libcamera is a userspace camera stack with pipeline handlers for ISPs
and image sources, and image processing algorithms that run in loadable
IPA modules. Package the library, the libcamerasrc GStreamer element,
the V4L2 compatibility layer with libcamerify, the cam tool and one
package per IPA module with its tuning data (IPU3, Mali-C55, rkisp1,
rkisp2, Raspberry Pi VC4 and the software ISP) as separate packages.
All pipeline handlers except the Raspberry Pi PiSP, which needs libpisp,
and the vimc and virtual test handlers are built. Devices are enumerated
through libudev-zero.
The package carries patches in three groups, by number:
- 001-067: backports from libcamera master that the rkisp2 pipeline
handler builds on, among them the V4L2Stats, AwbAlgorithm,
CcmAlgorithm and LscAlgorithm rework of libipa and the DelayedControls
changes;
- 100-119: the rkisp2 pipeline handler and IPA of Paul Elder, which are
still under review;
- 200-215: a build option to leave IPA modules unsigned, fixes for the
rkisp2 pipeline handler, the IPA proxy, the GStreamer element and the
AGC, and the support for the RV1126 with the IMX415.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The libcamera Mojom parser imports PLY directly. Restore the package for
host builds so libcamera can declare it as a build dependency instead
of installing it through pip.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
- speed up the label reversal
- merge the feeds without the large sort buffer
- lower memory and cpu usage in the feed processing
- multiple, small fixes
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
This fixes:
- CVE-2025-1218
- CVE-2025-14181
- CVE-2026-17543
- CVE-2026-17544
- CVE-2026-17545
- CVE-2026-7260
- CVE-2026-9672
- CVE-2026-91765
- CVE-2026-91766
- CVE-2026-91767
- CVE-2026-91768
- CVE-2026-91769
- CVE-2026-92842
Upstream changelogs:
https://www.php.net/ChangeLog-8.php#8.4.24https://www.php.net/ChangeLog-8.php#8.4.25https://www.php.net/ChangeLog-8.php#8.4.26
The new patch is required to successfully build riscv64 packages:
the dropped line unconditionally pulls in -latomic, even when
there are no references in the binaries. This would in turn
force us here to model the +libatomic dependency also when
not needed. Upstreaming the patch is on my todo list.
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
weechat-full conflicts with weechat-minimal, so weechat-full can only
be built in if weechat-minimal is not. luci-app-weechat depends on the
virtual weechat and selects the default variant weechat-minimal unless
weechat-full is selected. Together this is a recursive dependency:
PACKAGE_luci-app-weechat depends on PACKAGE_weechat-full
PACKAGE_weechat-full depends on PACKAGE_weechat-minimal
PACKAGE_weechat-minimal is selected by PACKAGE_luci-app-weechat
It also keeps weechat-full out of any image with luci-app-weechat,
because the selected weechat-minimal wins.
Move the conflict to the default variant weechat-minimal. The build
system does the same since openwrt.git commit 6d5c71f748 ("build:
auto-generate CONFLICTS for package variants sharing PROVIDES"), but
only if the other variant does not declare the conflict itself. Keep
it explicit for branches without that commit, like openwrt-25.12.
Reported-by: Hannu Nyman <hannu.nyman@iki.fi>
Suggested-by: Mario Andrés Pérez <mapb_@outlook.com>
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
changelog: https://curl.se/ch/8.23.0.html
curl 8.23.0 removes SMB support, so the obsolete LIBCURL_SMB
and LIBCURL_NO_SMB configuration option and configure argument
are removed.
Signed-off-by: Ivan Pavlov <AuthorReflex@gmail.com>
- use the GNU regex matchers with gawk >= 5.4;
gawk 5.4 switched its default regex engine to MinRX, this
slows down the ip validation a lot (~35x slower)
Signed-off-by: Dirk Brenken <dev@brenken.org>
- use the GNU regex matchers with gawk >= 5.4;
gawk 5.4 switched its default regex engine to MinRX, this
slows down the domain check a lot (~35x slower)
- speed up the tld compression
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
uvol creates /tmp/run/uvol/.meta/apk as the database directory of apk's
uvol layer, but leaves it empty. apk only activates a layer other than
the root one when its world file can be read, so every package built
for that layer is refused as "masked in: layer" until something writes
the file. The container runtime keeps its global state in
/tmp/run/uvol/.meta/uxc, which only container packages ship, so on a
device without any of them that state cannot be stored.
Create an empty world file and the uxc directory when they are missing,
whenever .meta is created or adopted at boot.
uvol up on an LVM volume that is already active and registered with
blockd registers it again. blockd answers each registration with a
mount.add notification, so a consumer that brings volumes up from a
mount.add trigger, such as the container runtime, triggers itself again
without end. Return success for such a volume without registering it,
as the UBI backend already does for an active volume.
Fixes: 6772c0fe44 ("uvol: clean up paths and fix delayed startup")
Fixes: cb60600aec ("uvol: bump version to 1.1")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Add a service definition for the netcup CloudDNS DynDNS API
(https://customercontrolpanel.de/wsDynDns.php). Domains migrated to
CloudDNS cannot be updated through the legacy CCP API used by the
netcup.com service anymore.
option username not used, can be anything
option password API key (CCP "API-Keys", not a Legacy API key)
option domain FQDN
Bump PKG_RELEASE.
Signed-off-by: Dieter Softwaresonnenschein <dieter.softwaresonnenschein@proton.me>
- remove raw feed download files after preparation
- pack multiple domains per dnsmasq 'local=' line
- log which (custom) feed file will be used
- readme update
Signed-off-by: Dirk Brenken <dev@brenken.org>
- faster IPv4 validation in f_chkip (~2-3 × faster)
- avoid full nft element fetches in the following functions:
f_actual, f_down (reload & count) and f_search
Signed-off-by: Dirk Brenken <dev@brenken.org>
- f_chkdom validates domains with a single anchored regex instead
of a per-label loop (~2.5× faster)
- f_tld merges compression and allowlist removal into one pass (~2× faster)
Signed-off-by: Dirk Brenken <dev@brenken.org>
This PR updates DNSdist to the latest release on the 2.1.x
branch, 2.1.3, including various bug fixes but no security
issues.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
A client asks again when the TTL of an answer runs out, and the write
for the new answer reaches the kernel up to one write interval later.
With the element timed out to the second it is missing for exactly
that gap, and a connection opened in it starts on the normal uplink
and keeps that path for its lifetime.
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
The auth syslog block only logs ike, cfg, asn and tls. chd, enc and esp
are not logged there any more; they are only part of the daemon block.
Also change how the levels are written to the charon syslog config:
- config_get now defaults every level to "0" instead of an empty string.
- All levels are always written out. The '[ "$x" = "" ] ||' guards are
removed, so an unset option results in an explicit level 0 instead of
no line at all.
Tidy up the code in config_charon_plugin_syslog():
- Move the cfg, asn and tls declarations and config_get calls from the
daemon section to the auth section.
- Sort the local variables, config_get calls and swan_xappend3 calls
alphabetically in both sections.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Add option 'aggressive' to the globals section of /etc/config/ipsec.
When enabled, the charon setting
'i_dont_care_about_security_and_use_aggressive_mode_psk = yes' is
written to the generated strongswan.conf. The setting is only
emitted when the option is active.
IKEv1 aggressive mode with PSK is sometimes required to interoperate
with old peers that do not support main mode with PSK.
If enabled, IKE Responders are allowed to use IKEv1 Aggressive Mode with
Pre-Shared Keys (PSKs). This is strongly discouraged due to security
concerns (offline attacks on the openly transmitted hash of the PSK).
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Rename the per-option charon config helpers in swanctl.init to carry
a "common" infix (scripts, interfaces_use, ignore_routing_tables,
install_routes) and call them from a new config_charon_common()
wrapper. config_strongswan_generate() now calls only the wrapper.
This is purely a refactoring to add additional configuration parameters
for general charon options that are not loaded by a plugin.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The syslog daemon and auth facilities both use default = 0, so a group
configured for one facility was also logged by the other, producing
duplicate messages.
Set groups that are configured for daemon (dmn, mgr, job, cfg, knl,
net, asn, lib, tls, tnc, imc, imv, pts, app, wch) to -1 in auth, and
groups configured for auth (ike, chd, enc, esp) to -1 in daemon.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The proposals (IKE_SA) and esp_proposals (CHILD_SA) settings in
swanctl.conf do not have to be configured explicitly. If omitted,
charon falls back to its default proposals:
- IKE: the default proposals include all algorithms supported by the
loaded plugins that are not considered insecure.
- ESP: the default proposals are hard-coded, as the kernel can't be
queried for its supported algorithms. They include the supported
key exchange methods as well as "none", which makes PFS optional.
The default ESP proposal is only used if neither ah_proposals nor
esp_proposals are configured for a CHILD_SA.
Update the config to reflect that both options are optional.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
With peers that support multiple IKEv2 key exchanges (RFC 9370), up
to seven additional key exchanges may be negotiated. strongSwan
configures them by prefixing the algorithm keyword with keX_ (X being
1..7), e.g. 'x25519-ke1_mlkem768'.
The 'dh_group' option only allows a single key exchange method. Add a
'ke' list option to the crypto_proposal sections, which holds the
additional key exchange methods. Both config_ike_proposal() and
config_esp_proposal() append them to the generated proposal after
dh_group, so 'x25519' plus 'list ke mlkem768' results in
'x25519-ke1_mlkem768'.
The keN_ prefix is generated by the init script from the position of
the entry in the list. Entries which already carry a keN_ prefix are
used verbatim with a warning, which keeps keX_none (used to make a
key exchange round optional) working. Entries beyond the seventh are
dropped with a warning. A warning is also emitted if key exchange
methods are configured without a dh_group, since the first key
exchange method is mandatory.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
- new client selector src_dev: everything arriving on an ingress
device, in both address families - a whole guest network or VLAN,
independent of a changing IPv6 prefix; prerouting only, like src_mac
- new destination selector dst_file: address and prefix lists from a
file, read like domain_file and refilled atomically by
`shunt refresh`; domain_file.uc becomes list_file.uc for both kinds
- dport/proto alone now select traffic as documented, instead of
rejecting the policy as "selects nothing"
- a policy whose dst entries are all unusable is skipped instead of
being widened to every destination of its clients
- client and static destination sets use auto-merge, so overlapping
prefixes no longer fail the whole ruleset with "conflicting
intervals"
- update the README
Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: Dirk Brenken <dev@brenken.org>
Some of these are obsolete. Others like CTS make no sense for IPSec.
Others are already selected by others. Simplify the list.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
e500 cores trap on dcbzl, maclhw and mullhw, but configure enables
dcbzl for --cpu=8548, and ppc4xx too with CONFIG_USE_LTO, so ffmpeg
dies with SIGILL (seen on a Turris 1.1). Pass --disable-dcbzl and
--disable-ppc4xx for 8540 and 8548 and make configure honour them.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Maintainer: Rob White rob@blue-wave.net
Compile tested: All
Run tested: OpenWrt master/snapshot.
Description: mesh11sd (7.3.1)
This is a bugfix release.
Numerous bugs were fixed, including correct handling of legacy swconfig
devices, introduction of the loop_interval_delta config option to reduce
overload hang-ups on legacy devices with slow clock rates, and improved
watchdog functionality allowing better autonomous critical error recovery.
The full changelog can be seen here:
https://github.com/openNDS/mesh11sd/blob/7.3.1/ChangeLog
Signed-off-by: Rob White <rob@blue-wave.net>
1.32 declares a tomlkit dependency, which the host build rejects as
unmet. It is only reached by the "hatchling version" CLI, not by the
PEP 517 backend the feed uses, so patch it out rather than package
tomlkit for an unreachable code path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Maxim Storchak
Dirk Brenken
Josef Schlehofer
Daniel Golle
Jon Henrik Bjørnstad
Michael Heimpold
Ivan Pavlov
Ray Wang
Dieter Softwaresonnenschein
Tianling Shen
Javier Marcet
George Sapkin
Remi Gacogne
Niklas Thorild
Andy Chiang
Jean Thomas
Florian Eckert
Rosen Penev
Rob White
Sandro Jäckel
Alexandru Ardelean