hostname before evaluating the IP
- Normalizes IPv6 addresses before comparison
- Exits early when no update is required
Fixes#30387
Signed-off-by: Martin Brodbeck <martin@brodbeck-online.de>
(cherry picked from commit 55a465f358)
- Remove DDNS provider definitions for discontinued services:
DNSDynamic
DNSMax
DNS Park
Google Domains
ThatIP
TwoDNS
- None of these services can be used for DDNS updates anymore. Remove their
provider definitions and entries from the provider list to avoid exposing
obsolete and non-functional configurations.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 49f3441ee5)
To handle ip address changing by ifupdate.
When the ipv6 address is updated for an interface
(some ISP only give dynamic ipv6 address).
The ddns script will go into dead loop,
as the new ipv6 address is not used.
The simple change is restarting ddns when ip address is changed.
Signed-off-by: Jimmy Qin <sunnyqeen@gmail.com>
(cherry picked from commit 889e134007)
Gandi has deprecated Api Key for authentication and replaced it with
Personal Access Tokens. This adds a v2 gandi package containing a script
using the new authentication scheme while keeping the old version intact
for any existing API Key users. Additionally, it documents the old
version as deprecated and points users to v2.
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
(cherry picked from commit 413aa843b0)
The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps
DATE_PROG="date +'$ddns_dateformat'"
...
write_log 5 "PID '$$' started at $(eval $DATE_PROG)"
and for the "last update" timestamp in the updater
EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'"
write_log 7 "last update: $(eval $EPOCH_TIME)"
The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set
ddns_dateformat="%F'; touch /tmp/pwned; '"
and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.
Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.
luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.
Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house)
Fixes: 1c20dcb71a ("ddns-scripts: update to 2.7.6-1")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7364629d70)
Bump PKG_VERSION for the ddns-scripts changes and reset PKG_RELEASE to
1 as requested.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 774c01bcba)
Add the missing spaces around the test bracket in the one.com
pre-removal script and escape IPKG_INSTROOT consistently with the other
subpackages.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 3aca374056)
The /usr/bin/ddns frontend did not support a version option, so
generic package tests treated it as an executable that could not report
the package version.
Read the installed version file and support -V/--version, matching the
version output style used by dynamic_dns_updater.sh.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 37c99fc548)
Keep the existing cURL bind_network behavior of binding to the
logical device first. This preserves the behavior introduced for
PPPoE and multi-WAN setups where the selected network must also be
used for the DDNS update request.
Some setups can still fail when libcurl binds directly to the logical
PPP device. In that case the transfer may time out even though binding
to the source address of the same network succeeds. This can make DDNS
updates fail repeatedly on affected systems.
Retry cURL transfers once with the network source IP when the
device-bound transfer fails. This leaves the normal path unchanged,
keeps the update request on the same network, and matches the existing
GNU Wget behavior which already binds to the network IP address.
Also document the implicit bind_network default and the cURL fallback
in the sample configuration.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 9a5e6063f1)
None of the ddns-scripts executables or scripts report the package version when
run, which causes the generic version probe to fail.
Add a test-version.sh to skip the version check for ddns-scripts and all of
its subpackages.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ed32ce42d2)
In luci, the `interface` value has `o.default = 'wan'` configured.
Due to a behavior fix in 'o.default', values matching the default are
no longer saved. Currently, this is workedaround by disabling
'o.rmempty' in luci, but handling this compatibility fallback on the
backend is a cleaner and superior approach.
Ref: https://github.com/openwrt/luci/commit/b004197a277804ec0c8f092412b91c1d3e5936fa
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
(cherry picked from commit de4f8fe9e3)
When fetching the IP via a URL with `force_ipversion` enabled,
a `Busybox nslookup - no support to 'force IP Version' (ignored)`
log is generated periodically. This log is redundant, in this scenario
`force_ipversion` only affects the results fetched by wget/uclient-fetch/curl.
It is perfectly fine for nslookup to query both A/AAAA records simultaneously.
Signed-off-by: Andy Chiang <AndyChiang_git@outlook.com>
(cherry picked from commit 52b5b8e655)
Add DDNS update support for blazingfast.io Anycast DNS via their
REST API. Authentication is performed via JWT token obtained from
the login endpoint. Zone records are fetched to verify the record
type before update, ensuring IPv4 services only target A records
and IPv6 services only target AAAA records.
Service, zone and record IDs are passed via param_opt as
space-separated key=value pairs:
service_id=X zone_id=Y record_id=Z
curl --config file approach is used throughout to avoid eval and
shell injection from user-controlled values. Supports both IPv4
and IPv6. For dual-stack, create two separate DDNS service sections
with their respective record IDs.
Tested on GL.iNet MT5000 (Brume 3) running OpenWrt with
ddns-scripts 2.8.2.
Signed-off-by: Fotios Kitsantas <fkitsantas@icloud.com>
(cherry picked from commit 288f220aa3)
Alexandru Ardelean
Josef Schlehofer
George Sapkin
Andrea Pesaresi
Moritz Warning
Fabrice Fontaine
Mai Thanh Minh
Vladimir Ulrich
Niklas Thorild
Remi Gacogne
Ivan Pavlov
Seo Suchan
Martin Brodbeck
Jimmy Qin
Keith T. Garner
Hauke Mehrtens
Jiang Tengfei
Angus Young
Andy Chiang
Fotios Kitsantas