PKG_NAME:=nftables
PKG_VERSION:=1.1.6
-PKG_RELEASE:=1
+PKG_RELEASE:=2
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://netfilter.org/projects/$(PKG_NAME)/files
PKG_LICENSE_FILES:=COPYING
PKG_INSTALL:=1
+PKG_FIXUP:=autoreconf
PKG_BUILD_FLAGS:=lto
--- /dev/null
+From 2a0ec8a7246e5c5eb85270e3d4de43e20a00c577 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Wed, 28 Jan 2026 18:31:05 +0000
+Subject: [PATCH] build: simplify the instantation of nftversion.h
+
+Add an nftversion.h.in autoconf input file which configure uses to instantiate
+nftversion.h in the usual way.
+
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ configure.ac | 19 +++----------------
+ nftversion.h.in | 19 +++++++++++++++++++
+ 2 files changed, 22 insertions(+), 16 deletions(-)
+ create mode 100644 nftversion.h.in
+
+diff --git a/configure.ac b/configure.ac
+index 6825474..2c61072 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -147,22 +147,8 @@ AM_CONDITIONAL([BUILD_SERVICE], [test "x$unitdir" != x])
+ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
+ [Stable release number])],
+ [], [with_stable_release=0])
+-AC_CONFIG_COMMANDS([stable_release],
+- [STABLE_RELEASE=$stable_release],
+- [stable_release=$with_stable_release])
+-AC_CONFIG_COMMANDS([nftversion.h], [
+-(
+- echo "static char nftversion[[]] = {"
+- echo " ${VERSION}," | tr '.' ','
+- echo " ${STABLE_RELEASE}"
+- echo "};"
+- echo "static char nftbuildstamp[[]] = {"
+- for ((i = 56; i >= 0; i-= 8)); do
+- echo " ((uint64_t)MAKE_STAMP >> $i) & 0xff,"
+- done
+- echo "};"
+-) >nftversion.h
+-])
++AC_SUBST([STABLE_RELEASE],[$with_stable_release])
++AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
+ # Current date should be fetched exactly once per build,
+ # so have 'make' call date and pass the value to every 'gcc' call
+ AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
+@@ -175,6 +161,7 @@ AM_CONDITIONAL([BUILD_DISTCHECK], [test "x$enable_distcheck" = "xyes"])
+ AC_CONFIG_FILES([ \
+ Makefile \
+ libnftables.pc \
++ nftversion.h \
+ ])
+ AC_OUTPUT
+
+diff --git a/nftversion.h.in b/nftversion.h.in
+new file mode 100644
+index 0000000..6f89771
+--- /dev/null
++++ b/nftversion.h.in
+@@ -0,0 +1,19 @@
++#ifndef NFTABLES_NFTVERSION_H
++#define NFTABLES_NFTVERSION_H
++
++static char nftversion[] = {
++ @NFT_VERSION@,
++ @STABLE_RELEASE@
++};
++static char nftbuildstamp[] = {
++ ((uint64_t)MAKE_STAMP >> 56) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 48) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 40) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 32) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 24) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 16) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 8) & 0xff,
++ ((uint64_t)MAKE_STAMP >> 0) & 0xff,
++};
++
++#endif /* !defined(NFTABLES_NFTVERSION_H) */
--- /dev/null
+From b92571cc59ce49fdd9fe2daac9350529adfb2424 Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Wed, 28 Jan 2026 18:31:06 +0000
+Subject: [PATCH] build: generate build time-stamp once at configure
+
+The existing implementation tries to generate a time-stamp once when make is
+run. However, it doesn't work and generates one for every compilation. Getting
+this right portably in automake is not straightforward. Instead, do it when
+configure is run.
+
+Rename the time-stamp variable since it is no longer generated by make.
+
+Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ Makefile.am | 2 --
+ configure.ac | 4 +---
+ nftversion.h.in | 18 ++++++++++--------
+ 3 files changed, 11 insertions(+), 13 deletions(-)
+
+diff --git a/Makefile.am b/Makefile.am
+index b134330..ceb2225 100644
+--- a/Makefile.am
++++ b/Makefile.am
+@@ -159,8 +159,6 @@ AM_CFLAGS = \
+ \
+ $(GCC_FVISIBILITY_HIDDEN) \
+ \
+- -DMAKE_STAMP=$(MAKE_STAMP) \
+- \
+ $(NULL)
+
+ AM_YFLAGS = -d -Wno-yacc
+diff --git a/configure.ac b/configure.ac
+index 2c61072..9859072 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -149,9 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
+ [], [with_stable_release=0])
+ AC_SUBST([STABLE_RELEASE],[$with_stable_release])
+ AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
+-# Current date should be fetched exactly once per build,
+-# so have 'make' call date and pass the value to every 'gcc' call
+-AC_SUBST([MAKE_STAMP], ["\$(shell date +%s)"])
++AC_SUBST([BUILD_STAMP], [$(date +%s)])
+
+ AC_ARG_ENABLE([distcheck],
+ AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
+diff --git a/nftversion.h.in b/nftversion.h.in
+index 6f89771..325b9dc 100644
+--- a/nftversion.h.in
++++ b/nftversion.h.in
+@@ -1,19 +1,21 @@
+ #ifndef NFTABLES_NFTVERSION_H
+ #define NFTABLES_NFTVERSION_H
+
++#define BUILD_STAMP @BUILD_STAMP@
++
+ static char nftversion[] = {
+ @NFT_VERSION@,
+ @STABLE_RELEASE@
+ };
+ static char nftbuildstamp[] = {
+- ((uint64_t)MAKE_STAMP >> 56) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 48) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 40) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 32) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 24) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 16) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 8) & 0xff,
+- ((uint64_t)MAKE_STAMP >> 0) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 56) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 48) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 40) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 32) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 24) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 16) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 8) & 0xff,
++ ((uint64_t)BUILD_STAMP >> 0) & 0xff,
+ };
+
+ #endif /* !defined(NFTABLES_NFTVERSION_H) */
--- /dev/null
+From ca86f206c92704170a295b8dc7a41f6448835dde Mon Sep 17 00:00:00 2001
+From: Jeremy Sowden <jeremy@azazel.net>
+Date: Wed, 28 Jan 2026 18:31:07 +0000
+Subject: [PATCH] build: support `SOURCE_DATE_EPOCH` for build time-stamp
+
+In order to support reproducible builds, set the build time-stamp to the value
+of the environment variable, `SOURCE_DATE_EPOCH`, if set, and fall back to
+calling `date`, otherwise.
+
+Link: https://reproducible-builds.org/docs/source-date-epoch/
+Fixes: 64c07e38f049 ("table: Embed creating nft version into userdata")
+Reported-by: Arnout Engelen <arnout@bzzt.net>
+Closes: https://github.com/NixOS/nixpkgs/issues/478048
+Suggested-by: Philipp Bartsch <phil@grmr.de>
+Signed-off-by: Jeremy Sowden <jeremy@azazel.net>
+Signed-off-by: Phil Sutter <phil@nwl.cc>
+---
+ configure.ac | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/configure.ac b/configure.ac
+index 9859072..0226086 100644
+--- a/configure.ac
++++ b/configure.ac
+@@ -149,7 +149,7 @@ AC_ARG_WITH([stable-release], [AS_HELP_STRING([--with-stable-release],
+ [], [with_stable_release=0])
+ AC_SUBST([STABLE_RELEASE],[$with_stable_release])
+ AC_SUBST([NFT_VERSION], [$(echo "${VERSION}" | tr '.' ',')])
+-AC_SUBST([BUILD_STAMP], [$(date +%s)])
++AC_SUBST([BUILD_STAMP], [${SOURCE_DATE_EPOCH:-$(date +%s)}])
+
+ AC_ARG_ENABLE([distcheck],
+ AS_HELP_STRING([--enable-distcheck], [Build for distcheck]),
projects / thirdparty / openwrt.git / commitdiff
