changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog
* Remove ca-certificates-local example (closes: #988912, #1127101).
* Update Mozilla certificate authority bundle to version 2.86
The following certificate authority was added (+):
+ e-Szigno TLS Root CA 2023
The following certificate authorities were removed (-):
- QuoVadis Root CA 2
- QuoVadis Root CA 3
- DigiCert Assured ID Root CA
- DigiCert Global Root CA
- DigiCert High Assurance EV Root CA
- SwissSign Gold CA - G2
- SecureTrust CA
- Secure Global CA
- COMODO Certification Authority
- Certigna
- certSIGN ROOT CA
- AffirmTrust Commercial
- AffirmTrust Networking
- AffirmTrust Premium
- AffirmTrust Premium ECC
- TeliaSonera Root CA v1
- Entrust Root Certification Authority - G2
- Entrust Root Certification Authority - EC1
- Trustwave Global Certification Authority
- Trustwave Global ECC P256 Certification Authority
- Trustwave Global ECC P384 Certification Authority
- GLOBALTRUST 2020
- GTS Root R2
- FIRMAPROFESIONAL CA ROOT-A WEB
The following certificate authority was renamed (~):
~ "OISTE Server Root RSA G1" (removed leading space)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23675
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
(cherry picked from commit 8aaa8d401308d32806c080aab458c3f08208cbf0)
(cherry picked from commit 8b29bf400569335f27e6ebac22f68c5b3254238f)
This fixes multiple bugs, some might be security relevant.
Link: https://github.com/openwrt/openwrt/pull/24330
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit b421c63071dc56dd9a2aab2b26dee23bc7eb677f)
Debian changelog:
* Update Mozilla certificate authority bundle to version 2.82
The following certificate authorities were added (+):
+ TrustAsia TLS ECC Root CA
+ TrustAsia TLS RSA Root CA
+ SwissSign RSA TLS Root CA 2022 - 1
+ OISTE Server Root ECC G1
+ OISTE Server Root RSA G1
The following certificate authorities were removed (-):
- GlobalSign Root CA
- Entrust.net Premium 2048 Secure Server CA
- Baltimore CyberTrust Root (closes: #1121936)
- Comodo AAA Services root
- XRamp Global CA Root
- Go Daddy Class 2 CA
- Starfield Class 2 CA
- CommScope Public Trust ECC Root-01
- CommScope Public Trust ECC Root-02
- CommScope Public Trust RSA Root-01
- CommScope Public Trust RSA Root-02
* Use dh_usrlocal to create /usr/local/share/ca-certificates
(closes: #1127100)
Signed-off-by: Fengyu Wu <saldry@proton.me>
Link: https://github.com/openwrt/openwrt/pull/23155
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 403c52db37c74246469e1cdf532aa576235d69fb)
(cherry picked from commit db8cbe9de8864cd4a362db8e39142ed13149da18)
Update procd cherry-picking fixes from main branch to dedicated
openwrt-24.10 backport branch.
c59f2d8 instance: don't print error in case cgroups are disabled
196291a instance: use positive error numbers for strerror()
d23ddec rcS, ubus: constify char * arguments and variables where appropriate
aeeef20 instance: use mkdir_p helper
d033b7c signal: handle SIGUSR1 as halt
8bc8377 cgroups: fix syntax error
909d02b instance: check length of names when creating cgroups
5ec782f procd: jail/cgroups: fix OOB write in cgroups_apply()
8581313 hotplug-dispatch: fix filter disallowing setting PATH
6265463 service instance: Improve handling of watchdog config changes
45bef92 service instance: Fix overwriting of watchdog linked list members
8294471 coldplug: fix missing header include
fb1c92b hotplug-dispatch: fix missing header include
6dafa86 initd/coldplug: create /dev/null before running udevtrigger
c268f13 hotplug-dispatch: redirect output to /dev/null
b8c4f86 hotplug-dispatch: use stat if d_type is DT_UNKNOWN
1f2aa1a system: fix arguments validation in ubus handler
7e5e049 service: fix use-after-free on service data update
3f48d76 instance: convert jail feature flags to bitmap
2c7c0d2 rcS: avoid duplicate pending "running" calls
5a9b16d service: re-run init script "running" command after instance restart
d5a45ff jail: fix NULL-pointer dereference when connection to ubus failed
8de8cdf jail: always handle mkdir() return value
fa594db jail: seccomp-oci: fix uninitialized pointer read in error path
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 3e77f8c7abdefa321f2fbc97a27e9d482789a183)
b462895d3157 lua: CMakeLists: drop redundant cmake_minimum_required
f247c18f8a55 examples: CMakeLists: drop redundant cmake_minimum_required
83a70399030d github: add CI build
d31effb4277b ubusd: Fix out of bounds access in event register message
d95837b1b143 ubusd: acl: compare uid/gid instead of user/group strings
b81257bb20dd ubusd: load extra group IDs for a client process
7d7b45fea05b add debian/ directory
aa4a7ee1d341 ubusd: fix more instances of missing length checks for patterns
60e04048a0e2 ubusd: fix ACL check for receiving events
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 4b907e69ea58fc0ba35fd1755dc4ba22262af3a4)
(cherry picked from commit a7901969932a175cded3c93bdeb65f32ed3705e6)
2b69c9859946 examples: CMakeLists: update cmake minimum required version to 3.10
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 88fe81bb0caaab8d159805f1f639261f105a7c2a)
(cherry picked from commit a46d2efad232cebec2a8aea90234018ce59fe0ae)
8b320f9 ucode: adjust for new ext resource type
e61d2be sys: use strstr() to detect installed packages
bba9519 rpc-sys: packagelist: don't truncate input lines on read
The removed patch was applied upstream.
Link: https://github.com/openwrt/openwrt/pull/19919
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
(cherry picked from commit 2a2f1573a761a2f80e5d3af37485aa07f3ca5225)
partname_volume_init() calls block_volume_format() passing the device
path.
Previously the parent path was passed typically leading to retrieve the
size of the parent device and not the device to be formatted.
Eventually, formatting the block device with mkfs.f2fs failed silently
when the block device is too small and created a ram overlayfs instead
of trying to format with ext4.
Patch was sent upstream for review in
https://patchwork.ozlabs.org/project/openwrt/patch/tencent_1BDE4F7AE014AD4D4FA835C5DFEAB35AFB06@qq.com/
Fixes: PCF-1893
Tracked-by: FEAT-29
Signed-off-by: Paul HENRYS <paul.henrys_ext@softathome.com>
Provide the system CA Bundle ODL and install it to the location where it
will be picked up by tr181-security and imported into
Device.Security.CABundle data model.
In future the creation of ODL is to be replaced with automation script.
References: PCF-2487
References: PCF-2583
Signed-off-by: Piotr Nakraszewicz <piotr.nakraszewicz@consult.red>
This patch can be removed, since the change is now applied upstream and available in the version of procd we are using (7330fa55c5)
This reverts commit 4b03b1fbefe0a637ad0eba37be441163094f2144.
Signed-off-by: Matthias Franck <matthias.franck@softathome.com>
We've 3 downstream patches for procd which were cherry-picking since 19.07
releases and this commit rebases them onto the procd from OpenWrt 24.10.
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Lxc automatically mounts sys and proc in the rootfs of the container. When an unprivileged container is created however, the sys and proc of the host should be mounted with option relatime. The procd of openwrt mounts these with option noatime. As a result, an unprivileged container cannot start.
remounting them allows starting of the containers:
mount -t sys sys -o remount,rw,nosuid,nodev,noexec,relatime /sys
mount -t proc proc -o remount,rw,nosuid,nodev,noexec,relatime /proc
The patch modifies procd to do this correctly from the start.
Issue: LCMFT-338 for unprivileged lxc containers, proc and sys should be mounted with relatime
Signed-off-by: Matthias FRANCK <matthias.franck@softathome.com>
We've 3 downstream patches for procd which were cherry-picked from 22.03
release and this commit rebases them onto the procd from OpenWrt 23.05.
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>
Mount systemd cgroup virtual controller at boot, so they can be used to
run systemd based containers.
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
(cherry picked from commit 69ec728452918e6679b1de74a954c00df0d7c96e)
Set clone_children flag in cpuset, so it inherits the configured defaults of the parent.
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
(cherry picked from commit 58da6b91b3208438d561638618abb2703c230d0b)
Properly mount cgroups in a root tmpfs where every controller is mounted
in a seperate subdirectory, recommended by the kernel documentation of
cgroupsv1.
Signed-off-by: Matthias FRANCK <matthias.franck_ext@softathome.com>
(cherry picked from commit af84ad24a6acd355ec39c8355eccb02e47b3bec6)
27839f854a58 ubusd: make txq_len field signed
b35b2bc63e8e ubusd: treat EACCES on write like EAGAIN
713e9d19b2b6 ubusd: retry write on EINTR
8bb523ab20e0 ubusd: fix txq_len accounting
b1b783c74742 ubusd: add another tx attempt on enqueueing the first message for a client
5952b48e251c ubusd: do not call socket callback from ubus_msg_send
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 90cd8640bde750e014b6c02ed9ffb6f626753fc7)
(cherry picked from commit d9cd67b542e55841bda48871fd9a03391a40d1a2)
88e6325092bf libubus: flush all pending requests on connection loss
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 707a89bc264e0a2b6593da753301912d7ec40f77)
Update ca-certificates to version 20241223
* Update Mozilla certificate authority bundle to version 2.70.
The following certificate authorities were added (+):
+ Telekom Security TLS ECC Root 2020
+ Telekom Security TLS RSA Root 2023
+ FIRMAPROFESIONAL CA ROOT-A WEB
+ TWCA CYBER Root CA
+ SecureSign Root CA12
+ SecureSign Root CA14
+ SecureSign Root CA15
The following certificate authorities were removed (-):
- Security Communication Root CA (closes: #1063093)
Signed-off-by: Hannu Nyman <hannu.nyman@iki.fi>
Link: https://github.com/openwrt/openwrt/pull/18468
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit c79572210fa47d015b3bdc03f38c25ef5262a318)
Check the return value of malloc and pread in case they fail.
Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
(cherry picked from commit 3f014543cd4bd099dc089cbb9b9b2d7b0db8a021)
Signed-off-by: Rafal Boni <rafal.boni@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17889
Signed-off-by: Robert Marko <robimarko@gmail.com>
Fix a bug in linksys_bootcount.c that resetbc won't work on nand
with min I/O size> 2048.
Check the boot-log entry's intergrity with checksum.
Signed-off-by: Qiyuan Zhang <zhang.github@outlook.com>
Link: https://github.com/openwrt/openwrt/pull/16070
(cherry picked from commit 62da99e6d506f3517f50c1efd61e1911df507ae3)
Signed-off-by: Rafal Boni <rafal.boni@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/17889
Signed-off-by: Robert Marko <robimarko@gmail.com>
047b2efc1348 CMakeLists.txt: bump minimum cmake version
16ff0badbde7 CMakeLists: add support for including ABIVERSION in the library version number
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit e046f8c318618162fcdd768c4a9eadd53c239629)
fb3c2343b17b add support for an override config directory
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 44c877f1973b923a2032ce9d880f496a2b077ef6)
10f7996ec294 file: Ignore config file with '.' in name
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 3929ef4c21844189d5db8d14e7e6dc6ba983d571)
d996988ae55b libubus: close file descriptor after sending it from a request
afa57cce0aff libubus: add support for using channels
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit f0df6e3a4a4996eca917fa17591b8f1d483dfa30)
It seems that we have some kind of a symbol name conflict which causes
CONFIG_SECCOMP to always be read as y.
Unfortunatelly, I could not figure out what is causing this, but simply
renaming SECCOMP to USE_SECCOMP seems to properly work and leaves the
symbol unset unless arch dependencies are satisfied.
This fixes qoriq and others that dont support seccomp from failing due
to procd-seccomp package being selected to get included but it cannot be
built for them:
ERROR: unable to select packages:
procd-seccomp (no such package):
required by: base-files-1637~52b6c92479[procd-seccomp]
Fixes: 4c65359af49b ("build: fix including busybox, procd and apk/opkg in imagebuilder")
Link: https://github.com/openwrt/openwrt/pull/17048
Signed-off-by: Robert Marko <robimarko@gmail.com>
(cherry picked from commit a48ec449ccab0069e84a72837bf06ba543e53aec)
Since the image builder pulls package lists from metadata directly,
add procd and busybox as depdendencies to base-files.
As for the package manager itself, since it can be disabled it needs
to be added directly in the image builder makefile
Fixes: 44598c233dd9 ("build: remove broken dependency of metadata on toplevel .config variables")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 4c65359af49b6ccecd98987f842db5eba985f64b)
Instead of relying on .config symbols for metadata, alter the DEFAULT
variable of affected packages. Fixes enabling opkg vs apk among others.
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 44598c233dd9a676bc34666968f33f8b9ff4dd0c)
This can be useful to reload the firewall when procd firewall data changes
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 49d92d3e933c45e3684da2fbf0a198d195635581)
Allows a running servie to manage its own data if untouched by the init script
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 8c5826b140b6288b9270d232ecda0d540e380d4e)
2e206dbe77ec service: add support for triggers on service/instance data changes
735b48728fca service: remove leftover lines from previous commit
32469644a029 service: allow incremental changes to service properties
fd01fb852302 service: fix double free bug when dealing with data
Signed-off-by: Felix Fietkau <nbd@nbd.name>
(cherry picked from commit 3d900bd055b5d8f07a879c9c8c4f7783d35dd4ba)
e2f05de state: set_stdio: chdir back to / in case of failure
30542c9 inittab: Disable implicit controlling TTY.
Signed-off-by: John Crispin <john@phrozen.org>
(cherry picked from commit 2bcc49aef93f454950d425b8de69d230b52cc63c)
During the last OpenWrt developer meeting 2024-11-26 it was decided,
that 24.10 will be the last release using opkg package manager and thus
apk won't be supported, so make it explicit and mark apk package manager
as broken.
References: https://openwrt.org/meetings/20241126#release_2410
Link: https://github.com/openwrt/openwrt/pull/17097
Signed-off-by: Petr Štetiar <ynezz@true.cz>
7330fa5 initd: mount /sys and /proc with MS_RELATIME
Fixes mounting /proc in unpriviledged user namespace.
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
(cherry picked from commit 1e8505ac4e88212106fe78486cfcbe9cae7660f9)
109fa41b2321 system: fix description value from os-release
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
(cherry picked from commit 09a8b4920cf117942561237d639d5101283a53c4)
Mark the package as nonshared to build it in the target specific build
step 1 of the build bots instead of the architecture generic build step 2.
In the build step 2 it may be left out if we build it using a different
target.
Fixes: #16857
Link: https://github.com/openwrt/openwrt/pull/16859
Signed-off-by: Robert Marko <robimarko@gmail.com>
@KA2107 reported that opkg is not able to verify the artifact signatures
produced by buildbot using the usign 24.10 release keys. So lets fix it
by actually adding the 24.10 usign key with d310c6f2833e97f7 fingerprint
into the openwrt-keyring package.
Fixes: #16850
Reported-by: @KA2107
Fixes: a535cfc09e1c ("openwrt-keyring: add OpenWrt 24.10 release build usign key")
References: 2d03f27f0f07 ("openwrt-keyring: make opkg use 22.03 usign key")
Signed-off-by: Kuan-Yi Li <kyli@abysm.org>
Signed-off-by: Petr Štetiar <ynezz@true.cz> [commit description]
65bb027 CMakeLists.txt: bump minimum cmake version
252a9b0 libubus: Make UBUS_* macros work cleanly in C++
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
apk/openwrt-snapshots.pem contains Elliptic Curve based public key which
is going to be used for signing of apk's package.adb package indexes
after the builds using `apk adbsign --sign-key <key> packages.adb`
command on the buildbot.
References: https://github.com/openwrt/buildbot/pull/46
Link: https://github.com/openwrt/openwrt/pull/16539
Signed-off-by: Petr Štetiar <ynezz@true.cz>
bcc091d session: Fix crash when the UCI option 'password' or 'username' is missing
9f4b86e rpcd: iwinfo: add IEEE 802.11be support
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
