Merge branch 'openwrt:main' into wax206

Author: small-white-rabbit

config/Config-build.in

@@ -250,6 +250,15 @@ menu "Global build settings"
 
 	comment "Hardening build options"
 
+	config PKG_FANALYZER
+		bool
+		prompt "Enable gcc fanalyzer"
+		default n
+		help
+		  Add -fanalyzer to the CFLAGS. As a result of this option, a static analysis
+		  of the program flow is conducted, allowing interprocedural paths to be
+		  identified and warnings to be issued if problems are identified.
+
 	config PKG_CHECK_FORMAT_SECURITY
 		bool
 		prompt "Enable gcc format-security"

include/hardening.mk

@@ -9,6 +9,7 @@ PKG_SSP ?= 1
 PKG_FORTIFY_SOURCE ?= 1
 PKG_RELRO ?= 1
 PKG_DT_RELR ?= 1
+PKG_FANALYZER ?= 0
 
 ifdef CONFIG_PKG_CHECK_FORMAT_SECURITY
   ifeq ($(strip $(PKG_CHECK_FORMAT_SECURITY)),1)
@@ -77,3 +78,8 @@ ifdef CONFIG_PKG_DT_RELR
   endif
 endif
 
+ifdef CONFIG_PKG_FANALYZER
+  ifeq ($(strip $(PKG_FANALYZER)),1)
+    TARGET_CFLAGS +=  -fanalyzer
+  endif
+endif

include/package-pack.mk

@@ -280,7 +280,7 @@ endif
 		)
     endif
 
-	$(INSTALL_DIR) $$(PDIR_$(1))/tmp
+	$(INSTALL_DIR) $$(PDIR_$(1))
 
 ifeq ($(CONFIG_USE_APK),)
 	mkdir -p $$(IDIR_$(1))/CONTROL

package/network/utils/bpftool/Makefile

@@ -8,11 +8,11 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=bpftool
-PKG_VERSION:=7.5.0
+PKG_VERSION:=7.6.0
 PKG_RELEASE:=1
 
 PKG_SOURCE_URL:=https://github.com/libbpf/bpftool
-PKG_MIRROR_HASH:=1da7c08959e7819772145774322ffd876f3180065be1c3759336dca98ac9f666
+PKG_MIRROR_HASH:=7406a424375642fda35cae6eccaa8e27c21e4f132123c0207a83f763ef6fe899
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 

package/network/utils/bpftool/patches/002-includes.patch

@@ -1,6 +1,6 @@
 --- a/src/Makefile
 +++ b/src/Makefile
-@@ -73,10 +73,10 @@ CFLAGS += -W -Wall -Wextra -Wno-unused-p
+@@ -72,10 +72,10 @@ CFLAGS += -Wno-missing-field-initializer
  CFLAGS += $(filter-out -Wswitch-enum -Wnested-externs,$(EXTRA_WARNINGS))
  CFLAGS += -DPACKAGE='"bpftool"' -D__EXPORTED_HEADERS__ \
  	-I$(or $(OUTPUT),.) \

package/system/apk/Makefile

@@ -5,9 +5,9 @@ PKG_RELEASE:=2
 
 PKG_SOURCE_URL=https://gitlab.alpinelinux.org/alpine/apk-tools.git
 PKG_SOURCE_PROTO:=git
-PKG_SOURCE_DATE:=2025-10-07
-PKG_SOURCE_VERSION:=6ffc65c63004b8d991ead4ea0f3d80e05b06b977
-PKG_MIRROR_HASH:=388e0210247a49099f49e783ff3d0753bed26bbb91acec2dd2d5722aca5daf6f
+PKG_SOURCE_DATE:=2025-11-10
+PKG_SOURCE_VERSION:=2c027261492169783f6aaa2b7731a4e90dc7a5b0
+PKG_MIRROR_HASH:=177769a6b7a4b0a2117ed4326060eb08b19c1b930a8a92b7c25d2f56154f497e
 
 PKG_VERSION=3.0.0_pre$(subst -,,$(PKG_SOURCE_DATE))
 

package/system/apk/patches/0001-openwrt-move-layer-db-to-temp-folder.patch

@@ -10,7 +10,7 @@ Signed-off-by: Paul Spooren <mail@aparcar.org>
 
 --- a/src/database.c
 +++ b/src/database.c
-@@ -1856,7 +1856,7 @@ const char *apk_db_layer_name(int layer)
+@@ -1937,7 +1937,7 @@ const char *apk_db_layer_name(int layer)
  {
  	switch (layer) {
  	case APK_DB_LAYER_ROOT: return "lib/apk/db";

package/system/apk/patches/010-libressl4.patch

@@ -0,0 +1,32 @@
+From aa71510f843d5cce5f75b6abfa3a70caeacbe36d Mon Sep 17 00:00:00 2001
+From: Rosen Penev <rosenp@gmail.com>
+Date: Thu, 20 Nov 2025 18:26:52 -0800
+Subject: [PATCH] fix usage under LibreSSL > 3
+
+crypto needs to be initialized as the context relies on it.
+
+Fixes crash in EVP_DigestInit_ex being called with a NULL digest.
+
+Signed-off-by: Rosen Penev <rosenp@gmail.com>
+---
+ src/apk.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/src/apk.c
++++ b/src/apk.c
+@@ -571,6 +571,7 @@ int main(int argc, char **argv)
+ 	apk_argv[argc] = NULL;
+ 	apk_argv[argc+1] = NULL;
+ 
++	apk_crypto_init();
+ 	apk_ctx_init(&ctx);
+ 	umask(0);
+ 	setup_terminal();
+@@ -583,7 +584,6 @@ int main(int argc, char **argv)
+ 		if (applet->parse) applet->parse(applet_ctx, &ctx, APK_OPTIONS_INIT, NULL);
+ 	}
+ 
+-	apk_crypto_init();
+ 	apk_io_url_init(&ctx.out);
+ 	apk_io_url_set_timeout(60);
+ 	apk_io_url_set_redirect_callback(redirect_callback);

package/system/apk/patches/999-small-scripts-tar.patch

@@ -1,8 +1,6 @@
-diff --git a/doc/apk.8.scd b/doc/apk.8.scd
-index bd15fe75d7a4..cbac8c6c8b7b 100644
 --- a/doc/apk.8.scd
 +++ b/doc/apk.8.scd
-@@ -461,7 +461,8 @@ timeout 120
+@@ -462,7 +462,8 @@ timeout 120
  */lib/apk/db/installed*
  	Database of installed packages and their contents.
 
@@ -12,23 +10,19 @@ index bd15fe75d7a4..cbac8c6c8b7b 100644
  	Collection of all package scripts from currently installed packages.
 
  */lib/apk/db/triggers*
-diff --git a/src/apk_database.h b/src/apk_database.h
-index 9f8670ac8ebb..10f1414c9e06 100644
 --- a/src/apk_database.h
 +++ b/src/apk_database.h
-@@ -202,6 +202,7 @@ struct apk_database {
+@@ -210,6 +210,7 @@ struct apk_database {
  	unsigned int compat_depversions : 1;
  	unsigned int sorted_names : 1;
  	unsigned int sorted_installed_packages : 1;
 +	unsigned int scripts_tar : 1;
 
  	struct apk_dependency_array *world;
  	struct apk_id_cache *id_cache;
-diff --git a/src/database.c b/src/database.c
-index cbe58ebbf885..cb1b709140af 100644
 --- a/src/database.c
 +++ b/src/database.c
-@@ -1255,8 +1255,11 @@ static int apk_db_read_layer(struct apk_database *db, unsigned layer)
+@@ -1338,8 +1338,11 @@ static int apk_db_read_layer(struct apk_
  	}
 
  	if (!(flags & APK_OPENF_NO_SCRIPTS)) {
@@ -42,7 +36,7 @@ index cbe58ebbf885..cb1b709140af 100644
  		if (!ret && r != -ENOENT) ret = r;
  	}
 
-@@ -2128,8 +2131,9 @@ static int apk_db_write_layers(struct apk_database *db)
+@@ -2214,8 +2217,9 @@ static int apk_db_write_layers(struct ap
  			continue;
  		}
  		ld->installed = apk_ostream_to_file(ld->fd, "installed", 0644);

package/system/refpolicy/Makefile

@@ -6,12 +6,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=refpolicy
-PKG_VERSION:=2.20200229
-PKG_RELEASE:=3
+PKG_VERSION:=2.20250923
+PKG_RELEASE:=1
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.bz2
-PKG_SOURCE_URL:=https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_2_20200229
-PKG_HASH:=dec854512ed00cd057408f330c2cea4de7a4405f7a147458f59c994bf578e4b0
+PKG_SOURCE_URL:=https://github.com/SELinuxProject/refpolicy/releases/download/RELEASE_2_20250923
+PKG_HASH:=e5b435c934048d01ca4415a1f2670a51e113f26f5d01ad4227c98fbe8dea8d5b
 PKG_INSTALL:=1
 PKG_BUILD_DEPENDS:=checkpolicy/host policycoreutils/host