libjuice: fix SHA-1 on big-endian targets

2026-09-01T00:17:38Z

libjuice's vendored picohash guards the final byte-order swap in _picohash_sha1_final with SHA_BIG_ENDIAN, which nothing defines, while endianness is detected into _PICOHASH_BIG_ENDIAN. On big-endian targets the swap runs when it must not and every SHA-1 digest is emitted with each 32-bit word reversed, taking HMAC-SHA1 with it. libjuice uses HMAC-SHA1 for STUN MESSAGE-INTEGRITY, so on mips, mips64, powerpc and every other big-endian target each ICE connectivity check is rejected as failing integrity. No candidate pair is nominated and no session can be established. picohash is the default backend, as USE_NETTLE is off, so this affects the package as built here. Verified on lantiq/xrx200 (mips_24kc, MIPS 34Kc): before the patch an ICE agent loops with "STUN integrity check failed" and never leaves the connecting state; after it the agent reaches completed and a session comes up over the DHT and ICE. RFC 2202 HMAC-SHA1 test case 1 and the SHA-1 vector for "abc" both fail before and pass after. Submitted upstream as paullouisageneau/libjuice#353 and, for the vendored copy's origin, kazuho/picohash#13. Signed-off-by: Daniel Golle

libjuice: add package

2026-08-18T14:25:47Z

A lightweight ICE (RFC 8445) library with STUN, for peer-to-peer UDP hole punching. Needed by comrade; also usable on its own. Signed-off-by: Daniel Golle

packages/libs/libjuice, branch master

libjuice: fix SHA-1 on big-endian targets

libjuice: add package