3da6c104f0f5 database: use APK_DB_LAYER_ROOT in more places
5437e3abada1 audit: add usr/lib/apk to the list of protected paths under --full
de9baf912245 change default db location to /usr, but detect and use /lib if exists
218fdaa1a1a2 context: close root_fd on free
d33294236cb4 database: add support for only-when-modified trigger paths
36935db0ef3b package: fix memfd_create warnings on Linux kernels < 6.7
1c3fc36051a3 blob: add and use apk_blob_trim_{start,end}
af5f9e3f93b0 pkg: fix v3 package size setting to installeddb
9428e34694c8 version: allow --check and --test to work without database
4b4add5326a8 test: fix unit test registration function to be unique
eac18cb200d4 test: add testlib.sh for user tests
20dae205b006 mkpkg: fix creation of package with hardlinks
7bdecdca6a95 pkg: only allow tags in world and some commands
76de228bcc0b commit: show tags of world constrains
9a1b1cf68420 test: use testlib for solver.sh
99fc2a2a5efc test: remove dependency on GNU tar
6927746b9a10 Revert usrmerge/LFS related changes to apk used paths
5d287a9b06e9 apk-tools-3.0.0_pre5
8d93a79fb895 mkpkg: fix hardlink on big-endian system
Link: https://github.com/openwrt/openwrt/pull/17148
Signed-off-by: Robert Marko <robimarko@gmail.com>
Rename jffs2reset to factoryreset. Convert all scripts to using the new command
line. Print a deprecation notice when jffs2reset is invoked.
49d36ba jffs2reset: rename to factoryreset
b135064 jffs2reset: print deprecation message
Signed-off-by: John Crispin <john@phrozen.org>
libapk as a library is used nowhere else and makes no sense to link it
shared. By linking static, we can take advantage of LTO and get the size
reduced further.
Some numbers locally:
Before:
168K staging_dir/target-mips_24kc_musl/root-ath79/usr/bin/apk*
252K staging_dir/target-mips_24kc_musl/root-ath79/usr/lib/libapk.so.2.99.0*
Static:
344K staging_dir/target-mips_24kc_musl/root-ath79/usr/bin/apk*
Static + LTO:
305K staging_dir/target-mips_24kc_musl/root-ath79/usr/bin/apk*
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17109
Signed-off-by: Robert Marko <robimarko@gmail.com>
Currently we're going to ship all the apk keys in the keyring, but the
preference is to ship and use single release/branch specific key so lets
use openwrt-snapshots.pem for apk explicitly as well.
Fixes: 2cea050024 ("openwrt-keyring: add apk public key for signing of package indexes")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/16852
Signed-off-by: Robert Marko <robimarko@gmail.com>
This reverts commit 37784c48e9 as the
preference is to have single explicit key for each release/branch.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/16852
Signed-off-by: Robert Marko <robimarko@gmail.com>
It seems that we have some kind of a symbol name conflict which causes
CONFIG_SECCOMP to always be read as y.
Unfortunatelly, I could not figure out what is causing this, but simply
renaming SECCOMP to USE_SECCOMP seems to properly work and leaves the
symbol unset unless arch dependencies are satisfied.
This fixes qoriq and others that dont support seccomp from failing due
to procd-seccomp package being selected to get included but it cannot be
built for them:
ERROR: unable to select packages:
procd-seccomp (no such package):
required by: base-files-1637~52b6c92479[procd-seccomp]
Fixes: 4c65359af4 ("build: fix including busybox, procd and apk/opkg in imagebuilder")
Link: https://github.com/openwrt/openwrt/pull/17048
Signed-off-by: Robert Marko <robimarko@gmail.com>
Allows us to drop the description backport.
Changes:
e3464d0 db: make repository description an atom instead of allocation
417a93c pkg: truncate apkv3 description to 256 bytes
d26b65d db, audit: remove support for files without embedded checksum
64ff8c7 db: allow files starting with a dot in the root directory of apk3 packages
89e4bf1 db, fs: do not extract devices in --usermode
4050f9e db: fix hardlink handling: root directory and v3 checksums
ade0be3 db, extract: handle file/directory extraction errors more consistently
a4837ae package: don't call make_device_tree when APK_NO_CHROOT is set
1e04115 package: respect libexecdir instead of hard-coding /usr/libexec
76970a9 package: move the location of executable package scripts
19b1df7 blob: refactor apk_blob_for_each_segment into apk_blob_foreach_word
e38d5b5 test: add missing alpine tests makefile
fcd4def test: move vertest to cmocka based unit testing infrastructure
8a13ed9 test: fix solver.sh for parallel use
5add6fc (tag: v3.0.0_pre4) apk-tools-3.0.0_pre4
5dd91e3 db: consider --force-no-chroot when determining /dev/fd availability
d86afde db: print message when a file is written to .apk-new
a5aeb3d test: unify makefile and meson tests
a236fdd pkg: use memfd_create only if target root has dev/fd working
563d364 tests: minor updates to root tests
08b4d21 tests: move solver test data to separate directory
c259642 tests: rework solver tests to not require apk-test binary
d2aaf13 commit: sort matched dependencies on error analysis
98d7196 db: fix permissions of arch file
b231eac db: simplify add_repos_from_file
2a3dbfc db: add and use apk_db_parse_file helper to parse files line by line
c1a3e69 db: validate package arch against compatible arches
Link: https://github.com/openwrt/openwrt/pull/17015
Signed-off-by: Robert Marko <robimarko@gmail.com>
Analog to how we handle custom feeds in opkg, add a customfeeds.list for
custom package feeds and mark it as a configuration file.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16940
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Currently its not possible to generate apk package.adb package index if
the package has longer description field, which leads to following
failure:
(2352/2353) Installing zoneinfo-all (2024b-r1)
(2353/2353) Installing zstd (1.5.6-r1)
ERROR: System state may be inconsistent: failed to write database: No buffer space available
1 error; 2704 MiB in 2353 packages
The code to read/write installeddb does not really handle long
description well. Until the database is converted to apkv3 format,
truncate the apkv3 descriptions to allow existing code to work.
APKv3 index and packages still contain the original long description
unmodified, so no package rebuild will be needed.
Fixing the issue by backporting the single upstream fix as its not
possible to to upstep apk to the latest Git HEAD due to some
regressions, see commit 692052cdc0e7 ("Revert "apk: update to Git
417a93ceae540444fdbd3f76d1dadf0e15621fdc (2024-11-13)"") for more
details.
Fixes: #16929
References: https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/11038
Upstream-Status: Backport [417a93ceae]
Link: https://github.com/openwrt/openwrt/pull/16951
Signed-off-by: Petr Štetiar <ynezz@true.cz>
7330fa5 initd: mount /sys and /proc with MS_RELATIME
Fixes mounting /proc in unpriviledged user namespace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Explicitly enable help so that the build will fail when an appropriate
lua binary isn't found instead of silently disabling the feature.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Most apk meson args are shared between host and target builds, so lets
have a common variable for them.
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Commit b2a84c86e3 ("apk: host: make the help available") enabled the
host build for lua (5.1) as a dependency, but apk defaults to lua 5.3.
This caused it to ignore our lua, and only build the help if the host
system had lua 5.3 installed.
Fix this by explicitly setting the lua version to ours.
Fixes: b2a84c86e3 ("apk: host: make the help available")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
This reverts commit c6a3a11c07 as it was
reported, that it causes issues:
ERROR: failed to read repositories: /dev/zero: No buffer space available
ERROR: unable to select packages:
ca-bundle-20240203-r1:
error: uninstallable
arch: all
satisfies: world[ca-bundle]
Reported-by: xiao bo <peterwillcn@gmail.com>
References: c6a3a11c07 (commitcomment-149072959)
Signed-off-by: Petr Štetiar <ynezz@true.cz>
c1a3e69f24e2 db: validate package arch against compatible arches
2a3dbfc9db58 db: add and use apk_db_parse_file helper to parse files line by line
b231eacd8121 db: simplify add_repos_from_file
98d7196a48d4 db: fix permissions of arch file
d2aaf13ee488 commit: sort matched dependencies on error analysis
c259642c006d tests: rework solver tests to not require apk-test binary
08b4d21f922e tests: move solver test data to separate directory
563d36481166 tests: minor updates to root tests
a236fdd39040 pkg: use memfd_create only if target root has dev/fd working
a5aeb3db113f test: unify makefile and meson tests
d86afdef88b0 db: print message when a file is written to .apk-new
5dd91e3c387d db: consider --force-no-chroot when determining /dev/fd availability
5add6fce22d4 apk-tools-3.0.0_pre4
8a13ed96d1d5 test: fix solver.sh for parallel use
fcd4defc18e6 test: move vertest to cmocka based unit testing infrastructure
e38d5b5a9d04 test: add missing alpine tests makefile
19b1df79ebca blob: refactor apk_blob_for_each_segment into apk_blob_foreach_word
76970a938dd7 package: move the location of executable package scripts
1e0411568dad package: respect libexecdir instead of hard-coding /usr/libexec
a4837ae8ffe2 package: don't call make_device_tree when APK_NO_CHROOT is set
ade0be3449e4 db, extract: handle file/directory extraction errors more consistently
4050f9e69d2e db: fix hardlink handling: root directory and v3 checksums
89e4bf1db040 db, fs: do not extract devices in --usermode
64ff8c72d9fb db: allow files starting with a dot in the root directory of apk3 packages
d26b65d30f55 db, audit: remove support for files without embedded checksum
417a93ceae54 pkg: truncate apkv3 description to 256 bytes
Fixes: #16929
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Since the image builder pulls package lists from metadata directly,
add procd and busybox as depdendencies to base-files.
As for the package manager itself, since it can be disabled it needs
to be added directly in the image builder makefile
Fixes: 44598c233d ("build: remove broken dependency of metadata on toplevel .config variables")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Instead of relying on .config symbols for metadata, alter the DEFAULT
variable of affected packages. Fixes enabling opkg vs apk among others.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Mark the package as nonshared to build it in the target specific build
step 1 of the build bots instead of the architecture generic build step 2.
In the build step 2 it may be left out if we build it using a different
target.
Fixes: #16857
Link: https://github.com/openwrt/openwrt/pull/16859
Signed-off-by: Robert Marko <robimarko@gmail.com>
@KA2107 reported that opkg is not able to verify the artifact signatures
produced by buildbot using the usign 24.10 release keys. So lets fix it
by actually adding the 24.10 usign key with d310c6f2833e97f7 fingerprint
into the openwrt-keyring package.
Fixes: #16850
Reported-by: @KA2107
Fixes: a535cfc09e ("openwrt-keyring: add OpenWrt 24.10 release build usign key")
Signed-off-by: Petr Štetiar <ynezz@true.cz>
65bb027 CMakeLists.txt: bump minimum cmake version
252a9b0 libubus: Make UBUS_* macros work cleanly in C++
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
apk/openwrt-snapshots.pem contains Elliptic Curve based public key which
is going to be used for signing of apk's package.adb package indexes
after the builds using `apk adbsign --sign-key <key> packages.adb`
command on the buildbot.
References: https://github.com/openwrt/buildbot/pull/46
Link: https://github.com/openwrt/openwrt/pull/16539
Signed-off-by: Petr Štetiar <ynezz@true.cz>
bcc091d session: Fix crash when the UCI option 'password' or 'username' is missing
9f4b86e rpcd: iwinfo: add IEEE 802.11be support
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Specification:
- MT7629 CPU
- MT7531 switch
- MT7761N and MT7762N wifi
- 256 MB RAM
- 128 MB NAND flash with dual-boot partitions
- 2 buttons: WPS and reset
- 1 WAN port (1G)
- 4 LAN ports (1G)
- 1 USB port
Limitations (same as other MT7629/MT7761N/MT7762N devices):
- Wifi is not working
- Second core is not working (kernel error message "CPU1: failed to come online")
Disassembly:
- There are two screws under the front rubber feet and two under the label on the bottom (in the corners towards the back, you should be able to feel them).
Serial Interface:
- UART pin header is already soldered on the board. Pinning from front to back:
1 - VCC
2 - TX
3 - RX
4 - n/a
5 - GND
GPIO:
- 1 white LED, connected to GPIO 52
- 1 reset button, connected to GPIO 60
- 1 WPS button, connected to GPIO 58
MAC Adresses:
- The MAC address printed on the device label is used for LAN and WAN
- The MAC address is stored in the devinfo partition in ASCII format (hw_mac_addr=aa:bb:cc:dd:ee)
- 2.4 GHz wifi uses MAC of the device label + 1
- 5 GHz wifi uses MAC of the device label + 2
Flashing:
- OpenWrt is only runnig in the first partition of dual boot
- To ensure to be able to go back to the factory image, flash the last OEM firmware via OEM web interface. This will ensure that the OEM firmware is present on both partitions
- Because of dual boot partitions, flashing via OEM interface is not supported
- Start a TFTP server and provide the initramfs image. Default settings:
- Router IP: 192.168.1.1
- TFTP server IP: 192.168.1.100
- TFTP file name: 7531.bin
- Open the device, connect UART and select " 1. System Load Linux to SDRAM via TFTP." during startup
- Adapt the settings to your environment, if required
- After initramfs is booted, flash the sysupgrade image
Return to OEM firmware:
- Run the following commands in OpenWrt to switch to the second partition
fw_setenv boot_part 2
fw_setenv bootimage 2
- Reboot the device. OEM firmware will start up again
Signed-off-by: Roland Reinl <reinlroland+github@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/16067
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Initially APK would sign packages and package index and verify
signatures individually. With the latest change, all packages inside a
trusted index are automatically trusted.
This is important within the OpenWrt eco-system since signing the index
happens on another machine than the package creation.
Signed-off-by: Paul Spooren <mail@aparcar.org>
408c2cc libfstools: skip JFFS2 padding when BLOCKSIZE was given
013050f fstools: remove redundant F2FS_MINSIZE definition
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Currently, the apk utility lacks accessible help documentation, making
it cumbersome for human users:
apk-tools 3.0.0_pre20240519, compiled for x86_64.
ERROR: This apk-tools has been built without help
This absence of help forces users to delve into the apk's build
directory to understand its functionality. To enhance usability, we will
enable the help feature for the host build. The host environment can
accommodate the 3% increase in binary size for the added convenience.
On Ubuntu 22.04, x86_64 platform, the apk size increases by 17,816 bytes
(from 594,144 to 611,960 bytes), a 2.99% increase. This is a reasonable
trade-off for improved ergonomics.
Additionally fix the Lua host build dependency as apk-tools uses during
the build Lua to convert SCDOC manpages to apk-tools help messages.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Link: https://github.com/openwrt/openwrt/pull/15543
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
containing fixes around tar and internal checksums.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/15646
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Enable trx feature of mtd command to fixup trx length and crc32 while
booting for some Buffalo devices.
Signed-off-by: INAGAKI Hiroshi <musashino.open@gmail.com>
Drop downstream mbedtls patch since it went upstream.
Signed-off-by: Paul Spooren <mail@aparcar.org>
Link: https://github.com/openwrt/openwrt/pull/15522
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
The host build would need Lua to compile which currently adds a race
condition. Instead of tracking that down just disable helptext for the
host build.
Signed-off-by: Paul Spooren <mail@aparcar.org>
A new option called `USE_APK` is added which generated APK packages
(.apk) instead of OPKG packages (.ipk).
Some features like fstools `snapshot` command are not yet ported
Signed-off-by: Paul Spooren <mail@aparcar.org>
We simply grep for "src/". So no need for "\/".
Furthermore, since grep-3.8 this creates warnings.
As written in the grep-3.8 announcement:
Regular expressions with stray backslashes now cause warnings, as
their unspecified behavior can lead to unexpected results.
For example, '\a' and 'a' are not always equivalent
<https://bugs.gnu.org/39678>.
Fixes a warning during the first boot:
grep: warning: stray \ before /
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
mDNS broadcast can't accept empty TXT record and would fail
registration.
Current procd_add_mdns_service checks only if the first passed arg is
empty but don't make any verification on the other args permittins
insertion of empty values in TXT record.
Example:
procd_add_mdns "blah" \
"tcp" "50" \
"1" \
"" \
"3"
Produce:
{ "blah_50": { "service": "_blah._tcp.local", "port": 50, "txt": [ "1", "", "3" ] } }
The middle empty TXT record should never be included as it's empty.
This can happen with scripts that make fragile parsing and include
variables even if they are empty.
Prevent this and make the TXT record more solid by checking every
provided TXT record and include only the non-empty ones.
The fixed JSON is the following:
{ "blah_50": { "service": "_blah._tcp.local", "port": 50, "txt": [ "1", "3" ] } }
Fixes: b0d9dcf84d ("procd: update to latest git HEAD")
Reported-by: Paul Donald <newtwen@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/15331
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
APK (Alpine Package Keeper) is the package manager of Alpine Linux and
has multiple advantages over OPKG. While Alpine uses APK version 2, this
commit adds version 3 with a heavily optimised database structure and
additional feature making it suitable for OpenWrt.
This commit will be followed by many more to add APK build capabilities
to the OpenWrt build system, firstly enabling side by side builds of APK
and OPKG packages, later replacing OPKG entirely.
Signed-off-by: Paul Spooren <mail@aparcar.org>
When using zst instead of xz, the hash changes.
This was missed in the initial treewide updated.
Fixes: b3c1c57a35 ("treewide: update PKG_MIRROR_HASH to zst")
Signed-off-by: Robert Marko <robimarko@gmail.com>
When using zst instead of xz, the hash changes. This commit fixes the
hash for packages and tools in core.
Signed-off-by: Paul Spooren <mail@aparcar.org>
254810d16cf1 watchdog: always close fd on watchdog stop
946552a7b598 trace: use standard POSIX header for basename()
Signed-off-by: Robert Marko <robimarko@gmail.com>
79f8cfa58ee7 ci: add github test workflow
428f40e7984f test commit fixing warnings
63058d1f81a5 ci: enable ujail builds
49ea930a862c utils: add key-value offset support to get_cmdline_val()
ca8c30208d5e inittab: fallback when multiple "console=" is detected
Required for the recent Elecom multiple console commits.
Signed-off-by: Robert Marko <robimarko@gmail.com>
Different from OPKG, APK uses a deterministic version schema which chips
the version into chunks and compares them individually. This enforces a
certain schema which was previously entirely flexible.
- Releases are added at the very and end prefixed with an `r` like
`1.2.3-r3`.
- Hashes are prefixed with a `~` like `1.2.3~abc123`.
- Dates become semantic versions, like `2024.04.01`
- Extra tags are possible like `_git`, `_alpha` and more.
For full details see the APK test list:
https://gitlab.alpinelinux.org/alpine/apk-tools/-/blob/master/test/version.data
Signed-off-by: Paul Spooren <mail@aparcar.org>
Using := doesn't fly well when including other variables. In fact this
would cause the variable to be empty and break cloning of the git repo.
Fix: "c354c069b3 uci: fix Makefile formatting"
Signed-off-by: Paul Spooren <mail@aparcar.org>
97bacb70138a libfstools: query drivers by priority
41e619ed1352 block: recognize /dev/fit* block devices
bc3b8cdd3de3 libfstools: add uImage.FIT fitblk driver
846302d09246 libfstools: partname: raise priority to 25
1a5695925ecf mount_root: add support for passing args to mount_root start
1858a492c300 mount_root: permit to pass mount options for rootfs mount
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Linksys MX4200 is a 802.11ax Tri-band router/AP.
Specifications:
* CPU: Qualcomm IPQ8174 Quad core Cortex-A53 1.4GHz
* RAM: 512MB of DDR3
* Storage: 512Mb NAND
* Ethernet: 4x1G RJ45 ports (QCA8075)
* WLAN:
* 2.4GHz: Qualcomm QCN5024 2x2 802.11b/g/n/ax 574 Mbps PHY rate
* 5GHz: Qualcomm QCN5054 2x2@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* 5GHz: Qualcomm QCN5054 4x4@80MHz or 2x2@160MHz 802.11a/b/g/n/ac/ax 2402 PHY rate
* LED-s:
* RGB system led
* Buttons: 1x Soft reset 1x WPS
* Power: 12V DC Jack
Installation instructions:
Open Linksys Web UI - http://192.168.1.1/ca or http://10.65.1.1/ca depending on your setup.
Login with your admin password. The default password can be found on a sticker under the device.
To enter into the support mode, click on the “CA” link and the bottom of the page.
Open the “Connectivity” menu and upload the squash-factory image with the “Choose file” button.
Click start. Ignore all the prompts and warnings by click “yes” in all the popups.
The Wifi radios are turned off by default. To configure the router, you will need to connect your computer to the LAN port of the device.
Then you would need to write openwrt to the other partition for it to work
- First Check booted partition
fw_printenv -n boot_part
- Then install Openwrt to the other partition if booted in slot 1:
mtd -r -e alt_kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin alt_kernel
- If in slot 2:
mtd -r -e kernel -n write openwrt-qualcommax-ipq807x-linksys_mx4200v(X)-squashfs-factory.bin kernel
Replace (X) with your model version either 1 or 2
Signed-off-by: Mohammad Sayful Islam <sayf.mohammad01@gmail.com>
Reviewed-by: Robert Marko <robimarko@gmail.com>
d852f877920b service: Fix retriggering of init.d-scripts.
7e6c6efd6fbc udebug: add support for logging via udebug
Signed-off-by: Felix Fietkau <nbd@nbd.name>
2b39a27d8bcc libubus: fix reconnect with auto subscribe
f84eb5998c6e libubus: fix initial subscribe with autosubscribe
Signed-off-by: Felix Fietkau <nbd@nbd.name>
3a07943 block: support skipping uuid check
56a9b4e block: consider currently mounted root device first
9cd09d4 block: try to find the root device on both / and /rom
c1a8d95 block: support extroot on already mounted overlay
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Some packages won't ever have something to patch as they normally
install files or are meta-packages.
For these special packages, disable QUILT refresh.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
This is needed for ksh/bash style process substitution such as
<(command) and >(command) which was introduced in ash as of busybox
version 1.34.0 to work.
Signed-off-by: Erik Karlsson <erik.karlsson@genexis.eu>
Due to some hiccup my local urngd-2023-07-25-7aefb47b.tar.xz ended up
being different from archived one. Repackaging it locally confirmed the
previous hash was incorrect.
Fixes: c74b5e09e6 ("urngd: update to the latest master")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
The existing implementation incorrectly reported `running` for services
without any instances or with all instances stopped/terminated.
Improve the default implementation of `/etc/init.d/* status` to properly
report services with not running instances. In case a service exists,
but without running instance, the status call will now report
"not running" with exit code 5. In case some instances are running and
some are stopped/terminated, the call will report "running (X/Y)" where
`X` denoted the amount of running instances and `Y` the amount of total
registered ones.
Ref: https://forum.openwrt.org/t/x/159443
Signed-off-by: Jo-Philipp Wich <jo@mein.io>
7aefb47 jitterentropy-rngd: update to the v1.2.0
What's interesting about jitterentropy-rngd v1.2.0 release is that it
bumps its copy of jitterentropy-library from v2.2.0 to the v3.0.0. That
bump includes a relevant commit 3130cd9 ("replace LSFR with SHA-3 256").
When initializing entropy jent calculates time delta. Time values are
obtained using clock_gettime() + CLOCK_REALTIME. There is no guarantee
from CLOCK_REALTIME of unique values and slow devices often return
duplicated ones.
A switch from jent_lfsr_time() to jent_hash_time() resulted in many less
cases of zero delta and avoids ECOARSETIME.
Long story short: on some system this fixes:
[ 6.722725] urngd: jent-rng init failed, err: 2
This is important change for BCM53573 which doesn't include hwrng and
seems to have arch_timer running at 36,8 Hz.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Based on Paul Fertser <fercerpav@gmail.com>'s guidance:
Change AUTORELEASE in rules.mk to:
```
AUTORELEASE = $(if $(DUMP),0,$(shell sed -i "s/\$$(AUTORELEASE)/$(call commitcount,1)/" $(CURDIR)/Makefile))
```
then update all affected packages by:
```
for i in $(git grep -l PKG_RELEASE:=.*AUTORELEASE | sed 's^.*/\([^/]*\)/Makefile^\1^';);
do
make package/$i/clean
done
```
Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>
Specifications:
SOC: Atheros/Qualcomm QCA9557-AT4A @ 720MHz
RAM: 2x Winbond W9751G6KB-25 (128 MiB)
FLASH: Hynix H27U1G8F2BTR-BC TSOP48 ONFI NAND (128 MiB)
WIFI1: Atheros AR9550 5.0GHz (SoC)
WIFI2: Atheros AR9582-AR1A 2.4GHz
WIFI2: Atheros AR9582-AR1A 2.4GHz + 5GHz
PHYETH: Atheros AR8035-A, 802.3af PoE capable Atheros (1x Gigabit LAN)
LED: 1x Power-LED, 1 x RGB Tricolor-LED
INPUT: One Reset Button
UART: JP1 on PCB (Labeled UART), 3.3v-Level, 115200n8
(VCC, RX, TX, GND - VCC is closest to the boot set jumper
under the console pins.)
Flashing instructions:
Depending on the installed firmware, there are vastly different
methods to flash a MR18. These have been documented on:
<https://openwrt.org/toh/meraki/mr18>
Tip:
Use an initramfs from a previous release and then use sysupgrade
to get to the later releases. This is because the initramfs can
no longer be built by the build-bots due to its size (>8 MiB).
Note on that:
Upgrades from AR71XX releases are possible, but they will
require the force sysupgrade option ( -F ).
Please backup your MR18's configuration before starting the
update. The reason here is that a lot of development happend
since AR71XX got removed, so I do advise to use the ( -n )
option for sysupgrade as well. This will cause the device
to drop the old AR71xx configuration and make a new
configurations from scratch.
Note on LEDs:
The LEDs has changed since AR71XX. The white LED is now used during
the boot and when upgrading instead of the green tricolor LED. The
technical reason is that currently the RGB-LED is brought up later
by a userspace daemon.
(added warning note about odm-caldata partition. remove initramfs -
it's too big to be built by the bots. MerakiNAND -> meraki-header.
sort nu801's targets)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This reduces open coding and allows to easily add a knob to enable
it treewide, where chosen packages can still opt-out via "no-lto".
Some packages used LTO, but not the linker plugin. This unifies 'em
all to attempt to produce better code.
Quoting man gcc(1):
"This improves the quality of optimization by exposing more code to the
link-time optimizer."
Also use -flto=auto instead of -flto=jobserver, as it's not guaranteed
that every buildsystem uses +$(MAKE) correctly.
Signed-off-by: Andre Heider <a.heider@gmail.com>
This reduces open coding and allows to easily add a knob to
enable it treewide, where chosen packages can still opt-out via
"no-gc-sections".
Note: libnl, mbedtls and opkg only used the CFLAGS part without the
LDFLAGS counterpart. That doesn't help at all if the goal is to produce
smaller binaries. I consider that an accident, and this fixes it.
Note: there are also packages using only the LDFLAGS part. I didn't
touch those, as gc might have been disabled via CFLAGS intentionally.
Signed-off-by: Andre Heider <a.heider@gmail.com>
d978830 rc: add option to get info for a single script in list method
632b4fc rc: add option to skip running check for list method
5577db9 rc: add support for scanning USE_PROCD and skip running if not supported
4de3f02 rc: fix and improve script scanning START and STOP
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
I've somehow managed to commit wrong package mirror hash in commit 36076b5a40
("ubus: update to version 2022-06-15"), so lets fix it by using a proper
one.
Fixes: 36076b5a40 ("ubus: update to version 2022-06-15")
Reported-by: Andre Heider <a.heider@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
Update which contains just a following fix:
* ubusd: add lookup command queuing support
Defers and continues a client's lookup command to avoid unnecessary
buffering under load.
Signed-off-by: Petr Štetiar <ynezz@true.cz>
1ea5855 partname: Introduce fstools_partname_fallback_scan option
While at it also drop AUTORELEASE from PKG_RELEASE.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
c0df2a7 iwinfo: add "band" and "mhz" to the scan output
06ad60f iwinfo: add "band" to the freqlist output
b32fd32 iwinfo: add flags to freqlist output
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
04d7570 jail: fs: don't overwrite existing mount target
6b9629b jail: don't assume positive return value of creat
190f13a init: attempt to mount efivarfs
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
The libraries libpthread, libdl, libutil, libanl have been integrated
into the libc library in version 2.34. it is not needed to explicitly
link them any more.
Most of the functions have been moved from the librt.so into libc.so
some time ago already.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Add patch to fix compilation error with USE_CPUID_DEVICE enabled and musl
used as libc. Musl doesn't add limits.h header by default and this is
required if USE_CPUID_DEVICE is used.
The package currently compile because fortify headers include limits.h
by default.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Passing all arguments to /etc/init.d/$service restores the
behaviour of openwrt 21.02. This is relevant for services
such as etherwake which take more then one argument, e.g.:
"service etherwake start <list of devices to wake>"
Signed-off-by: Andrew Ammerlaan <andrewammerlaan@gentoo.org>
ee54c6b libfstools: skip JFFS2 padding on block devices
Fixes config restore on the BPi R3 when using MMC storage.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
gcc 10 with -O2 reports following:
In function ‘strncpy’,
inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:244:4:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In function ‘strncpy’,
inlined from ‘rpc_sys_packagelist’ at /opt/devel/openwrt/c-projects/rpcd/sys.c:227:4:
/usr/include/x86_64-linux-gnu/bits/string_fortified.h:106:10: error: ‘__builtin_strncpy’ specified bound 128 equals destination size [-Werror=stringop-truncation]
106 | return __builtin___strncpy_chk (__dest, __src, __len, __bos (__dest));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Since it is not possible to avoid truncation by strncpy, it is necessary
to make sure the result of strncpy is properly NUL-terminated and the
NUL must be inserted explicitly, after strncpy has returned.
References: #10442
Reported-by: Alexey Smirnov <s.alexey@gmail.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz>
8c213b0 libfstools: Rename move_mount() function to ovl_move_mount() for glibc 2.36
81785c1 block: Do not include linux/fs.h any more
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
The command 'opkg search /etc/config/fstab' does not return a package
name for this config file. In order to know to which package this config
file belongs to, a 'conffiles' entry was made for this file to package
'block-mount'.
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
the tacked on @TARGET_bcm53xx causes warnings:
tmp/.config-package.in:14027:warning: ignoring unsupported character '@'
tmp/.config-package.in:26028:warning: ignoring unsupported character '@'
this was wrong.
Fixes: be1761fa14 ("nu801: add MR26 to the table")
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
ef5d3e3 jail: fix various ignoring return value compilation warning
8e4a956 jail: add WARNING macro to log non critical warning message
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
46a33b8 kmodloader: fix compilation warning with not checking return of asprintf
Also switch PKG_RELEASE to AUTORELEASE.
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Changes:
9c44557 opkg_remove: avoid remove pkg repeatly with option --force-removal-of-dependent-packages
2edcfad libopkg: set 'const' attribute for argv
This should fix the CI error in the packages repository, which happens with perl.
Signed-off-by: Josef Schlehofer <pepe.schlehofer@gmail.com>
2f793a4 lua: add optional path filter to objects() method
2bebf93 ubusd: handle invoke on event object without data
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
557c98e init: selinux: don't relabel virtual filesystems
7a00968 init: only relabel rootfs if started from initramfs
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
86ca9c6 devstatus: prints to terminal
95de949 deal with /rom/dev/console label inconsistencies
ab6b6ee uci: hack to deal with potentially mislabeled char files
acf9172 dnsmasq this can't be right
021db5b luci-app-tinyproxy
cf3a9c4 support/secmark: removes duplicate loopback rules
eeb2610 dhcp servers: recv dhcp client packets
d5a5fc3 more support/secmark "fixes"
35d8604 update support secmark
4c155c0 packets these were caused by labeling issues with loopback
fad35a5 nftables reads routing table
f9c5a04 umurmur: kill an mumur instance that does not run as root
10a10c6 mmc stordev make this consistent
ab3ec5b Makefile: sort with LC_ALL=C
b34eaa5 fwenv rules
8c2960f adds rfkill nodedev and some mmc partitions to stordev
5a9ffe9 rcboot runs fwenv with a transition
9954bf6 dnsmasq in case of tcp
ab66468 dnsmasq try this
5bfcb88 dnsmasq stubby not sure why this is happening
863f549 luci not sure why it recv and send server packets
d5cddb0 uhttpd sends sigkill luci cgi
44cc04d stubby: it does not maintain anything in there
db730b4 Adds stubby
ccbcf0e tor simplify network access
a308065 tor basic
a9c0163 znc loose ends
327a9af acme: allow acme_cleanup.sh to restart znc
4015614 basic znc
7ef14a2 support/secmark: clarify some things
3107afe README: todo qrencode
943035a README and secmark doc
4c90937 ttyd: fix that socket leak again
3239adf dnsmasq icmp packets and fix a tty leak issue
b41d38f Makefile: optimize
95d05b1 sandbox dontaudit ttyd leak
0b7d670 rpcd: reads mtu
e754bf1 opkg-lists try this
35fb530 opkg-lists: custom
4328754 opkg try to address mislabeled /tmp/opkg-lists
3e2385c rcnftqos
95eae2d ucode
c86d366 luci diagnostics
e10b443 rpcd packets and wireguard/luci
a25e020 igmpproxt packets
0106f00 luci
dcef79c nftqos related
3c9bc90 related to nft-qos and luci
f8502d4 dnsmasq more related to /usr/lib/dnsmasq/dhcp-script.sh
29a4271 dnsmasq: related to /usr/lib/dnsmasq/dhcp-script.sh
0c5805a some nft-qos
1100b41 adds a label for /tmp/.ujailnoafile
e141a83 initscript: i labeled ujail procd.execfile
a3b0302 Makefile: adds a default target + packets target
6a3f8ef label usign as opkg and label fwtool and sysupgrade
04d1cc7 sysupgrade: i meant don't do the fc spec
763bec0 sysupgrade: dont do /tmp/sysupgrade.img
af2306f adds a failsafe.tmpfile and labels validate_firmware_image
5b15760 fwenv: comment doesnt make sense
370ac3b fwenv: executes shell
67e3fcb fwenv: adds fw_setsys
544d211 adds procd execfile module to label procd related exec files
99d5f13 rclocalconffile: treat /etc/rc.button like /etc/rc.local
4dfd662 label uclient-fetch the same as wget
75d8212 osreleasemiscfile: adds /etc/device_info
0c1f116 adds a rcbuttonconffile for /etc/rc.button (base-files)
ccd23f8 adds a syslog.conffile for /etc/syslog.conf (busybox)
f790600 adds a libattr.conffile for /etc/xattr.conf
fcc028e fwenv: adds fwsys
1255470 xtables: various iptables alternatives
a7c4035 Revert "sqm: runs xtables, so also allow nftables"
0d331c3 sqm: runs xtables, so also allow nftables
f34076b acme: will run nftables in the near future
6217046 allow ssl.read types to read /tmp/etc/ssl/engines.cnf
d0deea3 fixes dns packets
8399efc Revert "sandbox: see if dontauditing this affects things"
73d716a sandbox: see if dontauditing this affects things
b5ee097 sandbox: also allow readinherited dropbear pipes
12ee46b iwinfo traverses /tmp/run/wpa_supplicant
4a4d724 agent.cil: also reads inherited dropbear pipes
d48013f support/secmark: i tightened my dns packet policy
645ad9e dns packets redone
4790b25 dnsnetpacket: fix obj macro template
d9fafff redo dns packets
0a68498 ttyd: leaks a netlink route socket
1d2e6be .gitattributes: remove todo
e1bb954 usbutil: reads bus sysfile symlinks
d275a32 support/secmark: clean it up a little
af5ce12 Makefile: exclude packet types in default make target
3caacdf support/secmark: document tunable/boolean
e3dd3e6 invalidpacketselinuxbool: make it build-time again
54f0ccf odhcpd packet fix
4a864ba contrib/secmark: add a big FAT warning
bead937 contrib/secmark: adds note about secmark support
146ae16 netpacket remove test
2ce9899 dns packets, odhcp6c raw packet, 4123 ntpnts for netnod
070a45f chrony and unbound packets
eba894f rawip socket packets cannot be labeled
656ae0b adds isakmp (500), ipsec-nat-t (4500) and rawip packet types
35325db adds igmp packet type
5cf444c adds icmp packet type
2e41304 sandbox some more packet access for sandbox net
12caad6 packet accesses
b8eb9a8 adds a trunkload of packet types
a42a336 move rules related to invalid netpeers and ipsec associations
a9e40e0 xtables/nftables allow relabelto all packet types
aa5a52c README: adds item to wish list
3a96eec experiment: simple label based packet filtering
26d6f95 nftables reads/writes fw pipes
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
try to clean up some labeling inconsistencies
iwinfo loose ends
ucode loose ends
Makefile: adjust mintesttgt (adds blockmount/blockd)
nftables: reads inherited netifd pipe
ucode: reads inherited netifd pipes
mountroot: fowner
sandbox: writes inherited dropbear pipes
unbound related to /tmp/etc/ssl
unbound loose ends
adds a sslconftmpfile for /tmp/etc/ssl
README: maintain a wish list in the README
iwinfo: netifd forgot write
gptfdisk loose ends
iwinfo: netifd wpad reads/writes inherited netifd fifo files
netifd (mac80211.sh) executes iwinfo
luci: executes wireguard
luci-cgi: audits xtables execute access
rcuhttpd: lists ssl certfile dirs
iwinfo, wifi,nftables usage of ttyd pty if available
urandomseed: seedrng needs cap_sys_admin
iwinfo iwinfo, nftables and some chronyd rules related to ntp nts server
nftables, wifi and adds iwinfo skel
nftables, rpcd, ucode
nftables, ucode and seedrng ucode, fw3/nftables, luci
adds ucode skel and some fw3/nftables related
urandomseed: some seedrng rules
fw3 adds some support for fw4
urandomseed: /etc/seedrng is for seed.credit
hotplugcal: runs ucode which is interpreter like
adds a nftables skeleton and makes xtables optional
agent: allow all agents to write inherited dropbear pipes
urandomseed: this seems to be replaced by seedrng
kmodloader: label /etc/modules.conf kmodloader.conffile
Revert "shelexecfile: remove auditallow rule"
Makefile: sort the modules to process by secilc
Moves back to git.defensec.nl
unbound odhcpd (ip) reads net proc
tcp dump
shelexecfile: remove auditallow rule
rrd.cil: fixes indent
Target rddtool from cgi-io instead of runnit it without transition
rrd.cil related
rrd, rpcd, cgiio clean ups related to luci-app-statistics
Rules for rrd files and luci-statistics
unboundcontrol ordering
Several missing permissions
blockmount, dnsmasq, hotplugcall, rpcd, unbound
adds mctp_socket (linux 5.15)
ip: forgot tc-tiny type transition to go along with the fc spec
ip: adds a fc spec for tc-tiny (called by sqm)
adds ttyACM fc spec and various assorted loose ends
.gitattributes: do not export the github workflows
workflow use selinux 3.3
project moved back to https://git.defensec.nl/selinux-policy.git
Signed-off-by: Dominick Grift <dominick.grift@defensec.nl>
This reverts commit 2edc017a6e.
We shouldn't be using a shell script here, but the SeedRNG integration
into OpenWRT requires a bit more thought. Etienne raised some important
points immediately after this was merged and planned to send some follow
up commits, but became busy with other things. The points he raised are
important enough that we should actually back this out until it's ready
to go, and then merge it as a cohesive unit. So let's revert this for
now, and come back to it later on.
Cc: Etienne Champetier <champetier.etienne@gmail.com>
Cc: Petr Štetiar <ynezz@true.cz>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
The RNG can't actually be seeded from a shell script, due to the
reliance on ioctls. For this reason, the seedrng project provides a
basic script meant to be copy and pasted into projects like OpenWRT
and tweaked as needed: <https://git.zx2c4.com/seedrng/about/>.
This commit imports it into the urandom-seed package and wires up the
init scripts to call it. This also is a significant improvement over the
current init script, which does not robustly handle cleaning up of seeds
and syncing to prevent reuse. Additionally, the existing script creates
a new seed immediately after writing an old one, which means that the
amount of entropy might actually regress, due to failing to credit the
old seed.
Closes: https://github.com/openwrt/openwrt/issues/9570
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [fixed missing INSTALL_DIR]
The inclusion of the kmod-leds-uleds into the userspace
nu801 package causes a circular dependency inside the
buildsystem... which causes it to be picked regardless
of other DEPENDS values.
In case of the mx100, this could be solved by moving the
kmod-leds-uled dependency to the kmod-meraki-mx100.
Bonus: drop @!LINUX_5_4 from kmod-meraki-mx100
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
Chen Minqiang reported that he has troubles downloading nu801.
His logs showed the followin TLS Handshake failure.
|Checking out files from the git repository...
|Cloning into 'nu801-d9942c0c'...
|fatal: unable to access 'https://github.com/chunkeey/nu801.git/':
| gnutls_handshake() failed: The TLS connection was non-properly terminated.
|Makefile:39: recipe for target '[...]/dl/nu801-d9942c0c.tar.xz' failed
This can be fixed by providing a PKG_MIRROR_HASH. The download
scripts will now be able to pull the source from OpenWrt's source
archive, which should be available through HTTP.
Reported-by: Chen Minqiang <ptpt52@gmail.com>
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
This reverts commit 80b7a8a7f5.
Now that 5.10 is the default kernel for all platforms, we can
bring back the NU801 userspace driver for platforms that rely
on it. Currently it's used on the MX100 x86_64 target, but
other Meraki platforms use this controller.
Note that we also now change how we load nu801. The way we did
this previously with procd worked, but it meant it didn't load
until everything was up and working.
To fix this, let's call nu801 from boot and re-trigger the
preinit blink sequence. Since nu801 runs as a daemon this is
now something we can do.
Signed-off-by: Chris Blake <chrisrblake93@gmail.com>
(removed empty line, currently only MX100 uses it so: @TARGET_x86)
Signed-off-by: Christian Lamparter <chunkeey@gmail.com>
