Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

python-engineio & python-socketio: package update

Signed-off-by: Aleksander Jan Bajkowski <A.Bajkowski@stud.elka.pw.edu.pl>

Library for node.js will be disabled temporarily due to difficulty in supporting the latest node.js.

Signed-off-by: Hirokazu MORIKAWA <morikw2@gmail.com>

xray-core: remove PROVIDES

Signed-off-by: Jan Hak <jan.hak@nic.cz>

Minor ZeroTier update. Refreshed patches.

Signed-off-by: Moritz Warning <moritzwarning@web.de>

yq: Update to 4.7.1

gitlab-runner: update to version 13.11.0

redis: update to version 6.2.2

Using `$(INSTALL_CONF)` will cause the program has no access to
configurations file when someone enabled the selinux support.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Xray now is no longer planning to keep compatibility with original
v2ray. Remove PROVIDES before it is totally broken.

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

In case a volume which is down is removed, no ubus event needs to be
fired. Don't try.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Using strcmp() to compare a version string doesn't work well.
Use verrevcmp() function from opkg instead.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>

Signed-off-by: Tianling Shen <cnsztl@immortalwrt.org>

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

From mosquitto 2.x, port became optional and deprecated in the config,
and it was recommended that listeners be used instead.  Drop the hard
requirement in our config conversion script.

Reported in: https://github.com/openwrt/packages/issues/15506


Signed-off-by:  <karlp@etactica.com>

As reported in: https://github.com/openwrt/packages/issues/15506



Signed-off-by: Karl Palsson <karlp@etactica.com>

CMake was using the wrong paths. Fix them up.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

I noticed that the package contained 3 identical copies of the lib:

root@52170cbc2408:/# ls -ali /usr/lib/libh2o*
 162653 -rwxr-xr-x    1 root     root        348857 Apr 25 11:50 /usr/lib/libh2o-evloop.so
 162660 -rwxr-xr-x    1 root     root        348857 Apr 25 11:50 /usr/lib/libh2o-evloop.so.0.13
 162661 -rwxr-xr-x    1 root     root        348857 Apr 25 11:50 /usr/lib/libh2o-evloop.so.0.13.6

so this commit fixes that:

root@472ad3a8404e:/# ls -ali /usr/lib/libh2o*
 289858 lrwxrwxrwx    1 root     root            21 Apr 25 12:43 /usr/lib/libh2o-evloop.so -> libh2o-evloop.so.0.13
 289859 lrwxrwxrwx    1 root     root            23 Apr 25 12:43 /usr/lib/libh2o-evloop.so.0.13 -> libh2o-evloop.so.0.13.6
 289860 -rw-r--r--    1 root     root        348857 Apr 25 12:41 /usr/lib/libh2o-evloop.so.0.1

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

h2o is the library dnsdist uses to offer DNS over HTTPS to clients. dnsdist is the only user of h2o in this tree.

While h2o can depend on Ruby (to build mruby support), this is disabled in the OpenWRT build of h2o. Hence, the Ruby dependency is unnecessary, and removing it saves a few megabytes of disk space.

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

unbound: fix typo in assist name of https-dns-proxy

I left the old version in, in case users have configs that already correct for this error.

Signed-off-by: Peter van Dijk <peter.van.dijk@powerdns.com>

squid: Enable dynamic SSL certificate generation

Signed-off-by: Tao Gong <gongtao0607@gmail.com>

Maintainer: @neheb / @BKPepe / @zhanhb
Compile tested: ipq806x, generic, netgear_r7800, master
Run tested: ipq806x, generic, netgear_r7800, openwrt-19.07

Description:

Squid now only support HTTPS proxy in TCP tunnel mode (e.g. `ssl_bump splice all`):

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    ssl_bump splice all

In order to operate in SSL Bump mode, we need to compile with `--enable-ssl-crtd` for following configuration:

    https_port 3128 ssl-bump tls-cert=/etc/squid/squid.pem generate-host-certificates=on
    sslcrtd_program /usr/lib/squid/security_file_certgen -s /car/cache/squid/ssl_db -M 4MB
    ssl_bump stare all
    ssl_bump bump all

This PR switch the `SQUID_enable-ssl-crtd` into `default y`, therefore default enable SSL Bump mode.

Signed-off-by: Wong Hoi Sing Edison <hswong3i@pantarei-design.com>

Signed-off-by: Aleksander Jan Bajkowski <A.Bajkowski@stud.elka.pw.edu.pl>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Staging certificates have the advantage that their retry limits are loose.
Therefore they can be obtained quickly when automatic retries are used.
Unfortunately they can not be used for deployments because their CA is not
accepted by clients. Production certificates do not have this limitation, but
their retry limits are strict. For production certificates, automatic retries
can only be performed a few times per hour. This makes automatic obtainment of
certificates tenacious.

With use_auto_staging=1, the advantages of the two certificate types are
combined. Uacme will first obtain a staging certificate. When the staging
certificate is successfully obtained, uacme will switch and obtain a production
certificate. Since the staging certificate has already been successfully
obtained, we can ensure that the production certificate is successfully
obtained in the first attempt. This means that "retries" are performed on the
staging certificate and the production certificate is obtained in the first
attempt.

In summary, this feature enables fast obtaining of production certificates when
automatic retries are used.

By default, this feature is set to use_auto_staging=0, which means that
uacme will behave as before by default.

Signed-off-by: Leonardo Mörlein <git@irrelefant.net>