u-boot-kirkwood: add u-boot build for kirkwood

This file build IPFire (dtb, bootz) compatible versions for:

Marvell DreamPlug
Iomega iConnect Wireless
Raidsonic ICY-Box 62x0

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/core120' into kernel-4.14

kernel: update to 4.14.37

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: update buildscript

enable wandboard
update ident strings
distclean after every target

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core120: Regenerate IPsec configuration

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "IPsec: Try to restart always-on tunnels immediately"

This reverts commit a261cb06c6cdd3ba14ad0163c8c9e714ae94fc5b.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dma: Apply compile fix

dma segfaulted when built without string.h.

Fixes: #11701
Submitted upstream: https://github.com/corecode/dma/pull/58

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

leds: dreamplug: the blue led has wrong name in dtb

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

leds: rename dreamplug leds for new kernel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.35

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

iw: update to 4.14

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

crda: update to 3.18

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: i586 enable cs5535 gpio module

this modul is needed for alix led support

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

firstsetup: fix disabling tty's on scon mode

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

grub: update to 2.02

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: fix typo in startscript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

acpid: start also if kernel has no acpi support.

acpid is also needed for gpio and hid powerbuttons if there is no
real acpi support.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'kernel-5.14' of git.ipfire.org:/pub/git/people/arne_f/ipfire-2.x into kernel-4.14

screen: build before elfutils

if it buils after elfutils it links against libelf which is an addon

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

acpid: build also on arm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bump packages

the old packages are linked against removed libs

fixes: 11685

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.34

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

flash-images: merge normal and scon to one image.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.33

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update config

disable isdn
disable audit
disable profiling on arm
disable scsi driver on arm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'master' into core120

core120: Update OepnVPN configurations for PMTU changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

OpenVPN: Drop Path MTU discovery settings

These have to be dropped since the entire system does not
support Path MTU discovery any more. This should not have
any disadvantage on any tunnels since PMTU didn't really
work in the first place.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: fix kirkwood config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core120: don't (re)move old packfire/gpg databases

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'master' into core119

core120: Update pakfire keystore

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Ship changed pakfire files

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Store key material in own directory

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

u-boot: update bootscript to boot from other devices than mmc

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/master' into kernel-4.14

Merge remote-tracking branch 'origin/core120' into kernel-4.14

Merge branch 'master' into core119

curl: Drop old compatibility symlink

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: Rootfile update

Main library was missing

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Import new pakfire keys

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Import old key, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Rename new key to pakfire-2018.key

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Validate signatures when multiple are available

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: add pakfire script to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.32

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

openssl: update rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: x86_64 rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: x86_64 enable DEVFREQ modules

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge remote-tracking branch 'origin/master' into kernel-4.14

kernel: update to 4.14.31

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'core119' into next

core120: set pafire version to 120

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Use upstream proxy for HTTPS, too

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

use protocol defined in server-list.db for mirror communication

For each mirror server, a protocol can be specified in the
server-list.db database. However, it was not used for the
actual URL query to a mirror before.

This might be useful for deploy HTTPS pinning for Pakfire.
If a mirror is known to support HTTPS, all queries to it
will be made with this protocol.

This saves some overhead if HTTPS is enforced on a mirror
via 301 redirects. To enable this, the server-list.db
needs to be adjusted.

The second version of this patch only handles protocols
HTTP and HTTPS, since we do not expect anything else here
at the moment.

Partially fixes #11661.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Cc: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Fix crash on startup

Zone names should not be terminated with a dot.

Fixes: #11689
Reported-by: Pontus Larsson <pontuslarsson51@yahoo.se>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update for curl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

asterisk: Ship documentation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fetchmail: Permit building without SSLv3

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to 1.0.2o

CVE-2018-0739 (OpenSSL advisory) [Moderate severity] 27 March 2018:

Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious
input with excessive recursion. This could result in a Denial Of
Service attack. There are no such structures used within SSL/TLS
that come from untrusted sources so this is considered safe.
Reported by OSS-fuzz.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Update to 1.1.0h

CVE-2018-0739 (OpenSSL advisory) [Moderate severity] 27 March 2018:

Constructed ASN.1 types with a recursive definition (such as can be
found in PKCS7) could eventually exceed the stack given malicious
input with excessive recursion. This could result in a Denial Of
Service attack. There are no such structures used within SSL/TLS
that come from untrusted sources so this is considered safe.
Reported by OSS-fuzz.

This patch also entirely removes support for SSLv3. The patch to
disable it didn't apply and since nobody has been using this before,
we will not compile it into OpenSSL any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Ship updated QoS script and gnupg

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix typo in 'makeqosscripts.pl'

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

curl: update to 7.59.0

Update curl to 7.59.0 which fixes a number of bugs and
some minor security issues.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

gnupg: update to 1.4.22

Update GnuPG to 1.4.22, which fixes some security vulnerabilities,
such as the memory side channel attack CVE-2017-7526.

Signed-off-by: Peter Müller <peter.mueller@link38.eu>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xr819-firmware: move rootfile to common

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.30

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

xr819-firmware: add firmware for xradio xr-819 wlan

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: updated arm config and image build

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

inittab: change tty1 to console

this reduce the differences between tty and scon installations
and make it easier to switch between.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

swconfig: remove old swconfig utility

this is not compatible with kernel 4.14
todo: replace swconfig calls in initskript

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

rpi-firmware: update to 2018-03-16

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

checknewlog: don't report u-boot mkimage rootfile.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

u-boot: update to 2018.03

todo: check wandboard version. there are internal changes to merge
the different wandboard images to one and u-boot.imx is not build
anymore. Which file is needed to boot on wandboard?

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.29

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core120: Ship updated vnstat

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

vnstat: Update to 1.18

For details see: https://humdi.net/vnstat/CHANGES

Changed "SaveInterval 5" to "SaveInterval 1" in '/etc/vnstat.conf', triggered by
https://forum.ipfire.org/viewtopic.php?f=22&t=20448 to avoid data loss with 1Gbit
connections and high traffic.

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Forgot to "git add" the new pakfire init script

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "installer: Import the Pakfire key at install time"

This reverts commit 7d995c9f56055f39e559bd6e355a9a1689585c6d.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Import key when system boots up

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

ffmpeg: Ship libraries correctly

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

hdparm: Update to 9.55

Changelogs against 9.53:

"hdparm-9.55:
- added #include <sys/sysmacros.h> for major()/minor() macros

hdparm-9.54:
- Partial revert of Jmicron changes, from Jan Friesse."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dmidecode 3.1: Added patch (Fix firmware version of TPM device)

For details see:
http://git.savannah.gnu.org/cgit/dmidecode.git/commit/?id=174387405e98cd94c627832ae23abcb9be7e5623

"Both the operator (detected by clang, reported by Xorg) and the mask
for the minor firmware version field of TPM devices were wrong."

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Fix python-m2crypto rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Ship updated logrotate and restart unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.7.0

For details see:
http://www.unbound.net/download.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

logrotate: Update to 3.14.0

For details see:
https://github.com/logrotate/logrotate/releases

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

htop: Update to 2.1.0

For details see:
https://hisham.hm/htop/index.php?page=downloads

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.3

For details see:
http://ftp.isc.org/isc/bind9/9.11.3/RELEASE-NOTES-bind-9.11.3.html

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 2.9.4

For details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rsync: Update to 3.1.3

For details see:
https://download.samba.org/pub/rsync/src/rsync-3.1.3-NEWS

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

PAM: Delete old lib and symlinks

Core 119 update delivers an updated PAM whereby the libdir has been changed from /lib to /usr/lib
but the old libraries and symlinks are still presant. Since the system searches /lib before
/usr/lib , the old libs and symlinks are used which ends up in an `LIBPAM_EXTENSION_1.1' not found.

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.27

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: drop rpi config

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

OpenVPN: Update to version 2.4.5

This is primarily a maintenance release, with further improved OpenSSL 1.1 integration, several minor bug fixes and other minor improvements.
Further information can be found in here https://github.com/OpenVPN/openvpn/blob/release/2.4/Changes.rst#version-245 and
here https://community.openvpn.net/openvpn/wiki/ChangesInOpenvpn24 .

Signed-off-by: Erik Kapfer <erik.kapfer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

pakfire: Drop old key import mechanism

This was error-prone and allowed to potentially inject another
key.

Fixes: #11539
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Import the Pakfire key at install time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core120: Import new pakfire PGP key

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Import new Pakfire Signing Key

We will swap the key that we use to sign Pakfire packages
since the current one is considered outdated cryptography.

Fixes: #11539
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>