aboutsummaryrefslogtreecommitdiffstats
path: root/package/libs
Commit message (Collapse)AuthorAgeFilesLines
* selinux-policy: update to 1.2.5Linhui Liu2023-05-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | 30d503a uci jsonfilter: pipe and leak e13cb64 rpcd leds 144781f jsonfilter, luci, ubus 1210762 rpcd and all agents get fd's leaked ab9227c rpcd 2f99e0e luci rpcd b43aaf3 rpcd (enable/disable services) luci peeraddr f20f03e rpcd 7bc74f6 rpcd reads all subj state and luci-bwc leaks 9634b17 adds inotify perms to anon_inode 3d3c17c adds bare anon_inode (linux 5.15) 7104b20 dnsmasq and luci 0de2c66 luci,rpcd, ucode, wpad 14f5cf9 luci and ucode e3ce84c rpcd, ucode and cgiio loose ends 96a2401 misc updates 9fe0490 initscript: remove redundant rules 71bd77e allow all init scripts to log to logd f697331 sandbox: make ttydev handling more robust a471877 simplify pty tty console access f738984 sandbox: also remove TIOSCTI from all ttydevs Signed-off-by: Linhui Liu <liulinhui36@gmail.com> (cherry picked from commit 4c5a9da8699a7982b8f03b28561f955d9d1313f1)
* pcre2: fix host compilation of libselinux by enabling PICPetr Štetiar2023-05-311-1/+2
| | | | | | | | | | | | | | | libselinux-3.5 fails to compile in Fedora 38 container due to the following: cc -O2 -I/openwrt/staging_dir/host/include -I/openwrt/staging_dir/hostpkg/include -I/openwrt/staging_dir/target-x86_64_musl/host/include -I../include -D_GNU_SOURCE -DNO_ANDROID_BACKEND -DUSE_PCRE2 -DPCRE2_CODE_UNIT_WIDTH=8 -I/openwrt/staging_dir/hostpkg/include -L/openwrt/staging_dir/host/lib -L/openwrt/staging_dir/hostpkg/lib -L/openwrt/staging_dir/target-x86_64_musl/host/lib -Wl,-rpath=/openwrt/staging_dir/hostpkg/lib -shared -o libselinux.so.1 avc.lo avc_internal.lo avc_sidtab.lo booleans.lo callbacks.lo canonicalize_context.lo checkAccess.lo check_context.lo checkreqprot.lo compute_av.lo compute_create.lo compute_member.lo compute_relabel.lo compute_user.lo context.lo deny_unknown.lo disable.lo enabled.lo fgetfilecon.lo freecon.lo freeconary.lo fsetfilecon.lo get_context_list.lo get_default_type.lo get_initial_context.lo getenforce.lo getfilecon.lo getpeercon.lo init.lo is_customizable_type.lo label.lo label_db.lo label_file.lo label_media.lo label_support.lo label_x.lo lgetfilecon.lo load_policy.lo lsetfilecon.lo mapping.lo matchmediacon.lo matchpathcon.lo policyvers.lo procattr.lo query_user_context.lo regex.lo reject_unknown.lo selinux_check_securetty_context.lo selinux_config.lo selinux_internal.lo selinux_restorecon.lo sestatus.lo setenforce.lo setexecfilecon.lo setfilecon.lo setrans_client.lo seusers.lo sha1.lo stringrep.lo validatetrans.lo -L/openwrt/staging_dir/hostpkg/lib -lpcre2-8 -lfts -ldl -Wl,-soname,libselinux.so.1,--version-script=libselinux.map,-z,defs,-z,relro /usr/bin/ld: /openwrt/staging_dir/hostpkg/lib/libpcre2-8.a(pcre2_compile.c.o): relocation R_X86_64_32S against symbol `_pcre2_ucd_stage1_8' can not be used when making a shared object; recompile with -fPIC /usr/bin/ld: failed to set dynamic section sizes: bad value So lets fix it by enabling build of host static library with the position independent code option enabled. Signed-off-by: Petr Štetiar <ynezz@true.cz> (cherry picked from commit 12494f5b8a7bb48cbf7b2fba7d17a53981173120)
* bpftools: update, split off bpftool and libbpf packagesTony Ambardar2023-05-252-0/+85
| | | | | | | | | | | | | | | | My original bpftools package made "variant" builds of bpftool and libbpf as a convenience, since both used the same local kernel sources with the same versioning. This is no longer the case, since the commit below switched to using an out-of-tree build mirror hosting repos for each. Replace bpftools with separate bpftool and libbpf packages, each simplified and correctly versioned. Also fix the broken libbpf ABI introduced in the same commit. Existing build .config files are not impacted. Fixes: 00cbf6f6ab1d ("bpftools: update to standalone bpftools + libbpf, use the latest version") Signed-off-by: Tony Ambardar <itugrok@yahoo.com> (cherry picked from commit afe1bf11f2539f75e30ab3206891dbe6f8c43bd5) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* libxml2: update to 2.11.4Nick Hainke2023-05-241-2/+2
| | | | | | | | | Release Notes: https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.4 Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit c520d682f02890afb38e43b862ca856e2b933507) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* libcap: update to 2.69Nick Hainke2023-05-241-2/+2
| | | | | | | | | | Release Notes: https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.iuvg7sbjg8pe Fixes: CVE-2023-2602 CVE-2023-2603 Signed-off-by: Nick Hainke <vincent@systemli.org> (cherry picked from commit 78c45c1e591ce5aeff9fb7eeae049662c4ac4ef2) Signed-off-by: Daniel Golle <daniel@makrotopia.org>
* nettle: update to 3.9Nick Hainke2023-05-202-7/+7
| | | | | | | | | | Changelog: https://git.lysator.liu.se/nettle/nettle/-/blob/26cd0222fd09b8f5dc0edba30d6908722c7e9b09/NEWS Refresh patch: - 100-portability.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* pcre2: switch to Github Releases and bump to 10.42Linhui Liu2023-05-201-4/+4
| | | | | | | | | The mirror at SourceForge is an unofficial mirror and no longer maintained. ChangeLogs: https://github.com/PCRE2Project/pcre2/blob/pcre2-10.42/ChangeLog Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
* libjson-c: import patch to fix compilation on macosNick Hainke2023-05-192-1/+185
| | | | | | | | | | | | | | Fixes errors in the form of: /Users/user/src/openwrt/openwrt/build_dir/hostpkg/json-c-0.16/json_util.c:63:35: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] const char *json_util_get_last_err() ^ void 1 error generated. ninja: build stopped: subcommand failed. Reported-by: Paul Spooren <mail@aparcar.org> Suggested-by: Paul Spooren <mail@aparcar.org> Signed-off-by: Nick Hainke <vincent@systemli.org>
* libxml2: update to 2.11.3Nick Hainke2023-05-182-4/+4
| | | | | | | | | | | | Changelog: - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.10.4 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.0 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.1 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.2 - https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.11.3 Fixes: CVE-2023-28484 CVE-2023-29469 Signed-off-by: Nick Hainke <vincent@systemli.org>
* treewide: replace AUTORELEASE with real PKG_RELEASETianling Shen2023-05-185-5/+5
| | | | | | | | | | | | | | | | | | Based on Paul Fertser <fercerpav@gmail.com>'s guidance: Change AUTORELEASE in rules.mk to: ``` AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile)) ``` then update all affected packages by: ``` for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';); do make package/$i/clean done ``` Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
* libselinux: update to 3.5Linhui Liu2023-05-181-6/+5
| | | | | | | | | | | | | Switch from libpcre to libpcre2. While working on it remove the double defined HOST_BUILD_DEPENDS section. Release Notes: https://github.com/SELinuxProject/selinux/releases/download/3.4/RELEASE-3.4.txt https://github.com/SELinuxProject/selinux/releases/download/3.5/RELEASE-3.5.txt Signed-off-by: Linhui Liu <liulinhui36@gmail.com> [depend on libpcre2] Signed-off-by: Nick Hainke <vincent@systemli.org>
* libsemanage: update to 3.5Linhui Liu2023-05-181-2/+2
| | | | | | | | Release Notes: https://github.com/SELinuxProject/selinux/releases/download/3.4/RELEASE-3.4.txt https://github.com/SELinuxProject/selinux/releases/download/3.5/RELEASE-3.5.txt Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
* libsepol: update to 3.5Linhui Liu2023-05-181-2/+2
| | | | | | | | Release Notes: https://github.com/SELinuxProject/selinux/releases/download/3.4/RELEASE-3.4.txt https://github.com/SELinuxProject/selinux/releases/download/3.5/RELEASE-3.5.txt Signed-off-by: Linhui Liu <liulinhui36@gmail.com>
* pcre: move package to packages feedNick Hainke2023-05-182-140/+0
| | | | | | | With the update of selinux no package depends anymore on pcre in the base repository. Move it to packages feed. Signed-off-by: Nick Hainke <vincent@systemli.org>
* pcre2: import pcre2 from packages feedNick Hainke2023-05-182-0/+138
| | | | | | | pcre2 is needed by newer selinux versions, so it needs to be in the base repository. Signed-off-by: Nick Hainke <vincent@systemli.org>
* libbsd: fix compilation with musl 1.2.4Robert Marko2023-05-161-1/+3
| | | | | | | | | | | musl 1.2.4 deprecated legacy "LFS64" ("large file support") interfaces so just having _GNU_SOURCE defined is not enough anymore. _LARGEFILE64_SOURCE has to be defined in the source, or CFLAGS can be used to pass -D_LARGEFILE64_SOURCE to allow to keep using LFS64 definitions. Fixes: fff878c5bcda ("toolchain/musl: update to 1.2.4") Signed-off-by: Robert Marko <robimarko@gmail.com>
* libselinux: fix compilation with musl 1.2.4Robert Marko2023-05-151-0/+1
| | | | | | | | | | musl 1.2.4 deprecated legacy "LFS64" ("large file support") interfaces so just having _GNU_SOURCE defined is not enough anymore. _LARGEFILE64_SOURCE has to be defined in the source, or CFLAGS can be used to pass -D_LARGEFILE64_SOURCE to allow to keep using LFS64 definitions. Signed-off-by: Robert Marko <robimarko@gmail.com>
* gettext-full: link to local libunistringMichael Pratt2023-05-151-2/+4
| | | | | | | Configure gettext to require and link to our local libunistring explicitly. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* gettext-full: add missing link to libunistringMichael Pratt2023-05-151-0/+21
| | | | | | | | | | | | | | | | | | | | | | Running autoreconf or autogen.sh is causing the gettext-runtime subdirectory to have a configure script that looks for and attempts to link to an external libunistring. However, the macros and symbols for supporting that configuration are not present in this subdirectory yet. This results in some host machines to not build the included libunistring objects for libgrt, but at the same time, also not input the proper flag to the linker for linking to an external library when it is found or even when explicitly setting configuration to use a prefix for libunistring, resulting in the common linking failure "undefined reference". Some similar (and old...) upstream commits do the same thing, but only for gettext-tools and libgettextpo. Ref: ae943bcc1 ("Link with libunistring, if it exists.") # gettext.git Ref: 61e21a72f ("Avoid link error in programs that use libgettextpo.") # gettext.git Signed-off-by: Michael Pratt <mcpratt@pm.me>
* libunistring: add from packages feedMichael Pratt2023-05-151-0/+64
| | | | | | | | Add libunistring in order to link to gettext and other packages directly instead of the built-in substitute for it. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* gettext-full: bootstrap to local gnulib sourceMichael Pratt2023-05-042-344/+39
| | | | | | | | | | | | | | | | | Using the local gnulib source during autogen.sh allows for fine-grained control over the macros and source files for use with gettext but part of gnulib instead of gettext, without having to wait for a release or deal with gnulib as a git submodule. This is an alternative to running autoreconf. It also removes the need to patch macros in the case where there is a conflict between the source and our aclocal directory. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* gettext-full: link to local libxml2Michael Pratt2023-05-043-25/+35
| | | | | | | | | | | | | | | | | | | Some users have reported that gettext builds are attempting to link to libxml2 while it was supposed to be configured to use it's own built-in substitute. Configure gettext to require and link to our local libxml2 explicitly. Add a patch to revert upstream commit 87927a4e2 which forces libtextstyle to use the built-in libxml, no matter what the configuration is, making that option configurable again after the configure script is regenerated. Reported-by: Tianling Shen <cnsztl@immortalwrt.org> Signed-off-by: Michael Pratt <mcpratt@pm.me>
* gettext-full: set gperf as build prerequisiteMichael Pratt2023-05-041-0/+2
| | | | | | Require gperf to be built before gettext. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* libxml2: add from packages feedMichael Pratt2023-05-042-0/+218
| | | | | | | Add libxml2 which can be used to build gettext instead of the old built-in substitute for it. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* gettext-full: override SUBDIRS variable with MakefileMichael Pratt2023-05-042-23/+44
| | | | | | | | | | | | | | | | Instead of editing the SUBDIRS variable with a patch, it can be overriden at the end of the command line when invoking Make. This tool has a series of recursive Makefiles in each subdirectory, therefore SUBDIRS is set to a pattern of Make functions so that the result is variable depending on the current subdirectory that Make is being invoked in. Some of the subdirectories don't have a Makefile and are just storing files for another subdirectory Makefile target, therefore we have to place a fake Makefile that does nothing. Signed-off-by: Michael Pratt <mcpratt@pm.me>
* openssl: fix low-severity CVE-2023-1255Eneas U de Queiroz2023-04-292-1/+40
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This applies commit 02ac9c94 to fix this OpenSSL Security Advisory issued on 20th April 2023[1]: Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVE-2023-1255) ============================================================== Severity: Low Issue summary: The AES-XTS cipher decryption implementation for 64 bit ARM platform contains a bug that could cause it to read past the input buffer, leading to a crash. Impact summary: Applications that use the AES-XTS algorithm on the 64 bit ARM platform can crash in rare circumstances. The AES-XTS algorithm is usually used for disk encryption. The AES-XTS cipher decryption implementation for 64 bit ARM platform will read past the end of the ciphertext buffer if the ciphertext size is 4 mod 5 in 16 byte blocks, e.g. 144 bytes or 1024 bytes. If the memory after the ciphertext buffer is unmapped, this will trigger a crash which results in a denial of service. If an attacker can control the size and location of the ciphertext buffer being decrypted by an application using AES-XTS on 64 bit ARM, the application is affected. This is fairly unlikely making this issue a Low severity one. 1. https://www.openssl.org/news/secadv/20230420.txt Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* libpcap: update to 1.10.4Nick Hainke2023-04-221-2/+2
| | | | | | | Changes: https://git.tcpdump.org/libpcap/blob/104271ba4a14de6743e43bcf87536786d8fddea4:/CHANGES Signed-off-by: Nick Hainke <vincent@systemli.org>
* uclient: update to Git version 2023-04-13Matthias Schiffer2023-04-131-3/+3
| | | | | | | | 007d94546749 uclient: cancel state change timeout in uclient_disconnect() 644d3c7e13c6 ci: improve wolfSSL test coverage dc54d2b544a1 tests: add certificate check against letsencrypt.org Signed-off-by: Matthias Schiffer <mschiffer@universe-factory.net>
* mbedtls: Update to version 2.28.3Hauke Mehrtens2023-04-103-96/+90
| | | | | | | | | | | | | | | This only fixes minor problems. Changelog: https://github.com/Mbed-TLS/mbedtls/releases/tag/v2.28.3 The 100-fix-compile.patch patch was merged upstream, see: https://github.com/Mbed-TLS/mbedtls/issues/6243 https://github.com/Mbed-TLS/mbedtls/pull/7013 The code style of all files in mbedtls 2.28.3 was changed. I took a new version of the 100-x509-crt-verify-SAN-iPAddress.patch patch from this pull request: https://github.com/Mbed-TLS/mbedtls/pull/6475 Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* libcap: update to 2.68Nick Hainke2023-04-081-2/+2
| | | | | | | Release Notes: https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.vdh3d47czmle Signed-off-by: Nick Hainke <vincent@systemli.org>
* openssl: fix CVE-2023-464 and CVE-2023-465Eneas U de Queiroz2023-04-073-1/+252
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Apply two patches fixing low-severity vulnerabilities related to certificate policies validation: - Excessive Resource Usage Verifying X.509 Policy Constraints (CVE-2023-0464) Severity: Low A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of computational resources, leading to a denial-of-service (DoS) attack on affected systems. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. - Invalid certificate policies in leaf certificates are silently ignored (CVE-2023-0465) Severity: Low Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL and other certificate policy checks are skipped for that certificate. A malicious CA could use this to deliberately assert invalid certificate policies in order to circumvent policy checking on the certificate altogether. Policy processing is disabled by default but can be enabled by passing the `-policy' argument to the command line utilities or by calling the `X509_VERIFY_PARAM_set1_policies()' function. Note: OpenSSL also released a fix for low-severity security advisory CVE-2023-466. It is not included here because the fix only changes the documentation, which is not built nor included in any OpenWrt package. Due to the low-severity of these issues, there will be not be an immediate new release of OpenSSL. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* openssl: add legacy providerEneas U de Queiroz2023-04-058-45/+123
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This adapts the engine build infrastructure to allow building providers, and packages the legacy provider. Providers are the successors of engines, which have been deprecated. The legacy provider supplies OpenSSL implementations of algorithms that have been deemed legacy, including DES, IDEA, MDC2, SEED, and Whirlpool. Even though these algorithms are implemented in a separate package, their removal makes the regular library smaller by 3%, so the build options will remain to allow lean custom builds. Their defaults will change to 'y' if not bulding for a small flash, so that the regular legacy package will contain a complete set of algorithms. The engine build and configuration structure was changed to accomodate providers, and adapt to the new style of openssl.cnf in version 3.0. There is not a clean upgrade path for the /etc/ssl/openssl.cnf file, installed by the openssl-conf package. It is recommended to rename or remove the old config file when flashing an image with the updated openssl-conf package, then apply the changes manually. An old openssl.cnf file will silently work, but new engine or provider packages will not be enabled. Any remaining engine config files under /etc/ssl/engines.cnf.d can be removed. On the build side, the include file used by engine packages was renamed to openssl-module.mk, so the engine packages in other feeds need to adapt. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* openssl: make UCI config aware of built-in enginesEneas U de Queiroz2023-04-052-8/+43
| | | | | | | | | Engines that are built into the main libcrypto OpenSSL library can't be disabled through UCI. Add a 'builtin' setting to signal that the engine can't be disabled through UCI, and show a message explaining this in case buitin=1 and enabled=0. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* openssl: avoid OPENSSL_SMALL_FOOTPRINT, no-asmEneas U de Queiroz2023-04-052-4/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Building openssl with OPENSSL_SMALL_FOOTPRINT yelds only from 1% to 3% decrease in size, dropping performance from 2% to 91%, depending on the target and algorithm. For example, using AES256-GCM with 1456-bytes operations, X86_64 appears to be the least affected with 2% performance penalty and 1% reduction in size; mips drops performance by 13%, size by 3%; Arm drops 29% in performance, 2% in size. On aarch64, it slows down ghash so much that I consider it broken (-91%). SMALL_FOOTPRINT will reduce AES256-GCM performance by 88%, and size by only 1%. It makes an AES-capable CPU run AES128-GCM at 35% of the speed of Chacha20-Poly1305: Block-size=1456 bytes AES256-GCM AES128-GCM ChaCha20-Poly1305 SMALL_FOOTPRINT 62014.44 65063.23 177090.50 regular 504220.08 565630.28 182706.16 OpenSSL 1.1.1 numbers are about the same, so this should have been noticed a long time ago. This creates an option to use OPENSSL_SMALL_FOOTPRINT, but it is turned off by default unless SMALL_FLASH or LOW_MEMORY_FOOTPRINT is used. Compiling with -O3 instead of -Os, for comparison, will increase size by about 14-15%, with no measureable effect on AES256-GCM performance, and about 2% increase in Chacha20-Poly1305 performance on Aarch64. There are no Arm devices with the small flash feature, so drop the conditional default. The package is built on phase2, so even if we include an Arm device with small flash later, a no-asm library would have to be built from source anyway. Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* libnl-tiny: update to the latest versionHauke Mehrtens2023-04-021-3/+3
| | | | | | | f5d9b7e libnl-tiny: fix duplicated branch in family.h 11b7c5f attr: add NLA_S* definitions Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* libtraceevent: update to 1.7.2Nick Hainke2023-04-011-2/+2
| | | | | | | | | | | Changes: 1c6f0f3 libtraceevent: version 1.7.2 73f6a8a libtraceevent: Fix some missing commas in big endian blocks da2ea6b libtraceevent: Rename "ok" to "token_has_paren" in process_sizeof() e6f7cfa libtraceevent: No need for testing ok in else if (!ok) in process_sizeof() a4b1ba5 libtraceevent: Fix double free in parsing sizeof() Signed-off-by: Nick Hainke <vincent@systemli.org>
* treewide: opt-out of tree-wide LTO usageAndre Heider2023-03-212-1/+3
| | | | | | These fail to build with LTO enabled or packages depending on them do. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "lto" in PKG_BUILD_FLAGSAndre Heider2023-03-214-12/+8
| | | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-lto". Some packages used LTO, but not the linker plugin. This unifies 'em all to attempt to produce better code. Quoting man gcc(1): "This improves the quality of optimization by exposing more code to the link-time optimizer." Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed that every buildsystem uses +$(MAKE) correctly. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: add support for "gc-sections" in PKG_BUILD_FLAGSAndre Heider2023-03-214-8/+10
| | | | | | | | | | | | | | | This reduces open coding and allows to easily add a knob to enable it treewide, where chosen packages can still opt-out via "no-gc-sections". Note: libnl, mbedtls and opkg only used the CFLAGS part without the LDFLAGS counterpart. That doesn't help at all if the goal is to produce smaller binaries. I consider that an accident, and this fixes it. Note: there are also packages using only the LDFLAGS part. I didn't touch those, as gc might have been disabled via CFLAGS intentionally. Signed-off-by: Andre Heider <a.heider@gmail.com>
* treewide: replace PKG_USE_MIPS16:=0 with PKG_BUILD_FLAGS:=no-mips16Andre Heider2023-03-217-7/+6
| | | | | | | Keep backwards compatibility via PKG_USE_MIPS16 for now, as this is used in all package feeds. Signed-off-by: Andre Heider <a.heider@gmail.com>
* libnftnl: update to 1.2.5Nick Hainke2023-03-191-3/+3
| | | | | | | | | Upstream switched to "tar.xz". Release Notes: https://www.spinics.net/lists/netfilter/msg61016.html Signed-off-by: Nick Hainke <vincent@systemli.org>
* elfutils: update to 1.89Nick Hainke2023-03-122-4/+6
| | | | | | | | | | Release Notes: https://sourceware.org/pipermail/elfutils-devel/2023q1/006023.html Refresh patch: - 003-libintl-compatibility.patch Signed-off-by: Nick Hainke <vincent@systemli.org>
* openssl: fix variable reference in conffilesEneas U de Queiroz2023-03-061-3/+3
| | | | | | | | | | | | Fix the trivial abscence of $() when assigning engine config files to the main libopenssl-config package even if the corresponding engines were not built into the main library. This is mostly cosmetic, since scripts/ipkg-build tests the file's presence before it is actually included in the package's conffiles. Fixes: 30b0351039 "openssl: configure engine packages during install" Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* openssl: fix sysupgrade failure with devcryptoEneas U de Queiroz2023-03-064-5/+73
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The bump to 3.0.8 inadvertently removed patches that are needed here, but were not adopted upstream. The most important one changes the default value of the DIGESTS setting from ALL to NONE. The absence of this patch causes a sysupgrade failure while the engine is in use with digests enabled. When this happens, the system fails to boot with a kernel panic. Also, explicitly set DIGESTS to NONE in the provided config file, and change the default ciphers setting to disable ECB, which has been recommended for a long time and may cause trouble with some apps. The config file change by itself is not enough because the config file may be preserved during sysupgrade. For people affected by this bug: You can either: 1. remove, the libopenssl-devcrypto package 2. disable the engine in /etc/config/openssl; 3. change /etc/ssl/engines.cnf.d/devcrypto.cnf to set DIGESTS=NONE; 4. update libopenssl-devcrypto to >=3.0.8-3 However, after doing any of the above, **you must reboot the device before running sysupgrade** to ensure no running application is using the engine. Running `/etc/init.d/openssl restart` is not enough. Fixes: 7e7e76afca "openssl: bump to 3.0.8" Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* ncurses: add alacritty terminfoTobias Hilbig2023-02-261-1/+2
| | | | | | | | Add terminfo file for the terminal emulator alacritty. https://github.com/alacritty/alacritty Signed-off-by: Tobias Hilbig <web.tobias@hilbig-ffb.de>
* ustream-ssl: update to Git version 2023-02-25Hauke Mehrtens2023-02-251-4/+4
| | | | | | 498f6e2 ustream-mbedtls: Use getrandom() instead of /dev/urandom Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
* libcap: update to 2.67Nick Hainke2023-02-251-3/+3
| | | | | | | | | | Release notes: https://sites.google.com/site/fullycapable/release-notes-for-libcap#h.o8papfkfh1x9 While working on it, remove $(AUTORELEASE). Tested-by: Linhui Liu liulinhui36@gmail.com # Xiaomi AX3600 Signed-off-by: Nick Hainke <vincent@systemli.org>
* openssl: fix powerpc & arc libatomic dependenciesEneas U de Queiroz2023-02-222-3/+3
| | | | | | | | | | | PowerPC CONFIG_ARCH is defined as powerpc, not ppc. Fix that in the DEPENDS condition. Arc needs to be built with libatomic. Change the OpenSSL configuration file, and add it to the libatomic DEPENDS condition. Fixes: 7e7e76afca "openssl: bump to 3.0.8" Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* openssl: bump to 3.0.8Eneas U de Queiroz2023-02-2015-3833/+85
| | | | | | | | | | This is a major update to the current LTS version, supported until 2026-09-07. Changelog: https://github.com/openssl/openssl/blob/openssl-3.0.8/CHANGES.md Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
* elfutils: fix build with GCC 11Andre Heider2023-02-181-1/+9
| | | | | | | | GCC 11 doesn't know about -Wno-error=use-after-free and aborts compilation. Fixes: 2748c45d "elfutils: Ignore wrong use-after-free error" Signed-off-by: Andre Heider <a.heider@gmail.com>
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-06 01:32:02 +0000