libatomic is only needed where the compiler does not inline 64-bit
atomics, but the package depends on it on every target.
ATOMIC64_DEPENDS restricts the dependency to those targets.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
CONFIGURE_VARS is assigned rather than appended to, which discards the
default from package-defaults.mk: the cross compiler settings and the
CFLAGS, CXXFLAGS, CPPFLAGS and LDFLAGS the build system passes. The
library is configured with autoconf's own -g -O2 and built for the
toolchain's default architecture instead, without the target CPU flags,
the hardening flags and -ffile-prefix-map. On x86/geode that also costs
the 64-bit atomics: at the default -march=i486 the compiler cannot
inline them and emits __atomic_load_8 and __atomic_store_8 calls, so
every binary linking the static library needs libatomic.
Fixes: 13a058bed6 ("libtorrent: update to 0.15.3")
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
This version bump includes fixes for the following CVEs:
- CVE-2026-66046
- CVE-2026-72522
- CVE-2026-76641
- CVE-2026-76956
- CVE-2026-76957
Full release notes:
https://github.com/libexpat/libexpat/blob/master/expat/Changes
Signed-off-by: Wei-Ting Yang <williamatcg@gmail.com>
Update c-ares from 1.34.6 to 1.34.8.
Version 1.34.7 includes the following security fixes:
* CVE-2026-33630 (GHSA-6wfj-rwm7-3542): fix a use-after-free /
double-free issue in query-completion handling.
* CVE-2026-69184 (GHSA-pjmc-gx33-gc76): limit DNS name compression
pointer traversal to prevent CPU-exhaustion denial of service.
* CVE-2026-69186 (GHSA-jv8r-gqr9-68wj): validate DNS record counts
before allocation to prevent memory-amplification denial of service.
It also fixes the UDP socket exhaustion regression introduced in 1.34.6.
Version 1.34.8 reverts an unintended API break introduced in 1.34.7 by
the callback parameter const changes.
Signed-off-by: Karen Khachatryan <karen0734@gmail.com>
Two fixes to the maintenance and search timers, both of which cost a
node contacts it should have had.
Neighbourhood maintenance for both address families was gated on a
single flag that either family's bucket maintenance could set. Bucket
maintenance only confirms nodes that are already known, while
neighbourhood maintenance is what grows the table, so a family whose
nodes never answer held back table growth for the other family too. A
node with no route for one family still holds addresses of that family,
because they arrive in the replies of the other, so this reaches any
single-stack node on a dual-stack build. Each family is now gated on
its own bucket maintenance, and the number of queries per round is
unchanged.
A search step scheduled for exactly its due second returned without
sending anything, because the comparison required the second to have
passed rather than arrived. The early return left the step time alone,
so the search then waited another full interval having sent nothing.
Reset PKG_RELEASE, since the source version changed.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
libjuice's vendored picohash guards the final byte-order swap in
_picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while
endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets
the swap runs when it must not and every SHA-1 digest is emitted with each
32-bit word reversed, taking HMAC-SHA1 with it.
libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64,
powerpc and every other big-endian target each ICE connectivity check is
rejected as failing integrity. No candidate pair is nominated and no
session can be established. picohash is the default backend, as USE_NETTLE
is off, so this affects the package as built here.
Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE
agent loops with "STUN integrity check failed" and never leaves the
connecting state; after it the agent reaches completed and a session comes
up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1
vector for "abc" both fail before and pass after.
Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored
copy's origin, kazuho/picohash#13.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
On big-endian hosts the server parsed every tcpip-forward bind port as
zero and bound an ephemeral port, so -R remote forwarding never carried
a connection. With no usable entropy source the library crashed inside
mbedtls instead of failing cleanly.
Patches 2-4 were sent upstream to the libssh mailing list:
https://archive.libssh.org/libssh/2026-08/0000000.htmlhttps://archive.libssh.org/libssh/2026-08/0000001.html
Patch 1 backports the seed-failure error path they depend on from
upstream master commit ac4b723c.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
- added a meson.build alongside the existing Makefile, giving more
control for implementing additional features such as optional symbol
versioning (#81, #77)
- added optional versioned symbols when compiling via meson, opt out
with -Dsymbol-versioning=disabled (#82, fixes#77)
This package still builds via the traditional Makefile (no meson.mk
included), which upstream keeps alongside the new meson.build; SONAME
is unchanged (libudev.so.1).
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
It seems these softwares are no longer maintained,
because the latest upstream commit is 7 years ago.
I think Wi-Fi 7 MLO provides similar feature.
This commit drops macremapper, libdcwproto, libdcwsocket,
dcstad, mrmctl and dcwapd.
Signed-off-by: Yanase Yuki <dev@zpc.st>
1.15: fix potential 4 MB on-stack allocation / stack-based buffer overflow
in the OLE2 plugin.
1.16: security fix to not honour LIBEXTRACTOR_PREFIX when linked into a
SUID binary running as root; fix tIME chunk parser in PNG plugin, QT
mime-type detection, wrong constant in REAL plugin, multi-chunked
decompression in DEB plugin, GIF plugin memory leak, W32 IPC error
handling, gzip-compressed header bit-flags.
1.17: fix various minor issues, including a missing 0 terminator in ZIP
handling under particular circumstances.
1.18: detect secure execution mode properly when deciding whether to
honour LIBEXTRACTOR_PREFIX (use secure_getenv()/issetugid()/real vs
effective UID-GID instead of only checking for root).
1.19: add RTF and msoffice plugins; fix bugs and performance issues in
the unzip logic, an offset calculation issue in the WAV extractor, and
minor memory leaks in the ELF extractor; add OSS-Fuzz support.
Add the two new plugins to PLUGINS so they actually get built and
packaged rather than compiled and silently dropped. Per
src/plugins/Makefile.am upstream, neither needs a new dependency:
libextractor_rtf is unconditional (same group as the already-packaged
riff/ps plugins), and libextractor_msoffice only requires HAVE_ZLIB
(same group as the already-packaged deb/odf/zip plugins), which is
already satisfied.
Not build-verified: a pre-existing host python3/ncurses build failure
affecting every package in this feed blocks the build well before it
reaches libextractor's own compile step.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
1.0.10:
* Fix race in thread-per-connection mode on wake-up signal
* Fix rare assertion failure in relation to suspend-and-resume processing
1.0.9:
* Enfocing a minimal size on the PSK.
* Fix support for red zones in memorypool.
* Fix rare over-writing of HTTP version string
* Fix rare crash from adding connection
1.0.8:
* Fixing vulnerabilities
1.0.7:
* Fixing various vulnerabilities
1.0.6:
* Fix various minor issues, like theoretical integer overflows for extreme inputs or NULL
1.0.5:
* Also ensuring other HTTP client headers that should be unique are unique.
1.0.4
* Fixed bug where additional "Content-Length" headers were ignored
1.0.3:
* Fixed bug in connection list traversal logic that could
Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
Security release from 18.4 (18.5 was never released, pulled post-wrap
due to a regression). A dump/restore is not required for those running
18.x, but see the migration notes below for the first three security
fixes, GIN index reltuples corruption, and btree_gist/ltree reindexing.
- restrict logical decoding output plugins to a new
output_plugin_libraries allowlist; previously a replication user
could load any library for logical decoding (CVE-2026-6471)
- fix contrib/pgcrypto PGP encryption to detect unsupported ciphers;
previously an OpenSSL cipher rejection (e.g. FIPS mode) was ignored
and pgcrypto silently XORed plaintext instead of encrypting it
(CVE-2026-14663)
- fix psql to skip in-line data following a scripted
"COPY ... FROM STDIN" even when the COPY fails before
PGRES_COPY_IN, closing a SQL-injection hazard in scripts that
exercise failing COPY commands (CVE-2026-6464)
- cross-check the output row type of a portal running EXECUTE/FETCH;
divergent declared row types between the outer and inner portal
could lead to server memory disclosure and arbitrary code execution
(CVE-2026-16239)
- fix a buffer overrun with a long time zone abbreviation in
to_char(), which could crash the server or be exploited for
arbitrary code execution (CVE-2026-14669)
Plus a variety of other fixes from 18.4; see the upstream release notes
for the complete list.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Security fix release; hiredis 1.4.x users are recommended to upgrade.
- prevent arbitrarily nested replies from causing a stack overflow
(PR #1340)
- protect against overflow of map elements (PR #1341)
Both issues were found by He Huang (Swinburne University of Technology)
using NexusSan fuzzing.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
2.1.1:
- gpgme_op_export now also returns operational errors
- w32: improved debug output in spawn/selection functions, improved
serialization between reader and writer threads, added CRLF handling
for armored output in gpgme-json
2.1.2:
- w32: fixed a syntax error
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
0.4.19:
- added native KEYMGMT, SIGNATURE and ASYM_CIPHER operations to the
PKCS#11 provider, enabling OpenSSL 4.x support and improving RSA
interoperability
- added support for ML-DSA, SLH-DSA and FALCON key generation, signing
and verification; PQC key generation examples and provider tests
- added PKCS#11 provider support for ECDH, X25519 and X448 key exchange,
including X25519/X448 key generation
- improved Ed25519/Ed448 public-key resolution with certificate fallback
- fixed use-after-free crashes after enumerating additional PKCS#11 keys
- fixed a potential out-of-bounds write while parsing PKCS#11 URI
attributes
- fixed PKCS#11 session, attribute and key-reference leaks
0.4.20:
- added PKCS#11 3.2 interface discovery and updated the bundled header
to version 3.2
- added PKCS#11 provider support for ML-KEM-512/768/1024 key generation,
encapsulation and decapsulation
- added PKCS11_evp_pkey_decapsulate() API
- added provider signature AlgorithmIdentifier support, including
RSA-PSS parameters and correct default salt length handling
- fixed RSA-PSS salt length parsing and spurious OpenSSL errors
- fixed session-pool races and deadlocks during concurrent key
generation and cryptographic operations
- fixed key-cache and OpenSSL 1.x RSA object use-after-free bugs
- fixed provider EC parameter lifetime handling and resource leaks
during EC, RSA, EdDSA and XDH operations and context cleanup
- fixed installation of p11_ver.h, required by p11_err.h
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
A small, auditable, portable cryptographic library. It provides the
BLAKE2b and Ed25519 primitives that an mbedTLS-based libssh lacks, so
comrade can follow that backend without pulling in libcrypto.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
KCP, a reliable ARQ protocol offering a TCP-like ordered stream over an
unreliable datagram transport. Built shared as libkcp with an imposed
soname, since upstream sets none.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
A lightweight ICE (RFC 8445) library with STUN, for peer-to-peer UDP
hole punching. Needed by comrade; also usable on its own.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The library installed as a bare libdht.so with no SONAME, so consumers
recorded the filename as their DT_NEEDED and there was no way to express
an ABI break. Build it as libdht.so.0 with a matching soname and declare
ABI_VERSION, so the package is versioned like any other shared library.
jech/dht makes no ABI promise of its own, so 0 is a packaged ABI epoch:
bump PKG_ABI_VERSION if the exported surface changes. That epoch is now
a single variable referenced from ABI_VERSION, the soname, the output
filename and the symlink target, rather than repeated literally in all
four places, matching the pattern already used by libcurl-gnutls.
Also pass TARGET_CFLAGS/TARGET_CPPFLAGS/TARGET_LDFLAGS to the compile
and link, which the hand-written rules had skipped, and fix
PKG_LICENSE_FILES: jech/dht ships LICENCE, not LICENSE, so the declared
file was never found.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
In actions-shared-workflows the version is now checked in
test-version.sh, while test.sh is left for the generic tests.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
Update from the 6.2.x series to the current 8.x line. The 8.x releases
are tri-licensed (RSALv2 / SSPLv1 / AGPL-3.0); set PKG_LICENSE to
AGPL-3.0-only and follow upstream renaming COPYING to LICENSE.txt.
Drop 020-fix-atomicvar.patch, no longer needed, and keep
030-skip-module-tests.patch. Add a functional test.sh.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
1.4.1 ships as a .tar.xz (the .tar.gz is gone), so switch PKG_SOURCE to
.tar.xz; the @GNU mirror still serves it. Replace 001-only-src.patch
(SUBDIRS = src) with PKG_SUBDIRS:=src so tests/doc/tools stay unbuilt.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Remove the quiet mode flag (-q) from grep in version check commands
to ensure that their stdout output is visible.
While at it, switch the remaining regex matches (perl, sscep, awscli) to
fixed-string matching where appropriate, so that special characters in the
version string are matched literally.
For libzip, the zipcmp and zipmerge branches ran grep and then
unconditionally exited 0, so a version mismatch was never reported and
the version check override always passed.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
001-cmake4.patch backported the unreleased upstream commit 52b803f. The
buildroot's CMake 4 only needs the raised minimum (FindPythonInterp still
resolves), so replace it with -DCMAKE_POLICY_VERSION_MINIMUM=3.5.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
When libapparmor installs headers and libraries for build, libextractor
picks it up and fails with "missing dependencies libapparmor.so.1").
Disable it explicitly via configure.
Fixes: https://github.com/openwrt/packages/pull/30068#issuecomment-5107754731
Fixes: 3253c6c9b ("apparmor: stage libapparmor headers via InstallDev")
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Update to the latest upstream stable release.
Also, add backslash for CMake options, so that they get activated.
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Add pending patches submitted upstream, which fix the build failures
discovered on powerpc with musl, and drop the powerpc exclusion from
DEPENDS.
Patches are from https://github.com/gperftools/gperftools/pull/1616
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
The license 'GPL-2.0+' is marked deprecated. Use instead
'GPL-2.0-or-later' identifier.
https://spdx.org/licenses/GPL-2.0+.html
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The license 'GPL-2.0+' is marked deprecated. Use instead
'GPL-2.0-or-later' identifier.
https://spdx.org/licenses/GPL-2.0+.html
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The license 'GPL-2.0+' is marked deprecated. Use instead
'GPL-2.0-or-later' identifier.
https://spdx.org/licenses/GPL-2.0+.html
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
The license 'GPL-2.0+' is marked deprecated. Use instead
'GPL-2.0-or-later' identifier.
https://spdx.org/licenses/GPL-2.0+.html
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Daniel Golle
Wei-Ting Yang
Romain Isnel
Karen Khachatryan
Yanase Yuki
Alexander Couzens
Josef Schlehofer
Alexandru Ardelean
Hirokazu MORIKAWA
Lukas Voegl
Eric Luehrsen
Florian Eckert
Jan Klos