staging/stintel/package/system, branch master

ca-certificates: update to 20260816

2026-08-23T09:34:58Z

changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog * Update Mozilla certificate authority bundle to version 2.90 The following certificate authorities were added (+): + "SECOM TLS ECC Root CA 2024" + "SECOM TLS RSA Root CA 2024" + "Telia EC TLS Root CA v3" + "Telia RSA TLS Root CA v3" The following certificate authorities were removed (-): - "Atos TrustedRoot 2011" - "Entrust Root Certification Authority" - "SecureSign Root CA12" - "ePKI Root Certification Authority" Signed-off-by: Fengyu Wu Link: https://github.com/openwrt/openwrt/pull/24839 Signed-off-by: Robert Marko

fstools: update to git HEAD of 2026-07-25

2026-07-25T16:30:51Z

2aa1640 block: preen a registered volume before mount on request d43ffba block: use preen mode for the f2fs filesystem check a71e97d blockd: do not let a slow startup helper hold back readiness 1c17d24 blockd: expose storage readiness via a queryable status method f60b3a3 blockd: pass registrant mount options down to block on autofs mount 998f6ab blockd: notify when an idle autofs mount is unmounted 0008996 block: mount ubus-registered devices without an fstab entry 4fd1502 blockd: coldplug block devices 89a6f52 blockd: retry interrupted waitpid() in synchronous block() helper 37cf94d blockd: fix bounds of the ubus event name buffer Signed-off-by: Daniel Golle

rpcd: update to Git HEAD (2026-07-19)

2026-07-21T20:59:58Z

e37ed9d81469 file: re-authorize ACL against resolved path to close symlink bypass Link: https://github.com/openwrt/openwrt/pull/24329 Signed-off-by: Hauke Mehrtens

mtd: fis: fix buffer overflow from negative memset size

2026-07-17T08:02:59Z

In fis_remap(), when desc < last, the memset size is computed as 'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is always less than end, making 'tmp - end' negative. When cast to size_t, this wraps to a very large value, causing a massive buffer overflow. Fix by swapping the operands to 'end - tmp' which correctly computes the number of bytes to clear. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23550 Signed-off-by: Jonas Jelonek

ubus: update to Git HEAD (2026-06-28)

2026-06-28T14:48:20Z

24864e7840b3 ubusd_id: use GRND_INSECURE to avoid blocking boot on getrandom() Fixes: https://github.com/openwrt/ubus/issues/21 Signed-off-by: Hauke Mehrtens

procd: update to Git HEAD (2026-06-17)

2026-06-24T09:21:28Z

9ff6e43bb75f service: notify instance exit details via ubus 4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace 60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace Signed-off-by: Felix Fietkau

mtd: bump package release

2026-06-16T09:32:52Z

This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()" which changed the code but did not increase the release. This causes two packages with the same version to have different content and thereby hashes. Signed-off-by: Paul Spooren Link: https://github.com/openwrt/openwrt/pull/23827 Signed-off-by: Christian Marangi

package: make APK embedded help gzip reproducible

2026-06-10T18:15:15Z

APK compresses it's helptext using LUA and require `zlib`, which isn't available on the Buildbots. It thens falls back to `gzip`, which embeds the MTIME, making the binary itself unreproducible. This commits adds a downstream patch to run `gzip` with `-n`, setting the time to 0. Link: https://github.com/openwrt/openwrt/pull/23736 Signed-off-by: Paul Spooren

mtd: fix buffer leak and fd leak in mtd_dump()

2026-06-08T14:18:23Z

Two leaks in mtd_dump(): - The buffer allocated with malloc(erasesize) is never freed before returning, leaking erasesize bytes on every call. - The pre-existing malloc-NULL early return path also leaked the just- opened fd by returning directly instead of going through cleanup. Initialize buf to NULL, route the malloc-NULL case through the existing 'out:' label, and add free(buf) on the cleanup path so both fd and buf are released consistently on every exit. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23706 Signed-off-by: Jonas Jelonek

mtd: check malloc() return value in mtd_check()

2026-06-08T14:17:42Z

After malloc(erasesize) in mtd_check(), the result was never checked for NULL. On allocation failure, the buf pointer remained NULL and would later be used in image_check() via read(imagefd, buf + buflen, ...), causing a NULL pointer dereference. Add a NULL check after the allocation and return early. The early return path also closes the just-opened fd and frees the strdup'd colon-separated device-list copy to avoid leaks. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23705 Signed-off-by: Jonas Jelonek