- Fix loop in subshells calling wait builtin with inherited job list
- Fix mapfile problem when callback unsets the variable it is modifying
- Fix subshells inappropriately running the EXIT trap if they receive a
fatal signal before resetting traps
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
(cherry picked from commit 3085718815)
rust/host fails to compile on macOS running on Intel x64
because the host target triple is autogenerated to be
'arm64-unknown-linux-'. Rust doesn't have such a target triple, thus the
build fails because there are no pre-built artefacts for bootstrapping.
Fix this by setting RUSTC_HOST_ARCH to 'x86_64-apple-darwin' in case
our host is HOST_ARCH=x86_64 and HOST_OS=Darwin.
This fix is based on the existing fix for Apple silicon [1].
Fixes:
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/x.py", line 53, in <module>
bootstrap.main()
~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1418, in main
bootstrap(args)
~~~~~~~~~^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 1366, in bootstrap
build.download_toolchain()
~~~~~~~~~~~~~~~~~~~~~~~~^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 697, in download_toolchain
download_component(download_info)
~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 529, in download_component
get(
~~~^
download_info.base_download_url,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
...<3 lines>...
verbose=download_info.verbose,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
)
^
File "/Volumes/pepe/py/openwrt/build_dir/target-x86_64_musl/host/rustc-1.96.0-src/src/bootstrap/bootstrap.py", line 58, in get
raise RuntimeError(
...<6 lines>...
)
RuntimeError: src/stage0 doesn't contain a checksum for dist/2026-04-16/rust-std-1.95.0-x86_64-unknown-linux-darwin24.6.0.tar.xz. Pre-built artifacts might not be available for this target at this time, see https://doc.rust-lang.org/nightly/rustc/platform-support.html for more information.
[1] https://github.com/openwrt/packages/commit/105fa3920e12f557bdf1fcbc566fc286fb53e319
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
(cherry picked from commit aa32dd256e)
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
Large version jump from 4.8.1 to 4.19.4 (latest upstream LTS).
Build changes:
- Refresh patches/004-fix-su-controoling-term.patch: su.c moved the
ioctl() call from line 1122 to 1169 and changed (char *) 0 to
(char *) NULL; update patch context and re-canonicalise through
quilt (blank context line spacing).
- New CONFIGURE_ARGS:
* --disable-logind: 4.19.4 added an optional libsystemd-based
logind integration which OpenWrt doesn't ship.
* --without-libbsd: shadow's configure now hard-fails on missing
readpassphrase() unless libbsd is found; the in-tree
lib/readpassphrase.c fallback is enabled by --without-libbsd.
* --without-sssd: avoid dragging in an sssd build dep.
* --disable-subordinate-ids: 4.19.4 builds libsubid (subuid/subgid
runtime API) unconditionally when subids are enabled, and its
libtool -export-symbols-regex generates a version script that
binutils 2.40+ rejects against libxcrypt's versioned
crypt_checksalt@@XCRYPT_4.3 symbol. Disabling subordinate-ids
skips libsubid entirely; OpenWrt doesn't ship libsubid.
- Drop newgidmap, newuidmap, lastlog and groups from SHADOW_APPLETS:
newgidmap/newuidmap are only built when subordinate-ids are
enabled, lastlog defaults to disabled in 4.19.4, and the groups
binary was removed from shadow upstream (use coreutils).
Test coverage:
- Replace the per-applet --version check in test.sh with per-applet
functional tests:
pwck -> 'pwck -r' read-only consistency check; accept
non-zero exit since the CI container's /etc/passwd
trips minor warnings.
grpck -> 'grpck -r' read-only consistency check.
chage -> 'chage -l root' lists password aging info.
useradd -> 'useradd -D' dumps defaults without modifying state.
passwd -> 'passwd -S root' prints the password status line.
faillog -> create empty /var/log/faillog then 'faillog -a'
must emit a header line.
login/su -> PAM-interactive; presence covered by generic tests.
Other applets -> verify binary presence (CI's generic tests
already check stripped, no build paths, linked-libs).
- Add test-version.sh as a generic-version-check override: shadow
tools don't honour --version (only --help), so the framework's
probe finds no PKG_VERSION match in any binary and would otherwise
fail Generic tests for every sub-package.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit dc52894904)
- Python3-pysocks was removed as it was not maintained in commit 95fe4bf332 ("python-pysocks: remove outdated and not maintained package")
- Python3-unidecode was removed in commit 09951a9cfd ("python-unidecode: drop unmaintained package"), because there is no official support for Python 3.12 and it is still using setup.py, which is deprecated.
Fixes:
```
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-pysocks', which does not exist
WARNING: Makefile 'package/feeds/packages/onionshare-cli/Makefile' has a dependency on 'python3-unidecode', which does not exist
```
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit c62a85e847)
Install libperl.so with executable permissions (0755) instead of copying
it as-is.
This allows the OpenWrt build system to recognize the library as a binary and
automatically run the "strip" utility on it. Stripping removes unnecessary
debugging metadata and helper symbols that are only needed for development but
not for running Perl on the router.
This change reduces the installed size of libperl.so on the device:
- Before (not stripped): 3.7 MB (3,929,652 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, with debug_info, not stripped
```
- After (stripped): 3.5 MB (3,674,081 bytes)
```
root@turris:~# file /usr/lib/perl5/5.40/CORE/libperl.so
/usr/lib/perl5/5.40/CORE/libperl.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, no section header
```
Saving ~255 KB of flash storage space on target devices.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit b6d2070fc8)
zipmerge and zipcmp prints version on -V,
but ziptool does not offer version number in any output.
Co-authored-by: George Sapkin <george@sapk.in>
Signed-off-by: Michael Heimpold <mhei@heimpold.de>
(cherry picked from commit fa6c9463ad)
Tracing Transmission 4.11 showed the Transmission is started to use
the pwritev2 syscall for better write performance.
Add pwritev2 and preadv2 (which may be used as well, and anyway
doesn't hurt) to the list of allowed syscalls.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 9e84e22a78)
arm926ej-s (ARMv5) does not have native lock-free atomics and the
toolchain inserts calls to libatomic.so.1 for atomic operations.
The libgstreamer1 DEPENDS only listed armeb, powerpc, mips and mipsel
as needing libatomic, missing plain arm (little-endian 32-bit ARM).
Extend the condition to include arm so the package is properly
declared on all 32-bit ARM targets that require libatomic.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 2ac8367f3a)
The build fails on xscale because the dependency to libatomic.so.1 is
missing.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 086dcb2a59)
libtheora's configure probes the host assembler for NEON support
rather than the target CPU, so on pre-ARMv7 (arm926ej-s, etc.) it
falsely succeeds and the build emits NEON the CPU can't execute.
Force --disable-asm only when the ARM target's TARGET_CFLAGS does
not advertise armv7 or armv8, so cortex-a* keeps the NEON path.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 214b265f4a)
The RRL module's kru.inc.c has a `static_assert(ATOMIC_CHAR16_T_LOCK_FREE
== 2, ...)` that breaks the build on any target whose toolchain does
not advertise lock-free 16-bit atomics (e.g. ARMv5 arm926ej-s).
Upstream considers the assertion non-essential and plans to drop it;
they recommended a patch over a Makefile-level RRL disable. Bump
PKG_RELEASE for the patch swap.
Suggested-by: Daniel Salzman <daniel.salzman@nic.cz>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 106acb9774)
Removing the ncursesw path from include avoids seeing the wide-char
version of ncurses, so the host build picks up the narrow static lib
that the OpenWrt SDK stages. To keep that pin from leaking back in
through other curses headers the build host may have under
/usr/include, also force every header check in Python's configure.ac
AC_CHECK_HEADERS(curses.h ncurses.h ncursesw/ncurses.h
ncursesw/curses.h ncursesw/panel.h panel.h) line to "no" via cached
ac_cv_header_* variables.
The narrow ncursesw_* trio was enough on the original reporter's
host; Jan Kardell's review of the first cut hit a build where
`/usr/include/curses.h` and `/usr/include/ncurses.h` from the
distro's libncurses-dev were still being picked up. Adding the
non-wide entries (and panel.h for symmetry, in case a host also
ships /usr/include/panel.h alone) makes the override insensitive to
whichever curses dev packages the host distro happens to provide.
Reported-by: Jan Kardell <jan.kardell@telliq.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit d883c02a41)
Resolves several security issues:
- CVE-2026-3592: Limit resolver server list size.
- CVE-2026-3039: Fix GSS-API resource leak.
- CVE-2026-5950: Avoid unbounded recursion loop.
- CVE-2026-5947: Fix crash in resolver when SIG(0)-signed responses are
received under load.
- CVE-2026-3593: Add system test for HTTP/2 SETTINGS frame flood.
- CVE-2026-5946: Disable recursion, UPDATE, and NOTIFY for non-IN views.
Complete list of changes is available upstream at
https://ftp.isc.org/isc/bind9/9.20.23/doc/arm/html/changelog.html
Signed-off-by: Noah Meyerhans <frodo@morgul.net>
(cherry picked from commit ea421564d333b53b847434aaed2cd4d8a74954f0)
* bugfix: only load the configuration once per run: a new `ban_confload`
guard short-circuits `f_conf()` on subsequent calls, avoiding
repeated `config_load` invocations
* new: the per-set report now sorts elements by their packet counter in
descending order before truncating to the top 50, so the report
shows the most active elements instead of just the first 50 found
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit faeecaeb14)
Refresh the hardware database with the latest USB, PCI and PnP IDs.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 3695f1dae5)
Changes since 2023.4:
* Add automatic signing keys for trixie
* Add Debian Stable Release Key (13/trixie) (ID: 762F67A0B2C39DE4)
* Clean up maintscript removal of ancient archive certificates
* Get rid of team-members/ and signature verification
* Remove buster keys
* Rename keyrings from .gpg to .pgp
* Use OpenPGP instead of GnuPG when referring to the specification
Link: https://salsa.debian.org/release-team/debian-archive-keyring/-/blob/debian/2025.1/debian/changelog
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 211a19f9d1)
Update to latest upstream release.
Highlights of changes since 1.0.128:
* Added support for Debian 13 (trixie)
* Added support for many new Ubuntu releases (jammy through plucky)
* Improvements to keyring handling
* Various bug fixes and cleanups
Drop PKG_REAL_VERSION and the now-redundant PKG_BUILD_DIR override:
upstream and downstream versions match, so use PKG_VERSION directly
in PKG_SOURCE.
Link: https://salsa.debian.org/installer-team/debootstrap/-/blob/1.0.143/debian/changelog
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 254a5b69af)
This software is no longer maintained because upstream
repository has been archived by the owner.
No packages depends on this.
Signed-off-by: Yanase Yuki <dev@zpc.st>
(cherry picked from commit 4045db6ae4)
Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lspci tool. Otherwise this package can not be installed if you also have
enabled lspci from busybox.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit 31b6d1c8c3)
Update from 017 to 019. Version 019 dropped autoconf in favour of meson,
so switch to include/meson.mk and drop PKG_FIXUP:=autoreconf and the
autoconf CONFIGURE_ARGS.
The binary lsusb no longer reads usb.ids directly; it now queries the
udev hardware database. lsusb.py still searches /usr/share/hwdata/usb.ids
for device name resolution.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 1f0bfd80c7)
Use the ALTERNATIVES symlink handling to avoid conflicts with busybox
lsusb tool. Otherwise this package can not be installed if you also have
enabled lsusb from busybox.
Signed-off-by: Martin Schiller <ms@dev.tdt.de>
(cherry picked from commit a39a55629b)
First upstream release since 2023-07. All four locally-carried patches
are merged in 1.0.4 and can be dropped:
- 0001 (PR #57): udev_device.c TOCTOU race fix
- 0002 (PR #62): avoid OOM on small systems
- 0003 (PR #66): correct touchpad detection
- 0004 (PR #80): hwdb USB ID lookup from usb.ids
The release also pulls in PR #79 (do not assume EV_REL and EV_ABS are
mutually exclusive in udev_device.c).
Release notes:
https://github.com/illiliti/libudev-zero/releases/tag/1.0.4
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit f10dfca2ba)
Replace the four stub udev_hwdb_*() functions with a working
implementation that looks up vendor and product names from
/usr/share/hwdata/usb.ids, so callers using the standard libudev
hwdb API benefit without needing package-specific patches.
The patch is a clean backport of upstream commit 2bebebc9e0444
("udev: implement hwdb USB ID lookup from usb.ids (#80)") merged
to illiliti/libudev-zero master on 2026-05-19, post-1.0.3. Drop
when the package is bumped to the next libudev-zero release.
Upstream now defaults USB_IDS_PATH to ${SHAREDIR}/hwdata/usb.ids
with SHAREDIR=${PREFIX}/share, so the explicit
USB_IDS_PATH=/usr/share/hwdata/usb.ids in MAKE_FLAGS is no longer
needed and is dropped.
Fixes: https://github.com/openwrt/packages/issues/29386
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 93759026fd)
Changes since 2024-05-13:
c24e06c2 configure: Check for SVE support in MS armasm64 via as_check
3a8b5be2 aarch64: Use elf_aux_info() for CPU feature detection on FreeBSD/OpenBSD
1243d9ff Provide x264_getauxval() wrapper for getauxvaul() and elf_aux_info()
80c1c47c configure: Add DragonFly support
3a21e97b Fix build with Android NDK and API < 24 for 32-bit targets
b1d2de88 Use getauxval() on Linux and elf_aux_info() on FreeBSD/OpenBSD on arm/ppc
da14df55 Make use of sysconf(3) _SC_NPROCESSORS_ONLN and _SC_NPROCESSORS_CONF
023112c6 aarch64: defines involving bit shifts should be unsigned
938601b9 Use sysctlbyname(3) hw.logicalcpu on macOS
a64111b1 Enable use of __sync_fetch_and_add() wherever detected instead of just X86
450946f9 ci: Test compiling for Android
52f7694d Use sched_getaffinity on Android
373697b4 Bump dates to 2025
c80f8a28 msvsdepend: Allow using the script for .S sources too
27d83708 Makefile: Generate dependency information implicitly while compiling
a0191bd8 configure: Use as_check for checking for aarch64 features
72ce1cde configure: Use as_check for the main check for whether NEON is supported
f87ca183 configure: Check for .arch and .arch_extension for enabling aarch64 extensions
87044b21 aarch64: Use configure detected directives for enabling SVE/SVE2
fc4012fb configure: Check for the dotprod and i8mm aarch64 extensions
0e48d072 aarch64: Add flags for runtime detection of dotprod and i8mm
570f6c70 aarch64: Add runtime detection of extensions on Windows and macOS
fe9e4a7f Provide implementations for functions using the instructions SDOT/UDOT in the DotProd Armv8 extension.
32c3b801 lavf: Update the code to work with the latest libavutil API
4360ac37 ci: Fix ffmpeg build
40617ddb ci: Remove vlc-contrib dependency
85b5ccea Update gas-preprocessor.pl to the latest upstream version
ff620d0c configure: Use MSYSTEM_CARCH for default arch on msys2
714e07b4 arm: Don't test x264_cpu_fast_neon_mrc_test on Windows
291476d7 windows: Fix named pipes detection
b35605ac i8mm & neon hpel_filter optimization
0480cb05 riscv64: add compile support
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 775c87e364)
- f_search: refactored backup and local block-/allowlist scan to run in parallel
- f_search: raise the search timeout in backups to max. 90 seconds
- f_load: skip f_fetch for search action, no remote download is needed for local lookups
- f_dns: skip destructive paths (file wipe, f_dnsup) for search and report actions
- LuCI: adapt search backend changes in the frontend
- LuCI: minor frontend fixes & improvements
Signed-off-by: Dirk Brenken <dev@brenken.org>
(cherry picked from commit 5e7db72445)
Add a simple CI compilation test to ensure that the Go toolchain is
functional.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit d9fdda8cf2)
Wei-Ting Yang
Georgi Valkov
Alexandru Ardelean
Josef Schlehofer
Michael Heimpold
Dirk Brenken
Olivier Poitrey
Daniel Golle
Tyrel M. McQueen
Hannu Nyman
Hauke Mehrtens
Jan Hák
Ray Wang
Noah Meyerhans
Yanase Yuki
Martin Schiller
Rui Salvaterra
Dee HY
Sandro Jäckel
John Audia
George Sapkin
Niklas Thorild
Szabolcs Hubai