]> git.ipfire.org Git - ipfire-2.x.git/log
ipfire-2.x.git
6 months agobtrfs-progs: Update to version 6.17.1
Adolf Belka [Sat, 22 Nov 2025 19:52:27 +0000 (20:52 +0100)] 
btrfs-progs: Update to version 6.17.1

- Update from version 6.17 to 6.17.1
- No change in rootfile
- Changelog
    6.17.1
   * inspect list-chunks: more sorting keys, descending order
   * fi resize: add support for offline (unmounted) growing of single device
   * device stats: add support for offline (unmounted) reads
   * quota status: new command, overview what mode is enabled, tunables
   * fi commit-stats: new command, print various commit stats from sysfs (since
     kernel 6.1)
   * balance start: print warning and delay start if there's a missing device
     in the filesystem
   * mkfs:
      * print zoned mode (native, emulated)
   * check:
      * verify device bytes in super block item and in chunk tree
   * other
      * updated CI, new and updated tests
      * cleanups, refactoring
      * documentation updates

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoopenvpn: Update to version 2.6.16
Adolf Belka [Sat, 22 Nov 2025 19:45:04 +0000 (20:45 +0100)] 
openvpn: Update to version 2.6.16

- Update from version 2.6.15 to 2.6.16
- No change to rootfile
- Changelog
    2.6.16
Security fixes:
    CVE-2025-13086: Fix memcmp check for the hmac verification in the 3way
handshake. This bug renders the HMAC based protection against state
exhaustion on receiving spoofed TLS handshake packets in the OpenVPN
server inefficient.
Bug fixes:
    fix invalid pointer creation in tls_pre_decrypt() - technically this is a
memory over-read issue, in practice, the compilers optimize it away so
no negative effects could be observed.
    Windows: in the interactive service, fix the "undo DNS config" handling.
    Windows: in the interactive service, disallow using of "stdin" for the
config file, unless the caller is authorized OpenVPN Administrator
    Windows: in the interactive service, change all netsh calls to use
interface index and not interface name - sidesteps all possible attack
avenues with special characters in interface names.
    Windows: in the interactive service, improve error handling in some
"unlikely to happen" paths.
    auth plugin/script handling: properly check for errors in creation on
$auth_failed_reason_file (arf).
    for incoming TCP connections, close-on-exec option was applied to the wrong
socket fd, leaking socket FDs to child processes.
    sitnl: set close-on-exec flag on netlink socket
    ssl_mbedtls: fix missing perf_pop() call (optional performance profiling)
Windows MSI changes since 2.6.15-I001:
    Built against OpenSSL 3.6.0
    Included openvpn-gui updated to 11.58.0.0
        Check the return value of GetProp()
        Make config path check similar to that in interactive service
        Escape the type id of password message received from openvpn
        Add a message source for event logging
        Check correct management daemon path when OpenVPN3 is enabled
        Fix OpenVPN3 radio button label size when OVPN3 is enabled
        Use GetTempPath() for debug file in plap as well
        Migrate all saved plain usernames to encrypted format
    Included win-dco driver updated to 2.8.0

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agolldpd: Create /etc/lldp.d in the target system
Michael Tremer [Thu, 20 Nov 2025 16:25:45 +0000 (16:25 +0000)] 
lldpd: Create /etc/lldp.d in the target system

Fixes: #13905 - LLDP daemon fails to start due to missing config directory and dependency
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agolibseccomp: Move the package into the core system
Michael Tremer [Thu, 20 Nov 2025 16:23:52 +0000 (16:23 +0000)] 
libseccomp: Move the package into the core system

This is required by lldpd.

Fixes: #13905 - LLDP daemon fails to start due to missing config directory and dependency
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore199: Ship general-functions.pl
Adolf Belka [Mon, 17 Nov 2025 17:30:46 +0000 (18:30 +0100)] 
core199: Ship general-functions.pl

- This file was changed in CU198 but was not shipped so the changes were not included in
   CU198 updates.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoffmpeg: Re-enable lame and SSL support
Stefan Schantl [Mon, 17 Nov 2025 11:49:55 +0000 (12:49 +0100)] 
ffmpeg: Re-enable lame and SSL support

The ffmpeg developers decided at some point in the past to change some
defaults during configure and therefore we need to explit enable support
for lame and openssl.

Signed-off-by: Stefan Schantl <stefan.schantl@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agonano: Update to 8.7
Matthias Fischer [Sun, 16 Nov 2025 13:32:36 +0000 (14:32 +0100)] 
nano: Update to 8.7

For details see:
https://www.nano-editor.org/news.php

"2025 November 12 - GNU nano 8.7 "Blue Highways"

    At the Execute prompt, preceding the command with two pipe symbols
    allows implementing a copy-to-clipboard feature in your nanorc (on
    terminals that support OSC 52). See the doc/sample.nanorc file."

Signed-off-by: Matthias Fischer <matthias.fischer@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agofmt: bump package version
Arne Fitzenreiter [Mon, 17 Nov 2025 09:49:26 +0000 (10:49 +0100)] 
fmt: bump package version

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agokernel: update to 6.12.58
Arne Fitzenreiter [Mon, 17 Nov 2025 09:41:16 +0000 (10:41 +0100)] 
kernel: update to 6.12.58

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
6 months agozabbix_agentd: Update to 7.0.21 (LTS)
Robin Roevens [Tue, 11 Nov 2025 21:11:59 +0000 (22:11 +0100)] 
zabbix_agentd: Update to 7.0.21 (LTS)

- Update of rootfile not required

Improvements:
- ZBXNEXT-9902 Changed timeout range for Zabbix JS and Zabbix get utilities

Bugs fixed:
- ZBX-25148 Added adjustments for sequential data entries with the same timestamp
- ZBX-25263 Fixed Zabbix agent to attempt next refresh of active checks in 60 seconds in case of connection errors

Full changelogs:
- https://www.zabbix.com/rn/rn7.0.19
- https://www.zabbix.com/rn/rn7.0.20
- https://www.zabbix.com/rn/rn7.0.21

Signed-off-by: Robin Roevens <robin.roevens@disroot.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoinstaller: Ensure the console it configure to use UTF-8
Michael Tremer [Tue, 11 Nov 2025 21:31:39 +0000 (21:31 +0000)] 
installer: Ensure the console it configure to use UTF-8

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoinstaller: Use locales by their full handles
Michael Tremer [Tue, 11 Nov 2025 11:09:49 +0000 (11:09 +0000)] 
installer: Use locales by their full handles

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoinstaller: Install all supported locales
Michael Tremer [Tue, 11 Nov 2025 11:09:14 +0000 (11:09 +0000)] 
installer: Install all supported locales

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoqemu: Drop custom udev rules
Michael Tremer [Mon, 10 Nov 2025 21:15:48 +0000 (21:15 +0000)] 
qemu: Drop custom udev rules

These rules are now included in the default udev rules.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agolldpd: Build with the seccomp filter only on x86_64
Michael Tremer [Mon, 10 Nov 2025 16:03:04 +0000 (16:03 +0000)] 
lldpd: Build with the seccomp filter only on x86_64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata-reporter: Send reports at 1 am
Michael Tremer [Fri, 7 Nov 2025 14:44:37 +0000 (14:44 +0000)] 
suricata-reporter: Send reports at 1 am

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agoinitscripts: dhcp: Tolerate running other dhcp servers
Michael Tremer [Fri, 7 Nov 2025 14:39:27 +0000 (14:39 +0000)] 
initscripts: dhcp: Tolerate running other dhcp servers

Some users have been trying to run multiple instances of the DHCP server
and restarting the main server won't work because the initscript refuses
to launch the process if there is another one with the same command.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agocore199: Ship suricata-reporter
Michael Tremer [Fri, 7 Nov 2025 14:35:27 +0000 (14:35 +0000)] 
core199: Ship suricata-reporter

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agosuricata-reporter: Update to version 0.5
Michael Tremer [Fri, 7 Nov 2025 14:34:56 +0000 (14:34 +0000)] 
suricata-reporter: Update to version 0.5

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
6 months agokernel: update to 6.12.57
Arne Fitzenreiter [Mon, 10 Nov 2025 04:33:36 +0000 (05:33 +0100)] 
kernel: update to 6.12.57

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agobackup: Include /etc/locale.conf
Michael Tremer [Fri, 7 Nov 2025 13:52:43 +0000 (13:52 +0000)] 
backup: Include /etc/locale.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship /etc/locale.conf
Michael Tremer [Fri, 7 Nov 2025 13:51:01 +0000 (13:51 +0000)] 
core199: Ship /etc/locale.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agostage2: Create /etc/locale.conf
Michael Tremer [Fri, 7 Nov 2025 13:50:22 +0000 (13:50 +0000)] 
stage2: Create /etc/locale.conf

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship the redirect wrapper
Michael Tremer [Fri, 7 Nov 2025 13:50:03 +0000 (13:50 +0000)] 
core199: Ship the redirect wrapper

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agourlfilter: Remove squidclamav from the redirect wrapper
Michael Tremer [Fri, 7 Nov 2025 13:49:31 +0000 (13:49 +0000)] 
urlfilter: Remove squidclamav from the redirect wrapper

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoproxy.cgi: Remove remainders of squidclamav
Michael Tremer [Fri, 7 Nov 2025 13:47:38 +0000 (13:47 +0000)] 
proxy.cgi: Remove remainders of squidclamav

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agovdradmin: Remove ineffective statement
Michael Tremer [Fri, 7 Nov 2025 13:37:47 +0000 (13:37 +0000)] 
vdradmin: Remove ineffective statement

Every line will be executed in a fresh shell, so although the statement
sets the variable, nothing will ever be called to use it.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship ntp because of OpenSSL update
Michael Tremer [Fri, 7 Nov 2025 11:45:22 +0000 (11:45 +0000)] 
core199: Ship ntp because of OpenSSL update

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship LLDP changes
Michael Tremer [Fri, 7 Nov 2025 11:32:07 +0000 (11:32 +0000)] 
core199: Ship LLDP changes

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolldpd: Don't install the static library
Michael Tremer [Fri, 7 Nov 2025 11:23:09 +0000 (11:23 +0000)] 
lldpd: Don't install the static library

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoinitscripts: Add an initscript for lldpd
Michael Tremer [Thu, 6 Nov 2025 16:46:56 +0000 (16:46 +0000)] 
initscripts: Add an initscript for lldpd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoweb-user-interface: Add LLDP to the network menu
Michael Tremer [Thu, 6 Nov 2025 16:46:55 +0000 (16:46 +0000)] 
web-user-interface: Add LLDP to the network menu

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoweb-user-interface: Add lldp.cgi
Michael Tremer [Thu, 6 Nov 2025 16:46:54 +0000 (16:46 +0000)] 
web-user-interface: Add lldp.cgi

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocfgroot: Create /var/ipfire/lldp/settings
Michael Tremer [Thu, 6 Nov 2025 16:46:53 +0000 (16:46 +0000)] 
cfgroot: Create /var/ipfire/lldp/settings

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomisc-progs: Add lldpdctrl
Michael Tremer [Thu, 6 Nov 2025 16:46:52 +0000 (16:46 +0000)] 
misc-progs: Add lldpdctrl

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolldpd: New package
Michael Tremer [Thu, 6 Nov 2025 16:46:51 +0000 (16:46 +0000)] 
lldpd: New package

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
Reviewed-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Add the forgotten usb-modeswitch-data file
Michael Tremer [Fri, 7 Nov 2025 11:20:15 +0000 (11:20 +0000)] 
core199: Add the forgotten usb-modeswitch-data file

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Restart strongSwan
Michael Tremer [Fri, 7 Nov 2025 11:19:52 +0000 (11:19 +0000)] 
core199: Restart strongSwan

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship strongswan
Adolf Belka [Fri, 7 Nov 2025 09:59:44 +0000 (10:59 +0100)] 
core199: Ship strongswan

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agostrongswan: Update to version 6.0.3
Adolf Belka [Fri, 7 Nov 2025 09:59:43 +0000 (10:59 +0100)] 
strongswan: Update to version 6.0.3

- Update from version 6.0.2 to 6.0.3
- Update of rootfile
- Changelog
    6.0.3
- Fixed a vulnerability in the eap-mschapv2 plugin related to processing Failure
  Request packets on the client that can lead to a heap-based buffer overflow
  and potentially remote code execution.
  This vulnerability has been registered as CVE-2025-62291.
- The new `alert` event for vici is raised for certain error conditions.
- Only plugins with matching version number are loaded by programs.
- IKE SAs redirected during IKE_AUTH are now properly tracked by controller and
  trap-manager.
- Fallback to the IKE identity for clients that don't provide an EAP-Identity to
  fix a regression in 6.0.2.
- Detecting unwrapped CKA_EC_POINTs has been improved in the pkcs11 plugin.
- The whitelist plugin uses non-blocking I/O to avoid issues with clients that
  stay connected for a long time.  The buffer size for IDs was increased to 256.
- The certexpire plugins also uses 256 bytes for its identity buffer.
- Convenient decorators for event handling are provided by the Python bindings
  for vici.
- The openssl plugin also supports Ed25519 via AWS-LC.  It also loads EdDSA keys
  from PKCS#12 containers.
- The testing environment is now based on Debian 13 (trixie), by default.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosquid: Don't forcibly kill any redirectory processes
Michael Tremer [Fri, 7 Nov 2025 10:20:33 +0000 (11:20 +0100)] 
squid: Don't forcibly kill any redirectory processes

This is a race which might cause that when squidGuard pre-compiles any
data, it will be killed too. If that happens, squid will keep forking
squidGuard processes which will be unresponsive (because they are trying
to compile they own databases) and the whole system will become
unresponsive at some point.

There should be no need to perform this action.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship elfutils, iana-etc, libcap, lvm2 & sqlite
Adolf Belka [Thu, 6 Nov 2025 18:03:24 +0000 (19:03 +0100)] 
core199: Ship elfutils, iana-etc, libcap, lvm2 & sqlite

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosuricata: Update to version 8.0.2
Adolf Belka [Thu, 6 Nov 2025 21:03:23 +0000 (22:03 +0100)] 
suricata: Update to version 8.0.2

- Update from version 8.0.1 to 8.0.2
- No change to rootfile
- Changelog
    8.0.2
CVE IDs Addressed:
    CVE-2025-64344: HIGH
    CVE-2025-64333: HIGH
    CVE-2025-64332: HIGH
    CVE-2025-64331: HIGH
    CVE-2025-64330: HIGH
    CVE-2025-64335: HIGH
    CVE-2025-64334: HIGH
Bug #7910: lua/http: null dereference in accessor functions (8.0.x backport)
Bug #7911: eve/alert: incorrect verdict with pass + alert rule (8.0.x backport)
Bug #7923: output/json: invalid IKE logs (8.0.x backport)
Bug #7940: decoder/vxlan: packet drops with non-zero reserved fields
 (8.0.x backport)
Bug #7943: runmode/dpdk: dpdk_vars initialized to NULL for any livedev
 (8.0.x backport)
Bug #7961: mime: incorrect decoding of quoted-printable text attachments
 (8.0.x backport)
Bug #7974: detect/files: signatures using file keywords on udp only app protos
 fail (8.0.x backport)
Bug #7976: dpdk: CPU exclude logic is broken (8.0.x backport)
Bug #7990: dpdk: compile warning ‘rte_eth_bond_members_get’ is deprecated
 (8.0.x backport)
Bug #7992: http2: wrong parsing of go away frames error code (8.0.x backport)
Bug #7998: detect: replace keyword leaks memory (8.0.x backport)
Bug #8005: pcap-log: bpf-filter not applied when using multi mode (8.0.x backport)
Bug #8007: anomaly/ether_type: always logged as big endian (8.0.x backport)
Bug #8016: detect/ip.src: does not load with lua transform (8.0.x backport)
Bug #8020: tls: certificate SAN is freed in case of any error (8.0.x backport)
Bug #8034: flow/timeouts: yaml configured values unused for bypassed
 (8.0.x backport)
Bug #8053: python/Makefile: too open file permissions for defaults.py
 (8.0.x backport)
Bug #8076: snmp: detection-only setting is broken (8.0.x backport)
Feature #8072: flow: midstream exception policy "reject-both" support
 (8.0.x backport)
Task #5472: tracking: upgrading from 7 to 8
Task #7936: security: review security levels definitions (8.0.x backport)
Task #7978: github/actions: add DPDK 23.11 build (8.0.x backport)
Task #7984: ci: Add multi-tenant test (backport to 8.0)
Task #7985: ci: Add multi-tenant test (8.0.x backport)
Documentation #7914: devguide: Add Eve Output Plugins (8.0.x backport)
Documentation #7916: userguide: document tx scoped xbits (8.0.x backport)
Documentation #7917: userguide: add section for rule hooks (8.0.x backport)
Security #8066: lua: stack overflow from unbounded stack allocation in
 LuaPushStringBuffer (8.0.x backport)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosqlite: Update to version 3510000
Adolf Belka [Thu, 6 Nov 2025 18:03:30 +0000 (19:03 +0100)] 
sqlite: Update to version 3510000

- Update from version 3500400 to 3510000
- Update of rootfile
- Changelog
    3510000
New macros in sqlite3.h:
    SQLITE_SCM_BRANCH → the name of the branch from which the source code is
taken.
    SQLITE_SCM_TAGS → space-separated list of tags on the source code check-in.
    SQLITE_SCM_DATETIME → ISO-8601 date and time of the source code check-in.
Two new JSON functions, jsonb_each() and jsonb_tree() work the same as the
 existing json_each() and json_tree() functions except that they return JSONB
 for the "value" column when the "type" is 'array' or 'object'.
The carray and percentile extensions are now built into the amalgamation,
though they are disabled by default and must be activated at
compile-time using the -DSQLITE_ENABLE_CARRAY and/or
-DSQLITE_ENABLE_PERCENTILE options, respectively.
Enhancements to TCL Interface:
    Add the -asdict flag to the eval command to have it set the row data as a
dict instead of an array.
    User-defined functions may now break to return an SQL NULL.
CLI enhancements:
    Increase the precision of ".timer" to microseconds.
    Enhance the "box" and "column" formatting modes to deal with double-wide
characters.
    The ".imposter" command provides read-only imposter tables that work with
VACUUM and do not require the --unsafe-testing option.
    Add the --ifexists option to the CLI command-line option and to the .open
command.
    Limit columns widths set by the ".width" command to 30,000 or less, as
there is not good reason to have wider columns, but supporting wider
columns provides opportunity to malefactors.
Performance enhancements:
    Use fewer CPU cycles to commit a read transaction.
    Early detection of joins that return no rows due to one or more of the
tables containing no rows.
    Avoid evaluation of scalar subqueries if the result of the subquery does
not change the result of the overall expression.
    Faster window function queries when using
"BETWEEN :x FOLLOWING AND :y FOLLOWING" with a large :y.
Add the PRAGMA wal_checkpoint=NOOP; command and the SQLITE_CHECKPOINT_NOOP
 argument for sqlite3_wal_checkpoint_v2().
Add the sqlite3_set_errmsg() API for use by extensions.
Add the sqlite3_db_status64() API, which works just like the existing
 sqlite3_db_status() API except that it returns 64-bit results.
Add the SQLITE_DBSTATUS_TEMPBUF_SPILL option to the sqlite3_db_status() and
 sqlite3_db_status64() interfaces.
In the session extension add the sqlite3changeset_apply_v3() interface.
For the built-in printf() and the format() SQL function, omit the leading '-'
 from negative floating point numbers if the '+' flag is omitted and the "#"
 flag is present and all displayed digits are '0'. Use '%#f' or similar to
 avoid outputs like '-0.00' and instead show just '0.00'.
Improved error messages generated by FTS5.
Enforce STRICT typing on computed columns.
Improved support for VxWorks
JavaScript/WASM now supports 64-bit WASM. The canonical builds continue to be
 32-bit but creating one's own 64-bit build is now as simple as running "make".
Improved resistance to database corruption caused by an application breaking
 Posix advisory locks using close().

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoprotobuf: Update to version 33.0
Adolf Belka [Thu, 6 Nov 2025 18:03:29 +0000 (19:03 +0100)] 
protobuf: Update to version 33.0

- Update from version 32.1 to 33.0
- Update of rootfile
- Changelog
    33.0
Bazel
    Feat: update bazel central registry publish workflow (#23465) (#23913)
(d5217fd)
    Add target_compatible_with parameter to proto_toolchain in Bazel rules
(#22429) (30d2332)
    Bazel: add missing rules_cc loads (#23584) (d98e2ef)
Compiler
    Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
    Ship all option dependencies to plugins along with regular ones. (abeb130)
C++
    Avoid calling deprecated arena-enabled constructors in arena.h. (813a7ef)
    Add a macro to make RepeatedField(Arena*) constructor private in a future
release. (768db14)
    Add a macro to make Map(Arena*) constructor private in a future release.
(543a17f)
    Optimize ReadPackedVarint (3d94d83)
    Add a macro to make RepeatedPtrField(Arena*) constructor private in a
future release (6422b9d)
    Add IsEmpty() function to reflection. (b64e490)
    Refactor RuntimeAssertInBounds to remove repeated logic and make
Get/Mutable easier to read. (2f270c4)
    Disable symbol visibility enforcement by default in C++ runtime (ae308fc)
    Fix a bug in the main C++ JSON parser/serializer camelcasing of certain
non-style-compliant names incorrectly, in a way that would prevent it
from interoperating with any other implementation on those fields.
(e25e267)
    Fail early for messages with more than 65k fields. (90824aa)
    Add option to C++ JSON Parser/Serializer to allow customers to
affirmatively disable legacy bug-compatibilty behaviors. (6ea1640)
    Fix mishandling on JSON serialization of Timestamp with invalid negative
and too-large nanos value. (a959f27)
    Preserve features in type resolver (c7030f4)
    Add a DCHECK that ArenaStringPtr::Set(char*, Arena*) is not called with
(95b1763)
Java
    Restored compatibility of runtime with gencode created with protoc <3.21
    With this release, compatibility of the runtime with older gencode down to
     3.0.0 is restored, compared to the previous support minimum of gencode
     created with 3.22+. Note that it is still strongly recommended to
     regenerate your gencode with a newer protoc and to avoid using gencode
     which was created with an old protoc.
    Generated code from this range is covered by CVE-2022-3171 and is
     potentially vulnerable to a Denial of Service risk.
    JavaProto 4.x previously dropped compatibility with the potentially
     vulnerable generated code, having the behavior of:
        The vulnerable generated code was source-incompatible with new runtime
 (would not compile when built from source)
        The vulnerable generated code was ABI-incompatible with new runtime
 (when using a .class file compiled against old runtime, a
 NoSuchMethodException would be thrown at parse time).
    Starting with this release:
        The vulnerable generated code is now source-compatible (will compile).
        The first time each potentially vulnerable type is parsed, an error
 message will be logged noting that potentially vulnerable generated
 code is in use and the name of the corresponding type.
        Environment variables may be set to either throw an exception instead
 (-Dcom.google.protobuf.error_on_unsafe_pre22_gencode) or to entirely
 silence the logged messages
 (-Dcom.google.protobuf.use_unsafe_pre22_gencode)
    This change was made based on community feedback regarding the difficulty
in identifying and quickly remediating stale gencode in their
transitive dependencies weighed against a careful evaluation of the
realistic risk exposure of DoS (with no risk of other concerns
including information leak or RCE).
    We strongly recommend that any users who observe the log messages to
regenerate the corresponding code with a newer protoc. We recommend
that any security-conscious services opt into the
error_on_unsafe_pre22_gencode behavior to preclude any risk of a
Denial of Service surface area being exposed.
    A future 4.x release may flip the default behavior to error by default as
a measure to further help the ecosystem avoid the Denial of Service
risks, while still maintaining the ability to opt into continuing to
use insecure gencode for users who are parsing trusted inputs and
where the difficulty of regenerating is high.
Changes
    Switch the pre22 warning to use CopyOnWriteArraySet. (#23969) (e55224c)
    Expose helpers for checking if messages and enums are nested. (8de4002)
    Fix a bug calculating the file name in the absense of directories. (c4ff7a6)
    Clarify the public APIs of GeneratorNames helpers. (537ac35)
    Expose helpers to predict generated class names in java. (eba6df2)
    Deprecate ClassName methods in favor of new QualifiedClassName ones.
(ca4fb2f)
    Restore the 3-argument internalBuildGeneratedFileFrom. (4376591)
    Fix large java enums not being honored on lite runtime. (a995803)
    Slightly relax Java Poison Pill on prerelease versions (-rc1, -dev, etc).
(7b0bee3)
    Avoid boxing/unboxing varint, fixed32, and fixed64 fields in
UnknownFieldSet.Field (810272f)
    Readd new*List() methods on GeneratedMessageV3. (badaf41)
    Add Values.of(Map<String, Value> values). (c518f25)
    Fix handling of optional dependencies in java generator. (8d51e34)
    Restore ABI compatibility for extension methods which was previously
(knowingly) broken with 4.x: 94a2a44 (ea33ae8)
    Restore Protobuf Java extension modifiers in gencode that were previously
removed in 7bff169 (f2257f5)
    Ship all option dependencies to plugins along with regular ones. (abeb130)
    Optimize redaction state calculation (e05db5c)
    Add isPlaceholder() accessors to file, message, and enum descriptors
(f978ec2)
    Improve Java gencode static initialization to avoid unnecessary
temporaries again (745e15b)
    Improve Java gencode static initialization to avoid unnecessary
temporaries (b68b673)
    Remove protobuf-util usages of guava except annotations. (5768acd)
    Restore compatibility of runtime with pre-3.22.x gencode impacted by
CVE-2022-3171 (7c51e5b)
    Expose an iterator for GeneratedMessage.ExtendableMessage.extensions
(b25d39e)
Rust
    Change Rust prelude to bring in traits as _ (c3f7e8d)
    Make message Muts Send (8bff944)
    See also UPB changes below, which may affect Rust.
Python
    Publish s390x wheels for Python/upb. (56b2b89)
    Fix a crash that happens during shutdown due to looking up modules in the
cache (d57d270)
    Add construction support for repeated Timestamp/Duration/Struct/ListValue.
(5f6c013)
    Fix handling of repeated extension fields in PyProto JSON (07ef676)
    Fixed a parser bug where closed enums are parsed incorrectly for
non-repeated extensions. (c36f728)
    Fixed mypy errors by setting __slots__ to empty in .pyi files. (38ca2d3)
    Raise warnings for float_precision from python json_format. (4659cd7)
    Raise warnings when assign bool to int/enum field in Python Proto. This
will turn into error in 34.0 release. (4ee55d7)
PHP
    Fix(php): php errors on repeated field (#23372) (6fee29b)
UPB (Python/PHP/Ruby C-Extension)
    Fixed a parser bug where closed enums are parsed incorrectly for
non-repeated extensions. (c36f728)
Other
    Update token for BCR release to reuse existing BOT_ACCESS_TOKEN used for
staleness_refresh.yml and update_php_repo.yml (#23925) (dcace2f)
    Use the 'better' JSON parser on the conformance suite harness. (4b4e405)
    Add JSON conformance test that a single value provided for a repeated
field should parse fail. (9806994)
    Add conformance test cases for malformed nanos fields on Durations and
Timestamps. (a6bdd0a)

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolvm2: Update to version 2.03.36
Adolf Belka [Thu, 6 Nov 2025 18:03:28 +0000 (19:03 +0100)] 
lvm2: Update to version 2.03.36

- Update from version 2.03.35 to 2.03.36
- No change to rootfile
- Changelog
    2.03.36
  Fix uninitialized chunk_size_calc_policy in pool parameter functions.
  Fix approximate allocation for Raid with insufficient extents.
  Fix race in dmeventd remonitoring optimization (2.03.35).
  Use -real suffix for pvmove UUID.
  Add support pvmove segmentation allocation/pvmove_max_segmentation_size_mb.
  Allow creating _imeta with multiple segments.
  Fix driver_version() accepts NULL version buffer pointer.
  Fix invalid free() call in error path of _add_metadata_area_to_pv().
  Avoid destroying aio context in forked process.
  Add lvs -o cache_promotions,cache_promotions fields.
  Update pvmove logic when moving i.e. raid legs.
  Display integrity info in lvdisplay.
  Increase storage size for internal filter chain.
  Add helper function display_mb_size().
  Enhance code for adding and removing integrity to RAID volumes.
  Add code for basic validation of integrity segment.
  Use -real private suffix for integrity origin and meta volumes.
  Use -real private suffix for mirror and raid legs.
  Detect and use existing XFS quota mount options for lvresize --fs resize.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolibcap: Update to version 2.77
Adolf Belka [Thu, 6 Nov 2025 18:03:27 +0000 (19:03 +0100)] 
libcap: Update to version 2.77

- Update from version 2.76 to 2.77
- Update of rootfile
- Changelog
    2.77
    Fix mistakes in setcap for reporting errors: report them with the
appropriate filename. Thanks to Nikolas for reporting these in
Bug 220245.
    Fix bug in cap.GetIAB() reported and fix provided by Garret Kelly via
Bug 220420.
    Improve libcap managed memory allocation and support CHERI RISC-V. Reported
with fix by Chris Hofer via Bug 220415.
    Add (unverified) support for the PSX mechanism on microblaze, arc, openrisc
and xtensa architectures. Thanks to Tom Petazzoni for including these in
Bug 219915
        Please let me know if these work or fail on these architectures.
    Add C++ support to the run a .so file as an executable mechanism employed by
libcap.so, libpsx.so and pam_cap.so. Not really necessary for the libcap
build tree, but wanted to capture the details of my recent update to a
Stackoverflow answer on the topic.
    Use BUILD_LDFLAGS when compiling _makenames fix contributed by Khem Raj.
        Fix broke some builds, so will revert and apply a more comprehensive fix.
    Fixed sendmail issue discussion link. Thanks to Ariel Otilibili for noticing
the breakage and contributing a fix.
    Some debugging fixes for use of the kdebug/ testing setup,

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoiana-etc: Update to version 20251030
Adolf Belka [Thu, 6 Nov 2025 18:03:26 +0000 (19:03 +0100)] 
iana-etc: Update to version 20251030

- Update from version 20250505 to 20251030
- No change to rootfile
- No changelog provided

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoelfutils: Update to version 0.194
Adolf Belka [Thu, 6 Nov 2025 18:03:25 +0000 (19:03 +0100)] 
elfutils: Update to version 0.194

- Update from version 0.193 to 0.194
- Update of rootfile
- Changelog
    0.194
debuginfod-find: Fixed caching bug preventing user-cancelled downloads
                 from being re-downloaded at a later time.
elfclassify: New options --has-debug-sections and --any-ar-member.
elflint: Presence of vendor- and application-specific ELF note types no
         longer triggers compliance errors.
libdwfl_stacktrace: New function dwflst_sample_getframes.  The
                    libdwfl_stacktrace library interface is experimental
                    and may be subject to API/ABI changes.
libelf: Manual pages have been added for many libelf library functions.
        Additional manual pages are planned for future releases.
readelf: Up to 13% faster when using the -N option.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agompd: Ship due to so-bump in fmt
Adolf Belka [Thu, 6 Nov 2025 18:02:56 +0000 (19:02 +0100)] 
mpd: Ship due to so-bump in fmt

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agofmt: Update to version 12.1.0
Adolf Belka [Thu, 6 Nov 2025 18:02:55 +0000 (19:02 +0100)] 
fmt: Update to version 12.1.0

- Update from version 11.2.0 to 12.1.0
- Update of rootfile
- so-bump so mpd requires shipping
- Changelog
    12.1.0
- Optimized `buffer::append`, resulting in up to ~16% improvement on spdlog
  benchmarks (https://github.com/fmtlib/fmt/pull/4541). Thanks @fyrsta7.
- Worked around an ABI incompatibility in `std::locale_ref` between clang and
  gcc (https://github.com/fmtlib/fmt/issues/4573).
- Made `std::variant` and `std::expected` formatters work with `format_as`
  (https://github.com/fmtlib/fmt/issues/4574,
  https://github.com/fmtlib/fmt/pull/4575). Thanks @phprus.
- Made `fmt::join<string_view>` work with C++ modules
  (https://github.com/fmtlib/fmt/issues/4379,
  https://github.com/fmtlib/fmt/pull/4577). Thanks @Arghnews.
- Exported `fmt::is_compiled_string` and `operator""_cf` from the module
  (https://github.com/fmtlib/fmt/pull/4544). Thanks @CrackedMatter.
- Fixed a compatibility issue with C++ modules in clang
  (https://github.com/fmtlib/fmt/pull/4548). Thanks @tsarn.
- Added support for cv-qualified types to the `std::optional` formatter
  (https://github.com/fmtlib/fmt/issues/4561,
  https://github.com/fmtlib/fmt/pull/4562). Thanks @OleksandrKvl.
- Added demangling support (used in exception and `std::type_info` formatters)
  for libc++ and clang-cl
  (https://github.com/fmtlib/fmt/issues/4542,
  https://github.com/fmtlib/fmt/pull/4560,
  https://github.com/fmtlib/fmt/issues/4568,
  https://github.com/fmtlib/fmt/pull/4571).
  Thanks @FatihBAKIR and @rohitsutreja.
- Switched to global `malloc`/`free` to enable allocator customization
  (https://github.com/fmtlib/fmt/issues/4569,
  https://github.com/fmtlib/fmt/pull/4570). Thanks @rohitsutreja.
- Made the `FMT_USE_CONSTEVAL` macro configurable by users
  (https://github.com/fmtlib/fmt/pull/4546). Thanks @SnapperTT.
- Fixed compilation with locales disabled in the header-only mode
  (https://github.com/fmtlib/fmt/issues/4550).
- Fixed compilation with clang 21 and `-std=c++20`
  (https://github.com/fmtlib/fmt/issues/4552).
- Fixed a dynamic linking issue with clang-cl
  (https://github.com/fmtlib/fmt/issues/4576,
  https://github.com/fmtlib/fmt/pull/4584). Thanks @FatihBAKIR.
- Fixed a warning suppression leakage on gcc
  (https://github.com/fmtlib/fmt/pull/4588). Thanks @ZedThree.
- Made more internal color APIs `constexpr`
  (https://github.com/fmtlib/fmt/pull/4581). Thanks @ishani.
- Fixed compatibility with clang as a host compiler for NVCC
  (https://github.com/fmtlib/fmt/pull/4564). Thanks @valgur.
- Fixed various warnings and lint issues
  (https://github.com/fmtlib/fmt/issues/4565,
  https://github.com/fmtlib/fmt/pull/4572,
  https://github.com/fmtlib/fmt/pull/4557).
  Thanks @LiangHuDream and @teruyamato0731.
- Improved documentation
  (https://github.com/fmtlib/fmt/issues/4549,
  https://github.com/fmtlib/fmt/pull/4551,
  https://github.com/fmtlib/fmt/issues/4566,
  https://github.com/fmtlib/fmt/pull/4567,
  https://github.com/fmtlib/fmt/pull/4578,).
  Thanks @teruyamato0731, @petersteneteg and @zimmerman-dev.
    12.0.0
- Optimized the default floating point formatting
  (https://github.com/fmtlib/fmt/issues/3675,
  https://github.com/fmtlib/fmt/issues/4516). In particular, formatting a
  `double` with format string compilation into a stack allocated buffer is
  more than 60% faster in version 12.0 compared to 11.2 according to
  [dtoa-benchmark](https://github.com/fmtlib/dtoa-benchmark):
  ```
  Function  Time (ns)  Speedup
  fmt11        34.471    1.00x
  fmt12        21.000    1.64x
  ```
  <img width="766" height="609" src="https://github.com/user-attachments/assets/d7d768ad-7543-468c-b0bb-449abf73b31b" />
- Added `constexpr` support to `fmt::format`. For example:
  ```c++
  #include <fmt/compile.h>
  using namespace fmt::literals;
  std::string s = fmt::format(""_cf, 42);
  ```
  now works at compile time provided that `std::string` supports `constexpr`
  (https://github.com/fmtlib/fmt/issues/3403,
  https://github.com/fmtlib/fmt/pull/4456). Thanks @msvetkin.
- Added `FMT_STATIC_FORMAT` that allows formatting into a string of the exact
  required size at compile time.
  For example:
  ```c++
  #include <fmt/compile.h>
  constexpr auto s = FMT_STATIC_FORMAT("{}", 42);
  ```
  compiles to just
  ```s
  __ZL1s:
        .asciiz "42"
  ```
  It can be accessed as a C string with `s.c_str()` or as a string view with
  `s.str()`.
- Improved C++20 module support
  (https://github.com/fmtlib/fmt/pull/4451,
  https://github.com/fmtlib/fmt/pull/4459,
  https://github.com/fmtlib/fmt/pull/4476,
  https://github.com/fmtlib/fmt/pull/4488,
  https://github.com/fmtlib/fmt/issues/4491,
  https://github.com/fmtlib/fmt/pull/4495).
  Thanks @arBmind, @tkhyn, @Mishura4, @anonymouspc and @autoantwort.
- Switched to using estimated display width in precision. For example:
  ```c++
  fmt::print("|{:.4}|\n|1234|\n", "🐱🐱🐱");
  ```
  prints
  ![](https://github.com/user-attachments/assets/6c4446b3-13eb-43b9-b74a-b4543540ad6a)
  because `🐱` has an estimated width of 2
  (https://github.com/fmtlib/fmt/issues/4272,
  https://github.com/fmtlib/fmt/pull/4443,
  https://github.com/fmtlib/fmt/pull/4475).
  Thanks @nikhilreddydev and @localspook.
- Fix interaction between debug presentation, precision, and width for strings
  (https://github.com/fmtlib/fmt/pull/4478). Thanks @localspook.
- Implemented allocator propagation on `basic_memory_buffer` move
  (https://github.com/fmtlib/fmt/issues/4487,
  https://github.com/fmtlib/fmt/pull/4490). Thanks @toprakmurat.
- Fixed an ambiguity between `std::reference_wrapper<T>` and `format_as`
  formatters (https://github.com/fmtlib/fmt/issues/4424,
  https://github.com/fmtlib/fmt/pull/4434). Thanks @jeremy-rifkin.
- Removed the following deprecated APIs:
  - `has_formatter`: use `is_formattable` instead,
  - `basic_format_args::parse_context_type`,
    `basic_format_args::formatter_type` and similar aliases in context types,
  - wide stream overload of `fmt::printf`,
  - wide stream overloads of `fmt::print` that take text styles,
  - `is_*char` traits,
  - `fmt::localtime`.
- Deprecated wide overloads of `fmt::fprintf` and `fmt::sprintf`.
- Improved diagnostics for the incorrect usage of `fmt::ptr`
  (https://github.com/fmtlib/fmt/pull/4453). Thanks @TobiSchluter.
- Made handling of ANSI escape sequences more efficient
  (https://github.com/fmtlib/fmt/pull/4511,
  https://github.com/fmtlib/fmt/pull/4528).
  Thanks @localspook and @Anas-Hamdane.
- Fixed a buffer overflow on all emphasis flags set
  (https://github.com/fmtlib/fmt/pull/4498). Thanks @dominicpoeschko.
- Fixed an integer overflow for precision close to the max `int` value.
- Fixed compatibility with WASI (https://github.com/fmtlib/fmt/issues/4496,
  https://github.com/fmtlib/fmt/pull/4497). Thanks @whitequark.
- Fixed `back_insert_iterator` detection, preventing a fallback on slower path
  that handles arbitrary iterators (https://github.com/fmtlib/fmt/issues/4454).
- Fixed handling of invalid glibc `FILE` buffers
  (https://github.com/fmtlib/fmt/issues/4469).
- Added `wchar_t` support to the `std::byte` formatter
  (https://github.com/fmtlib/fmt/issues/4479,
  https://github.com/fmtlib/fmt/pull/4480). Thanks @phprus.
- Changed component prefix from `fmt-` to `fmt_` for compatibility with
  NSIS/CPack on Windows, e.g. `fmt-doc` changed to `fmt_doc`
  (https://github.com/fmtlib/fmt/issues/4441,
  https://github.com/fmtlib/fmt/pull/4442). Thanks @n-stein.
- Added the `FMT_CUSTOM_ASSERT_FAIL` macro to simplify providing a custom
  `fmt::assert_fail` implementation (https://github.com/fmtlib/fmt/pull/4505).
  Thanks @HazardyKnusperkeks.
- Switched to `FMT_THROW` on reporting format errors so that it can be
  overriden by users when exceptions are disabled
  (https://github.com/fmtlib/fmt/pull/4521). Thanks @HazardyKnusperkeks.
- Improved master project detection and disabled install targets when using
  {fmt} as a subproject by default (https://github.com/fmtlib/fmt/pull/4536).
  Thanks @crueter.
- Made various code improvements
  (https://github.com/fmtlib/fmt/pull/4445,
  https://github.com/fmtlib/fmt/pull/4448,
  https://github.com/fmtlib/fmt/pull/4473,
  https://github.com/fmtlib/fmt/pull/4522).
  Thanks @localspook, @tchaikov and @way4sahil.
- Added Conan instructions to the docs
  (https://github.com/fmtlib/fmt/pull/4537). Thanks @uilianries.
- Removed Bazel files to avoid issues with downstream packaging
  (https://github.com/fmtlib/fmt/pull/4530). Thanks @mering.
- Added more entries for generated files to `.gitignore`
  (https://github.com/fmtlib/fmt/pull/4355,
  https://github.com/fmtlib/fmt/pull/4512).
  Thanks @dinomight and @localspook.
- Fixed various warnings and compilation issues
  (https://github.com/fmtlib/fmt/pull/4447,
  https://github.com/fmtlib/fmt/issues/4470,
  https://github.com/fmtlib/fmt/pull/4474,
  https://github.com/fmtlib/fmt/pull/4477,
  https://github.com/fmtlib/fmt/pull/4471,
  https://github.com/fmtlib/fmt/pull/4483,
  https://github.com/fmtlib/fmt/pull/4515,
  https://github.com/fmtlib/fmt/issues/4533,
  https://github.com/fmtlib/fmt/pull/4534).
  Thanks @dodomorandi, @localspook, @remyjette, @Tomek-Stolarczyk, @Mishura4,
  @mattiasljungstrom and @FatihBAKIR.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoRemove the separate rootfile for udev on riscv64
Michael Tremer [Thu, 6 Nov 2025 16:07:56 +0000 (16:07 +0000)] 
Remove the separate rootfile for udev on riscv64

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship usb_modeswitch
Michael Tremer [Thu, 6 Nov 2025 16:06:45 +0000 (16:06 +0000)] 
core199: Ship usb_modeswitch

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agousb-modeswitch*: Update path for udev rules
Michael Tremer [Thu, 6 Nov 2025 16:06:14 +0000 (16:06 +0000)] 
usb-modeswitch*: Update path for udev rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship the refreshed udev
Michael Tremer [Tue, 4 Nov 2025 16:17:24 +0000 (16:17 +0000)] 
core199: Ship the refreshed udev

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoqemu: Install the udev rules to the right place
Michael Tremer [Tue, 4 Nov 2025 16:03:41 +0000 (16:03 +0000)] 
qemu: Install the udev rules to the right place

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomakeqosscripts.pl: Update path to udev scripts
Michael Tremer [Tue, 4 Nov 2025 16:01:55 +0000 (16:01 +0000)] 
makeqosscripts.pl: Update path to udev scripts

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolvm2: Move udev rules to the right place
Michael Tremer [Tue, 4 Nov 2025 16:01:13 +0000 (16:01 +0000)] 
lvm2: Move udev rules to the right place

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodbus: Move from a package to the core system
Michael Tremer [Tue, 28 Oct 2025 16:19:52 +0000 (16:19 +0000)] 
dbus: Move from a package to the core system

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodbus: Fix permissions of the setuid helper
Michael Tremer [Tue, 28 Oct 2025 15:43:40 +0000 (15:43 +0000)] 
dbus: Fix permissions of the setuid helper

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodbus: Create the messagebus user by default
Michael Tremer [Tue, 28 Oct 2025 15:43:28 +0000 (15:43 +0000)] 
dbus: Create the messagebus user by default

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoinstaller: Fix path to udevadm
Michael Tremer [Thu, 16 Oct 2025 14:03:15 +0000 (14:03 +0000)] 
installer: Fix path to udevadm

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosystemd: Move to /usr and drop LFS udev rules
Michael Tremer [Wed, 15 Oct 2025 16:40:35 +0000 (16:40 +0000)] 
systemd: Move to /usr and drop LFS udev rules

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoalsa: Update rootfile
Michael Tremer [Mon, 13 Oct 2025 15:46:55 +0000 (15:46 +0000)] 
alsa: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agobtrfs-progs: Update rootfile
Michael Tremer [Mon, 13 Oct 2025 10:13:38 +0000 (10:13 +0000)] 
btrfs-progs: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoopenvmtools: Update rootfile
Michael Tremer [Sat, 11 Oct 2025 13:14:24 +0000 (13:14 +0000)] 
openvmtools: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agofuse: Update rootfile
Michael Tremer [Sat, 11 Oct 2025 13:13:42 +0000 (13:13 +0000)] 
fuse: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoxfsprogs: Update rootfile
Michael Tremer [Sat, 11 Oct 2025 13:13:11 +0000 (13:13 +0000)] 
xfsprogs: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomdadm: Update rootfile
Michael Tremer [Sat, 11 Oct 2025 13:12:17 +0000 (13:12 +0000)] 
mdadm: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agompd: Build without systemd
Michael Tremer [Sat, 11 Oct 2025 13:11:13 +0000 (13:11 +0000)] 
mpd: Build without systemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodbus: Build without systemd
Michael Tremer [Sat, 11 Oct 2025 13:11:04 +0000 (13:11 +0000)] 
dbus: Build without systemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agotshark: Update rootfile
Michael Tremer [Sat, 11 Oct 2025 13:09:51 +0000 (13:09 +0000)] 
tshark: Update rootfile

This package now builds something to access the systemd journal.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolibloc: Disable support for systemd
Michael Tremer [Sat, 11 Oct 2025 13:08:27 +0000 (13:08 +0000)] 
libloc: Disable support for systemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosystemd: Fix linking udev
Michael Tremer [Fri, 10 Oct 2025 11:27:50 +0000 (11:27 +0000)] 
systemd: Fix linking udev

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agodnsdist: Disable support for systemd
Michael Tremer [Fri, 10 Oct 2025 11:08:39 +0000 (11:08 +0000)] 
dnsdist: Disable support for systemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoddns: Pretend we don't have pkg-config to disable systemd detection
Michael Tremer [Thu, 9 Oct 2025 17:35:54 +0000 (17:35 +0000)] 
ddns: Pretend we don't have pkg-config to disable systemd detection

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoclamav: Explicitely disable systemd
Michael Tremer [Thu, 9 Oct 2025 17:35:11 +0000 (17:35 +0000)] 
clamav: Explicitely disable systemd

Since we are now building the library, ClamAV thinks that we have
systemd support which causes cmake to fail.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agofuse: Don't try to move a removed rule
Michael Tremer [Wed, 8 Oct 2025 09:15:38 +0000 (09:15 +0000)] 
fuse: Don't try to move a removed rule

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosystemd: Update rootfile
Michael Tremer [Wed, 8 Oct 2025 09:14:21 +0000 (09:14 +0000)] 
systemd: Update rootfile

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosystemd: Build and install libsystemd
Michael Tremer [Tue, 7 Oct 2025 17:20:11 +0000 (17:20 +0000)] 
systemd: Build and install libsystemd

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agosystemd: Rename the udev lfs file
Michael Tremer [Tue, 7 Oct 2025 16:24:16 +0000 (16:24 +0000)] 
systemd: Rename the udev lfs file

We are basically building systemd here. Not a lot of it, but a little
bit and it is only going to be more.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoudev: Update to systemd 258
Michael Tremer [Tue, 7 Oct 2025 16:23:15 +0000 (16:23 +0000)] 
udev: Update to systemd 258

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agostage2: Add bugtracker URL to /etc/os-release
Michael Tremer [Tue, 7 Oct 2025 16:08:39 +0000 (16:08 +0000)] 
stage2: Add bugtracker URL to /etc/os-release

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomail.cgi: Fix splitting the authentication line
Michael Tremer [Mon, 3 Nov 2025 17:11:14 +0000 (18:11 +0100)] 
mail.cgi: Fix splitting the authentication line

We only want to split once to avoid breaking when passwords contain
special characters.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agolibvirt: Uncomment two lines in the rootfile
Adolf Belka [Thu, 30 Oct 2025 16:23:55 +0000 (17:23 +0100)] 
libvirt: Uncomment two lines in the rootfile

- These lines were new in with the previous update from 11.4.0 to 11.7.0 but I
   incorrectly commented them out.
- This has been flagged up in the forum as it is stopping the user doing a virsh backup.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoovpnmain.cgi: Show a warning for deprecated, legacy ciphers
Michael Tremer [Thu, 30 Oct 2025 15:35:32 +0000 (16:35 +0100)] 
ovpnmain.cgi: Show a warning for deprecated, legacy ciphers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoovpnmain.cgi: Implement adding multiple WINS servers
Michael Tremer [Thu, 30 Oct 2025 15:17:04 +0000 (16:17 +0100)] 
ovpnmain.cgi: Implement adding multiple WINS servers

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoovpnmain.cgi: Support multiple DNS global servers
Michael Tremer [Thu, 30 Oct 2025 15:05:00 +0000 (16:05 +0100)] 
ovpnmain.cgi: Support multiple DNS global servers

Fixes: #13900 - “Additional configuration” is missing in OpenVPN Advanced Settings (CU197)
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoovpnmain.cgi: Fix iterating over the DHCP CCD options
Michael Tremer [Thu, 30 Oct 2025 11:40:16 +0000 (12:40 +0100)] 
ovpnmain.cgi: Fix iterating over the DHCP CCD options

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomake.sh: Build expect a lot earlier
Michael Tremer [Thu, 30 Oct 2025 14:48:20 +0000 (14:48 +0000)] 
make.sh: Build expect a lot earlier

That way, we will have a good chance that the same tools are available
during the state2 build as there in the toolchain stage.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agocore199: Ship expect and tcl
Adolf Belka [Thu, 30 Oct 2025 10:18:30 +0000 (11:18 +0100)] 
core199: Ship expect and tcl

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agotcl: install private headers for expect to use in build
Adolf Belka [Thu, 30 Oct 2025 10:18:29 +0000 (11:18 +0100)] 
tcl: install private headers for expect to use in build

- expect looks for both the public and private headers so make install-private-headers
   added into lfs.
- Update of rootfile

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomake.sh: Add expect into the lfsmake2 list
Adolf Belka [Thu, 30 Oct 2025 10:18:28 +0000 (11:18 +0100)] 
make.sh: Add expect into the lfsmake2 list

- With expect available in the main build section the hack of having --enable-toolchain
   used for it is no longer needed.

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agoexpect: Allow build of expect for swtpm
Adolf Belka [Thu, 30 Oct 2025 10:18:27 +0000 (11:18 +0100)] 
expect: Allow build of expect for swtpm

- expect was previously only built in the toolchain. This allows expect to be built for
   swtpm in the normal build.
- It is only used for the building of swtpm so the rootfile has all entries commented
   out.
- LFS changed to allow build in the toolchain or in the normal build

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agou-boot: Call the correct compiler to "cross-compile" u-boot
Michael Tremer [Thu, 30 Oct 2025 14:45:41 +0000 (14:45 +0000)] 
u-boot: Call the correct compiler to "cross-compile" u-boot

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agokernel: update to 6.12.56
Arne Fitzenreiter [Thu, 30 Oct 2025 14:41:28 +0000 (15:41 +0100)] 
kernel: update to 6.12.56

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agomake.sh: Disable the toolchain during normal builds
Michael Tremer [Tue, 28 Oct 2025 15:41:43 +0000 (15:41 +0000)] 
make.sh: Disable the toolchain during normal builds

This is a precaution because I have seen some files from the toolchain
being baked into the initrd. That should not happen and by keeping PATH
clean, there is no chance for any confusion.

In order to have the tools available that we need to build the initial
system, we will now have to pass a flag.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agomake.sh: Create a better PID 1 inside the environment
Michael Tremer [Tue, 28 Oct 2025 17:13:44 +0000 (17:13 +0000)] 
make.sh: Create a better PID 1 inside the environment

This is required so that we won't have any make processes locking up any
more. When the build process is getting aborted, this script will now
cleanly terminate anything inside the container and not block make as
PID 1.

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>
7 months agokernel: update to 6.12.55
Arne Fitzenreiter [Wed, 29 Oct 2025 07:04:30 +0000 (08:04 +0100)] 
kernel: update to 6.12.55

Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
7 months agocore199: Remove old Boost
Michael Tremer [Tue, 28 Oct 2025 10:22:01 +0000 (10:22 +0000)] 
core199: Remove old Boost

Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>