packages, branch openwrt-18.06

libwebsockets: fix recursive dependency

2022-10-27T12:48:35Z

While running `make menuconfig`, it was discovered then there is a recursive dependency like this: tmp/.config-package.in:59138:error: recursive dependency detected! tmp/.config-package.in:59138: symbol PACKAGE_libwebsockets-openssl is selected by PACKAGE_libwebsockets-mbedtls tmp/.config-package.in:59122: symbol PACKAGE_libwebsockets-mbedtls depends on PACKAGE_libwebsockets-openssl It is not possible with the recently added conflicts that two packages (OpenSSL and full variant, which uses OpenSSL as well), which are almost the same provides the same named package libwebsockets as their conflict - Mbed TLS. Fixes: 676c5c72b5eeb583da2603e399fac085fa442c59 ("libwebsockets: OpenSSL and mbedTLS variants should conflict") Signed-off-by: Josef Schlehofer (cherry picked from commit a4e8cbb89a48729b3c3ad615765549628d495b0f)

libwebsockets: OpenSSL and mbedTLS variants should conflict

2022-10-25T12:30:05Z

They provide the same files, but they don't conflict to each other, this means that users can install them side by side. Signed-off-by: Josef Schlehofer (cherry picked from commit 676c5c72b5eeb583da2603e399fac085fa442c59)

libwebsockets: full variant provides OpenSSL

2022-10-25T12:30:02Z

For some time, it is not possible to install ttyd and mosquitto-ssl at the same time, so let's solve it that libwebsockets-full provides libwebsockets-openssl. This allows to install ttyd and mosquitto at the same time. Also, we need to add conflict, because we should not have installed libwebsockets-openssl and libwebsockets-full at the same time as they provides the same files. Signed-off-by: Josef Schlehofer (cherry picked from commit 77e682a11c53f4dcd0e76bdea5ee82de77eaacfe)

bind: update to 9.11.37

2022-03-18T17:57:37Z

Fixes security issues: * CVE-2021-25220 -- The rules for acceptance of records into the cache have been tightened to prevent the possibility of poisoning if forwarders send records outside the configured bailiwick. * CVE-2021-25219 -- The "lame-ttl" option is now forcibly set to 0. This effectively disables the lame server cache, as it could previously be abused by an attacker to significantly degrade resolver performance. Signed-off-by: Noah Meyerhans

htpdate: drop www.freebsd.org from default server list

2022-02-23T22:10:19Z

The FreeBSD project stopped publishing HTTP date headers and seeks to limit further resource taxing by distributed htpdate clients using the www.freebsd.org host as default time source. Fixes: #17924 Reported-by: Allan Jude Signed-off-by: Jo-Philipp Wich (cherry picked from commit e8713180026e0cf1c9d1421e3b664fee3fa4df12)

bind: Bump to version 9.11.36

2021-10-29T17:28:53Z

The following security issues are addressed with this change: CVE-2020-8619 CVE-2020-8622 CVE-2020-8623 CVE-2020-8624 CVE-2020-8625 CVE-2021-25214 CVE-2021-25215 CVE-2021-25216 CVE-2021-25219 A complete description of the changes with this BIND release is available in the release notes at https://ftp.isc.org/isc/bind9/9.11.36/RELEASE-NOTES-bind-9.11.36.html Signed-off-by: Noah Meyerhans

python3: Update to 3.6.15

2021-09-08T21:12:03Z

Includes fix for CVE-2013-0340 ("Billion Laughs" vulnerability). Signed-off-by: Jeffery To

perl: perlmod.mk: use 'install' for host binaries

2021-08-15T05:09:24Z

When installing a host perl module, the host perl binary in the staging dir is replaced by using 'cp'. However, if the binary is running in a parallel job, cp will fail with a text file busy error. Use $(INSTALL_BIN), which unliks the file first to avoid the error. Signed-off-by: Eneas U de Queiroz (cherry picked from commit 19c7496648cb25500ca7007a7c1578a426c23a09) (cherry picked from commit 67f403b5e6afba14cbf6742833426faad796bfd9)

Merge pull request #16086 from turris-cz/lxc-update-keyserver

2021-07-11T18:44:01Z

lxc: add patch to switch GPG server

2021-07-10T14:33:22Z

By default, there was used sks-keyservers.net pool, which has invalid SSL certificate and they also announced that their service is deprecate and no longer maintained. Use the same GPG server as LXC is using by default in the newer releases. Signed-off-by: Josef Schlehofer