Skip version checks as none of the executables seem to report their
versions.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 1130219346)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Skip version checks as none of the executables seem to report their
versions.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 31247cdbe5)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
captest, filecap, netcap and pscap (libcap-ng-bin) do not print the
package version string (0.8.4), causing generic version check failures
in CI.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 12b01bad56)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The binary does not report the OpenWrt package version (2023.06.11~ab78c48f);
override the generic version check with test-version.sh.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 64628636ed)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
zstdgrep and zstdless are shell script wrappers that do not output a
version string, so the generic CI version check fails for them. Add a
test.sh case that verifies they are present and executable instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 543e47f0a0)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
dbus-utils utilities do not implement --version so the generic CI
version check fails for them. Add a test.sh case that verifies the
binaries are present and executable instead.
dbus-utils: dbus-monitor, dbus-send, dbus-test-tool
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 5b9e2dd55e)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The generic CI test fails for /usr/bin/attr because that binary does
not implement --version. getfattr and setfattr do, so test those for
the version string and only verify attr is present and executable.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 12d8cda801)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The test.sh lacked a package name guard, causing it to run (and fail)
when the -src subpackage was tested without python3 installed.
Add the standard guard to skip the test for non-main packages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 5264f85e22)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
None of the selinux-python tools print the package version, so the
generic version check fails for all of them.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 17283f7e83)
The override lists every python3 package by name, so it has to change
whenever the package set does, and it cannot be used as is on branches
that build a different set, like libpython3-3.13 and python3-email on
openwrt-25.12.
Check the interpreter, python3-dev and libpython3-X.Y against the
version, and accept the standard library modules and -src packages by
pattern, since they ship no executables. python3-dev now gets a real
check through python3-config and patchlevel.h, because python3-config
prints no version.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 9274fde0ba)
[take the new file, openwrt-25.12 does not have the package list from 9d69e4fa2]
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Move existing version checks into override and add explicit package checks.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit b5d3a38e45)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The generic package version check invokes ksmbd.tools directly, but the
multicall binary rejects that basename and fails the test.
Check the version through ksmbd.mountd and skip subpackages without
versioned executables.
Signed-off-by: Andrea Pesaresi <andreapesaresi82@gmail.com>
(cherry picked from commit 4ce49b0a9d)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 7cb0c183a9)
alsa-lib ships only a shared library and aserver has no --version, so
neither can satisfy the generic version probe. Add a test-version.sh
that exits 0 for both arms and exits 1 for unknown subpackages.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit c9f4980023)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Override generic version checks to skip them altogether because none of the
tools report their versions.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 3a41106cdc)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
aserver does not implement --version so the generic CI version check
fails for it. Add a test.sh case that verifies it is present and
executable instead.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 0f34c18d65)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Several bluez utilities do not implement --version so the generic CI
version check fails for them. Add test.sh cases that verify the
binaries are present and executable instead.
bluez-daemon: obexd
bluez-utils: bdaddr, ciptool, hciattach, hciconfig, l2ping, l2test, rctest
bluez-utils-extra: gatttool
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
(cherry picked from commit 3298822f8d)
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
This commit updates the PowerDNS authoritative server to 4.9.17,
the latest release in the 4.9.x LTS branch.
This fixes several security issues, including but not limited to:
CVE-2026-33257, CVE-2026-33260, CVE-2026-33611, CVE-2026-33610,
CVE-2026-33609, CVE-2026-33608, CVE-2026-42002, CVE-2026-42001,
CVE-2026-42000, CVE-2026-41999, CVE-2026-42396, CVE-2026-42005,
CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 259eb5fc32)
This commit updates PowerDNS Recursor to 5.2.13, the latest release
on the 5.2.x LTS branch.
This includes security fixes for the following issues and more:
CVE-2026-24027, CVE-2026-0398, CVE-2026-33256, CVE-2026-33257,
CVE-2026-33258, CVE-2026-33259, CVE-2026-33260, CVE-2026-33261,
CVE-2026-33262, CVE-2026-33601, CVE-2026-33600, CVE-2026-33612,
CVE-2026-40012, CVE-2026-42005, CVE-2026-42390, CVE-2026-42389,
CVE-2026-42388, CVE-2026-42387, CVE-2026-52690, CVE-2026-52688,
CVE-2026-52686, CVE-2026-52682.
Signed-off-by: Remi Gacogne <remi.gacogne@powerdns.com>
(cherry picked from commit 5867544afd)
Support configuring major version series as host-only (i.e. no target
packages) to reduce strain on buildbots in release branches. The goal is to
have one major target series and multiple host-only ones. E.g. 25.12 uses
1.26 as the default host/target series and 1.27 and beyond as host-only for
packages that require these.
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 4335f00bdd)
Fix stripping when using previous version as a bootstrap.
Fixes: 5657eb0e2 ("golang: split src into separate packages")
Signed-off-by: George Sapkin <george@sapk.in>
(cherry picked from commit 591422e869)
Security release:
- Proxy protocol: fix an out-of-bounds read in V1 header parsing
(GCVE-25-2026-09-50-1).
- Proxy protocol: do not use uninitialised data as the length of an
incompletely received V2 header (GCVE-25-2026-09-55-1).
- GnuTLS: fix a use-after-free when a client closes the connection
during session startup (GCVE-25-2026-09-51-1).
- Block more SMTP smuggling variants, extending the fixes for
CVE-2023-51766 (GCVE-25-2026-09-56-1).
All patches apply without changes.
Link: https://code.exim.org/exim/exim/src/tag/exim-4.100.1/doc/doc-txt/ChangeLog
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit ce188c6505)
downloads.exim.org keeps only the current release in exim4/ and moves
older tarballs to exim4/old/. Since 4.100.1 came out, the download of
4.100 from the primary URL fails with 404 and only works through the
OpenWrt mirror.
Add exim4/old/ as a second source URL.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit a983abe730)
xsltproc doesn't say it's own version but only dependcies it compiled on
Signed-off-by: Seo Suchan <tjtncks@gmail.com>
(cherry picked from commit 14d197418d)
dyndns.variomedia.de no longer accepts connections on port 80, so updates
fail unless the user enabled the use_https option. The HTTPS endpoint
works and answers with the usual dyndns2 status codes.
Switch both update URLs to HTTPS.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 0f85be35c6)
Remove the definitions of DDNS providers whose update endpoints no longer
work:
- system-ns.com: the domain now serves an unrelated online gambling site.
Keeping the entry would send the update token to a third party.
- xlhost.de: the domain has been a web hosting comparison site since 2017
and nsupdate.xlhost.de/nic/update returns 404.
- domopoli.de: the host does not answer on port 80 or 443. The update URL
also contains the scheme twice (http://[USERNAME]:[PASSWORD]@http://...),
so it could never have worked with ddns-scripts.
Drop their JSON files and their entries from the provider list.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 019ce1b87c)
Fix the netcup DDNS updater when comparing an existing
IPv6 record to the current address.
The previous logic relied on REGISTERED_IP and required it
to be set, but that value is not always available or reliable for
IPv6 records. As a result, the updater could wrongly skip or
fail to update AAAA entries.
This change:
- Removes the hard dependency on REGISTERED_IP
- Compares record type and hostname before evaluating the IP
- Normalizes IPv6 addresses before comparison
- Exits early when no update is required
Fixes#30387
Signed-off-by: Martin Brodbeck <martin@brodbeck-online.de>
(cherry picked from commit 55a465f358)
- Remove DDNS provider definitions for discontinued services:
DNSDynamic
DNSMax
DNS Park
Google Domains
ThatIP
TwoDNS
- None of these services can be used for DDNS updates anymore. Remove their
provider definitions and entries from the provider list to avoid exposing
obsolete and non-functional configurations.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
(cherry picked from commit 49f3441ee5)
To handle ip address changing by ifupdate.
When the ipv6 address is updated for an interface
(some ISP only give dynamic ipv6 address).
The ddns script will go into dead loop,
as the new ipv6 address is not used.
The simple change is restarting ddns when ip address is changed.
Signed-off-by: Jimmy Qin <sunnyqeen@gmail.com>
(cherry picked from commit 889e134007)
Gandi has deprecated Api Key for authentication and replaced it with
Personal Access Tokens. This adds a v2 gandi package containing a script
using the new authentication scheme while keeping the old version intact
for any existing API Key users. Additionally, it documents the old
version as deprecated and points users to v2.
Signed-off-by: Keith T. Garner <kgarner@kgarner.com>
(cherry picked from commit 413aa843b0)
The date format read from the UCI option ddns.global.ddns_dateformat was
embedded into a command string that is later executed through "eval", both
for the recurring log timestamps
DATE_PROG="date +'$ddns_dateformat'"
...
write_log 5 "PID '$$' started at $(eval $DATE_PROG)"
and for the "last update" timestamp in the updater
EPOCH_TIME="date -d @$EPOCH_TIME +'$ddns_dateformat'"
write_log 7 "last update: $(eval $EPOCH_TIME)"
The value is only wrapped in single quotes, so a single quote inside it
closes that quote and starts a new shell word. A user who can write the ddns
configuration - a delegated DDNS operator who was never granted shell access
- can set
ddns_dateformat="%F'; touch /tmp/pwned; '"
and have arbitrary commands run as root, because the updater runs as root.
The injection triggers on the next start of the updater, so in practice on
the next reconfiguration or reboot.
Stop building shell code from the option. Provide date_prog() as an ordinary
shell function and pass the format as a single quoted argument in both
places, which leaves no way for its content to be interpreted by the shell.
The remaining use of ddns_dateformat in dynamic_dns_updater.sh, for
NEXT_CHECK_TIME, already substituted it as a quoted argument without eval
and was not affected.
luci-app-ddns consumes the same option and is fixed separately in the LuCI
repository.
Reported-by: Matthew Hickey (Hacker Fantastic, https://hacker.house)
Fixes: 1c20dcb71a ("ddns-scripts: update to 2.7.6-1")
Assisted-by: Claude:claude-opus-5
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 7364629d70)
Bump PKG_VERSION for the ddns-scripts changes and reset PKG_RELEASE to
1 as requested.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 774c01bcba)
Add the missing spaces around the test bracket in the one.com
pre-removal script and escape IPKG_INSTROOT consistently with the other
subpackages.
Signed-off-by: Jiang Tengfei <admin@shaoxia.xyz>
(cherry picked from commit 3aca374056)
George Sapkin
Alexandru Ardelean
Josef Schlehofer
Andrea Pesaresi
Moritz Warning
Fabrice Fontaine
Mai Thanh Minh
Vladimir Ulrich
Niklas Thorild
Remi Gacogne
Ivan Pavlov
Seo Suchan
Martin Brodbeck
Jimmy Qin
Keith T. Garner
Hauke Mehrtens
Jiang Tengfei