staging/xback/package/system, branch master

procd: update to Git HEAD (2026-06-17)

2026-06-24T09:21:28Z

9ff6e43bb75f service: notify instance exit details via ubus 4f42296dc4f0 jail: mount rootfs overlay with userxattr in user namespace 60fdbf00e924 jail: chown rootfs overlay dir to mapped root in user namespace Signed-off-by: Felix Fietkau

mtd: bump package release

2026-06-16T09:32:52Z

This commit fixes "a5107ad58c6 mtd: fix buffer leak and fd leak in mtd_dump()" which changed the code but did not increase the release. This causes two packages with the same version to have different content and thereby hashes. Signed-off-by: Paul Spooren Link: https://github.com/openwrt/openwrt/pull/23827 Signed-off-by: Christian Marangi

package: make APK embedded help gzip reproducible

2026-06-10T18:15:15Z

APK compresses it's helptext using LUA and require `zlib`, which isn't available on the Buildbots. It thens falls back to `gzip`, which embeds the MTIME, making the binary itself unreproducible. This commits adds a downstream patch to run `gzip` with `-n`, setting the time to 0. Link: https://github.com/openwrt/openwrt/pull/23736 Signed-off-by: Paul Spooren

mtd: fix buffer leak and fd leak in mtd_dump()

2026-06-08T14:18:23Z

Two leaks in mtd_dump(): - The buffer allocated with malloc(erasesize) is never freed before returning, leaking erasesize bytes on every call. - The pre-existing malloc-NULL early return path also leaked the just- opened fd by returning directly instead of going through cleanup. Initialize buf to NULL, route the malloc-NULL case through the existing 'out:' label, and add free(buf) on the cleanup path so both fd and buf are released consistently on every exit. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23706 Signed-off-by: Jonas Jelonek

mtd: check malloc() return value in mtd_check()

2026-06-08T14:17:42Z

After malloc(erasesize) in mtd_check(), the result was never checked for NULL. On allocation failure, the buf pointer remained NULL and would later be used in image_check() via read(imagefd, buf + buflen, ...), causing a NULL pointer dereference. Add a NULL check after the allocation and return early. The early return path also closes the just-opened fd and frees the strdup'd colon-separated device-list copy to avoid leaks. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23705 Signed-off-by: Jonas Jelonek

mtd: check return values of lseek() and write() in mtd_write_buffer()

2026-06-08T14:17:02Z

Two ignored return values in mtd_write_buffer() caused silent failures: - lseek() return value was ignored. A failed seek (e.g. EBADF, ESPIPE) followed by write() would silently write at the wrong offset. - write() return value was ignored, silently discarding write errors. This could lead to data corruption on the MTD device without any indication. Check both return values, report errors to stderr and return -1 on failure. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23552 Signed-off-by: Jonas Jelonek

ca-certificates: update to 20260601

2026-06-07T08:47:20Z

changelog: https://salsa.debian.org/debian/ca-certificates/-/blob/master/debian/changelog * Remove ca-certificates-local example (closes: #988912, #1127101). * Update Mozilla certificate authority bundle to version 2.86 The following certificate authority was added (+): + e-Szigno TLS Root CA 2023 The following certificate authorities were removed (-): - QuoVadis Root CA 2 - QuoVadis Root CA 3 - DigiCert Assured ID Root CA - DigiCert Global Root CA - DigiCert High Assurance EV Root CA - SwissSign Gold CA - G2 - SecureTrust CA - Secure Global CA - COMODO Certification Authority - Certigna - certSIGN ROOT CA - AffirmTrust Commercial - AffirmTrust Networking - AffirmTrust Premium - AffirmTrust Premium ECC - TeliaSonera Root CA v1 - Entrust Root Certification Authority - G2 - Entrust Root Certification Authority - EC1 - Trustwave Global Certification Authority - Trustwave Global ECC P256 Certification Authority - Trustwave Global ECC P384 Certification Authority - GLOBALTRUST 2020 - GTS Root R2 - FIRMAPROFESIONAL CA ROOT-A WEB The following certificate authority was renamed (~): ~ "OISTE Server Root RSA G1" (removed leading space) Signed-off-by: Fengyu Wu Link: https://github.com/openwrt/openwrt/pull/23675 Signed-off-by: Jonas Jelonek

rpcd: update to Git HEAD (2026-06-04)

2026-06-05T14:35:07Z

69b62b1990bc rpc-sys: packagelist: increase input buffer size e655a0d69492 exec: defer async reply teardown to avoid use-after-free 5b078674a592 optimize by reusing timeout member d005c885dbe4 session: clamp uloop timeout to avoid int overflow a545f008da91 ucode: add request.defer() for async method handling ab6549a99c7c file: avoid sending uninitialized stack memory for broken symlinks 7af2dd81cd53 main: prevent integer overflow when parsing -t timeout argument 680705e4b76d plugin: use snprintf in ubus lookup callback to prevent buffer overflow fb0302dc0e51 session: detect short read of /dev/urandom in rpc_random() dc091afa5860 rpc-sys: packagelist: check calloc() result for world array 4fbd48515d6a rpc-sys: packagelist: avoid size_t underflow when stripping ABI version 46fce7d5efc9 ucode: fix off-by-one truncation of generated ubus object type name 26dba5206e17 exec: prevent double close() of exec pipe descriptors af5d6f431186 uci: prevent integer overflow of client supplied apply timeout d06d2a81dc29 rc: fix memory leak of list request context 0de666811559 rc: copy list "name" filter to avoid use-after-free 75470f4b5124 rc: use a per-request blob_buf for the list reply 3037a0e36856 treat exec failures in forked children with _exit() instead of return f5ffec54d7c7 rc: reap killed child on list "running" check timeout fd4fcdeb186b rpc-sys: packagelist: close status file on world parsing error paths e22aea1a51df rpc-sys: packagelist: read world file instead of mmap to avoid SIGBUS 79c8087c8e8e file: avoid zero-length b64_decode() on empty write data cd1d9588da63 ucode: bound recursion when converting blob arguments to ucode values 2decaec3ef1b iwinfo: fix error handling and backend leak in survey 28faf6403792 cast char arguments to unsigned char for ctype.h functions Link: https://github.com/openwrt/openwrt/pull/23650 Signed-off-by: Hauke Mehrtens

procd: update to Git HEAD (2026-05-22)

2026-06-03T11:18:29Z

ac5cc72f6cfa jail: mount ucode related bits into netifd jail 81119d3f249d instance: disable console logging 8013c0cd2755 jail: mount tools used by dhcp.sh in the netifd jail 876981d0516d jail: fix reading the oci device gid value c92dbcd460d7 jail: make /dev/tty accessible by others 74bfbee8adb8 service: fix calloc_a argument Signed-off-by: Felix Fietkau

mtd: imagetag: remove unused imagestart variable

2026-06-02T19:32:27Z

The imagestart variable was assigned sizeof(tag) (which incorrectly computed the pointer size rather than the struct size), but was never actually read after the assignment in either trx_fixup() or mtd_fixtrx(). The CRC calculations that follow use offsetof(struct bcm_tag, header_crc) directly. Remove the dead variable and its assignments entirely rather than fixing the sizeof expression. No functional change. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23546 Signed-off-by: Jonas Jelonek