Update ca-certificates to version 20241223
* Update Mozilla certificate authority bundle to version 2.70.
The following certificate authorities were added (+):
+ Telekom Security TLS ECC Root 2020
+ Telekom Security TLS RSA Root 2023
+ FIRMAPROFESIONAL CA ROOT-A WEB
+ TWCA CYBER Root CA
+ SecureSign Root CA12
+ SecureSign Root CA14
+ SecureSign Root CA15
The following certificate authorities were removed (-):
- Security Communication Root CA (closes: #1063093)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/18468
Signed-off-by: Robert Marko <robimarko@gmail.com>
As described in #13873, from 23.05.0 onwards logging to a file on an
external filesystem fails under some conditions.
This occurs because the log initscript had code added to prevent start
logging to an external filesystem on boot, and added a trigger to start
said logging when the external filesystem gets mounted.
The issue is that for filesystems mount with fstab uci, the fstab
scripts runs at START=11, while log runs at START=12, which means the
external filesystem may already be mounted by the time the log initscript
runs. Since the external filesystem is already mounted it does not
trigger a hotplug event to trigger the trigger to start logging. This
combination means the logging never automatically starts when the log
file is on an external filesystem.
We therefore add a check for the presence of a mounted filesystem when
the log file is being sent to an fstab mounted filesystem. If the
filesystem is mounted, we don't skip starting logging during boot.
If the filesystem is not mounted then file logging is not started and
the trigger will start the logging when the filesystem is mounted.
Signed-off-by: Daniel F. Dickinson <dfdpublic@wildtechgarden.ca>
[improved commit message]
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
PKG_MIRROR_HASH is incorrect and fails the download from mirrors.
Fixes: 0aaabffdea2c ("selinux-policy: update to version v2.6")
Signed-off-by: Álvaro Fernández Rojas <noltari@gmail.com>
APK update is currently broken if wget is used as a tool. This wasn't
correctly tested and cause seg fault. Backport the patch fixing this to
restore original functionality.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Rebased onto dssp5-base. Baseline is:
ss, tc, stubby, irqbalance, usbutils, ethtool, tcpdump, mtr,
bmon, zram-swap, parted, e2fsprogs, gdisk, block-mount,
kmod-fs-ext4, kmod-fs-f2fs, kmod-usb-storage, f2fs-tools-selinux,
kmod-usb-storage-uas, kmod-usb3, wireguard-tools,
openssh-sftp-server, luci-light, resolveip, blockd
Changes since v2.0:
3dcc957 three issues:
434bad8 /new_root related
04d18a5 README armsr combined-efi
506d8c1 /efi is not a thing in armsr combined-efi
c0db1ed efivarfs remove these filecons
4eb35b7 adds efivars noseclabelfs for armsr combined-efi
bbc6a6b adds /dev/ttyS3 to tty serialtermdev
1467206 README local logins
6ae3185 rename eficapsulemiscnodedev
d43ded0 rename to vportserialtermdev
a47d2f8 fixes virtio port serialtermdev
03aec70 blockmount: make it a bit more robust
70f1ed3 hotplugcall not sure what config triggers this
3338764 boarddetect: i was expecting this
d97548a deal with /dev/tty and /dev/vcs
c6ba4a5 adds virtio block device
d03e216 adds virtio vport serialtermdev for qemu guest agent
2dc0291 validatefirmwareimage: allow getattr of *all* dev chr files
fdfb3a7 adds /dev/efi_capsule_loader for armsr combined target
b129fb9 validatefirmwareimage ordering
b5e81b4 validatefirmwareimage clean up
0932dc5 README typo fixes
a1f88f0 README fix
e6c68be README typo fixes
a232c21 hvcloginserialtermdev: macro not used
d7edd95 support /usr/local and update README
c0d2947 validatefirmwareimage comment
7dbc9b3 validatefirmwareimage: allow find to getattr of dev.except char
f647175 platformtmpfile: elaborate a bit in comment
52f32c1 reintroduce misc.cil
320d77f validatefirmwareimage: /lib/upgrade/platform.sh
365fc65 deal with /efi for combined images
183b412 adds hvc logserialtermdev
20cd42a sshdsysagent: limited support for legacy scp -O with firmware images
1ccee8d validatefirmwareimages: some events related to "combined" images
9b47fc3 jshn reads /dev/urandom
f86def7 adds /tmp/log/apk.log
f1247b3 these are relative to the current namespace
32c0cc8 hotplugcall qemu virtio-console-helper
5cc41f5 uclient-fetch for manually downloading sysupgrade related
c8140bd cgi-io creates firmware and backup atomically
edf517b factoryreset deal with firstboot compatibility
f5116b5 pppd: redundant, is implied with shell client type
86be72c updates README
8c08ca1 luci-mod-system: a bit of speculation here
417f4a5 adds /dev/autofs
1ed537c misc.cil: remove
01d014a selinuxsecfile: be more specific
53fca71 rename blockd module
b4c9b15 ttyloginserialtermdev: ordering
016c3c1 sysagent traversal of /root is enough
d0d7c91 hotplugcall: net/00-sysctl
2821746 adds ttyAMA0 and some incomplete rules for board-detect
Run-tested: ilogic-openwrt_one, ipq40xx-generic-linksys_mr8300
Tested-by: Stefan Hellermann <stefan@the2masters.de>
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
Link: https://patchwork.ozlabs.org/project/openwrt/patch/20250116092312.1350223-1-dominick.grift@defensec.nl/
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
APK recently introduced python binding support. Disable this sub module
as we don't ship python in normal build to reduce space.
Link: https://github.com/openwrt/openwrt/pull/17925
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
5f127fcc415c convdb: preserve newlines at the end of scripts
e94a2212a0d2 convdb: import package names starting with leading dot
9c0d353c7905 adbdump: use literal block if yaml quoting is needed
93c6a09a8ea8 improve compatibility of shellscripts
6c454d13de9b doc: fix pre/post commit hook documentation
3eb0b70b6d0f solver: rework solver name ordering to fix install_if handling
78c3bdc03cbd solver: make dependencies only packages selectable
373b364ef2a8 build: use the VERSION directly as the soname
6f627d93f5a0 update .gitignore
908f1ee7e87b index, add, pkg: check arch in 'add' only to allow 'index' to work
7c164c471251 index: Fix total always 0
0042b035df53 pkg, db: check arch on apk_db_pkg_add
ffc706689603 applet: always show help for global options
f6a66ebc5876 help: use uppercase usage prefix
7ebb23720483 doc: fix manpage sections
5e5e1f088986 genhelp: reorganize and add --debug output mode
9b371e452fb2 genhelp: do man page link wrangling for COMMANDS text only
2a87e46a354b context: introduce and use apknew_suffix
a6180e4cfa1a meson: add tests option
eb100676c5f0 test: move subdir unit to be the first
a12eae1780e8 test/user/hardlink: be portable to bsd-style stat(1)
f0c096bc034b db: attempt new mount user namespace for chroot in usermode
994e5e4e0006 db: fix "fetch --recurisve" to work
24d8f9677d77 Revert "database: move lock file from /lib/apk to /run/apk"
470432aafe77 applets: simplify option group handling
e1275e2f5010 apk: load global options from /etc/apk/config
8c39b525cd0c add support for repository package name specification
5856cf100241 doc, db: fix repository url_base to be allocated and fetch man page
a0411e87187e cache: fix not to remove indexes
cddca5769e98 apk, commit: support --cache-predownload to first download packages
915e9841ed1c ci: always test all features available
4f94807104e3 commit: print version numbers with --verbose --interactive summary
5bd6d49ac447 fetch: call progress early to avoid flicker
fc66fdfc49cd test: portability fixes
3f73ba343cbd test: shellcheck test suite for bash, dash and busybox
d94671bb1235 test: fixup sourcing testlib.sh to work better with shellcheck
6007db9cdde6 print: refactor progress printing API
a1d7042a2d3b print: further refactor progress API
bed4628c9317 print: reorganize progress to be renderred after apk_out
8cd7362a986c add process main loop to pipe stdout/stderr and logs it
ccfd7ac5e518 db: log script output using apk_process api
3c4594962fb4 db: log uvol output using apk_process api and add tests
fc7768c09497 io_url_wget: log wget output using apk_process api
90a62541751f build: only use VERSION up until first space for soname
378d6360ab17 db: rename apk_db_add_repository to add_repository
5d978c2a5924 db: split open_repository out of add_repository
af812cd28c6d print: simplify code a little bit
4c776eb74997 db: make index refresh notices a progress note
64e053071a89 db: fix non-repository reverese dependency indexing
3cf039322ce1 apk-tools-3.0.0_rc1
90220e710c61 commit: fixup progress during package removal
d11521ec6309 apk-tools-3.0.0_rc2
dc191820b1c4 solver: fix name resolving order of pure virtual names
7da628bc455f libfetch: remove remaining ftp references
10b467c0992a libfetch: remove error generation script
b5b130e1d628 print: flush after progress notice if needed
d71722b9a637 libfetch: rework error codes API
7b0b69a3023f commit: advise on using upgrade --prune and/or --available
1fd82ea2d7dc test: fix spelling s/shuld/should
8eb22149138f process: move apk_exit_status_str as static function
752ee96a25b1 db: refactor repository parsing and url printing
bfa763904fe4 doc: update apk-keys(5) and apk-repositories(5)
165333af1a35 db: introduce and use apk_db_foreach_repository
8e98d6889c92 libfetch: remove unused file scheme and manual pages
30b1c0348d6b remove usage of TRUE/FALSE
fa19887d741c crypto: use explicit algorithm fetching for openssl >=3.0
a706cbdfd5b1 crypto: remove support for obsolete md5
35a57547a7d7 db: remove APK_REPOSITORY_CACHED and use cache_repository
7f616711636c db: const correctness for apk_db_pkg_available
2cda62cd3a4c io: adjust scheme detection in apk_url_local_file()
50a2c12a32b8 db: make repo.url_index a pure blob
a186267a8822 db: make repo.url_base_printable prefix of url_index_printable
9fb473c6a269 add .editorconfig
088c584bf515 mkndx: introduce --filter-spec to filter existing index
0c3188793243 atom: remove apk_atomize_dup0
866374c7cda0 python: add initial python binding
bdf492471328 python: add unittests
9afe8dae79a0 ci: install python3-dev
df3424e5c8cd python: move version to a submodule
3e65a63aa4f1 apk-tools-3.0.0_rc3
946027f6abde test: extend blob_split tests
e73b5e313998 db: do not add empty arch
a6c84f8f62f7 atom: use null atom also for zero length blobs
fb8eef15dc52 db: handle not found names in __apk_db_foreach_sorted_package
0ef8a2223cca commit: don't trigger question with --prune/--available warning
fe484a5c06b9 atom: remove apk_atomize
70fc828cf06b update: make --update-cache and and 'update' behave the same
04e83acfb9b9 upgrade: fix previous commit
cdeebc01283d test: add mkpkg/add symlink test
c2f21ce06a67 mkpkg: do not include filename on error message
de0a4886a91c fs_fsys: do not leave temporary files after failed commit
e5e362c1a65c doc: update --cache-max-age documentation
8d41ff40b59a fetch: fix fetch_err_make() for 32-bit arches
2526fd73bc66 walk_gentext: make state per-module, use apk_ostream for output
bb65553e6423 walk_genadb: make state per-module
a920e5976127 adb_walk: rename scheme to start_scheme and always call end for it
92c573fac280 adb_walk: separate string and numeric values
fe4876bd3a4e adbdump: add support for json output
66cc8da577f0 walk_adb: always call the string scalar function
40bfa97ce3e3 adb: reset dynamic on freeing adb_obj
7519b70d42d1 convert adb_walk_gen* to apk_serializer_*
64c484730c9f add missing serialize.c
83e85aaee220 add missing apk_serialize.h
f70638e12ccc serializer: simplify schema and array handling
9bfc259d9fdb serializer: merge start_schema and start_object to one op
a23368b38ff6 serialize_yaml: improve quoting detection
3a33e75b92aa serialize_adb: move from libapk to apk executable
f5c3fd843824 info: fix -W with symlinks
d54fdb753135 update, version: do not print unavailable repositories
8223c10d4c33 doc: extract arguments are files
a3b4ebcefa3b serialize_yaml/adb: support single quoting, and fixes
77aff1daa967 db: fix --no-cache
f0e3aa4c139d mkpkg: do not call openat() with null pathname
28770f552f4e adb: fix adb_block_init check when extended block is needed
1ca73b6ae892 blob: apk_blob_push_int use uint64_t as value
0b159e23432e print: use uint64_t for progress api progress type
5da830ba51d0 db, commit, print: use uint64_t for file size types
a7b5d8d8eeb9 mkndx, extract: use uint64_t for file size types
639f8ab8d9cd io: use uint64_t for file size as needed
49905d47ee90 io: introduce and use apk_istream_skip
8d83f18647d4 defines: drop muldiv and mulmod helpers
d373a9a6971e db: drop now unused apk_repo_format_cache_index
5700b195d67d pkg: update script execution logging style
00c51e267162 pkg: cap sizes that are allowed for scripts and some v2 fields
5157c540d732 io: fix segment_close to read the inner stream
ad741fe98b72 db: implement system repository list configuration path
6ca1831ed563 use #pragma once instead of ifdef guards
64254d190b32 db, ctx: add and use allocator in apk_ctx
581825bb0811 fix handling of etc/apk/config options with an argument
508b312df637 apk: add APK_CONFIG to overwite path to config file
0e8e7e5a8264 test: fix busybox realpath compat
0186a6aa9d5c apk: support loading configuration options from /lib/apk/config
0c52242990f4 db: fix package name orphan check
a7766c933853 add: don't print misleading error after failed non-repository check
4254863de6ac introduce and use apk_array_foreach and apk_array_foreach_item
b276b3c50618 serialize: separate apk_ser_string and its multiline variant
91dc10b1cddf blob: introduce and use apk_blob_foreach_token
d345a9aa6d25 adbgen: split adbgen specific code to separate file
00522cd60e18 apk: introduce and use APK_OPTVAL_* macros
7f8a1ca12465 list, search: fix origin existence checks
b0bb4a99378b adb: allow copying larger arrays
3fe4258d4c1b mkndx: fix matching packages from old index
b263d961ba12 libfetch/http: reuse fetch_netrc_auth for http(s)
1d4ed5525f54 ctype: fix apk_blob_{spn,cspn} for non-ascii characters
1fa9f3c221c7 genhelp.lua: don't match underscores in the middle of words
48980518436f ctx, trust: load public keys also from lib/apk/keys
ba38d6584599 mkndx: remove --rewrite-arch
a9ea20e37029 context: fix --keys-dir
8abae4785c78 various: fix compilation error for missing inttypes.h
fdb10df21486 various: fix compilation error for missing limits.h
89ef2b546087 database: fix compilation error for missing sched.h
8afd4ab47200 process: correctly handle error from pipe2 and open
1cbbf7457721 crypto_openssl: make sha global variables constant for OpenSSL < 3
025710552ac8 io: fix compilation error for missing stdarg.h
908efa92701c libfetch: allow obsolete date format in http timestamps
70494b5bcdf9 apk: add support for boolean flag arguments
16ab8c549a06 apk: add --cache-packages to enable package caching always
460d62ee743c db: extend repositories file format with commands
34771ccb7964 apk-tools-3.0.0_rc4
Link: https://github.com/openwrt/openwrt/pull/17925
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
047b2efc1348 CMakeLists.txt: bump minimum cmake version
16ff0badbde7 CMakeLists: add support for including ABIVERSION in the library version number
Signed-off-by: Felix Fietkau <nbd@nbd.name>
d996988ae55b libubus: close file descriptor after sending it from a request
afa57cce0aff libubus: add support for using channels
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Check the return value of malloc and pread in case they fail.
Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix a bug in linksys_bootcount.c that resetbc won't work on nand
with min I/O size> 2048.
Check the boot-log entry's intergrity with checksum.
Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently if the host system has cmocka installed it will leak the host
path and try to use the host cmocka and build tests.
This will obviously fail, so backport upstream commit allowing disabling
of tests and disable building them.
Fixes: openwrt/packages#25456
Link: https://github.com/openwrt/openwrt/pull/17297
Signed-off-by: Robert Marko <robimarko@gmail.com>
2e206dbe77ec service: add support for triggers on service/instance data changes
735b48728fca service: remove leftover lines from previous commit
32469644a029 service: allow incremental changes to service properties
fd01fb852302 service: fix double free bug when dealing with data
Signed-off-by: Felix Fietkau <nbd@nbd.name>
e2f05de state: set_stdio: chdir back to / in case of failure
30542c9 inittab: Disable implicit controlling TTY.
Signed-off-by: John Crispin <john@phrozen.org>
3da6c104f0f5 database: use APK_DB_LAYER_ROOT in more places
5437e3abada1 audit: add usr/lib/apk to the list of protected paths under --full
de9baf912245 change default db location to /usr, but detect and use /lib if exists
218fdaa1a1a2 context: close root_fd on free
d33294236cb4 database: add support for only-when-modified trigger paths
36935db0ef3b package: fix memfd_create warnings on Linux kernels < 6.7
1c3fc36051a3 blob: add and use apk_blob_trim_{start,end}
af5f9e3f93b0 pkg: fix v3 package size setting to installeddb
9428e34694c8 version: allow --check and --test to work without database
4b4add5326a8 test: fix unit test registration function to be unique
eac18cb200d4 test: add testlib.sh for user tests
20dae205b006 mkpkg: fix creation of package with hardlinks
7bdecdca6a95 pkg: only allow tags in world and some commands
76de228bcc0b commit: show tags of world constrains
9a1b1cf68420 test: use testlib for solver.sh
99fc2a2a5efc test: remove dependency on GNU tar
6927746b9a10 Revert usrmerge/LFS related changes to apk used paths
5d287a9b06e9 apk-tools-3.0.0_pre5
8d93a79fb895 mkpkg: fix hardlink on big-endian system
Link: https://github.com/openwrt/openwrt/pull/17148
Signed-off-by: Robert Marko <robimarko@gmail.com>
Rename jffs2reset to factoryreset. Convert all scripts to using the new command
line. Print a deprecation notice when jffs2reset is invoked.
49d36ba jffs2reset: rename to factoryreset
b135064 jffs2reset: print deprecation message
Signed-off-by: John Crispin <john@phrozen.org>
