diff --git a/.checkpackageignore b/.checkpackageignore index bd3766988d..95cb5eccc5 100644 --- a/.checkpackageignore +++ b/.checkpackageignore @@ -281,7 +281,6 @@ package/dmalloc/0004-Makefile-use-the-configure-detected-or-user-supplied.patch package/dmalloc/0005-configure-use-LD-instead-of-hard-coding-ld.patch lib_patch.Upstream package/docopt-cpp/0001-only-build-one-target-use-BUILD_SHARED_LIBS-where-appropriate.patch lib_patch.Upstream package/domoticz/S99domoticz Shellcheck -package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch lib_patch.Upstream package/dracut/merged-usr-module-setup.sh Shellcheck package/dropbear/S50dropbear Shellcheck lib_sysv.Indent lib_sysv.Variables package/dt/0001-adjust-os-symlink.patch lib_patch.Upstream diff --git a/docs/manual/migrating.adoc b/docs/manual/migrating.adoc index 68f09e1bae..86b040a19c 100644 --- a/docs/manual/migrating.adoc +++ b/docs/manual/migrating.adoc @@ -264,3 +264,9 @@ added to .cargo-checksum.json to clarify that this file is not a security mechanism. Tarballs generated by Cargo-fetched packages have changed, therefore the suffix of such tarballs has been changed from +-cargo5+ to +-cargo6+. + +[[migrating-to-2026-11]] +=== Migration to 2026.11 + +Due to the update of Dovecot to version 2.4.x the runtime configuration +files need to be updated. diff --git a/package/dovecot-pigeonhole/dovecot-pigeonhole.hash b/package/dovecot-pigeonhole/dovecot-pigeonhole.hash index 247f74fdba..96bf279e24 100644 --- a/package/dovecot-pigeonhole/dovecot-pigeonhole.hash +++ b/package/dovecot-pigeonhole/dovecot-pigeonhole.hash @@ -1,3 +1,3 @@ # Locally computed after checking signature -sha256 0377db284b620723de060431115fb2e7791e1df4321411af718201d6925c4692 dovecot-2.3-pigeonhole-0.5.21.1.tar.gz -sha256 fc9e9522216f2a9a28b31300e3c73c1df56acc27dfae951bf516e7995366b51a COPYING +sha256 ad7c478cb3aaa76c5f81f86727a3e6843645b0a1253f5684fb8a0beec0d22925 dovecot-pigeonhole-2.4.5.tar.gz +sha256 1fc821d394719d8b5337223c1f4bd898a231f2fb559f2cf3ebeda97be8362d6d COPYING diff --git a/package/dovecot-pigeonhole/dovecot-pigeonhole.mk b/package/dovecot-pigeonhole/dovecot-pigeonhole.mk index 4d21ebd395..17ffc1d7cf 100644 --- a/package/dovecot-pigeonhole/dovecot-pigeonhole.mk +++ b/package/dovecot-pigeonhole/dovecot-pigeonhole.mk @@ -4,9 +4,9 @@ # ################################################################################ -DOVECOT_PIGEONHOLE_VERSION = 0.5.21.1 -DOVECOT_PIGEONHOLE_SOURCE = dovecot-2.3-pigeonhole-$(DOVECOT_PIGEONHOLE_VERSION).tar.gz -DOVECOT_PIGEONHOLE_SITE = https://pigeonhole.dovecot.org/releases/2.3 +DOVECOT_PIGEONHOLE_VERSION_MAJOR = 2.4 +DOVECOT_PIGEONHOLE_VERSION = $(DOVECOT_PIGEONHOLE_VERSION_MAJOR).5 +DOVECOT_PIGEONHOLE_SITE = https://pigeonhole.dovecot.org/releases/$(DOVECOT_PIGEONHOLE_VERSION_MAJOR) DOVECOT_PIGEONHOLE_LICENSE = LGPL-2.1 DOVECOT_PIGEONHOLE_LICENSE_FILES = COPYING DOVECOT_PIGEONHOLE_CPE_ID_VENDOR = dovecot @@ -15,4 +15,10 @@ DOVECOT_PIGEONHOLE_DEPENDENCIES = dovecot DOVECOT_PIGEONHOLE_CONF_OPTS = --with-dovecot=$(STAGING_DIR)/usr/lib +# fix path to avoid using /usr/lib/dovecot +define DOVECOT_PIGEONHOLE_POST_CONFIGURE + $(SED) 's%^dovecot_pkglibexecdir =.*%dovecot_pkglibexecdir = $(STAGING_DIR)/usr/libexec%' $(@D)/src/plugins/settings/Makefile +endef +DOVECOT_PIGEONHOLE_POST_CONFIGURE_HOOKS += DOVECOT_PIGEONHOLE_POST_CONFIGURE + $(eval $(autotools-package)) diff --git a/package/dovecot/0001-Revert-lib-var-expand-crypt-Link-test-binary-statica.patch b/package/dovecot/0001-Revert-lib-var-expand-crypt-Link-test-binary-statica.patch new file mode 100644 index 0000000000..83ba1168ce --- /dev/null +++ b/package/dovecot/0001-Revert-lib-var-expand-crypt-Link-test-binary-statica.patch @@ -0,0 +1,32 @@ +From 08a6ca5cfb9d4148d5dedabd0660e06fd3081606 Mon Sep 17 00:00:00 2001 +From: Bernd Kuhls +Date: Tue, 25 Aug 2026 21:17:48 +0200 +Subject: [PATCH] Revert "lib-var-expand-crypt: Link test binary statically" + +This reverts commit 1c6b67195d279836d94e141215c626c20af93af6. + +Upstream: n/a (buildroot specific) + +Signed-off-by: Bernd Kuhls +--- + src/lib-var-expand-crypt/Makefile.am | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/src/lib-var-expand-crypt/Makefile.am b/src/lib-var-expand-crypt/Makefile.am +index aa6a3b9b81..12d424a845 100644 +--- a/src/lib-var-expand-crypt/Makefile.am ++++ b/src/lib-var-expand-crypt/Makefile.am +@@ -35,9 +35,8 @@ test_libs = \ + test_var_expand_crypt_SOURCES = test-var-expand-crypt.c + test_var_expand_crypt_LDADD = $(test_libs) $(SSL_LIBS) $(LIBDOVECOT_TEST_LIBS) + test_var_expand_crypt_DEPENDENCIES = $(module_LTLIBRARIES) +-test_var_expand_crypt_LDFLAGS = -static + if HAVE_WHOLE_ARCHIVE +-test_var_expand_crypt_LDFLAGS += -export-dynamic -Wl,$(LD_WHOLE_ARCHIVE),../lib/.libs/liblib.a,../lib-json/.libs/libjson.a,../lib-ssl-iostream/.libs/libssl_iostream.a,$(LD_NO_WHOLE_ARCHIVE) ++test_var_expand_crypt_LDFLAGS = -export-dynamic -Wl,$(LD_WHOLE_ARCHIVE),../lib/.libs/liblib.a,../lib-json/.libs/libjson.a,../lib-ssl-iostream/.libs/libssl_iostream.a,$(LD_NO_WHOLE_ARCHIVE) + endif + + test_var_expand_crypt_CFLAGS = $(AM_CFLAGS) \ +-- +2.47.3 + diff --git a/package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch b/package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch deleted file mode 100644 index 99a2b83563..0000000000 --- a/package/dovecot/0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch +++ /dev/null @@ -1,137 +0,0 @@ -From 7bad6a24160e34bce8f10e73dbbf9e5fbbcd1904 Mon Sep 17 00:00:00 2001 -From: Timo Sirainen -Date: Mon, 9 May 2022 15:23:33 +0300 -Subject: [PATCH] auth: Fix handling passdbs with identical driver/args but - different mechanisms/username_filter - -The passdb was wrongly deduplicated in this situation, causing wrong -mechanisms or username_filter setting to be used. This would be a rather -unlikely configuration though. - -Fixed by moving mechanisms and username_filter from struct passdb_module -to struct auth_passdb, which is where they should have been in the first -place. - -CVE: CVE-2022-30550 -Signed-off-by: Peter Korsgaard ---- - src/auth/auth-request.c | 6 +++--- - src/auth/auth.c | 18 ++++++++++++++++++ - src/auth/auth.h | 5 +++++ - src/auth/passdb.c | 15 ++------------- - src/auth/passdb.h | 4 ---- - 5 files changed, 28 insertions(+), 20 deletions(-) - -diff --git a/src/auth/auth-request.c b/src/auth/auth-request.c -index cd08b1fa02..0ca29f3674 100644 ---- a/src/auth/auth-request.c -+++ b/src/auth/auth-request.c -@@ -534,8 +534,8 @@ auth_request_want_skip_passdb(struct auth_request *request, - struct auth_passdb *passdb) - { - /* if mechanism is not supported, skip */ -- const char *const *mechs = passdb->passdb->mechanisms; -- const char *const *username_filter = passdb->passdb->username_filter; -+ const char *const *mechs = passdb->mechanisms; -+ const char *const *username_filter = passdb->username_filter; - const char *username; - - username = request->fields.user; -@@ -548,7 +548,7 @@ auth_request_want_skip_passdb(struct auth_request *request, - return TRUE; - } - -- if (passdb->passdb->username_filter != NULL && -+ if (passdb->username_filter != NULL && - !auth_request_username_accepted(username_filter, username)) { - auth_request_log_debug(request, - request->mech != NULL ? AUTH_SUBSYS_MECH -diff --git a/src/auth/auth.c b/src/auth/auth.c -index f2f3fda20c..9f6c4ba60c 100644 ---- a/src/auth/auth.c -+++ b/src/auth/auth.c -@@ -99,6 +99,24 @@ auth_passdb_preinit(struct auth *auth, const struct auth_passdb_settings *set, - auth_passdb->override_fields_tmpl = - passdb_template_build(auth->pool, set->override_fields); - -+ if (*set->mechanisms == '\0') { -+ auth_passdb->mechanisms = NULL; -+ } else if (strcasecmp(set->mechanisms, "none") == 0) { -+ auth_passdb->mechanisms = (const char *const[]){ NULL }; -+ } else { -+ auth_passdb->mechanisms = -+ (const char *const *)p_strsplit_spaces(auth->pool, -+ set->mechanisms, " ,"); -+ } -+ -+ if (*set->username_filter == '\0') { -+ auth_passdb->username_filter = NULL; -+ } else { -+ auth_passdb->username_filter = -+ (const char *const *)p_strsplit_spaces(auth->pool, -+ set->username_filter, " ,"); -+ } -+ - /* for backwards compatibility: */ - if (set->pass) - auth_passdb->result_success = AUTH_DB_RULE_CONTINUE; -diff --git a/src/auth/auth.h b/src/auth/auth.h -index f700e29d5c..460a179765 100644 ---- a/src/auth/auth.h -+++ b/src/auth/auth.h -@@ -41,6 +41,11 @@ struct auth_passdb { - struct passdb_template *default_fields_tmpl; - struct passdb_template *override_fields_tmpl; - -+ /* Supported authentication mechanisms, NULL is all, {NULL} is none */ -+ const char *const *mechanisms; -+ /* Username filter, NULL is no filter */ -+ const char *const *username_filter; -+ - enum auth_passdb_skip skip; - enum auth_db_rule result_success; - enum auth_db_rule result_failure; -diff --git a/src/auth/passdb.c b/src/auth/passdb.c -index eb4ac8ae82..f5eed1af4f 100644 ---- a/src/auth/passdb.c -+++ b/src/auth/passdb.c -@@ -224,19 +224,8 @@ passdb_preinit(pool_t pool, const struct auth_passdb_settings *set) - passdb->id = ++auth_passdb_id; - passdb->iface = *iface; - passdb->args = p_strdup(pool, set->args); -- if (*set->mechanisms == '\0') { -- passdb->mechanisms = NULL; -- } else if (strcasecmp(set->mechanisms, "none") == 0) { -- passdb->mechanisms = (const char *const[]){NULL}; -- } else { -- passdb->mechanisms = (const char* const*)p_strsplit_spaces(pool, set->mechanisms, " ,"); -- } -- -- if (*set->username_filter == '\0') { -- passdb->username_filter = NULL; -- } else { -- passdb->username_filter = (const char* const*)p_strsplit_spaces(pool, set->username_filter, " ,"); -- } -+ /* NOTE: if anything else than driver & args are added here, -+ passdb_find() also needs to be updated. */ - array_push_back(&passdb_modules, &passdb); - return passdb; - } -diff --git a/src/auth/passdb.h b/src/auth/passdb.h -index 2e95328e5c..e466a9fdb6 100644 ---- a/src/auth/passdb.h -+++ b/src/auth/passdb.h -@@ -63,10 +63,6 @@ struct passdb_module { - /* Default password scheme for this module. - If default_cache_key is set, must not be NULL. */ - const char *default_pass_scheme; -- /* Supported authentication mechanisms, NULL is all, [NULL] is none*/ -- const char *const *mechanisms; -- /* Username filter, NULL is no filter */ -- const char *const *username_filter; - - /* If blocking is set to TRUE, use child processes to access - this passdb. */ --- -2.30.2 - diff --git a/package/dovecot/0002-configure-Explicitly-check-for-icu-uc.patch b/package/dovecot/0002-configure-Explicitly-check-for-icu-uc.patch deleted file mode 100644 index ea9aecebde..0000000000 --- a/package/dovecot/0002-configure-Explicitly-check-for-icu-uc.patch +++ /dev/null @@ -1,28 +0,0 @@ -From 1ccd5b54a408d12fce0c94ab0bbaedbb5ef69830 Mon Sep 17 00:00:00 2001 -From: fundawang -Date: Sun, 27 Oct 2024 22:11:21 +0800 -Subject: [PATCH] configure: Explicitly check for icu-uc - -Ensure we link against libicu-uc when it's split in v76. - -Upstream: https://github.com/dovecot/core/commit/1ccd5b54a408d12fce0c94ab0bbaedbb5ef69830 - -Signed-off-by: Bernd Kuhls -[Bernd: backported to version 2.3.21.1] ---- - m4/want_icu.m4 | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/m4/want_icu.m4 b/m4/want_icu.m4 -index b656ef9f479..405a73b361f 100644 ---- a/m4/want_icu.m4 -+++ b/m4/want_icu.m4 -@@ -1,7 +1,7 @@ - AC_DEFUN([DOVECOT_WANT_ICU], [ - if test "$want_icu" != "no"; then - if test "$PKG_CONFIG" != "" && $PKG_CONFIG --exists icu-i18n 2>/dev/null; then -- PKG_CHECK_MODULES(LIBICU, icu-i18n) -+ PKG_CHECK_MODULES(LIBICU, icu-i18n icu-uc) - have_icu=yes - AC_DEFINE(HAVE_LIBICU,, [Define if you want ICU normalization support for FTS]) - elif test "$want_icu" = "yes"; then diff --git a/package/dovecot/Config.in b/package/dovecot/Config.in index e109ce6be8..6753160c27 100644 --- a/package/dovecot/Config.in +++ b/package/dovecot/Config.in @@ -2,8 +2,10 @@ config BR2_PACKAGE_DOVECOT bool "dovecot" depends on !BR2_STATIC_LIBS depends on BR2_USE_MMU # fork() + select BR2_PACKAGE_LIBICONV if !BR2_ENABLE_LOCALE select BR2_PACKAGE_LIBOPENSSL_ENGINES if BR2_PACKAGE_LIBOPENSSL select BR2_PACKAGE_LIBXCRYPT if BR2_TOOLCHAIN_USES_GLIBC + select BR2_PACKAGE_PCRE2_32 if BR2_PACKAGE_PCRE2 select BR2_PACKAGE_OPENSSL select BR2_PACKAGE_ZLIB help @@ -32,6 +34,24 @@ comment "mysql support needs a toolchain w/ C++, threads, wchar" depends on !BR2_INSTALL_LIBSTDCPP || !BR2_TOOLCHAIN_HAS_THREADS || \ !BR2_USE_WCHAR +config BR2_PACKAGE_DOVECOT_POSTGRESQL + bool "postgresql support" + depends on !BR2_sparc # postgresql + depends on BR2_USE_WCHAR # postgresql + depends on BR2_ENABLE_LOCALE # postgresql + depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL # postgresql + depends on !BR2_OPTIMIZE_FAST # postgresql + select BR2_PACKAGE_POSTGRESQL + help + Enable PostgreSQL support. + +comment "postgresql needs a toolchain w/ wchar, NPTL, locale" + depends on !BR2_sparc + depends on !BR2_USE_WCHAR + depends on !BR2_ENABLE_LOCALE + depends on !BR2_TOOLCHAIN_HAS_THREADS_NPTL + depends on BR2_OPTIMIZE_FAST + config BR2_PACKAGE_DOVECOT_SQLITE bool "sqlite support" select BR2_PACKAGE_SQLITE diff --git a/package/dovecot/dovecot.hash b/package/dovecot/dovecot.hash index fde96f32a5..f29eccb319 100644 --- a/package/dovecot/dovecot.hash +++ b/package/dovecot/dovecot.hash @@ -1,5 +1,5 @@ # Locally computed after checking signature -sha256 2d90a178c4297611088bf7daae5492a3bc3d5ab6328c3a032eb425d2c249097e dovecot-2.3.21.1.tar.gz -sha256 319a9830aab406109cd67cb45496587566a8123203d66d037b209ca3e13de02a COPYING +sha256 868c2686a61b5f8e00a3e4721789b1ab46e6528fd773a5fbed07a6ecba7731e6 dovecot-2.4.5.tar.gz +sha256 4825bf42bebc624c4ce283bd6147daa1aa2c874a12af6f7fb7b07a2c793cc131 COPYING sha256 dc626520dcd53a22f727af3ee42c770e56c97a64fe3adb063799d8ab032fe551 COPYING.LGPL sha256 52b8c95fabb19575281874b661ef7968ea47e8f5d74ba0dd40ce512e52b3fc97 COPYING.MIT diff --git a/package/dovecot/dovecot.mk b/package/dovecot/dovecot.mk index a4c799221c..74cacc3200 100644 --- a/package/dovecot/dovecot.mk +++ b/package/dovecot/dovecot.mk @@ -4,14 +4,16 @@ # ################################################################################ -DOVECOT_VERSION_MAJOR = 2.3 -DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).21.1 +DOVECOT_VERSION_MAJOR = 2.4 +DOVECOT_VERSION = $(DOVECOT_VERSION_MAJOR).5 DOVECOT_SITE = https://dovecot.org/releases/$(DOVECOT_VERSION_MAJOR) DOVECOT_INSTALL_STAGING = YES DOVECOT_LICENSE = LGPL-2.1, MIT, Public Domain, BSD-3-Clause, Unicode-DFS-2015 DOVECOT_LICENSE_FILES = COPYING COPYING.LGPL COPYING.MIT DOVECOT_CPE_ID_VENDOR = dovecot DOVECOT_SELINUX_MODULES = dovecot + +# 0001-Revert-lib-var-expand-crypt-Link-test-binary-statica.patch DOVECOT_AUTORECONF = YES # add host-gettext for AM_ICONV macro needed for autoreconf @@ -19,30 +21,22 @@ DOVECOT_DEPENDENCIES = \ host-gettext \ host-pkgconf \ $(if $(BR2_PACKAGE_LIBICONV),libiconv) \ - openssl - -# 0001-auth-Fix-handling-passdbs-with-identical-driver-args.patch -# Note: this ignore CVE entry is reported as stale by pkg-stats, but -# the NVD database is incorrect: -# https://lore.kernel.org/buildroot/20250517181815.02ce0393@windsurf/ -DOVECOT_IGNORE_CVES += CVE-2022-30550 + openssl \ + zlib DOVECOT_CONF_ENV = \ - RPCGEN=__disable_RPCGEN_rquota \ + RPCGEN=false \ i_cv_epoll_works=yes \ - i_cv_inotify_works=yes \ + i_cv_gssapi_spnego=yes \ i_cv_posix_fallocate_works=no \ - i_cv_signed_size_t=no \ i_cv_gmtime_max_time_t=32 \ - i_cv_signed_time_t=yes \ i_cv_mmap_plays_with_write=yes \ i_cv_fd_passing=yes \ - i_cv_c99_vsnprintf=yes \ lib_cv_va_copy=yes \ lib_cv___va_copy=yes \ lib_cv_va_val_copy=yes -DOVECOT_CONF_OPTS = --without-docs --with-ssl=openssl +DOVECOT_CONF_OPTS = --without-docs ifeq ($(BR2_PACKAGE_DOVECOT_MYSQL)$(BR2_PACKAGE_DOVECOT_SQLITE),) DOVECOT_CONF_OPTS += --without-sql @@ -69,6 +63,14 @@ else DOVECOT_CONF_OPTS += --without-libcap endif +ifeq ($(BR2_PACKAGE_LIBKRB5),y) +DOVECOT_CONF_ENV += KRB5CONFIG="$(STAGING_DIR)/usr/bin/krb5-config" +DOVECOT_CONF_OPTS += --with-gssapi=yes +DOVECOT_DEPENDENCIES += libkrb5 +else +DOVECOT_CONF_OPTS += --without-gssapi +endif + ifeq ($(BR2_PACKAGE_LIBSODIUM),y) DOVECOT_CONF_OPTS += --with-sodium DOVECOT_DEPENDENCIES += libsodium @@ -87,6 +89,20 @@ else DOVECOT_CONF_OPTS += --without-pam endif +ifeq ($(BR2_PACKAGE_OPENLDAP),y) +DOVECOT_CONF_OPTS += --with-ldap=yes +DOVECOT_DEPENDENCIES += openldap +else +DOVECOT_CONF_OPTS += --without-ldap +endif + +ifeq ($(BR2_PACKAGE_PCRE2),y) +DOVECOT_CONF_OPTS += --with-pcre2 +DOVECOT_DEPENDENCIES += pcre2 +else +DOVECOT_CONF_OPTS += --without-pcre2 +endif + ifeq ($(BR2_PACKAGE_DOVECOT_MYSQL),y) DOVECOT_CONF_ENV += MYSQL_CONFIG="$(STAGING_DIR)/usr/bin/mysql_config" DOVECOT_CONF_OPTS += --with-mysql @@ -95,6 +111,13 @@ else DOVECOT_CONF_OPTS += --without-mysql endif +ifeq ($(BR2_PACKAGE_DOVECOT_POSTGRESQL),y) +DOVECOT_CONF_OPTS += --with-pgsql +DOVECOT_DEPENDENCIES += postgresql +else +DOVECOT_CONF_OPTS += --without-pgsql +endif + ifeq ($(BR2_PACKAGE_DOVECOT_SQLITE),y) DOVECOT_CONF_OPTS += --with-sqlite DOVECOT_DEPENDENCIES += sqlite @@ -109,18 +132,11 @@ else DOVECOT_CONF_OPTS += --without-lz4 endif -ifeq ($(BR2_PACKAGE_XZ),y) -DOVECOT_CONF_OPTS += --with-lzma -DOVECOT_DEPENDENCIES += xz +ifeq ($(BR2_PACKAGE_ZSTD),y) +DOVECOT_CONF_OPTS += --with-zstd +DOVECOT_DEPENDENCIES += zstd else -DOVECOT_CONF_OPTS += --without-lzma -endif - -ifeq ($(BR2_PACKAGE_ZLIB),y) -DOVECOT_CONF_OPTS += --with-zlib -DOVECOT_DEPENDENCIES += zlib -else -DOVECOT_CONF_OPTS += --without-zlib +DOVECOT_CONF_OPTS += --without-zstd endif # fix paths to avoid using /usr/lib/dovecot