Remove SSL patch that has been made obsolete by upstream updates.
Update monit package to the latest release: v5.26.0. This release
supports TLSv1.3 and fixes a few bugs and vulnerabilities.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
(cherry picked from commit 9980d766ac)
Update to the latest maintenance release, fixing CVE-2018-11782 and
CVE-2019-0203 among other things.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
(cherry-picked from commit 53f33e5e74)
Commit b32f8d4ff0 broke compilation
of Subversion on systems where unixodbc package is present.
This partial revert fixes issue #8975.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Fixes issue #8978. If libcurl's SSL library is set to an SSL
library other than libmbedtls, compilation fails. This patch
configures python-curl to use the currently selected SSL library
for libcurl.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
With crypt(3) password storage scheme enabled, OpenLDAP can receive and
store SHA-256 and SHA-512 password hashes from Samba AD-DC. Without
crypt(3), synchronization of passwords between Samba AD-DC (v4.5 and
above) and OpenLDAP requires use of cleartext passwords.
To use password hashes from Samba, OpenLDAP must be compiled with
--enable-crypt switch. This patch introduces a new configuration
parameter to enable the use of crypt(3) function by OpenLDAP.
Enabling crypt(3) increases the size of slapd binary by 12 bytes on
the x86_64 target and by only 4 bytes on the ipq806x target.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
GraphicsMagick is a fork of ImageMagick, licensed under the MIT license.
It requires less space and it is [reportedly] faster than ImageMagick.
GraphicsMagick's installation footprint is:
x86_64: 4.3 MB, and
brcm47xx-mips74k (mipsel_74kc): 3.7 MB.
The shared libraries occupy 2.2 MB (mipsel_74kc). The 90 GraphicsMagick's
modules occupy 2.5 MB. It may be possible to reduce the installation
footprint by introducing build parameters to control the selection of
modules. In view of the large number of modules and the possibility of
breakage due to module interdependencies or other reasons, such attempt
is not made at this time.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Since 4.9.3, Samba AD-DC with MIT Kerberos will refuse to build unless
--with-experimental-mit-ad-dc is provided to the configure command.
The mandatory requirement was introduced in response to a report that
a user in a Samba AD domain can crash the KDC when Samba is built in
the non-default MIT Kerberos configuration:
https://www.samba.org/samba/security/CVE-2018-16853.html
This requirement was introduced in Samba commit
c5370a4349d381ba3b64b063dc28a2c54cfacdfc.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
This patch updates OpenLDAP to 2.4.47, introduces new build
parameters and places openldap-server, openldap-utils and
libopenldap under a separate menu item in Network.
OpenLDAP is difficult to find in menuconfig at present. Making
a separate menu item for OpenLDAP for selection of packages and
enabling or disabling build parameters makes better sense.
To have access to the loglevel directive, OpenLDAP must be built
with debugging information. Having access to the loglevel directive
is essential during the initial configuration of OpenLDAP server.
International users may want to enable ICU support to have access
to international characters.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
If the full language support is enabled (CONFIG_BUILD_NLS=y),
compilation fails on undefined references to libiconv,
libiconv_open and libiconv_closed. Including nls.mk into
the package's Makefile fixes the problem.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
The OpenDKIM package provides a service for signing and verifying
DomainKeys Identified Mail (DKIM) signatures. OpenDKIM consists of
a library that implements the DKIM service and a milter-based
filter application that can plug in to any milter-aware MTA, such
as Postfix or Sendmail, to provide that service to sufficiently
recent sendmail MTAs and other MTAs that support the milter
protocol.
This submission provides three new packages:
- libopendkim, a library for signing and verifying DKIM signatures,
- opendkim, the server application and the genkey script,
- opendkim-tools, a set of tools for configuring and testing OpenDKIM.
While at it, add PKG_BUILD_DEPENDS statement to sendmail's Makefile.
Travis CI buildbot sometimes fails to compile libopenssl before
starting to build sendmail. Since sendmail depends on libopenssl, the
whole Travis CI build process fails. Setting PKG_BUILD_DEPENDS
to "openssl", the directory name of libopenssl's Makefile, fixes the
problem.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Closes#5062. With ABI_VERSION declaration in dovecot's Makefile
introduced in PR #5182, pigeonhole plugin will now be rebuilt on every
dovecot upgrade. To announce the rebuilt pigeonhole plugin to opkg,
introduce a different model of version numbering. The new version
numbering now includes both dovecot and pigeonhole plugin version
numbers. Therefore, the rebuilt pigeonhole plugin will be visible to
opkg whenever dovecot or pigeonhole plugin version changes.
Rename "pigeonhole" to "dovecot-pigeonhole". There are several reasons
for renaming the package:
1. pigeonhole is a plugin. There seems to be a convention to name
plugins by adding corresponding suffixes to the parent package name,
such as lua-*, luci-*, php7-mod-*, perlbase-*, transmission-* etc.
2. When named as "dovecot-pigeonhole", the pigeonhole plugin is
displayed right next to dovecot in config manager ("make menuconfig")
and is therefore highly visible to anyone who explores the available
modules for dovecot.
3. When named as "dovecot-pigeonhole", the package version number
consisting of both dovecot and pigeonhole version numbers makes more
sense: "dovecot-pigeonhole_2.2.33.2-0.4.20-2" looks more comprehensible
than "pigeonhole_2.2.33.2-0.4.20-2", however admittedly both variants
look rather ugly.
Add ManageSieve to the package. Adding managesieve-login and its
libraries increases the size of the package by about 11% from 702061
bytes to 781294 bytes on the bcm53xx platform. As dovecot is unlikely
to be used on a low-end LEDE/OpenWrt box, the addition of ~80KB to
the package size is not likely to make a noticeable difference but it
will add the capability to use pigeonhole plugin for dovecot with
systems that talk ManageSieve, such as the RoundCube.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Add ABI_VERSION declaration in order to tell dovecot plugins that are
runtime-dependent on dovecot's Application Binary Interface (ABI)
version, such as the pigeonhole mail filter, that they need to be
rebuilt each time the dovecot's ABI version changes.
This PR is not yet closing issue #5062. A forthcoming PR for pigeonhole
package will close the issue.
Introduce a new configuration parameter to enable ICU (i18n) support.
Make the ICU disabled by default.
Introduce PKG_CONFIG_DEPENDS with the list of configuration parameters
triggering rebuild of dovecot.
Declare the conffiles section to save dovecot's configuration files and
its init.d script on sysupgrade.
Introduce a new package, dovecot-utils, to contain doveadm and dsync
utilities: closes#4912.
Correct the destination directory for the installation of
example-config files. At present, the example files are installed into
/usr/share/doc/dovecot/example-config/example-config.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Restore host building on request from a user. Apparently, packages
outside of openwrt/packages feed rely on Freetype 2 building on host.
While at it, remove sed-editing of freetype-config that is no longer
necessary. The current version of freetype-config correctly identifies
prefix, exec_prefix, includedir and libdir.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Update to the latest stable release.
Fix check for file descriptor passing that causes libmilter's runtime
error when libmilter/OpenDKIM are used with Postfix:
"unix_send_fd: your system has no support for file descriptor passing"
The issue with the file descriptor passing has been fixed upstream in
20170618 update to Postfix v3.3 experimental release. The patch must
therefore be removed before compiling Postfix v3.3.*
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Add Freetype 2 support to php7-mod-gd. Introduce a configuration
parameter to disable Freetype 2 support if the increased package
size is a concern.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Fix uid/gid conflict with package icecast (uid=87, gid=87) and
package pianod (uid=88, gid=88) by claiming uid/gid 25 for postfix
instead of 87 and uid/gid 26 for postconf instead of 88.
Remove main.cf.default that is not used by any Postfix module.
The default configuration parameters are hardcoded into postconf
and they are available via "postconf -d <parameter>".
main.cf.default is therefore unnecessary.
"mydomain" parameter should be deduced from the domain configuration
setting in /e/c/dhcp rather than from "hostname" in /e/c/system
which is often just a hostname without the domain name component.
"mynetworks" parameter is unnecessary where "mynetworks_style" is
defined.
The change of the location of data_directory, queue_directory and
mail_spool_directory from /var/lib/postfix, /var/spool/postfix and
/var/mail to /data/postfix/lib, /data/postfix/spool and
/data/postfix/mail has been postponed until the author of this
commit and the maintainer of this package has had a meaningful
opportunity to consult with LEDE/OpenWrt developers on the preferred
mount point for the persistent data storage device.
Change the criteria for executing the post-installation script.
Invoke postinst() where the value of "myhostname" parameter in main.cf
is not defined rather than where "$config_directory"/opkg_postinst is
present with the value of "$config_directory" hardcoded to
"$IPKG_INSTROOT"/etc/postfix in /etc/init.d/postfix.
Enable PCRE support by default.
Remove the code making entries in /etc/sysupgrade.conf and instead
define configuration files to be saved during a sysupgrade in
Makefile's Package/postfix/conffiles section.
Move the creation of mail_spool_directory from host to target in
order to enable change of directory ownership to 'postfix' when
postinit() is executed on the target.
Avoid postfix restart in postinst script that results in an
error message during opkg install process.
Enable Postfix autostart by creating a link in /etc/rc.d/ on
installation.
Make the code less verbose.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
This commit updates Freetype 2 to the latest upstream version and fixes
the issue where freetype-config was incorrectly installed into the
host, rather than the target, staging directory, therefore causing
compilation issues with other packages that depend on libfreetype.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Two important configuration files, /etc/php7-fpm.conf and
/etc/php7-fpm.d/www.conf are silently overwritten on each php7-fpm
upgrade or lost on a sysupgrade.
This commit adds the conffiles section for php7-fpm and revises
the conffiles section for php7.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
The sendmail Mail Filter API (Milter) is designed to allow third-party
programs access to mail messages as they are being processed in order to
filter meta-information and content.
This library is a prerequisite for the OpenDKIM package.
The proposed Makefile also contains sections for building Sendmail. These
sections are commented out because more work is necessary to properly
complete porting of Sendmail to LEDE/OpenWrt. The notes in Makefile
provide details on what is required to complete the port.
It has been verified that Sendmail executables compile and run properly
on the target system when the commented sections in Makefile are
uncommented.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
libgd fails to build due to missing dependency if the libtiff
package is selected. Fix the build issue and add two new
configuration options, both disabled by default:
1) enable TIFF support, and
2) enable Freetype 2.x support.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Update nginx to version 1.10.3.
Add new configuration options to enable the following optional
modules (disabled by default):
- http_auth_request_module
- http_v2_module
- http_realip_module
- http_secure_link_module
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
Compile tested: LEDE HEAD
If unixodbc package is present in the environment, subversion
fails to compile due to missing dependencies.
Fixes the dependency on unixodbc if unixodbc package is selected.
Signed-off-by: Val Kulkov <val.kulkov@gmail.com>
