staging/pepe2k/package/system, branch v18.06.9

uci: Backport security fixes

2020-10-27T23:28:08Z

This packports two security fixes from master. Signed-off-by: Hauke Mehrtens (cherry picked from commit f9005d4f80dee3dcc257d4613cbc46668faad094)

fstools: backport: fix ntfs uuid

2020-09-27T22:37:50Z

Signed-off-by: Liangbin Lian

ca-certificates: update to version 20200601

2020-06-09T22:31:21Z

This patch updates the ca-certificates and ca-bundle package. This version changed the files directory again, to work/, so PKG_BUILD_DIR was brought back. A list of changes from Debian's change-log entry for 20200601 [0]: * mozilla/{certdata.txt,nssckbi.h}: Update Mozilla certificate authority bundle to version 2.40. Closes: #956411, #955038 * mozilla/blacklist.txt Add distrusted Symantec CA list to blacklist for explicit removal. Closes: #911289 Blacklist expired root certificate, "AddTrust External Root" Closes: #961907 The following certificate authorities were added (+): + "Certigna Root CA" + "emSign ECC Root CA - C3" + "emSign ECC Root CA - G3" + "emSign Root CA - C1" + "emSign Root CA - G1" + "Entrust Root Certification Authority - G4" + "GTS Root R1" + "GTS Root R2" + "GTS Root R3" + "GTS Root R4" + "Hongkong Post Root CA 3" + "UCA Extended Validation Root" + "UCA Global G2 Root" The following certificate authorities were removed (-): - "AddTrust External Root" - "Certinomis - Root CA" - "Certplus Class 2 Primary CA" - "Deutsche Telekom Root CA 2" - "GeoTrust Global CA" - "GeoTrust Primary Certification Authority" - "GeoTrust Primary Certification Authority - G2" - "GeoTrust Primary Certification Authority - G3" - "GeoTrust Universal CA" - "thawte Primary Root CA" - "thawte Primary Root CA - G2" - "thawte Primary Root CA - G3" - "VeriSign Class 3 Public Primary Certification Authority - G4" - "VeriSign Class 3 Public Primary Certification Authority - G5" - "VeriSign Universal Root Certification Authority" [0] Signed-off-by: Christian Lamparter (cherry picked from commit f611b014a713d82d7c7da4c171f3aa04a8984063)

rpcd: update to latest openwrt-18.06 Git HEAD

2020-05-26T14:26:28Z

7be1f17 file: exec: properly free memory on error 313964c file: avoid closing stdio descriptors in rpc_file_exec_run cd09c5f file: patch process stdin to /dev/null efbcedb file: remove unused members from struct rpc_file_exec_context 71b00ab file: rpc_file_exec_run: fix potential memory leak and integer overflow c7bb956 plugin: fix double free in finish callback 16de3fa plugin: do not free method name separately 29c9c11 exec: properly free memory on rpc_exec() error 5cd4f4e plugin: exec: properly free memory on parse error d80f70e plugin: fix leaking invoked method name for exec plugins 53a0952 session: deny access if password login is disabled 662d034 uci: reset uci_ptr flags when merging options during section add dd46d6d uci: free configs list memory on return abbc302 uci: reset uci_ptr flags when merging set operations Signed-off-by: Jo-Philipp Wich

usign: update to latest git HEAD

2020-05-24T15:03:43Z

f1f65026a941 Always pad fingerprints to 16 characters Signed-off-by: Matthias Schiffer (cherry picked from commit e35e40ad824eab9d51cdd690fb747e576e01412f)

usign: update to latest Git HEAD

2020-05-24T15:03:35Z

f34a383 main: fix some resource leaks Signed-off-by: Hauke Mehrtens (cherry picked from commit 81e93fff7d867851f2fedd966a931336d4092686)

opkg: update to latest Git HEAD

2020-01-29T16:06:05Z

80d161e opkg: Fix -Wformat-overflow warning c09fe20 libopkg: fix skipping of leading whitespace when parsing checksums Fixes: CVE-2020-7982 Signed-off-by: Jo-Philipp Wich (cherry picked from commit c69c20c6670081d1eaab000734d89de57eb64148)

config: introduce separate CONFIG_SIGNATURE_CHECK option

2019-08-07T05:54:27Z

Introduce a new option CONFIG_SIGNATURE_CHECK which defaults to the value of CONFIG_SIGNED_PACKAGES and thus is enabled by default. This option is needed to support building target opkg with enabled signature verification while having the signed package lists disabled. Our buildbots currently disable package signing globally in the buildroot and SDK to avoid the need to ship private signing keys to the build workers and to prevent the triggering of random key generation on the worker nodes since package signing happens off-line on the master nodes. As unintended side-effect, updated opkg packages will get built with disabled signature verification, hence the need for a new override option. Signed-off-by: Jo-Philipp Wich (cherry picked from commit f565f276e2c06ac8f3176e0b16d6f2d40cd653d4)

usign: update to latest Git HEAD

2019-08-06T18:59:09Z

This update fixes usign signature verification on files with certain file sizes triggering a bug in the shipped SHA-512 implementation. 5a52b37 sha512: fix bad hardcoded constant in sha512_final() 3e6648b README: replace unicode character 716c3f2 README: add reference to OpenBSD signify 86d3668 README: provide reference for ed25519 algorithm 939ec35 usign: main.c: describe necessary arguments for -G Ref: https://forum.openwrt.org/t/signature-check-failed/41945 Signed-off-by: Jo-Philipp Wich (cherry picked from commit 991dd5a89340367920315a3fd0390a7423e6b34a)

opkg: bump to version 2019-06-14

2019-07-12T07:52:38Z

Changelog dcbc142 alternatives: remove duplicate 'const' specifier 21b7bd7 alternatives: special-case busybox as alternatives provider d4ba162 libopkg: only perform size check when information is available cb66403 libopkg: check for file size mismatches Opkg starting from this version special-cases busybox as alternatives provider. There should be no need to add entries to ALTERNATIVES of busybox package Signed-off-by: Yousong Zhou