unbound: Add TFO support for unbound

For further informations, see https://tools.ietf.org/html/rfc7413

Signed-off-by: erik.kapfer <ummeegge@ipfire.org>

unbound: Update to 1.8.3

For details see:
https://nlnetlabs.nl/svn/unbound/tags/release-1.8.3/doc/Changelog

"Fix dns64 allocation in wrong region for returned internal queries."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated grub

It doesn't need to be re-installed because no system with
that configuration should exist right now.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

grub: xfs: Accept filesystem with sparse inodes

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Tested-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Prefer red* or eth* when importing configuration

This change is necessary to make sure that the script prefers
are link with internet access. That would usually be red (after
the second boot) or eth* (on the first boot).

That allows (and ensures) that we can install packages in
the user-data script.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

installer: Intialize part_boot_efi_idx

This variable was not initialized on systems where EFI was not
in use. Therefore the generated parted command line was not
valid and caused the installation to abort.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated unbound

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

unbound: Update to 1.8.2

For details see:
https://nlnetlabs.nl/projects/unbound/download/

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

clamav: Update to 0.101.0

For details see:
https://blog.clamav.net/

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core127: Ship updated fireinfo

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 127

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

fireinfo: Add authentication for upstream proxies

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Merge branch 'master' into next

kernel: fix dwc2 (usb) dma crashes on RPi1-3

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

haproxy: Create/restore backup when package is installed/uninstalled

Fixes: #11946
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core126: finish core126

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core126: fix "need reboot display"

The display should displayed always except the linux-pae
packages is planned to be installed after this update.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

cpufrequtils: update initskript for xz compressed modules

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

initscripts: Import pakfire keys before importing AWS configuration

This is useful when the user-data script is installing
packages. For that it will need valid keys for course.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

rngd: update initskript and add hwrngtty support

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core126: add kernel files to update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core126: add kernel to updater

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.86

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

AWS: Add a timestamp to user-data.log

This way, multiple (failed) runs of the script won't
overwrite the log file.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

AWS: Write user-data.log to /var/log

This should not be in /root at all.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

make.sh: Build for x86_64 by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.85

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

bird: Launch service on install and add symlinks to start at boot time

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: Add initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: Add forgotten file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core126: Ship recently updated packages

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

BUG 11929: Build 'bind'-binaries dynamically and install needed libraries (V2)

Hi,

To save space linking the 'bind 9.11.5'-binaries was changed from statically to dynamically.

Changes to V2:
Removed unnecessary '*.so'-links.

Complete file sizes shrinked from ~4800K to ~1700K. Needs testing and confirmation!

I'm running this version right now under Core 124 - no seen problems so far.

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: Update to 2.0.2

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bird: Backup configuration file on update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

docker: Always agree to install all updates

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update arm-multi patchset

now patches for Raspberry Pi 3B+
LAN and WLAN included to patchset.

https://git.ipfire.org/?p=people/arne_f/kernel.git;a=shortlog;h=refs/tags/v4.14.84-multi

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nfs: Fix build

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.84

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

nfs: Add backup include file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nfs: Install configuration in package

This was lost in the last update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update maintainers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

git: Fix spelling of some contributors with umlauts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

credits.cgi: Remove old dev section

I do not know why I forgot this. Now it is how it was intended
in the first place.

This commit removes all email addresses because people keep
emailing me for private support. Use the forum guys!

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libvirt: This package depends on jansson now

Fixes: #11939
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update of French translation

Loads of strings have been translated for the first time
and others have been improved.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

nano: Update to 3.2

Hi,

Changed archive to 'xz' - this saves about 1.4MB (thanks Marcel ;-))

For further details see:
https://www.nano-editor.org/news.php

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

docker: Install wget in docker environment

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.83

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

docker: Add Debian image with basic build environment

By running "./make.sh docker" the current build environment
will be mounted into a Debian-based docker container.

This clean build environment can be used to compile the
toolchain or something...

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: update to 4.14.82

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

openssl: Update to 1.1.0j

  *) Timing vulnerability in DSA signature generation

     The OpenSSL DSA signature algorithm has been shown to be vulnerable to a
     timing side channel attack. An attacker could use variations in the signing
     algorithm to recover the private key.

     This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser.
     (CVE-2018-0734)
     [Paul Dale]

  *) Timing vulnerability in ECDSA signature generation

     The OpenSSL ECDSA signature algorithm has been shown to be vulnerable to a
     timing side channel attack. An attacker could use variations in the signing
     algorithm to recover the private key.

     This issue was reported to OpenSSL on 25th October 2018 by Samuel Weiser.
     (CVE-2018-0735)
     [Paul Dale]

  *) Add coordinate blinding for EC_POINT and implement projective
     coordinate blinding for generic prime curves as a countermeasure to
     chosen point SCA attacks.
     [Sohaib ul Hassan, Nicola Tuveri, Billy Bob Brumley]

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

openssl-compat: Update to 1.0.2q

  *) Microarchitecture timing vulnerability in ECC scalar multiplication

     OpenSSL ECC scalar multiplication, used in e.g. ECDSA and ECDH, has been
     shown to be vulnerable to a microarchitecture timing side channel attack.
     An attacker with sufficient access to mount local timing attacks during
     ECDSA signature generation could recover the private key.

     This issue was reported to OpenSSL on 26th October 2018 by Alejandro
     Cabrera Aldaya, Billy Brumley, Sohaib ul Hassan, Cesar Pereida Garcia and
     Nicola Tuveri.
     (CVE-2018-5407)
     [Billy Brumley]

  *) Timing vulnerability in DSA signature generation

     The OpenSSL DSA signature algorithm has been shown to be vulnerable to a
     timing side channel attack. An attacker could use variations in the signing
     algorithm to recover the private key.

     This issue was reported to OpenSSL on 16th October 2018 by Samuel Weiser.
     (CVE-2018-0734)
     [Paul Dale]

  *) Resolve a compatibility issue in EC_GROUP handling with the FIPS Object
     Module, accidentally introduced while backporting security fixes from the
     development branch and hindering the use of ECC in FIPS mode.
     [Nicola Tuveri]

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

kernel: arm32 bit fix config and update rootfile

Some drivers was disabled by oldconfig because i had
arm multiarch patchsed. This commit reenable it.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: enable HW of clearfog

clearfog base need MARVELL Phy and SDHCI Xenon enabled.

kernel: disable FW_LOADER_USER_HELPER_FALLBACK

newer (e)udev has dropped the support for this.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: compress kernel modules with xz

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

kernel: update to 4.14.81

alac: New package

This adds the Apple ALAC audio decoder

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core126: Ship libconfig

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Start Core Update 126

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

shairport-sync: Add install/uninstall scripts

These scripts will install symlinks to start the service
at boot time.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

shairport-sync: Add initscript

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

shairport-sync: Explicitely link against soxr

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

shairport-sync: Add backup include file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

shairport-sync: New package

Shairport Sync is an AirPlay audio player - it plays audio streamed
from iTunes, iOS, Apple TV and macOS devices and AirPlay sources
such as Quicktime Player and ForkedDaapd, among others.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

libconfig: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

soxr: New package (0.1.3)

The SoX Resampler library `libsoxr' performs one-dimensional sample-rate
conversion -- it may be used, for example, to resample PCM-encoded audio.
For higher-dimensional resampling, such as for visual-image processing, you
should look elsewhere.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

mpd: Depends on avahi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

xen-image: enlarge partitions and remove extra /var partition

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core125: finish update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

core125: restart init after glibc uodate

without restart remount of / will fail and may result in
a filesystem corruption at next boot.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

lang: Show the full untranslated string

This will help translators to add missing strings easier

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

dehydrated: New package

This is a light client for Let's Encrypt which is implemented
in bash and does not have any other dependencies apart from
openssl and curl.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update accelerator: Do not attempt to cache IPFire updates any more

We do not deliver anything via HTTP or FTP any more and therefore
nothing can be cached any more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

update accelerator: Cache .msp files for Adobe

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Update list of contributors

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backupiso: Add support for aarch64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backupiso: Fix order of variables

Some values in variables were corrected but used before.

Reported-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

observium-agent: Rootfile update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Do not try to change kernel hotplug handler any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

udev: Do no try to install any device nodes any more

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

core125: Ship syslog changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Tor: update to 0.3.4.9

For details and release announcement, see:
https://blog.torproject.org/new-release-tor-0349

Signed-off-by: Peter Müller <peter.mueller@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

bind: Update to 9.11.5

For details see:
http://ftp.isc.org/isc/bind9/9.11.5/RELEASE-NOTES-bind-9.11.5.html

Security fixes:
"named could crash during recursive processing of DNAME records when
deny-answer-aliases was in use. This flaw is disclosed in CVE-2018-5740. [GL #387]

When recursion is enabled but the allow-recursion and allow-query-cache ACLs are
not specified, they should be limited to local networks, but they were
inadvertently set to match the default allow-query, thus allowing
remote queries. This flaw is disclosed in CVE-2018-5738. [GL #309]"

Best,
Matthias

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

observium-agent: New package

This ships the observium agent including a couple of
modules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

Revert "haproxy: Make /dev/log available in chroot"

This reverts commit 699f0aa710932736d34dabf5a8c17287af29075c.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

syslog: Listen to network and block access from anywhere but localhost

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

backupiso: fix boot on EFI

the grub on EFI serch the config on volume "IPFire 2.21 arch"
so the custom "ipfire backup ..." volume name is not working
anymore.
This is now fixed and a backup-version.media tag will added.

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

backup: fix backupiso mastering

fixes: #11916

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

clamav: fix rootfile

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

freeradius: rootfile update

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

clamav: rootfile update

glibc: rootfile update armv5tel

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>

Merge branch 'next' of git.ipfire.org:/pub/git/ipfire-2.x into next

directfb: fix comile on 32bit arm

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>