staging/nbd/package/system, branch master

apk: handle edge case when parsing .apk files

2026-02-12T09:23:56Z

This was a regression introduced in the recent alignment changes and led to failures when reading (i.e. 'mkndx') certain packages like follows: ERROR: python3-botocore-1.31.7-r1.apk: unexpected end of file It affected packages with a header size greater than the read buffer size of 128KB but less than 160KB (128KB + (128KB / 4)). In those cases, we'd attempt a 0 byte read, leading to APKE_EOF. Based on some tests of files across multiple archs and feeds, it seems the only packages meeting those criteria were python3-botocore and golang-github-jedisct1-dnscrypt-proxy2-dev. Fixes: 64ec08eee1 ("apk: backport upstream fixes for unaligned access") Signed-off-by: Matt Merhar Link: https://github.com/openwrt/openwrt/pull/21992 Signed-off-by: Robert Marko

apk: backport upstream fixes for unaligned access

2026-02-10T14:06:52Z

On the kirkwood target, packages would frequently fail to install with APKE_ADB_SCHEMA, APKE_ADB_BLOCK, and/or segfaults. The culprit was unaligned access leading to bogus values being read out of memory on these particular ARMv5 CPUs. Pull in the relevant upstream fixes to address this. Fixes: https://github.com/openwrt/openwrt/issues/21307 Link: https://gitlab.alpinelinux.org/alpine/apk-tools/-/merge_requests/391 Link: https://gitlab.alpinelinux.org/alpine/apk-tools/-/merge_requests/392 Signed-off-by: Matt Merhar Link: https://github.com/openwrt/openwrt/pull/21958 Signed-off-by: Robert Marko

procd: update to git HEAD

2026-02-09T16:41:57Z

7e5b324 instance: check length of names when creating cgroups 014f94c procd: jail/cgroups: fix OOB write in cgroups_apply() e08cdc8 hotplug-dispatch: fix filter disallowing setting PATH afa4391 service instance: Improve handling of watchdog config changes 52c64d2 service instance: Fix overwriting of watchdog linked list members 96c827f coldplug: fix missing header include 6b10c71 hotplug-dispatch: fix missing header include 58d7aaa initd/coldplug: create /dev/null before running udevtrigger 64f97ff hotplug-dispatch: redirect output to /dev/null c4e9859 hotplug-dispatch: use stat if d_type is DT_UNKNOWN bafdfff system: fix arguments validation in ubus handler Signed-off-by: Daniel Golle

procd: reload_config: support UCI overlay directory

2026-02-07T09:04:17Z

Check /var/run/uci/ before /etc/config/ so that overlay configs also trigger service reload events. The overlay directory takes precedence, and uci show already handles merging overlay + base configuration correctly. Signed-off-by: John Crispin

apk: backport upstream fix for invalid fetch timestamps

2026-02-05T16:11:42Z

Uninitialized memory led to bogus, huge timestamps being set on files downloaded with the wget backend. This caused odd issues like 'ls -l' crashing busybox when attempting to list the .apk file afterwards. Link: https://gitlab.alpinelinux.org/alpine/apk-tools/-/commit/42f159e67bafe1dad16839c0c0a005b5e89487ba Signed-off-by: Matt Merhar Link: https://github.com/openwrt/openwrt/pull/21874 Signed-off-by: Robert Marko

uclient: provide virtual wget-any

2026-01-12T13:28:52Z

Packages shouldn't provide a package that another package, in this case wget from packages provides. Explicitly provide a virtual @wget-any instead to match the implicit wget provide and switch the only consumer to use the new provider. Set uclient-fetch as the default variant for wget-any. Signed-off-by: George Sapkin Link: https://github.com/openwrt/openwrt/pull/21369 Signed-off-by: Robert Marko

treewide: update SELinux project URL

2026-01-02T17:07:02Z

It seems old website has been retired. Signed-off-by: Yanase Yuki Link: https://github.com/openwrt/openwrt/pull/21279 Signed-off-by: Robert Marko

treewide: add explicit default variant

2026-01-02T13:46:30Z

Some packages with variants did not specify the default among the alternatives, so were left without any apk 'provider_priority' for that package. This caused the apk solver to select the wrong variant, silently changing the requested package list. Notable among these were busybox, procd and the hostapd/wpad suite. This behavior presented in the imagebuilders when creating the image as follows, silently replacing packages even when explicitly requested: $ make image PACKAGES=busybox ... ( 14/148) Installing busybox-selinux (1.37.0-r6) ... We add 'DEFAULT_VARIANT:=1' to the packages that were missing one, providing apk with sufficient information to choose the correct package. See link below for further examples and discussion. Link: https://github.com/openwrt/openwrt/pull/21288#issuecomment-3704101422 Signed-off-by: Eric Fahlgren Link: https://github.com/openwrt/openwrt/pull/21358 Signed-off-by: Robert Marko

ca-certificates: provide a virtual package

2025-12-31T17:16:48Z

Switch ca-certs provides to use the new virtual provides semantic that enables ca-bundle and ca-certificates to be installed side-by-side. Provide the new format virtual ca-certificates-any in ca-bundle. Fixes: https://github.com/openwrt/openwrt/issues/21257 Signed-off-by: George Sapkin Link: https://github.com/openwrt/openwrt/pull/21288 Signed-off-by: Robert Marko

apk: bump to 3.0.2

2025-12-12T12:59:39Z

We drop patch 0020-apk-fix-compile: integrated at source. Compressed help now functions normally. Signed-off-by: Paul Donald Link: https://github.com/openwrt/openwrt/pull/21127 Signed-off-by: Robert Marko