Development July 2023

development@lists.ipfire.org

8 participants
64 discussions

[PATCH] dehydrated: Keep going if re-issuing one certificate fails
by Michael Tremer 13 Jul '23

13 Jul '23

This change will make sure that dehydrated will continue if (re-)issuing one or more certificate fails. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/dehydrated/cron.sh | 2 +- lfs/dehydrated | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/config/dehydrated/cron.sh b/config/dehydrated/cron.sh index 0aa778a38..f2f842527 100644 --- a/config/dehydrated/cron.sh +++ b/config/dehydrated/cron.sh @@ -1,3 +1,3 @@ #!/bin/bash -exec /usr/bin/dehydrated --cron +exec /usr/bin/dehydrated --cron --keep-going diff --git a/lfs/dehydrated b/lfs/dehydrated index 7cd92076b..821c1433b 100644 --- a/lfs/dehydrated +++ b/lfs/dehydrated @@ -34,7 +34,7 @@ DL_FROM = $(URL_IPFIRE) DIR_APP = $(DIR_SRC)/$(THISAPP) TARGET = $(DIR_INFO)/$(THISAPP) PROG = dehydrated -PAK_VER = 5 +PAK_VER = 6 DEPS = -- 2.39.2

2 1

[PATCH] core177: Do not ship location database extracted in ipset format
by Michael Tremer 13 Jul '23

13 Jul '23

Since the update is not built on the day when people install it, we will ship an outdated database. For updates, where the firewall is being reloaded or rebooted, we will have an old database in place until the next database update job runs. Secondly, the data is 33 MiB in size, which is useless data shipped as every system will already have a database that is very likely to be more recent. In this update, we are not shipping the location database again, but I wanted to add this change so it does not get lost next time. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- config/rootfiles/core/177/exclude | 1 + 1 file changed, 1 insertion(+) diff --git a/config/rootfiles/core/177/exclude b/config/rootfiles/core/177/exclude index 378c2d563..8ee1c3c2f 100644 --- a/config/rootfiles/core/177/exclude +++ b/config/rootfiles/core/177/exclude @@ -27,6 +27,7 @@ var/ipfire/urlfilter/blacklist var/ipfire/urlfilter/settings var/lib/alternatives var/lib/location/database.db +var/lib/location/ipset var/log/cache var/log/dhcpcd.log var/log/messages -- 2.39.2

2 1

[PATCH] sudo: Update to version 1.9.14p1
by Adolf Belka 12 Jul '23

12 Jul '23

- Update from version 1.9.14 to 1.9.14p1 - Update of rootfile not required - Changelog 1.9.14p1 * Fixed an invalid free bug in sudo_logsrvd that was introduced in version 1.9.14 which could cause sudo_logsrvd to crash. * The sudoers plugin no longer tries to send the terminal name to the log server when no terminal is present. This bug was introduced in version 1.9.14. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- lfs/sudo | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lfs/sudo b/lfs/sudo index 759e3c83a..9f04c3495 100644 --- a/lfs/sudo +++ b/lfs/sudo @@ -24,7 +24,7 @@ include Config -VER = 1.9.13p3 +VER = 1.9.14p1 THISAPP = sudo-$(VER) DL_FILE = $(THISAPP).tar.gz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 46218ecf4cf06d2280ccf4c257b12a6f697eda17b96a6b7aa56f6c7f22d847ec2a8036b9f615c3328d985656539c95f37a40c6c72dfa5f65786ab45a28cf353f +$(DL_FILE)_BLAKE2 = fc5f0d7093f572b8ce56161f3e40b75ba9edf0863f44cdc2af6313f68d20a0c9c59536d1d6be5fddcffcc9caecd737109b5a389ee3748c65f3435b65b167d6e2 install : $(TARGET) -- 2.41.0

1 1

Re: IPFire 2.27 - Core Update 176 is available for testing
by Adolf Belka 11 Jul '23

11 Jul '23

Hi All, So far everything I have tested has worked as expected. That includes the OpenVPN roadwarrior connection. Looking good so far :crossed_fingers: Regards, Adolf. On 29/06/2023 12:20, IPFire Project wrote: > IPFire Logo > > there is a new post from Peter Müller on the IPFire Blog: > > *IPFire 2.27 - Core Update 176 is available for testing* > > The next update, IPFire 2.27 - Core Update 176, is available for testing. It features a toolchain and package updates (among the security-relevant of them are Intel microcodes), brings the latest batch of bug fixes. > > Click Here To Read More <https://blog.ipfire.org/post/ipfire-2-27-core-update-176-is-available-for-t…> > > The IPFire Project > Don't like these emails? Unsubscribe <https://people.ipfire.org/unsubscribe>. >

3 3

For Info - libgudev-238 can't be built
by Adolf Belka 11 Jul '23

11 Jul '23

Hi All, For info, the latest version of libgudev, 238, fails to build because it is looking for a libudev of at least 251 and eudev has version 243. This has been reported as an issue to the eudev issues section in github 3 days ago. Someone has tried just changing the version number in the libgudev meson requirements section but then the build fails because there is a new function which has been added in the systemd udev that is not yet in the standalone eudev package. I will keep an eye out on the eudev issues page for this. Regards, Adolf.

2 3

[PATCH 1/2] make.sh: x86_64: Enable CET full
by Michael Tremer 11 Jul '23

11 Jul '23

-fcf-protection enables Indirect Branch Tracking, which we have recently enabled in the kernel. We should enable this in userspace, too. I could not find out what GCC defaults to without any value, so this patch is explicitely enabling IBT for function returns, indirect function calls and indirect jumps. Signed-off-by: Michael Tremer <michael.tremer(a)ipfire.org> --- make.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/make.sh b/make.sh index 57b6c6f15..f07604073 100755 --- a/make.sh +++ b/make.sh @@ -145,7 +145,7 @@ configure_build() { BUILDTARGET="${build_arch}-pc-linux-gnu" CROSSTARGET="${build_arch}-cross-linux-gnu" BUILD_PLATFORM="x86" - CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection" + CFLAGS_ARCH="-m64 -mtune=generic -fcf-protection=full" ;; aarch64) -- 2.39.2

1 1

[PATCH 1/3] linux: Enable Indirect Branch Tracking by default
by Peter Müller 10 Jul '23

10 Jul '23

This became upstream default (see https://www.phoronix.com/news/Linux-IBT-By-Default-Tip for IT news media coverage), and given its security-relevance, we should adopt this setting as well. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/kernel/kernel.config.x86_64-ipfire | 2 +- config/rootfiles/common/x86_64/linux | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 6c880ca8a..d70a19656 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -431,7 +431,7 @@ CONFIG_X86_PAT=y CONFIG_ARCH_USES_PG_UNCACHED=y CONFIG_X86_UMIP=y CONFIG_CC_HAS_IBT=y -# CONFIG_X86_KERNEL_IBT is not set +CONFIG_X86_KERNEL_IBT=y CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS=y CONFIG_X86_INTEL_TSX_MODE_OFF=y # CONFIG_X86_INTEL_TSX_MODE_ON is not set diff --git a/config/rootfiles/common/x86_64/linux b/config/rootfiles/common/x86_64/linux index fb4ea3a6f..6d00654af 100644 --- a/config/rootfiles/common/x86_64/linux +++ b/config/rootfiles/common/x86_64/linux @@ -11318,6 +11318,7 @@ etc/modprobe.d/ipv6.conf #lib/modules/KVER-ipfire/build/include/config/X86_INTERNODE_CACHE_SHIFT #lib/modules/KVER-ipfire/build/include/config/X86_IOPL_IOPERM #lib/modules/KVER-ipfire/build/include/config/X86_IO_APIC +#lib/modules/KVER-ipfire/build/include/config/X86_KERNEL_IBT #lib/modules/KVER-ipfire/build/include/config/X86_L1_CACHE_SHIFT #lib/modules/KVER-ipfire/build/include/config/X86_LOCAL_APIC #lib/modules/KVER-ipfire/build/include/config/X86_MCE -- 2.35.3

2 3

[PATCH] kernel: update to 6.1.38
by Arne Fitzenreiter 10 Jul '23

10 Jul '23

Signed-off-by: Arne Fitzenreiter <arne_f(a)ipfire.org> --- config/kernel/kernel.config.aarch64-ipfire | 2 +- config/kernel/kernel.config.x86_64-ipfire | 2 +- lfs/linux | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/config/kernel/kernel.config.aarch64-ipfire b/config/kernel/kernel.config.aarch64-ipfire index a2c852654..0b300fa4c 100644 --- a/config/kernel/kernel.config.aarch64-ipfire +++ b/config/kernel/kernel.config.aarch64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.37-ipfire Kernel Configuration +# Linux/arm64 6.1.38-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/config/kernel/kernel.config.x86_64-ipfire b/config/kernel/kernel.config.x86_64-ipfire index 0017a6f54..3bddd3806 100644 --- a/config/kernel/kernel.config.x86_64-ipfire +++ b/config/kernel/kernel.config.x86_64-ipfire @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.37-ipfire Kernel Configuration +# Linux/x86 6.1.38-ipfire Kernel Configuration # CONFIG_CC_VERSION_TEXT="gcc (GCC) 13.1.0" CONFIG_CC_IS_GCC=y diff --git a/lfs/linux b/lfs/linux index 87442185a..e9a50fba5 100644 --- a/lfs/linux +++ b/lfs/linux @@ -24,7 +24,7 @@ include Config -VER = 6.1.37 +VER = 6.1.38 ARM_PATCHES = 6.1.y-ipfire2 @@ -76,7 +76,7 @@ objects = \ $(DL_FILE) = $(URL_IPFIRE)/$(DL_FILE) arm-multi-patches-$(ARM_PATCHES).patch.xz = $(URL_IPFIRE)/arm-multi-patches-$(ARM_PATCHES).patch.xz -$(DL_FILE)_BLAKE2 = 9ea4b47123c21b658923f46d3f7d6b911f49e8616f038feefef860b3bb8756b2cbd0b097640b18333d79951b99c37dc32c1a4357263ff69641580c4d3ab4bc56 +$(DL_FILE)_BLAKE2 = 43f0fe3f8aeb03e5a2bf46b358b8dc4515765b70f56fb136847c78a80889bc2e163768d941500c285f40f705634b5fd3d6e0d81c10521fc351596c95db62490e arm-multi-patches-$(ARM_PATCHES).patch.xz_BLAKE2 = 7afc460562fb24bcd75784fc79de768f9b60780aedd88d1a847927169e31920bbb475b1ac1466c4a224a7876d16bd8d465b96202de12b74f6e2ccbfcec731ad3 install : $(TARGET) -- 2.38.1

2 1

[PATCH] Core Update 177: Delete OpenSSL 1.1.1 files
by Peter Müller 10 Jul '23

10 Jul '23

Originally announced for Core Update 176, this step was postponed until Core Update 177 due to my fault of having shipped all necessary dependencies for OpenSSL 3.x in Core Update 175 properly. Signed-off-by: Peter Müller <peter.mueller(a)ipfire.org> --- config/rootfiles/core/177/update.sh | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/config/rootfiles/core/177/update.sh b/config/rootfiles/core/177/update.sh index ebe2b4fe5..39b908318 100644 --- a/config/rootfiles/core/177/update.sh +++ b/config/rootfiles/core/177/update.sh @@ -106,7 +106,10 @@ rm -rvf \ /lib/firmware/cxgb4/t5fw-1.27.1* \ /lib/firmware/cxgb4/t6fw-1.27.1* \ /lib/firmware/intel/ice/ddp-comms/ice_comms-1.3.3* \ - /lib/firmware/intel/ice/ddp-wireless_edge/ice_wireless_edge-1.3.7* + /lib/firmware/intel/ice/ddp-wireless_edge/ice_wireless_edge-1.3.7* \ + /usr/lib/engines-1* \ + /usr/lib/libcrypto.so.1* \ + /usr/lib/libssl.so.1* # update linker config ldconfig -- 2.35.3

2 1

[PATCH] glib: Update to version 2.77.0
by Adolf Belka 10 Jul '23

10 Jul '23

- Update from 2.71.1 to 2.77.0 - Update of rootfile - Changelog is too large to include here. Details can be found in the NEWS file in the source tarball. Signed-off-by: Adolf Belka <adolf.belka(a)ipfire.org> --- config/rootfiles/common/glib | 35 +++++++++++++++++++++++++++-------- lfs/glib | 6 +++--- 2 files changed, 30 insertions(+), 11 deletions(-) diff --git a/config/rootfiles/common/glib b/config/rootfiles/common/glib index 6b73dd42f..4481c2c7e 100644 --- a/config/rootfiles/common/glib +++ b/config/rootfiles/common/glib @@ -17,7 +17,6 @@ #usr/include/gio-unix-2.0/gio #usr/include/gio-unix-2.0/gio/gdesktopappinfo.h #usr/include/gio-unix-2.0/gio/gfiledescriptorbased.h -#usr/include/gio-unix-2.0/gio/gunixfdlist.h #usr/include/gio-unix-2.0/gio/gunixfdmessage.h #usr/include/gio-unix-2.0/gio/gunixinputstream.h #usr/include/gio-unix-2.0/gio/gunixmounts.h @@ -95,6 +94,7 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/gio/ginitable.h #usr/include/glib-2.0/gio/ginputstream.h #usr/include/glib-2.0/gio/gio-autocleanups.h +#usr/include/glib-2.0/gio/gio-visibility.h #usr/include/glib-2.0/gio/gio.h #usr/include/glib-2.0/gio/gioenums.h #usr/include/glib-2.0/gio/gioenumtypes.h @@ -174,6 +174,7 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/gio/gtlsserverconnection.h #usr/include/glib-2.0/gio/gunixconnection.h #usr/include/glib-2.0/gio/gunixcredentialsmessage.h +#usr/include/glib-2.0/gio/gunixfdlist.h #usr/include/glib-2.0/gio/gunixsocketaddress.h #usr/include/glib-2.0/gio/gvfs.h #usr/include/glib-2.0/gio/gvolume.h @@ -221,6 +222,7 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/glib/gkeyfile.h #usr/include/glib-2.0/glib/glib-autocleanups.h #usr/include/glib-2.0/glib/glib-typeof.h +#usr/include/glib-2.0/glib/glib-visibility.h #usr/include/glib-2.0/glib/glist.h #usr/include/glib-2.0/glib/gmacros.h #usr/include/glib-2.0/glib/gmain.h @@ -230,6 +232,7 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/glib/gmessages.h #usr/include/glib-2.0/glib/gnode.h #usr/include/glib-2.0/glib/goption.h +#usr/include/glib-2.0/glib/gpathbuf.h #usr/include/glib-2.0/glib/gpattern.h #usr/include/glib-2.0/glib/gpoll.h #usr/include/glib-2.0/glib/gprimes.h @@ -270,9 +273,12 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/glib/gversion.h #usr/include/glib-2.0/glib/gversionmacros.h #usr/include/glib-2.0/glib/gwin32.h +#usr/include/glib-2.0/gmodule #usr/include/glib-2.0/gmodule.h +#usr/include/glib-2.0/gmodule/gmodule-visibility.h #usr/include/glib-2.0/gobject #usr/include/glib-2.0/gobject/gbinding.h +#usr/include/glib-2.0/gobject/gbindinggroup.h #usr/include/glib-2.0/gobject/gboxed.h #usr/include/glib-2.0/gobject/gclosure.h #usr/include/glib-2.0/gobject/genums.h @@ -280,11 +286,13 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/gobject/glib-types.h #usr/include/glib-2.0/gobject/gmarshal.h #usr/include/glib-2.0/gobject/gobject-autocleanups.h +#usr/include/glib-2.0/gobject/gobject-visibility.h #usr/include/glib-2.0/gobject/gobject.h #usr/include/glib-2.0/gobject/gobjectnotifyqueue.c #usr/include/glib-2.0/gobject/gparam.h #usr/include/glib-2.0/gobject/gparamspecs.h #usr/include/glib-2.0/gobject/gsignal.h +#usr/include/glib-2.0/gobject/gsignalgroup.h #usr/include/glib-2.0/gobject/gsourceclosure.h #usr/include/glib-2.0/gobject/gtype.h #usr/include/glib-2.0/gobject/gtypemodule.h @@ -293,24 +301,26 @@ usr/include/glib-2.0/gio/gdebugcontroller.h #usr/include/glib-2.0/gobject/gvaluearray.h #usr/include/glib-2.0/gobject/gvaluecollector.h #usr/include/glib-2.0/gobject/gvaluetypes.h +#usr/lib/gio +#usr/lib/gio/modules #usr/lib/glib-2.0 #usr/lib/glib-2.0/include #usr/lib/glib-2.0/include/glibconfig.h #usr/lib/libgio-2.0.so usr/lib/libgio-2.0.so.0 -usr/lib/libgio-2.0.so.0.7101.0 +usr/lib/libgio-2.0.so.0.7700.0 #usr/lib/libglib-2.0.so usr/lib/libglib-2.0.so.0 -usr/lib/libglib-2.0.so.0.7101.0 +usr/lib/libglib-2.0.so.0.7700.0 #usr/lib/libgmodule-2.0.so usr/lib/libgmodule-2.0.so.0 -usr/lib/libgmodule-2.0.so.0.7101.0 +usr/lib/libgmodule-2.0.so.0.7700.0 #usr/lib/libgobject-2.0.so usr/lib/libgobject-2.0.so.0 -usr/lib/libgobject-2.0.so.0.7101.0 +usr/lib/libgobject-2.0.so.0.7700.0 #usr/lib/libgthread-2.0.so usr/lib/libgthread-2.0.so.0 -usr/lib/libgthread-2.0.so.0.7101.0 +usr/lib/libgthread-2.0.so.0.7700.0 #usr/lib/pkgconfig/gio-2.0.pc #usr/lib/pkgconfig/gio-unix-2.0.pc #usr/lib/pkgconfig/glib-2.0.pc @@ -319,6 +329,7 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/lib/pkgconfig/gmodule-no-export-2.0.pc #usr/lib/pkgconfig/gobject-2.0.pc #usr/lib/pkgconfig/gthread-2.0.pc +#usr/libexec/gio-launch-desktop #usr/share/aclocal/glib-2.0.m4 #usr/share/aclocal/glib-gettext.m4 #usr/share/aclocal/gsettings.m4 @@ -331,8 +342,8 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/share/gdb/auto-load #usr/share/gdb/auto-load/usr #usr/share/gdb/auto-load/usr/lib -#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.7101.0-gdb.py -#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.7101.0-gdb.py +#usr/share/gdb/auto-load/usr/lib/libglib-2.0.so.0.7700.0-gdb.py +#usr/share/gdb/auto-load/usr/lib/libgobject-2.0.so.0.7700.0-gdb.py #usr/share/gettext/its #usr/share/gettext/its/gschema.its #usr/share/gettext/its/gschema.loc @@ -342,6 +353,7 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/share/glib-2.0/codegen/codegen.py #usr/share/glib-2.0/codegen/codegen_docbook.py #usr/share/glib-2.0/codegen/codegen_main.py +#usr/share/glib-2.0/codegen/codegen_md.py #usr/share/glib-2.0/codegen/codegen_rst.py #usr/share/glib-2.0/codegen/config.py #usr/share/glib-2.0/codegen/dbustypes.py @@ -357,6 +369,9 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/share/glib-2.0/schemas/gschema.dtd #usr/share/glib-2.0/valgrind #usr/share/glib-2.0/valgrind/glib.supp +#usr/share/locale/ab +#usr/share/locale/ab/LC_MESSAGES +#usr/share/locale/ab/LC_MESSAGES/glib20.mo #usr/share/locale/af/LC_MESSAGES/glib20.mo #usr/share/locale/am #usr/share/locale/am/LC_MESSAGES @@ -441,6 +456,9 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/share/locale/hy/LC_MESSAGES #usr/share/locale/hy/LC_MESSAGES/glib20.mo #usr/share/locale/id/LC_MESSAGES/glib20.mo +#usr/share/locale/ie +#usr/share/locale/ie/LC_MESSAGES +#usr/share/locale/ie/LC_MESSAGES/glib20.mo #usr/share/locale/is #usr/share/locale/is/LC_MESSAGES #usr/share/locale/is/LC_MESSAGES/glib20.mo @@ -553,3 +571,4 @@ usr/lib/libgthread-2.0.so.0.7101.0 #usr/share/locale/zh_HK/LC_MESSAGES #usr/share/locale/zh_HK/LC_MESSAGES/glib20.mo #usr/share/locale/zh_TW/LC_MESSAGES/glib20.mo + diff --git a/lfs/glib b/lfs/glib index 157d6f57a..20e95b4ab 100644 --- a/lfs/glib +++ b/lfs/glib @@ -1,7 +1,7 @@ ############################################################################### # # # IPFire.org - A linux based firewall # -# Copyright (C) 2007-2021 IPFire Team <info(a)ipfire.org> # +# Copyright (C) 2007-2023 IPFire Team <info(a)ipfire.org> # # # # This program is free software: you can redistribute it and/or modify # # it under the terms of the GNU General Public License as published by # @@ -24,7 +24,7 @@ include Config -VER = 2.71.1 +VER = 2.77.0 THISAPP = glib-$(VER) DL_FILE = $(THISAPP).tar.xz @@ -40,7 +40,7 @@ objects = $(DL_FILE) $(DL_FILE) = $(DL_FROM)/$(DL_FILE) -$(DL_FILE)_BLAKE2 = 025072e9c8b22c9c7503e6fbb83d42ff15bb5e30fc2d864c91d018a7478eccbddd70955ffac16d2823ece2efebca19d86fed6bc69295bcbca74aa72ee43b236f +$(DL_FILE)_BLAKE2 = da610dfd6a9a95de0bcd92a939dc7ae27a2f2cfcd9c6df803948e43de90473b17d84b1463c5173b0b87ddef132d8784de5ad2df2482cd4a97625324d5adf65b7 install : $(TARGET) -- 2.41.0

1 3

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

Development July 2023