Makefile: update for 2025.05.1

Signed-off-by: Arnout Vandecappelle <arnout@rnout.be>

.checkpackageignore

@@ -386,7 +386,6 @@ package/dhcp/S80dhcp-relay Shellcheck lib_sysv.Variables
 package/dhcp/S80dhcp-server Shellcheck lib_sysv.Variables
 package/dhcp/dhclient-script Shellcheck lib_shellscript.TrailingSpace
 package/dhcpcd/S41dhcpcd lib_sysv.Indent lib_sysv.Variables
-package/dht/0001-cmake.patch lib_patch.Upstream
 package/dillo/0001-usr-local-include.patch lib_patch.Upstream
 package/dillo/0002-Fix-openssl-detection.patch lib_patch.Upstream
 package/dillo/0004-fix-build-with-gcc-10.patch lib_patch.Upstream
@@ -476,8 +475,8 @@ package/fwts/0001-build-do-not-use-Werror.patch lib_patch.Upstream
 package/fxdiv/0001-CMake-don-t-enable-CXX-unless-building-tests-benchma.patch lib_patch.Upstream
 package/fxload/0001-fix-static-build.patch lib_patch.Upstream
 package/gcc/12.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
-package/gcc/13.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
-package/gcc/14.2.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
+package/gcc/13.4.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
+package/gcc/14.3.0/0001-disable-split-stack-for-non-thread-builds.patch lib_patch.Upstream
 package/gcc/8.4.0/0001-xtensa-fix-PR-target-91880.patch lib_patch.Upstream
 package/gcc/8.4.0/0002-Revert-re-PR-target-92095-internal-error-with-O1-mcp.patch lib_patch.Upstream
 package/gcc/8.4.0/0003-libsanitizer-Remove-cyclades-from-libsanitizer.patch lib_patch.Upstream
@@ -590,8 +589,6 @@ package/irrlicht/0002-makefile-override-LDFLAGS-and-remove-obsolete-X11R6-.patch
 package/iucode-tool/S00iucode-tool lib_sysv.Variables
 package/iwd/S40iwd Shellcheck lib_sysv.Variables
 package/janus-gateway/0001-disable-ssp.patch lib_patch.Upstream
-package/jose/0001-lib-hsh.c-rename-hsh-local-variable.patch lib_patch.Upstream
-package/jose/0002-man-add-option-to-skip-building-man-pages.patch lib_patch.Upstream
 package/kexec-lite/0001-clean-restart.patch lib_patch.Upstream
 package/keyutils/0001-fix-install-rule.patch lib_patch.Upstream
 package/keyutils/0002-cifs.patch lib_patch.Sob lib_patch.Upstream
@@ -681,7 +678,6 @@ package/liboping/0003-Fix-compile-break-with-GCC-7-buffer-overflow-with-snprintf
 package/liboping/0004-Fix-compile-error-on-GCC-7.patch lib_patch.Upstream
 package/liboping/0005-src-oping.c-always-use-s-style-format-for-printf-sty.patch lib_patch.Upstream
 package/libp11/0001-src-p11_attr.c-fix-build-with-gcc-4.8.patch lib_patch.Upstream
-package/libplatform/0001-cmake-require-c-11-as-the-minimum-standard.patch lib_patch.Upstream
 package/libpthsem/0001-fix-build-on-linux-3.x-host.patch lib_patch.Upstream
 package/libressl/0001-always-expose-SSL_OP_NO_TLSv1_3.patch lib_patch.Upstream
 package/libroxml/0001-src-roxml_mem.h-add-missing-extern.patch lib_patch.Upstream
@@ -722,9 +718,6 @@ package/libuhttpd/0001-add-compatibility-for-wolfssl-5-0.patch lib_patch.Upstrea
 package/libuio/0001-configure.ac-set-automake-strictness-to-foreign.patch lib_patch.Upstream
 package/liburcu/0001-Only-blacklist-ARM-gcc-4.8.0-and-4.8.1.patch lib_patch.Upstream
 package/libvpx/0001-vpx_mem-vpx_mem.h-Fix-compilation-with-uClibc.patch lib_patch.Upstream
-package/libwebsock/0001-Switch-to-use-pkg-config-to-detect-libevent-and-open.patch lib_patch.Upstream
-package/libwebsock/0002-fix-ssl.patch lib_patch.Upstream
-package/libwebsock/0003-fix-incorrect-inline.patch lib_patch.Upstream
 package/libyuv/0001-i386-sse2.patch lib_patch.Upstream
 package/lighttpd/0001-Modify-the-default-lighttpd-configuration-file-to-ha.patch lib_patch.Upstream
 package/lighttpd/S50lighttpd Shellcheck lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
@@ -817,7 +810,6 @@ package/mono/0001-Fix-linkage-with-a-system-libatomic_ops-shared-library.patch l
 package/mono/0002-Ongoing-work-on-the-cmake-build.patch lib_patch.Upstream
 package/motion/S99motion Shellcheck lib_sysv.Indent lib_sysv.Variables
 package/mpir/0001-mpn-arm-udiv.asm-workaround-binutils-bug-14887.patch lib_patch.Upstream
-package/mpv/0001-fix-powerpc64-altivec.patch lib_patch.Upstream
 package/mraa/0001-include-Declare-gVERSION-global-as-extern.patch lib_patch.Upstream
 package/mrouted/S41mrouted NotExecutable
 package/mrp/S65mrp lib_sysv.Indent lib_sysv.Variables
@@ -873,7 +865,6 @@ package/norm/0001-protolib-drop-linux-version-check.patch lib_patch.Upstream
 package/norm/0002-Use-print-as-function-call-for-Python3-compatibility.patch lib_patch.Upstream
 package/norm/0003-Fix-mixed-tabs-spaces-in-protolib-wscript.patch lib_patch.Upstream
 package/nss-pam-ldapd/S45nslcd Shellcheck lib_sysv.EmptyLastLine lib_sysv.Indent lib_sysv.Variables
-package/ntp/0001-ntp-syscalls-fallback.patch lib_patch.Upstream
 package/ntp/S49ntp.in lib_sysv.Variables
 package/ntpsec/0001-wscript-remove-checks-for-bsd-string.h-fixes-host-co.patch lib_patch.Upstream
 package/nuttcp/0001-susv3-legacy.patch lib_patch.Upstream

CHANGES

@@ -1,3 +1,114 @@
+2025.05.1, released August 11th, 2025
+
+	Important / security related fixes:
+	- samba4: support Windows security hardening
+	- apache: CVE-2025-53020, CVE-2025-49812, CVE-2025-49630, CVE-2025-23048,
+	    CVE-2024-47252, CVE-2024-43394, CVE-2024-43204, CVE-2024-42516,
+	    CVE-2025-54090
+	- assimp: CVE-2025-2750, CVE-2025-2751, CVE-2025-2757, CVE-2025-3158
+	- clamav: CVE-2025-20260
+	- edk2: CVE-2024-38805
+	- git: CVE-2025-27613, CVE-2025-27614, CVE-2025-46835, CVE-2025-48384,
+	    CVE-2025-48385, CVE-2025-48386
+	- jose: CVE-2023-50967
+	- libarchive: CVE-2025-5914, CVE-2025-5915, CVE-2025-5916, CVE-2025-5917,
+	    CVE-2025-5918
+	- libavif: CVE-2025-48174, CVE-2025-48175
+	- libblockdev: CVE-2025-6019
+	- libbpf: CVE-2025-29481
+	- libglib2: CVE-2025-6052
+	- libheif: CVE-2025-43966, CVE-2025-43967
+	- libhtp: CVE-2024-45797
+	- libopenssl: CVE-2025-4575
+	- libsoup: CVE-2024-52530, CVE-2024-52531, CVE-2024-52532, CVE-2025-2784,
+	    CVE-2025-4476, CVE-2025-4948, CVE-2025-4969, CVE-2025-32050,
+	    CVE-2025-32052, CVE-2025-32053, CVE-2025-32906, CVE-2025-32910,
+	    CVE-2025-32911, CVE-2025-32912, CVE-2025-32913, CVE-2025-32914,
+	    CVE-2025-46420, CVE-2025-46421
+	- libxml2: CVE-2025-6021, CVE-2025-49794, CVE-2025-49796, CVE-2025-49795,
+	    CVE-2025-6170
+	- mbedtls: CVE-2025-47917, CVE-2025-48965, CVE-2025-49087, CVE-2025-49600,
+	    CVE-2025-49601, CVE-2025-52496, CVE-2025-52497
+	- micropython: CVE-2024-8947
+	- modsecurity2: 2025-47947, CVE-2025-48866
+	- orc: CVE-2024-40897
+	- php: CVE-2025-1735, CVE-2025-6491, CVE-2025-1220
+	- podman: CVE-2025-6032
+	- python-aiohttp: CVE-2025-53643
+	- python-django: CVE-2025-48432
+	- python-requests: CVE-2024-47081
+	- python-starlette: CVE-2025-54121
+	- python-urllib3: CVE-2025-50181, CVE-2025-50182
+	- python3: 2024-12718, CVE 2025-4138, CVE 2025-4330, CVE 2025-4435,
+	    2025-4517
+	- redis: CVE-2025-32023, CVE-2025-48367
+	- rust-bindgen: CVE-2024-43806, RUSTSEC-2024-0006
+	- samba4: CVE-2025-0620
+	- shim: CVE-2024-2312
+	- sngrep: CVE-2024-3119, CVE-2024-3120
+	- sudo: CVE-2025-32462, CVE-2025-32463
+	- tcpreplay: CVE-2023-4256, CVE-2023-43279, CVE-2024-22654
+	- tinyxml: CVE-2023-34194
+	- wpewebkit: CVE-2024-27856, CVE-2024-40866, CVE-2024-44185,
+	    CVE-2024-44187, CVE-2024-44192, CVE-2024-44244, CVE-2024-44296,
+	    CVE-2024-44308, CVE-2024-44309, CVE-2024-54467, CVE-2024-54479,
+	    CVE-2024-54502, CVE-2024-54505, CVE-2024-54508, CVE-2024-54534,
+	    CVE-2024-54543, CVE-2024-54551, CVE-2024-54658, CVE-2025-24143,
+	    CVE-2025-24150, CVE-2025-24158, CVE-2025-24162, CVE-2025-24201,
+	    CVE-2025-24208, CVE-2025-24209, CVE-2025-24213, CVE-2025-24216,
+	    CVE-2025-24223, CVE-2025-24264, CVE-2025-30427, CVE-2025-31204,
+	    CVE-2025-31205, CVE-2025-31206, CVE-2025-31215, CVE-2025-31257
+	- xorg-server / xwayland: CVE-2025-49175, CVE-2025-49176, CVE-2025-49177,
+	    CVE-2025-49178, CVE-2025-49179, CVE-2025-49180
+
+	Updated / fixed packages: amazon-ecr-credential-helper, at91bootstrap3,
+	avrdude, bcg729, berkeleydb, binutils, bmx7, boot/syslinux, ca-certificates,
+	chartjs, cifs-utils, cpp-httplib, cpulimit, daq, dht,
+	docker-credential-acr-env, docker-credential-gcr, elfutils, eudev, fwupd,
+	gcc, gnuplot, gstreamer1-editing-services, gumbo-parser, gvfs, hddtemp,
+	kvmtool, libargtable2, libcddb, libconfuse, libcrossguid, libcurl, libdex,
+	libesmtp, libgcrypt, libiec61850, libmanette, libmicrohttpd, libmpeg2,
+	libndp, libp11, libplatform, libspdm, libssh2, libuhttpd, libva, linux,
+	linux-tools (rtla), lpac, lrzsz, ltp-testsuite, lua, mjpg-streamer,
+	modem-manager, modsecurity2, mosquitto, mpv, mupdf, ncmpc, ncurses,
+	net-tools, network-manager, nginx-modsecurity, ntp, oniguruma, openblas,
+	parted, passt, php, python-asgiref, python-cython, python-dbus-fast,
+	python-dotenv, python-fastapi, python-future, python-glslang,
+	python-msgpack, python-multipart, python-remi, python-setuptools,
+	python-typing-extensions, qpid-proton, rapidjson, rauc-hawkbit-updater,
+	rtl8188eu, rtl8723bu, rtl8723ds, rtl8821au, rust, sdl2, shadowsocks-libev,
+	shairport-sync, sox, sqlite, squashfs, sudo, systemd, systemd, tailscale,
+	tor, uclibc, ustream-ssl, watchdog, webkitgtk, wpebackend-fdo, xen
+
+	Removed package: libebur128, libolm, libwebsock
+
+	Infrastructure updates / fixes:
+	- python-glslang is now a host package only
+	- Makefile unexports are now fixed and sorted
+	- hide gcc version for unsupported CPUs
+	- check-package: handle missing files
+	- test-pkg: stop on sigint
+	- toolchain/toolchain-wrapper.c:
+	    - correct CCACHE_BASEDIR comment
+	    - slightly simplify cmdline copying
+	    - get rid of EXCLUSIVE_ARGS
+	- erofs: reword "all-fragments" Kconfig text
+	- utils/update-rust: fix MIT hash
+
+	Test improvements:
+	- add new test for nginx-modsecurity
+	- new runtime test for gumbo-parser
+	- add a crun-based runtime test for docker-compose
+	- test_xen: add a base class
+	- test_xen: test on 32-bit Arm v7
+	- test_xen: rename TestXen to TestXenAarch64
+
+	Boards updated / fixed:
+	- globalscale_espressobin: update linux
+	- freescale/mxs: fix Linux booting
+	- ti_am62x_sk: bump Linux version
+	- beaglebone: bump Linux to 6.12.23-ti-arm32-r11
+
 2025.05, released June 9th, 2025
 
 	Various fixes.

Config.in.legacy

@@ -144,8 +144,36 @@ endif
 
 ###############################################################################
 
+comment "Legacy options removed in 2025.05.1"
+
+config BR2_PACKAGE_LIBCURL_BEARSSL
+	bool "libcurl removed BearSSL support"
+	select BR2_LEGACY
+	help
+	  Libcurl removed optional BearSSL support.
+
+config BR2_PACKAGE_LIBOLM
+	bool "libolm has been removed"
+	select BR2_LEGACY
+	help
+	  libolm is deprecated and has been removed from Buildroot.
+	  https://gitlab.matrix.org/matrix-org/olm#important-libolm-is-now-deprecated
+
+config BR2_PACKAGE_LIBWEBSOCK
+	bool "libwebsock has been removed"
+	select BR2_LEGACY
+	help
+	  The upstream Github repository payden/libwebsock is no
+	  longer available, and has been removed from Buildroot.
+
 comment "Legacy options removed in 2025.05"
 
+config BR2_PACKAGE_LIBEBUR128
+	bool "libebur128 has been removed"
+	select BR2_LEGACY
+	help
+	  The libebur128 package has been removed from Buildroot.
+
 config BR2_PACKAGE_MESA3D_GALLIUM_DRIVER_SWRAST
 	bool "mesa Gallium swrast driver was replaced by softpipe"
 	select BR2_LEGACY

DEVELOPERS

@@ -412,7 +412,6 @@ F:	package/libdvbcsa/
 F:	package/libdvdcss/
 F:	package/libdvdnav/
 F:	package/libdvdread/
-F:	package/libebur128/
 F:	package/libfreeglut/
 F:	package/libfribidi/
 F:	package/libg7221/
@@ -1265,7 +1264,6 @@ F:	package/httping/
 F:	package/iozone/
 F:	package/leptonica/
 F:	package/libeXosip2/
-F:	package/libolm/
 F:	package/libosip2/
 F:	package/ocrad/
 F:	package/opencl-clhpp/
@@ -1301,6 +1299,7 @@ F:	package/gcc/
 F:	package/harfbuzz/
 F:	package/libblockdev/
 F:	package/libfuse3/
+F:	package/liblo/
 F:	package/libnspr/
 F:	package/libnss/
 F:	package/libnvme/
@@ -1343,7 +1342,6 @@ F:	package/gengetopt/
 F:	package/janus-gateway/
 F:	package/libnice/
 F:	package/libsrtp/
-F:	package/libwebsock/
 F:	package/sofia-sip/
 
 N:	Grzegorz Blach <grzegorz@blach.pl>
@@ -2844,6 +2842,8 @@ F:	support/testing/tests/package/sample_python_s3transfer.py
 F:	support/testing/tests/package/sample_python_sdbus.py
 F:	support/testing/tests/package/sample_python_sdbus_networkmanager.py
 F:	support/testing/tests/package/sample_python_urllib3.py
+F:	support/testing/tests/package/test_nginx_modsecurity/
+F:	support/testing/tests/package/test_nginx_modsecurity.py
 F:	support/testing/tests/package/test_python_jmespath.py
 F:	support/testing/tests/package/test_python_pymupdf.py
 F:	support/testing/tests/package/test_python_rsa.py
@@ -3509,6 +3509,7 @@ F:	package/libsocketcan/
 F:	package/libubox/
 F:	package/libuci/
 F:	package/libxmlb/
+F:	package/libxmlrpc/
 F:	package/linux-firmware/
 F:	package/linux-serial-test/
 F:	package/lpac/

Makefile

@@ -92,9 +92,9 @@ all:
 .PHONY: all
 
 # Set and export the version string
-export BR2_VERSION := 2025.05
+export BR2_VERSION := 2025.05.1
 # Actual time the release is cut (for reproducible builds)
-BR2_VERSION_EPOCH = 1749500000
+BR2_VERSION_EPOCH = 1754924200
 
 # Save running make version since it's clobbered by the make package
 RUNNING_MAKE_VERSION := $(MAKE_VERSION)
@@ -407,27 +407,28 @@ ifeq ($(BR2_HAVE_DOT_CONFIG),y)
 # Hide troublesome environment variables from sub processes
 #
 ################################################################################
-unexport CROSS_COMPILE
+unexport AR
 unexport ARCH
 unexport CC
-unexport LD
-unexport AR
-unexport CXX
-unexport CPP
-unexport RANLIB
 unexport CFLAGS
-unexport CXXFLAGS
-unexport GREP_OPTIONS
-unexport TAR_OPTIONS
 unexport CONFIG_SITE
-unexport QMAKESPEC
-unexport TERMINFO
+unexport CPP
+unexport CROSS_COMPILE
+unexport CXX
+unexport CXXFLAGS
+unexport DEVICE_TREE
+unexport GCC_COLORS
+unexport GREP_OPTIONS
+unexport LD
 unexport MACHINE
 unexport O
-unexport GCC_COLORS
-unexport PLATFORM
 unexport OS
-unexport DEVICE_TREE
+unexport PLATFORM
+unexport QMAKESPEC
+unexport RANLIB
+unexport TAR_OPTIONS
+unexport TERMINFO
+unexport TOPDIR
 
 GNU_HOST_NAME := $(shell support/gnuconfig/config.guess)
 

board/beagleboard/beaglebone/patches/linux/linux.hash

@@ -1,2 +1,2 @@
 # Locally calculated
-sha256  203743e32c9fba3bb9f965c1b3799977961a9d25071d6d482d96d74adfdbaadb  linux-6.12.17-ti-arm32-r9.tar.gz
+sha256  3654ca31003d90d20b195b23f8d60b78fcffbf0fd7fed6116c22719e20ac933d  linux-6.12.23-ti-arm32-r11.tar.gz

board/freescale/common/mxs/post-image.sh

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -e
+
 #
 # dtb_list extracts the list of DTB files from BR2_LINUX_KERNEL_INTREE_DTS_NAME
 # in ${BR_CONFIG}, then prints the corresponding list of file names for the
@@ -7,10 +9,12 @@
 #
 dtb_list()
 {
-	local DTB_LIST="$(sed -n 's/^BR2_LINUX_KERNEL_INTREE_DTS_NAME="\([a-z0-9 \-]*\)"$/\1/p' ${BR2_CONFIG})"
+	local DTB_LIST
+
+	DTB_LIST="$(sed -n 's/^BR2_LINUX_KERNEL_INTREE_DTS_NAME="\([\/a-z0-9 \-]*\)"$/\1/p' "${BR2_CONFIG}")"
 
 	for dt in $DTB_LIST; do
-		echo -n "\"$dt.dtb\", "
+		echo -n "\"$(basename "${dt}").dtb\", "
 	done
 }
 

board/ti/am62x-sk/patches/linux/linux.hash

@@ -1,2 +1,2 @@
 # Locally calculated
-sha256  643142c1b5991560dd12f950825cc19e4497b95b82641918ecff1177f4130c1d  linux-6.12.24.tar.xz
+sha256  4a168aed2de5a81aadd90ba2b153860a98d99bfc34651936e17f18e54f01ba8c  linux-6.12.36.tar.xz

boot/at91bootstrap3/v3.10.3/0001-include-types.h-conditionally-define-bool-false-and-.patch

@@ -0,0 +1,47 @@
+From 908c65678867565a934ea5a967bfe7e204d1ccaf Mon Sep 17 00:00:00 2001
+From: Edgar Bonet <bonet@grenoble.cnrs.fr>
+Date: Wed, 25 Jun 2025 11:13:43 +0200
+Subject: [PATCH] include/types.h: conditionally define bool, false and true
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+include/types.h typedefs ‘bool’ and macro-defines ‘false’ and ‘true’.
+However, since C23, these are predefine keywords. As C23 is the default
+C dialect for GCC 15, building with this compiler fails with:
+
+    include/types.h:23:23: error: ‘bool’ cannot be defined via ‘typedef’
+       23 | typedef unsigned char bool;
+          |                       ^~~~
+    include/types.h:23:23: note: ‘bool’ is a keyword with ‘-std=c23’ onwards
+
+Fix this build failure by only defining ‘bool’, ‘false’ and ‘true’ on C
+dialects older than C23.
+
+Upstream: https://github.com/linux4sam/at91bootstrap/pull/188
+[Edgar: backport to v3.10.3]
+
+Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
+---
+ include/types.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/types.h b/include/types.h
+index 1246a4df..2c1a41cf 100644
+--- a/include/types.h
++++ b/include/types.h
+@@ -42,8 +42,11 @@ typedef signed long long s64;
+ typedef unsigned long size_t;
+ typedef signed long ssize_t;
+ 
++/* bool, false and true are predefined since C23. */
++#if __STDC_VERSION__ < 202311L
+ typedef unsigned char bool;
+ #define false	0U
+ #define true	1U
++#endif
+ 
+ #endif /* TYPES_H_ */
+-- 
+2.43.0
+

boot/at91bootstrap3/v4.0.0/0001-include-types.h-conditionally-define-bool-false-and-.patch

@@ -0,0 +1,46 @@
+From 4aab60e634d588dffbd3154fd0cfce78272b750a Mon Sep 17 00:00:00 2001
+From: Edgar Bonet <bonet@grenoble.cnrs.fr>
+Date: Wed, 25 Jun 2025 11:13:43 +0200
+Subject: [PATCH] include/types.h: conditionally define bool, false and true
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+include/types.h typedefs ‘bool’ and macro-defines ‘false’ and ‘true’.
+However, since C23, these are predefine keywords. As C23 is the default
+C dialect for GCC 15, building with this compiler fails with:
+
+    include/types.h:23:23: error: ‘bool’ cannot be defined via ‘typedef’
+       23 | typedef unsigned char bool;
+          |                       ^~~~
+    include/types.h:23:23: note: ‘bool’ is a keyword with ‘-std=c23’ onwards
+
+Fix this build failure by only defining ‘bool’, ‘false’ and ‘true’ on C
+dialects older than C23.
+
+Upstream: https://github.com/linux4sam/at91bootstrap/pull/188
+
+Signed-off-by: Edgar Bonet <bonet@grenoble.cnrs.fr>
+---
+ include/types.h | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/include/types.h b/include/types.h
+index 950b1a46..0ad9ae61 100644
+--- a/include/types.h
++++ b/include/types.h
+@@ -20,8 +20,11 @@ typedef signed long long s64;
+ typedef unsigned long size_t;
+ typedef signed long ssize_t;
+ 
++/* bool, false and true are predefined since C23. */
++#if __STDC_VERSION__ < 202311L
+ typedef unsigned char bool;
+ #define false	0U
+ #define true	1U
++#endif
+ 
+ #endif /* TYPES_H_ */
+-- 
+2.43.0
+

boot/edk2/0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch

@@ -0,0 +1,75 @@
+From 0a3b2a29b96b11fb858974044359c806c6b0a111 Mon Sep 17 00:00:00 2001
+From: Santhosh Kumar V <santhoshkumarv@ami.com>
+Date: Wed, 7 May 2025 18:53:30 +0530
+Subject: [PATCH] NetworkPkg/IScsiDxe:Fix for out of bound memory access for
+ bz4207 (CVE-2024-38805)
+
+In IScsiBuildKeyValueList, check if we have any data left (Len > 0) before advancing the Data pointer and reducing Len.
+Avoids wrapping Len. Also Used SafeUint32SubSafeUint32Sub call to reduce the Len .
+
+Upstream: https://github.com/tianocore/edk2/commit/b3a2f7ff24e156e8c4d694fffff01e95a048c536
+Signed-off-by: santhosh kumar V <santhoshkumarv@ami.com>
+Signed-off-by: Julien Olivain <ju.o@free.fr>
+---
+ NetworkPkg/IScsiDxe/IScsiProto.c | 29 ++++++++++++++++++++++++-----
+ 1 file changed, 24 insertions(+), 5 deletions(-)
+
+diff --git a/NetworkPkg/IScsiDxe/IScsiProto.c b/NetworkPkg/IScsiDxe/IScsiProto.c
+index ef587649a0..53a0ff801d 100644
+--- a/NetworkPkg/IScsiDxe/IScsiProto.c
++++ b/NetworkPkg/IScsiDxe/IScsiProto.c
+@@ -1880,6 +1880,8 @@ IScsiBuildKeyValueList (
+ {
+   LIST_ENTRY            *ListHead;
+   ISCSI_KEY_VALUE_PAIR  *KeyValuePair;
++  EFI_STATUS            Status;
++  UINT32                Result;
+ 
+   ListHead = AllocatePool (sizeof (LIST_ENTRY));
+   if (ListHead == NULL) {
+@@ -1903,9 +1905,14 @@ IScsiBuildKeyValueList (
+       Data++;
+     }
+ 
+-    if (*Data == '=') {
++    // Here Len must not be zero.
++    // The value of Len is size of data buffer. Actually, Data is make up of strings.
++    // AuthMethod=None\0TargetAlias=LIO Target\0 TargetPortalGroupTag=1\0
++    // (1) Len == 0, *Data != '=' goto ON_ERROR
++    // (2) *Data == '=', Len != 0 normal case.
++    // (3) *Data == '=', Len == 0, Between Data and Len are mismatch, Len isn't all size of data, as error.
++    if ((Len > 0) && (*Data == '=')) {
+       *Data = '\0';
+-
+       Data++;
+       Len--;
+     } else {
+@@ -1915,10 +1922,22 @@ IScsiBuildKeyValueList (
+ 
+     KeyValuePair->Value = Data;
+ 
+-    InsertTailList (ListHead, &KeyValuePair->List);
++    Status = SafeUint32Add ((UINT32)AsciiStrLen (KeyValuePair->Value), 1, &Result);
++    if (EFI_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a Memory Overflow is Detected.\n", __func__));
++      FreePool (KeyValuePair);
++      goto ON_ERROR;
++    }
+ 
+-    Data += AsciiStrLen (KeyValuePair->Value) + 1;
+-    Len  -= (UINT32)AsciiStrLen (KeyValuePair->Value) + 1;
++    Status = SafeUint32Sub (Len, Result, &Len);
++    if (EFI_ERROR (Status)) {
++      DEBUG ((DEBUG_ERROR, "%a Out of bound memory access Detected.\n", __func__));
++      FreePool (KeyValuePair);
++      goto ON_ERROR;
++    }
++
++    InsertTailList (ListHead, &KeyValuePair->List);
++    Data += Result;
+   }
+ 
+   return ListHead;
+-- 
+2.49.0
+

boot/edk2/edk2.mk

@@ -14,6 +14,9 @@ EDK2_DEPENDENCIES = edk2-platforms host-python3 host-acpica host-util-linux
 EDK2_INSTALL_TARGET = NO
 EDK2_INSTALL_IMAGES = YES
 
+# 0001-NetworkPkg-IScsiDxe-Fix-for-out-of-bound-memory-acce.patch
+EDK2_IGNORE_CVES += CVE-2024-38805
+
 ifeq ($(BR2_ENABLE_DEBUG),y)
 EDK2_BUILD_TYPE = DEBUG
 ifeq ($(BR2_TARGET_EDK2_OVMF_DEBUG_ON_SERIAL),y)

boot/shim/shim.hash

@@ -1,3 +1,3 @@
 # locally computed hash
-sha256  a79f0a9b89f3681ab384865b1a46ab3f79d88b11b4ca59aa040ab03fffae80a9  shim-15.8.tar.bz2
+sha256  d503f778dc75895d3130da07e2ff23d2393862f95b6cd3d24b10cbd4af847217  shim-16.0.tar.bz2
 sha256  15edf527919ddcb2f514ab9d16ad07ef219e4bb490e0b79560be510f0c159cc2  COPYRIGHT

boot/shim/shim.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-SHIM_VERSION = 15.8
+SHIM_VERSION = 16.0
 SHIM_SITE = https://github.com/rhboot/shim/releases/download/$(SHIM_VERSION)
 SHIM_SOURCE = shim-$(SHIM_VERSION).tar.bz2
 SHIM_LICENSE = BSD-2-Clause

boot/syslinux/syslinux.mk

@@ -56,6 +56,11 @@ SYSLINUX_POST_PATCH_HOOKS += SYSLINUX_CLEANUP
 # syslinux build system has no convenient way to pass CFLAGS,
 # and the internal zlib should take precedence so -I shouldn't
 # be used.
+# Install in a temporary location that eases final install into
+# images/ (see corresponding command, below).
+# Repeat the target, otherwise syslinux will try to build everything
+# Repeat LD (and CC) as it happens that some binaries are linked at
+# install-time.
 define SYSLINUX_BUILD_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE1) \
 		ASCIIDOC_OK=-1 \
@@ -70,6 +75,10 @@ define SYSLINUX_BUILD_CMDS
 		LDFLAGS_FOR_BUILD="$(HOST_LDFLAGS)" \
 		PYTHON=$(HOST_DIR)/bin/python3 \
 		$(SYSLINUX_EFI_ARGS) -C $(@D) $(SYSLINUX_TARGET)
+	$(TARGET_MAKE_ENV) $(MAKE1) $(SYSLINUX_EFI_ARGS) INSTALLROOT=$(@D)/br-root.temp \
+		CC="$(TARGET_CC)" \
+		LD="$(TARGET_LD)" \
+		-C $(@D) $(SYSLINUX_TARGET) install
 endef
 
 # While the actual bootloader is compiled for the target, several
@@ -77,6 +86,8 @@ endef
 # Repeat the target, otherwise syslinux will try to build everything
 # Repeat LD (and CC) as it happens that some binaries are linked at
 # install-time.
+# Don't use the temporarily-installed br-root.temp: HOST_DIR may be setup
+# differently (merged usr, merged bin...)
 define SYSLINUX_INSTALL_TARGET_CMDS
 	$(TARGET_MAKE_ENV) $(MAKE1) $(SYSLINUX_EFI_ARGS) INSTALLROOT=$(HOST_DIR) \
 		CC="$(TARGET_CC)" \
@@ -99,15 +110,15 @@ SYSLINUX_IMAGES-$(BR2_TARGET_SYSLINUX_EFI) += $(SYSLINUX_EFI_BITS)/efi/syslinux.
 
 SYSLINUX_C32 = $(call qstrip,$(BR2_TARGET_SYSLINUX_C32))
 
-# We install the c32 modules from the host-installed tree, where they
-# are all neatly installed in a single location, while they are
+# We install the c32 modules from the temporarily installed tree, where
+# they are all neatly installed in a single location, while they are
 # scattered around everywhere in the build tree.
 define SYSLINUX_INSTALL_IMAGES_CMDS
 	for i in $(SYSLINUX_IMAGES-y); do \
 		$(INSTALL) -D -m 0755 $(@D)/$$i $(BINARIES_DIR)/syslinux/$${i##*/}; \
 	done
 	for i in $(SYSLINUX_C32); do \
-		$(INSTALL) -D -m 0755 $(HOST_DIR)/share/syslinux/$${i} \
+		$(INSTALL) -D -m 0755 $(@D)/br-root.temp/usr/share/syslinux/$${i} \
 			$(BINARIES_DIR)/syslinux/$${i}; \
 	done
 endef

configs/beaglebone_defconfig

@@ -10,7 +10,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c board/beagleboard/beaglebone/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_TARBALL=y
-BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="$(call github,beagleboard,linux,6.12.17-ti-arm32-r9)/linux-6.12.17-ti-arm32-r9.tar.gz"
+BR2_LINUX_KERNEL_CUSTOM_TARBALL_LOCATION="$(call github,beagleboard,linux,6.12.23-ti-arm32-r11)/linux-6.12.23-ti-arm32-r11.tar.gz"
 BR2_LINUX_KERNEL_DEFCONFIG="bb.org"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="ti/omap/am335x-evm ti/omap/am335x-bone ti/omap/am335x-boneblack ti/omap/am335x-bonegreen ti/omap/am335x-evmsk ti/omap/am335x-boneblue ti/omap/am335x-boneblack-wireless ti/omap/am335x-bonegreen-wireless"

configs/globalscale_espressobin_defconfig

@@ -6,7 +6,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c board/globalscale/espressobin/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.15.1"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="5.15.186"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
 BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="board/globalscale/espressobin/linux-extras.config"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y

configs/ti_am62x_sk_defconfig

@@ -8,7 +8,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT_ARGS="-c ttyS2,115200n8 -d k3-am625-sk.dtb -l am62x
 BR2_ROOTFS_POST_IMAGE_SCRIPT_ARGS="-c board/ti/am62x-sk/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.24"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.36"
 BR2_LINUX_KERNEL_USE_ARCH_DEFAULT_CONFIG=y
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="ti/k3-am625-sk"

fs/erofs/Config.in

@@ -109,7 +109,7 @@ config BR2_TARGET_ROOTFS_EROFS_FRAGMENTS
 	  Introduced in Linux 6.1.
 
 config BR2_TARGET_ROOTFS_EROFS_ALL_FRAGMENTS
-	bool "enable fragments packing"
+	bool "enable all-fragments packing"
 	help
 	  Forcely record the whole files into a special inode for better
 	  compression. Introduced in Linux 6.1.

linux/Config.in

@@ -137,7 +137,7 @@ config BR2_LINUX_KERNEL_CUSTOM_REPO_GIT_SUBMODULES
 
 config BR2_LINUX_KERNEL_VERSION
 	string
-	default "6.14.10" if BR2_LINUX_KERNEL_LATEST_VERSION
+	default "6.14.11" if BR2_LINUX_KERNEL_LATEST_VERSION
 	default "5.10.162-cip24" if BR2_LINUX_KERNEL_LATEST_CIP_VERSION
 	default "5.10.162-cip24-rt10" if BR2_LINUX_KERNEL_LATEST_CIP_RT_VERSION
 	default BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE \

linux/linux.hash

@@ -1,12 +1,12 @@
 # From https://www.kernel.org/pub/linux/kernel/v6.x/sha256sums.asc
-sha256  de8b97cfeae74c22f832ee4ca2333c157cc978d98baa122f0ee9c01796a2fe43  linux-6.14.10.tar.xz
-sha256  a9b020721778384507010177d3929e7d4058f7f6120f05a99d56b5c5c0346a70  linux-6.12.32.tar.xz
-sha256  0d79ff359635e9f009f1e330deed5f3aefd8c452b80660bffdc504b877797719  linux-6.6.93.tar.xz
-sha256  bc3c45faf6f5f0450666c75fa9dad9bc7c0cf7c7cba0dbd94e5cfdc58229c116  linux-6.1.141.tar.xz
+sha256  3f1ccd0a6dc9c9777cb6fcef357c77e4a2386c84c52b6d5bbcda79c16af33b1b  linux-6.14.11.tar.xz
+sha256  6b19a3ae99423de2416964d67251d745910277af258b4c4c63e88fd87dbf0e27  linux-6.12.41.tar.xz
+sha256  8c4ff2869736538b9b0d88ea8dbf0332b79c6ecc40a32066768a754df1fae1c0  linux-6.6.101.tar.xz
+sha256  218f25663a41e3d811e84fa1c4acec50684898b2f6d0c8c0deb531d937e466f7  linux-6.1.147.tar.xz
 # From https://www.kernel.org/pub/linux/kernel/v5.x/sha256sums.asc
-sha256  3d03eb798910f32929f7fda5a56e4bb1a121f10bde320d6f3063639c009313dc  linux-5.15.185.tar.xz
-sha256  07c852940dc2dc03fe84f7fcf697648d7cba11c62d20504380492ba07aa46bb6  linux-5.10.238.tar.xz
-sha256  c879d0ba817aaa0fde318d58d7e1f141d9c29bd8569a96b73159ebc448077b99  linux-5.4.294.tar.xz
+sha256  e3d0025b87278e14733cb326700f17c7cceb54d920622b0d5fcd58a88c6850c3  linux-5.15.189.tar.xz
+sha256  8d88c3977226d666554b75f480d1e6c5f4e4d2acdf2a3462840c6bac88634d13  linux-5.10.240.tar.xz
+sha256  3d63614e58bf1befaba3f5713145200d09f26e564832c8948094fdf5b11fa73a  linux-5.4.296.tar.xz
 # Locally computed
 sha256  fb0edc3c18e47d2b6974cb0880a0afb5c3fa08f50ee87dfdf24349405ea5f8ae  linux-cip-5.10.162-cip24.tar.gz
 sha256  b5539243f187e3d478d76d44ae13aab83952c94b885ad889df6fa9997e16a441  linux-cip-5.10.162-cip24-rt10.tar.gz

package/Config.in

@@ -1553,7 +1553,6 @@ menu "Audio/Sound"
 	source "package/libcodec2/Config.in"
 	source "package/libcue/Config.in"
 	source "package/libcuefile/Config.in"
-	source "package/libebur128/Config.in"
 	source "package/libg7221/Config.in"
 	source "package/libgsm/Config.in"
 	source "package/libid3tag/Config.in"
@@ -1629,7 +1628,6 @@ menu "Crypto"
 	source "package/libmd/Config.in"
 	source "package/libmhash/Config.in"
 	source "package/libnss/Config.in"
-	source "package/libolm/Config.in"
 	source "package/libp11/Config.in"
 	source "package/libscrypt/Config.in"
 	source "package/libsecret/Config.in"
@@ -2114,7 +2112,6 @@ menu "Networking"
 	source "package/libutp/Config.in"
 	source "package/libuwsc/Config.in"
 	source "package/libvncserver/Config.in"
-	source "package/libwebsock/Config.in"
 	source "package/libwebsockets/Config.in"
 	source "package/libyang/Config.in"
 	source "package/libzenoh-c/Config.in"

package/amazon-ecr-credential-helper/amazon-ecr-credential-helper.hash

@@ -1,2 +1,3 @@
 # Localy computed
 sha256  53765b3e441a0e785131731d0cee4c0e2b2a22b90e523e9e4ec3e461c0ec5b05  amazon-ecr-credential-helper-v0.9.1-git4-go2.tar.gz
+sha256  ce65129252f145d6dd627bc354ccc28ba07c6cd27a8d278b7dcfde3ed6976a5a  LICENSE

package/apache/apache.hash

@@ -1,5 +1,5 @@
-# From https://downloads.apache.org/httpd/httpd-2.4.63.tar.bz2.{sha256,sha512}
-sha256  88fc236ab99b2864b248de7d49a008ec2afd7551e64dce8b95f58f32f94c46ab  httpd-2.4.63.tar.bz2
-sha512  a804ca564dfee5907fe4ce4f36884815bace0621bc7b8c9aa7c99472a954aa19cb13733f90678ff3d58ab3c76cc0e33a27e1035dc1d8cb597a9622154c59ef48  httpd-2.4.63.tar.bz2
+# From https://downloads.apache.org/httpd/httpd-2.4.65.tar.bz2.{sha256,sha512}
+sha256  58b8be97d9940ec17f7656c0c6b9f41b618aac468b894b534148e3296c53b8b3  httpd-2.4.65.tar.bz2
+sha512  202f8bfe2aafcfbcd7315191d466e9c10b9a8c0abafb7864510b6e1abe4cb660aaacc2456aa77d43e48ef7a49e591d0b54170d3daf67abc3e06c3da1c63fdffc  httpd-2.4.65.tar.bz2
 # Locally computed
 sha256  47b8c2b6c3309282a99d4a3001575c790fead690cc14734628c4667d2bbffc43  LICENSE

package/apache/apache.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-APACHE_VERSION = 2.4.63
+APACHE_VERSION = 2.4.65
 APACHE_SOURCE = httpd-$(APACHE_VERSION).tar.bz2
 APACHE_SITE = https://dlcdn.apache.org/httpd
 APACHE_LICENSE = Apache-2.0

package/assimp/0001-Fix-leak-5762.patch

@@ -1,139 +0,0 @@
-From 4024726eca89331503bdab33d0b9186e901bbc45 Mon Sep 17 00:00:00 2001
-From: Kim Kulling <kimkulling@users.noreply.github.com>
-Date: Sat, 7 Sep 2024 21:02:34 +0200
-Subject: [PATCH] Fix leak (#5762)
-
-* Fix leak
-
-* Update utLogger.cpp
-
-Upstream: https://github.com/assimp/assimp/commit/4024726eca89331503bdab33d0b9186e901bbc45
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
----
- code/Common/Assimp.cpp        | 13 ++++++---
- fuzz/assimp_fuzzer.cc         |  2 +-
- test/CMakeLists.txt           |  1 +
- test/unit/Common/utLogger.cpp | 52 +++++++++++++++++++++++++++++++++++
- 4 files changed, 63 insertions(+), 5 deletions(-)
- create mode 100644 test/unit/Common/utLogger.cpp
-
-diff --git a/code/Common/Assimp.cpp b/code/Common/Assimp.cpp
-index ef3ee7b5d..91896e405 100644
---- a/code/Common/Assimp.cpp
-+++ b/code/Common/Assimp.cpp
-@@ -359,20 +359,25 @@ void CallbackToLogRedirector(const char *msg, char *dt) {
-     s->write(msg);
- }
- 
-+static LogStream *DefaultStream = nullptr;
-+
- // ------------------------------------------------------------------------------------------------
- ASSIMP_API aiLogStream aiGetPredefinedLogStream(aiDefaultLogStream pStream, const char *file) {
-     aiLogStream sout;
- 
-     ASSIMP_BEGIN_EXCEPTION_REGION();
--    LogStream *stream = LogStream::createDefaultStream(pStream, file);
--    if (!stream) {
-+    if (DefaultStream == nullptr) {
-+        DefaultStream = LogStream::createDefaultStream(pStream, file);
-+    }
-+    
-+    if (!DefaultStream) {
-         sout.callback = nullptr;
-         sout.user = nullptr;
-     } else {
-         sout.callback = &CallbackToLogRedirector;
--        sout.user = (char *)stream;
-+        sout.user = (char *)DefaultStream;
-     }
--    gPredefinedStreams.push_back(stream);
-+    gPredefinedStreams.push_back(DefaultStream);
-     ASSIMP_END_EXCEPTION_REGION(aiLogStream);
-     return sout;
- }
-diff --git a/fuzz/assimp_fuzzer.cc b/fuzz/assimp_fuzzer.cc
-index 8178674e8..91ffd9d69 100644
---- a/fuzz/assimp_fuzzer.cc
-+++ b/fuzz/assimp_fuzzer.cc
-@@ -47,7 +47,7 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- using namespace Assimp;
- 
- extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t dataSize) {
--    aiLogStream stream = aiGetPredefinedLogStream(aiDefaultLogStream_STDOUT,NULL);
-+    aiLogStream stream = aiGetPredefinedLogStream(aiDefaultLogStream_STDOUT, nullptr);
-     aiAttachLogStream(&stream);
- 
-     Importer importer;
-diff --git a/test/CMakeLists.txt b/test/CMakeLists.txt
-index 7b7fd850a..1a45adac7 100644
---- a/test/CMakeLists.txt
-+++ b/test/CMakeLists.txt
-@@ -100,6 +100,7 @@ SET( COMMON
-   unit/Common/utBase64.cpp
-   unit/Common/utHash.cpp
-   unit/Common/utBaseProcess.cpp
-+  unit/Common/utLogger.cpp
- )
- 
- SET(Geometry 
-diff --git a/test/unit/Common/utLogger.cpp b/test/unit/Common/utLogger.cpp
-new file mode 100644
-index 000000000..932240a7f
---- /dev/null
-+++ b/test/unit/Common/utLogger.cpp
-@@ -0,0 +1,52 @@
-+/*
-+---------------------------------------------------------------------------
-+Open Asset Import Library (assimp)
-+---------------------------------------------------------------------------
-+
-+Copyright (c) 2006-2024, assimp team
-+
-+All rights reserved.
-+
-+Redistribution and use of this software in source and binary forms,
-+with or without modification, are permitted provided that the following
-+conditions are met:
-+
-+* Redistributions of source code must retain the above
-+copyright notice, this list of conditions and the
-+following disclaimer.
-+
-+* Redistributions in binary form must reproduce the above
-+copyright notice, this list of conditions and the
-+following disclaimer in the documentation and/or other
-+materials provided with the distribution.
-+
-+* Neither the name of the assimp team, nor the names of its
-+contributors may be used to endorse or promote products
-+derived from this software without specific prior
-+written permission of the assimp team.
-+
-+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-+---------------------------------------------------------------------------
-+*/
-+
-+#include "UnitTestPCH.h"
-+#include <assimp/Importer.hpp>
-+
-+using namespace Assimp;
-+class utLogger : public ::testing::Test {};
-+
-+TEST_F(utLogger, aiGetPredefinedLogStream_leak_test) {
-+    aiLogStream stream1 = aiGetPredefinedLogStream(aiDefaultLogStream_STDOUT, nullptr);
-+    aiLogStream stream2 = aiGetPredefinedLogStream(aiDefaultLogStream_STDOUT, nullptr);
-+    ASSERT_EQ(stream1.callback, stream2.callback);
-+}
--- 
-2.39.5
-

package/assimp/0002-Fix-use-after-free-in-the-CallbackToLogRedirector-59.patch

@@ -1,39 +0,0 @@
-From f12e52198669239af525e525ebb68407977f8e34 Mon Sep 17 00:00:00 2001
-From: tyler92 <tyler92@inbox.ru>
-Date: Wed, 11 Dec 2024 12:17:14 +0200
-Subject: [PATCH] Fix use after free in the CallbackToLogRedirector (#5918)
-
-The heap-use-after-free vulnerability occurs in the
-CallbackToLogRedirector function. During the process of logging,
-a previously freed memory region is accessed, leading to a
-use-after-free condition. This vulnerability stems from incorrect
-memory management, specifically, freeing a log stream and then
-attempting to access it later on.
-
-This patch sets NULL value for The DefaultStream global pointer.
-
-Co-authored-by: Kim Kulling <kimkulling@users.noreply.github.com>
-Upstream: https://github.com/assimp/assimp/commit/f12e52198669239af525e525ebb68407977f8e34
-Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
----
- code/Common/Assimp.cpp | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/code/Common/Assimp.cpp b/code/Common/Assimp.cpp
-index 91896e405..22e16bd36 100644
---- a/code/Common/Assimp.cpp
-+++ b/code/Common/Assimp.cpp
-@@ -416,6 +416,10 @@ ASSIMP_API aiReturn aiDetachLogStream(const aiLogStream *stream) {
-     DefaultLogger::get()->detachStream(it->second);
-     delete it->second;
- 
-+    if ((Assimp::LogStream *)stream->user == DefaultStream) {
-+        DefaultStream = nullptr;
-+    }
-+
-     gActiveLogStreams.erase(it);
- 
-     if (gActiveLogStreams.empty()) {
--- 
-2.39.5
-

package/assimp/0003-ASE-fix-possible-out-of-bound-access.patch

@@ -1,29 +0,0 @@
-From 65c95bf3207b81fe522811d45780d72ed41d9c1e Mon Sep 17 00:00:00 2001
-From: Kim Kulling <kim.kulling@googlemail.com>
-Date: Wed, 12 Mar 2025 20:17:38 +0100
-Subject: [PATCH] ASE: Fix possible out of bound access.
-
-Upstream: https://github.com/assimp/assimp/pull/6045
-
-CVE: CVE-2025-3015
-
-Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
----
- code/AssetLib/ASE/ASELoader.cpp | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/code/AssetLib/ASE/ASELoader.cpp b/code/AssetLib/ASE/ASELoader.cpp
-index eb6b37dc9b..c63edcf6bf 100644
---- a/code/AssetLib/ASE/ASELoader.cpp
-+++ b/code/AssetLib/ASE/ASELoader.cpp
-@@ -731,6 +731,10 @@ void ASEImporter::BuildUniqueRepresentation(ASE::Mesh &mesh) {
-     unsigned int iCurrent = 0, fi = 0;
-     for (std::vector<ASE::Face>::iterator i = mesh.mFaces.begin(); i != mesh.mFaces.end(); ++i, ++fi) {
-         for (unsigned int n = 0; n < 3; ++n, ++iCurrent) {
-+            const uint32_t curIndex = (*i).mIndices[n];
-+            if (curIndex >= mesh.mPositions.size()) {
-+                throw DeadlyImportError("ASE: Invalid vertex index in face ", fi, ".");
-+            }
-             mPositions[iCurrent] = mesh.mPositions[(*i).mIndices[n]];
- 
-             // add texture coordinates

package/assimp/0004-MDL-limit-max-texture-sizes.patch

@@ -1,41 +0,0 @@
-From 5d2a7482312db2e866439a8c05a07ce1e718bed1 Mon Sep 17 00:00:00 2001
-From: Kim Kulling <kimkulling@users.noreply.github.com>
-Date: Wed, 12 Mar 2025 21:29:33 +0100
-Subject: [PATCH] MDL: Limit max texture sizes
-
-- closes https://github.com/assimp/assimp/issues/6022
-
-Upstream: https://github.com/assimp/assimp/pull/6046
-
-CVE: CVE-2025-3016
-
-Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
----
- code/AssetLib/MDL/MDLMaterialLoader.cpp | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/code/AssetLib/MDL/MDLMaterialLoader.cpp b/code/AssetLib/MDL/MDLMaterialLoader.cpp
-index 2cac8a1e26..2e09992e89 100644
---- a/code/AssetLib/MDL/MDLMaterialLoader.cpp
-+++ b/code/AssetLib/MDL/MDLMaterialLoader.cpp
-@@ -209,6 +209,8 @@ void MDLImporter::CreateTexture_3DGS_MDL4(const unsigned char *szData,
-     return;
- }
- 
-+static const uint32_t MaxTextureSize = 4096;
-+
- // ------------------------------------------------------------------------------------------------
- // Load color data of a texture and convert it to our output format
- void MDLImporter::ParseTextureColorData(const unsigned char *szData,
-@@ -219,6 +221,11 @@ void MDLImporter::ParseTextureColorData(const unsigned char *szData,
- 
-     // allocate storage for the texture image
-     if (do_read) {
-+        // check for max texture sizes
-+        if (pcNew->mWidth > MaxTextureSize || pcNew->mHeight > MaxTextureSize) {
-+            throw DeadlyImportError("Invalid MDL file. A texture is too big.");
-+        }
-+      
-         if(pcNew->mWidth != 0 && pcNew->mHeight > UINT_MAX/pcNew->mWidth) {
-             throw DeadlyImportError("Invalid MDL file. A texture is too big.");
-         }

package/assimp/assimp.hash

@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  66dfbaee288f2bc43172440a55d0235dfc7bf885dda6435c038e8000e79582cb  assimp-5.4.3.tar.gz
+sha256  d1822d9a19c9205d6e8bc533bf897174ddb360ce504680f294170cc1d6319751  assimp-6.0.2.tar.gz
 sha256  147874443d242b4e2bae97036e26ec9d6b37f706174c1bd5ecfcc8c1294cef51  LICENSE

package/assimp/assimp.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-ASSIMP_VERSION = 5.4.3
+ASSIMP_VERSION = 6.0.2
 ASSIMP_SITE = $(call github,assimp,assimp,v$(ASSIMP_VERSION))
 ASSIMP_LICENSE = BSD-3-Clause
 ASSIMP_LICENSE_FILES = LICENSE
@@ -12,16 +12,6 @@ ASSIMP_CPE_ID_VENDOR = assimp
 ASSIMP_DEPENDENCIES = zlib
 ASSIMP_INSTALL_STAGING = YES
 
-# 0001-Fix-leak-5762.patch
-# 0002-Fix-use-after-free-in-the-CallbackToLogRedirector-59.patch
-ASSIMP_IGNORE_CVES += CVE-2024-48423
-
-# 0003-ASE-fix-possible-out-of-bound-access.patch
-ASSIMP_IGNORE_CVES += CVE-2025-3015
-
-# 0004-MDL-limit-max-texture-sizes.patch
-ASSIMP_IGNORE_CVES += CVE-2025-3016
-
 # relocation truncated to fit: R_68K_GOT16O. We also need to disable
 # optimizations to not run into "Error: value -43420 out of range"
 # assembler issues.

package/avrdude/avrdude.mk

@@ -29,12 +29,4 @@ ifeq ($(BR2_PACKAGE_HIDAPI),y)
 AVRDUDE_DEPENDENCIES += hidapi
 endif
 
-# if /etc/avrdude.conf exists, the installation process creates a
-# backup file, which we do not want in the context of Buildroot.
-define AVRDUDE_REMOVE_BACKUP_FILE
-	$(RM) -f $(TARGET_DIR)/etc/avrdude.conf.bak
-endef
-
-AVRDUDE_POST_INSTALL_TARGET_HOOKS += AVRDUDE_REMOVE_BACKUP_FILE
-
 $(eval $(cmake-package))

package/bcg729/bcg729.hash

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  68599a850535d1b182932b3f86558ac8a76d4b899a548183b062956c5fdc916d  bcg729-1.1.1.tar.gz
+sha256  62812779c776620f8fa005fc7c6ae14039d7b2efce66cf9af69c426393b5d062  bcg729-1.1.1-3-g8bec1e5fc072f3669e435edd137eb3da6da2eef7.tar.gz
 sha256  1b3782ccad7b8614100cda30d3faf42fc39f2e97932908c543005053b654ca68  LICENSE.txt

package/bcg729/bcg729.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-BCG729_VERSION = 1.1.1
+BCG729_VERSION = 1.1.1-3-g8bec1e5fc072f3669e435edd137eb3da6da2eef7
 BCG729_SITE = $(call github,BelledonneCommunications,bcg729,$(BCG729_VERSION))
 BCG729_LICENSE = GPL-3.0+
 BCG729_LICENSE_FILES = LICENSE.txt

package/berkeleydb/berkeleydb.mk

@@ -51,6 +51,7 @@ endef
 define HOST_BERKELEYDB_CONFIGURE_CMDS
 	(cd $(@D)/build_unix; rm -rf config.cache; \
 		$(HOST_CONFIGURE_OPTS) \
+		CFLAGS="$(HOST_CFLAGS) -std=gnu99" \
 		../dist/configure $(QUIET) \
 		--prefix=$(HOST_DIR) \
 		--with-gnu-ld \

package/binutils/2.42/0004-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch

@@ -0,0 +1,90 @@
+From 8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 16 Nov 2024 05:03:52 +0000
+Subject: [PATCH] opcodes: fix -std=gnu23 compatibility wrt static_assert
+
+static_assert is declared in C23 so we can't reuse that identifier:
+* Define our own static_assert conditionally;
+
+* Rename "static assert" hacks to _N as we do already in some places
+  to avoid a conflict.
+
+ChangeLog:
+	PR ld/32372
+
+        * i386-gen.c (static_assert): Define conditionally.
+        * mips-formats.h (MAPPED_INT): Rename identifier.
+        (MAPPED_REG): Rename identifier.
+        (OPTIONAL_MAPPED_REG): Rename identifier.
+        * s390-opc.c (static_assert): Define conditionally.
+
+Upstream: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4
+Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
+---
+ opcodes/i386-gen.c     | 2 ++
+ opcodes/mips-formats.h | 6 +++---
+ opcodes/s390-opc.c     | 2 ++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/opcodes/i386-gen.c b/opcodes/i386-gen.c
+index 053b66675c5..7ee8a30310c 100644
+--- a/opcodes/i386-gen.c
++++ b/opcodes/i386-gen.c
+@@ -30,7 +30,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ static const char *program_name = NULL;
+ static int debug = 0;
+diff --git a/opcodes/mips-formats.h b/opcodes/mips-formats.h
+index 90df7100803..c4dec6352bf 100644
+--- a/opcodes/mips-formats.h
++++ b/opcodes/mips-formats.h
+@@ -49,7 +49,7 @@
+ #define MAPPED_INT(SIZE, LSB, MAP, PRINT_HEX) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_3[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_mapped_int_operand op = { \
+       { OP_MAPPED_INT, SIZE, LSB }, MAP, PRINT_HEX \
+     }; \
+@@ -83,7 +83,7 @@
+ #define MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_4[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+@@ -93,7 +93,7 @@
+ #define OPTIONAL_MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_5[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_OPTIONAL_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+diff --git a/opcodes/s390-opc.c b/opcodes/s390-opc.c
+index 9d9f0973e55..49efd714157 100644
+--- a/opcodes/s390-opc.c
++++ b/opcodes/s390-opc.c
+@@ -36,7 +36,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+ 
+-- 
+2.34.1
+

package/binutils/2.43.1/0004-opcodes-fix-std-gnu23-compatibility-wrt-static_asser.patch

@@ -0,0 +1,90 @@
+From 8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4 Mon Sep 17 00:00:00 2001
+From: Sam James <sam@gentoo.org>
+Date: Sat, 16 Nov 2024 05:03:52 +0000
+Subject: [PATCH] opcodes: fix -std=gnu23 compatibility wrt static_assert
+
+static_assert is declared in C23 so we can't reuse that identifier:
+* Define our own static_assert conditionally;
+
+* Rename "static assert" hacks to _N as we do already in some places
+  to avoid a conflict.
+
+ChangeLog:
+	PR ld/32372
+
+        * i386-gen.c (static_assert): Define conditionally.
+        * mips-formats.h (MAPPED_INT): Rename identifier.
+        (MAPPED_REG): Rename identifier.
+        (OPTIONAL_MAPPED_REG): Rename identifier.
+        * s390-opc.c (static_assert): Define conditionally.
+
+Upstream: https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=8ebe62f3f0d27806b1bf69f301f5e188b4acd2b4
+Signed-off-by: Raphaël Mélotte <raphael.melotte@mind.be>
+---
+ opcodes/i386-gen.c     | 2 ++
+ opcodes/mips-formats.h | 6 +++---
+ opcodes/s390-opc.c     | 2 ++
+ 3 files changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/opcodes/i386-gen.c b/opcodes/i386-gen.c
+index 053b66675c5..7ee8a30310c 100644
+--- a/opcodes/i386-gen.c
++++ b/opcodes/i386-gen.c
+@@ -30,7 +30,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ static const char *program_name = NULL;
+ static int debug = 0;
+diff --git a/opcodes/mips-formats.h b/opcodes/mips-formats.h
+index 90df7100803..c4dec6352bf 100644
+--- a/opcodes/mips-formats.h
++++ b/opcodes/mips-formats.h
+@@ -49,7 +49,7 @@
+ #define MAPPED_INT(SIZE, LSB, MAP, PRINT_HEX) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_3[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_mapped_int_operand op = { \
+       { OP_MAPPED_INT, SIZE, LSB }, MAP, PRINT_HEX \
+     }; \
+@@ -83,7 +83,7 @@
+ #define MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_4[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+@@ -93,7 +93,7 @@
+ #define OPTIONAL_MAPPED_REG(SIZE, LSB, BANK, MAP) \
+   { \
+     typedef char ATTRIBUTE_UNUSED \
+-      static_assert[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
++      static_assert_5[(1 << (SIZE)) == ARRAY_SIZE (MAP)]; \
+     static const struct mips_reg_operand op = { \
+       { OP_OPTIONAL_REG, SIZE, LSB }, OP_REG_##BANK, MAP \
+     }; \
+diff --git a/opcodes/s390-opc.c b/opcodes/s390-opc.c
+index 9d9f0973e55..49efd714157 100644
+--- a/opcodes/s390-opc.c
++++ b/opcodes/s390-opc.c
+@@ -36,7 +36,9 @@
+ 
+ /* Build-time checks are preferrable over runtime ones.  Use this construct
+    in preference where possible.  */
++#ifndef static_assert
+ #define static_assert(e) ((void)sizeof (struct { int _:1 - 2 * !(e); }))
++#endif
+ 
+ #define ARRAY_SIZE(a) (sizeof(a) / sizeof((a)[0]))
+ 
+-- 
+2.34.1
+

package/bmx7/0004-support-mbedtls-2-8-0-without-mbedtls-compat-1-3.patch

@@ -0,0 +1,786 @@
+From a47d8d55717a74a2b399c612dc5a17df8d039125 Mon Sep 17 00:00:00 2001
+From: Axel Neumann <axel@notmail.org>
+Date: Fri, 17 May 2024 07:07:00 +0200
+Subject: [PATCH] Support mbedtls-2.8.0 without mbedtls/compat-1.3.h . Purge
+ Polarssl support
+
+Upstream: https://github.com/bmx-routing/bmx7/commit/a47d8d55717a74a2b399c612dc5a17df8d039125
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/crypt.c | 357 +++++++++++++++++-----------------------------------
+ src/crypt.h |  11 +-
+ 2 files changed, 115 insertions(+), 253 deletions(-)
+
+diff --git a/src/crypt.c b/src/crypt.c
+index 004b8e7..9270b75 100644
+--- a/src/crypt.c
++++ b/src/crypt.c
+@@ -37,34 +37,17 @@ static uint8_t shaClean = NO;
+ 
+ static CRYPTRSA_T *my_PrivKey = NULL;
+ 
+-#if (CRYPTLIB >= POLARSSL_MIN && CRYPTLIB <= POLARSSL_MAX) || (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB <= MBEDTLS_MAX)
+-
+-#if (CRYPTLIB >= POLARSSL_MIN && CRYPTLIB <= POLARSSL_MAX)
+-/******************* accessing polarssl: *************************************/
+-#include "polarssl/config.h"
+-#include "polarssl/sha256.h"
+-
+-#include "polarssl/entropy.h"
+-//#include "polarssl/entropy_poll.h"
+-
+-#include "polarssl/error.h"
+-#include "polarssl/md.h"
+-#include "polarssl/dhm.h"
+-#include "polarssl/rsa.h"
+-#include "polarssl/ctr_drbg.h"
+-
+-#include "polarssl/x509.h"
+-#if CRYPTLIB <= POLARSSL_1_2_9
+-#include "polarssl/x509write.h"
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-#include "polarssl/pk.h"
+-#endif
+ 
+-#elif (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB <= MBEDTLS_MAX)
++#if (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB <= MBEDTLS_MAX)
+ /******************* accessing mbedtls: *************************************/
+ 
+-#include "mbedtls/compat-1.3.h"
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++//#include "mbedtls/compat-1.3.h"
+ #include "mbedtls/config.h"
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++#include "mbedtls/compat-2.x.h"
++#endif
++
+ #include "mbedtls/sha256.h"
+ #include "mbedtls/entropy.h"
+ #include "mbedtls/error.h"
+@@ -75,10 +58,10 @@ static CRYPTRSA_T *my_PrivKey = NULL;
+ 
+ #endif
+ 
+-static entropy_context entropy_ctx;
+-static ctr_drbg_context ctr_drbg;
++static mbedtls_entropy_context entropy_ctx;
++static mbedtls_ctr_drbg_context ctr_drbg;
++static mbedtls_sha256_context sha_ctx;
+ 
+-static sha256_context sha_ctx;
+ 
+ uint8_t cryptDhmKeyTypeByLen(int len)
+ {
+@@ -111,7 +94,7 @@ void cryptDhmKeyFree(CRYPTDHM_T **cryptKey)
+ 		return;
+ 
+ 	if ((*cryptKey)->backendKey) {
+-		dhm_free((dhm_context*) ((*cryptKey)->backendKey));
++		mbedtls_dhm_free((mbedtls_dhm_context*) ((*cryptKey)->backendKey));
+ 		debugFree((*cryptKey)->backendKey, -300828);
+ 	}
+ 
+@@ -129,25 +112,25 @@ void cryptDhmKeyFree(CRYPTDHM_T **cryptKey)
+  *  http://www.cl.cam.ac.uk/~rja14/Papers/psandqs.pdf
+  *  http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-2643
+  */
+-static int _cryptDhmCheckRange(const mpi *param, const mpi *P)
++static int _cryptDhmCheckRange(const mbedtls_mpi *param, const mbedtls_mpi *P)
+ {
+-	mpi L, U;
++	mbedtls_mpi L, U;
+ 	int ret = FAILURE; //POLARSSL_ERR_DHM_BAD_INPUT_DATA;
+ 
+-	mpi_init(&L);
+-	mpi_init(&U);
++	mbedtls_mpi_init(&L);
++	mbedtls_mpi_init(&U);
+ 
+ 	if (
+-		mpi_lset(&L, 2) == 0 &&
+-		mpi_sub_int(&U, P, 2) == 0 &&
+-		mpi_cmp_mpi(param, &L) >= 0 &&
+-		mpi_cmp_mpi(param, &U) <= 0) {
++		mbedtls_mpi_lset(&L, 2) == 0 &&
++		mbedtls_mpi_sub_int(&U, P, 2) == 0 &&
++		mbedtls_mpi_cmp_mpi(param, &L) >= 0 &&
++		mbedtls_mpi_cmp_mpi(param, &U) <= 0) {
+ 
+ 		ret = SUCCESS;
+ 	}
+ 
+-	mpi_free(&L);
+-	mpi_free(&U);
++	mbedtls_mpi_free(&L);
++	mbedtls_mpi_free(&U);
+ 	return( ret);
+ }
+ 
+@@ -158,20 +141,12 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	char *goto_error_code = NULL;
+ 	int keyLen = 0;
+ 	CRYPTDHM_T *key = debugMallocReset(sizeof(CRYPTDHM_T), -300829);
+-	dhm_context *dhm = debugMallocReset(sizeof(dhm_context), -300830);
+-#if !(CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
+-	char *pptr = NULL;
+-	char *gptr = NULL;
+-#endif
++	mbedtls_dhm_context *dhm = debugMallocReset(sizeof(mbedtls_dhm_context), -300830);
+ 	int pSize = 0;
+ 	int xSize = 0;
+ 	int gxSize = 0;
+ 	int count = 0;
+ 
+-#if CRYPTLIB >= POLARSSL_1_3_9
+-	// in older versions, if dhm_init() exist, it only zero-memsets the dhm context
+-	dhm_init(dhm);
+-#endif
+ 	key->backendKey = dhm;
+ 
+ 	if (!(keyType))
+@@ -179,58 +154,36 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	if ((keyLen = cryptDhmKeyLenByType(keyType)) <= 0)
+ 		goto_error(finish, "Invalid size");
+ 
+-#if (CRYPTLIB >= POLARSSL_MIN && CRYPTLIB <= POLARSSL_MAX)
+-	if (keyType == CRYPT_DHM1024_TYPE) {
+-		pptr = POLARSSL_DHM_RFC5114_MODP_1024_P;
+-		gptr = POLARSSL_DHM_RFC5114_MODP_1024_G;
+-	} else if (keyType == CRYPT_DHM2048_TYPE) {
+-		pptr = POLARSSL_DHM_RFC3526_MODP_2048_P;
+-		gptr = POLARSSL_DHM_RFC3526_MODP_2048_G;
+-	} else if (keyType == CRYPT_DHM3072_TYPE) {
+-		pptr = POLARSSL_DHM_RFC3526_MODP_3072_P;
+-		gptr = POLARSSL_DHM_RFC3526_MODP_3072_G;
+-#elif (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB < MBEDTLS_2_8_0)
+-	if (keyType == CRYPT_DHM2048_TYPE) {
+-		pptr = MBEDTLS_DHM_RFC3526_MODP_2048_P;
+-		gptr = MBEDTLS_DHM_RFC3526_MODP_2048_G;
+-	} else if (keyType == CRYPT_DHM3072_TYPE) {
+-		pptr = MBEDTLS_DHM_RFC3526_MODP_3072_P;
+-		gptr = MBEDTLS_DHM_RFC3526_MODP_3072_G;
+-#elif (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
+ 
+ 	if (keyType == CRYPT_DHM2048_TYPE) {
+ 		static const unsigned char modp2048P[(2048/8)] = MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
+ 		static const unsigned char modp2048G[1] = MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
+-		if ((ret = mpi_read_binary(&dhm->P, modp2048P, sizeof(modp2048P) )) != 0 || (ret = mpi_read_binary(&dhm->G, modp2048G, sizeof(modp2048G))) != 0)
+-			goto_error(finish, "Failed setting dhm parameters!");
++
++		if ((ret = mbedtls_mpi_read_binary(&dhm->P, modp2048P, sizeof(modp2048P) )) != 0 || (ret = mbedtls_mpi_read_binary(&dhm->G, modp2048G, sizeof(modp2048G))) != 0)
++			goto_error(finish, "Failed reading dhm2048 parameters!");
+ 
+ 	} else if (keyType == CRYPT_DHM3072_TYPE) {
+ 		static const unsigned char modp3072P[(3072/8)] = MBEDTLS_DHM_RFC3526_MODP_3072_P_BIN;
+ 		static const unsigned char modp3072G[1] = MBEDTLS_DHM_RFC3526_MODP_3072_G_BIN;
+-		if ((ret = mpi_read_binary(&dhm->P, modp3072P, sizeof(modp3072P) )) != 0 || (ret = mpi_read_binary(&dhm->G, modp3072G, sizeof(modp3072G))) != 0)
+-			goto_error(finish, "Failed setting dhm parameters!");
+-#endif
++		if ((ret = mbedtls_mpi_read_binary(&dhm->P, modp3072P, sizeof(modp3072P) )) != 0 || (ret = mbedtls_mpi_read_binary(&dhm->G, modp3072G, sizeof(modp3072G))) != 0)
++			goto_error(finish, "Failed reading dhm3072 parameters!");
+ 	} else {
+ 		goto_error(finish, "Unsupported dhm type!");
+ 	}
+ 
+-#if !(CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
+-	if ((ret = mpi_read_string(&dhm->P, 16, pptr)) != 0 || (ret = mpi_read_string(&dhm->G, 16, gptr)) != 0)
+-		goto_error(finish, "Failed setting dhm parameters!");
+-#endif
+-	if (mpi_cmp_int(&dhm->P, 0) == 0)
++	if (mbedtls_mpi_cmp_int(&dhm->P, 0) == 0)
+ 		goto_error(finish, "Empty dhm->P");
+ 
+ 	// Generate X as large as possible ( < P )
+-	if ((pSize = mpi_size(&dhm->P)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm->P)) != keyLen)
+ 		goto_error(finish, "Invalid P size");
+ 
+ 	do {
+-		if ((ret = mpi_fill_random(&dhm->X, pSize, ctr_drbg_random, &ctr_drbg)) != 0)
++		if ((ret = mbedtls_mpi_fill_random(&dhm->X, pSize, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
+ 			goto_error(finish, "Failed allocating randomness");
+ 
+-		while (mpi_cmp_mpi(&dhm->X, &dhm->P) >= 0) {
+-			if ((ret = mpi_shift_r(&dhm->X, 1)) != 0)
++		while (mbedtls_mpi_cmp_mpi(&dhm->X, &dhm->P) >= 0) {
++			if ((ret = mbedtls_mpi_shift_r(&dhm->X, 1)) != 0)
+ 				goto_error(finish, "Failed shifting dhm->X param");
+ 		}
+ 
+@@ -240,13 +193,13 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	} while ((ret = _cryptDhmCheckRange(&dhm->X, &dhm->P)) != SUCCESS);
+ 
+ 	// Calculate GX = G^X mod P
+-	if (mpi_exp_mod(&dhm->GX, &dhm->G, &dhm->X, &dhm->P, &dhm->RP) != 0)
++	if (mbedtls_mpi_exp_mod(&dhm->GX, &dhm->G, &dhm->X, &dhm->P, &dhm->RP) != 0)
+ 		goto_error(finish, "Failed creating GX modulo");
+-	if (((int) (dhm->len = mpi_size(&dhm->P))) != keyLen)
++	if (((int) (dhm->len = mbedtls_mpi_size(&dhm->P))) != keyLen)
+ 		goto_error(finish, "Invalid len");
+-	if ((xSize = mpi_size(&dhm->X)) != keyLen)
++	if ((xSize = mbedtls_mpi_size(&dhm->X)) != keyLen)
+ 		goto_error(finish, "Invalid X size");
+-	if ((gxSize = mpi_size(&dhm->GX)) != keyLen)
++	if ((gxSize = mbedtls_mpi_size(&dhm->GX)) != keyLen)
+ 		goto_error(finish, "Invalid GX size");
+ 	if ((ret = _cryptDhmCheckRange(&dhm->GX, &dhm->P)) != SUCCESS)
+ 		goto_error(finish, "Invalid GX range");
+@@ -277,19 +230,19 @@ void cryptDhmPubKeyGetRaw(CRYPTDHM_T* key, uint8_t* buff, uint16_t buffLen)
+ 	assertion_dbg(-502719, (key && buff && buffLen && key->rawGXType && buffLen == key->rawGXLen),
+ 		"Failed: key=%d buff=%d buffLen=%d key.GXLen=%d", !!key, !!buff, buffLen, key ? key->rawGXLen : 0);
+ 
+-	dhm_context *dhm = key->backendKey;
++	mbedtls_dhm_context *dhm = key->backendKey;
+ 
+-	assertion_dbg(-502720, (dhm && buffLen == mpi_size(&dhm->GX) && buffLen == dhm->len),
+-		"Failed: dhm.GXlen=%zd dhm.len=%zd", dhm ? mpi_size(&dhm->GX) : 0, dhm ? dhm->len : 0);
++	assertion_dbg(-502720, (dhm && buffLen == mbedtls_mpi_size(&dhm->GX) && buffLen == dhm->len),
++		"Failed: dhm.GXlen=%zd dhm.len=%zd", dhm ? mbedtls_mpi_size(&dhm->GX) : 0, dhm ? dhm->len : 0);
+ 
+-	mpi_write_binary(&dhm->GX, buff, key->rawGXLen);
++	mbedtls_mpi_write_binary(&dhm->GX, buff, key->rawGXLen);
+ }
+ 
+ STATIC_FUNC
+ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ {
+ 	char *goto_error_code = NULL;
+-	dhm_context *dhm = NULL;
++	mbedtls_dhm_context *dhm = NULL;
+ 	uint8_t keyType = 0;
+ 	int keyLen = 0;
+ 	int pSize = 0;
+@@ -297,7 +250,7 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 	int gxSize = 0;
+ 	int gySize = 0;
+ 
+-	if (!(dhm = (dhm_context *) key->backendKey))
++	if (!(dhm = (mbedtls_dhm_context *) key->backendKey))
+ 		goto_error(finish, "Missing backend key");
+ 	if (!(keyType = key->rawGXType))
+ 		goto_error(finish, "Missing type");
+@@ -305,13 +258,13 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 		goto_error(finish, "Invalid size");
+ 	if ((int) dhm->len != keyLen)
+ 		goto_error(finish, "Invalid len");
+-	if ((pSize = mpi_size(&dhm->P)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm->P)) != keyLen)
+ 		goto_error(finish, "Invalid P size");
+-	if ((xSize = mpi_size(&dhm->X)) != keyLen)
++	if ((xSize = mbedtls_mpi_size(&dhm->X)) != keyLen)
+ 		goto_error(finish, "Invalid X size");
+-	if ((gxSize = mpi_size(&dhm->GX)) != keyLen)
++	if ((gxSize = mbedtls_mpi_size(&dhm->GX)) != keyLen)
+ 		goto_error(finish, "Invalid GX size");
+-	if ((gySize = mpi_size(&dhm->GY)) != keyLen)
++	if ((gySize = mbedtls_mpi_size(&dhm->GY)) != keyLen)
+ 		goto_error(finish, "Invalid GY size");
+ 	if (_cryptDhmCheckRange(&dhm->GX, &dhm->P) != SUCCESS)
+ 		goto_error(finish, "Invalid GX range");
+@@ -333,7 +286,7 @@ CRYPTSHA_T *cryptDhmSecretForNeigh(CRYPTDHM_T *myDhm, uint8_t *neighRawKey, uint
+ 	uint8_t keyType = 0;
+ 	int ret = 0;
+ 	CRYPTSHA_T *secret = NULL;
+-	dhm_context *dhm = NULL;
++	mbedtls_dhm_context *dhm = NULL;
+ 	uint8_t buff[CRYPT_DHM_MAX_LEN];
+ 	size_t n = 0;
+ 
+@@ -343,17 +296,13 @@ CRYPTSHA_T *cryptDhmSecretForNeigh(CRYPTDHM_T *myDhm, uint8_t *neighRawKey, uint
+ 	if (((keyType = cryptDhmKeyTypeByLen(neighRawKeyLen)) != myDhm->rawGXType) || ((n = dhm->len) != neighRawKeyLen) || (sizeof(buff) < neighRawKeyLen))
+ 		goto_error(finish, "Wrong type or keyLength");
+ 
+-	if ((ret = mpi_read_binary(&dhm->GY, neighRawKey, neighRawKeyLen)) != 0)
++	if ((ret = mbedtls_mpi_read_binary(&dhm->GY, neighRawKey, neighRawKeyLen)) != 0)
+ 		goto_error(finish, "Invalid GY");
+ 
+ 	if (cryptDhmKeyCheck(myDhm) != SUCCESS)
+ 		goto_error(finish, "Failed key check");
+ 
+-#if (CRYPTLIB >= POLARSSL_MIN && CRYPTLIB <= POLARSSL_MAX)
+-	if ((ret = dhm_calc_secret(dhm, buff, &n, ctr_drbg_random, &ctr_drbg)) != 0)
+-#elif (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB <= MBEDTLS_MAX)
+-	if ((ret = dhm_calc_secret(dhm, buff, sizeof(buff), &n, ctr_drbg_random, &ctr_drbg)) != 0)
+-#endif
++	if ((ret = mbedtls_dhm_calc_secret(dhm, buff, sizeof(buff), &n, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
+ 		goto_error(finish, "Failed calculating secret");
+ 
+ 	if (n > neighRawKeyLen || n < ((neighRawKeyLen / 4)*3))
+@@ -368,8 +317,8 @@ CRYPTSHA_T *cryptDhmSecretForNeigh(CRYPTDHM_T *myDhm, uint8_t *neighRawKey, uint
+ 		dbgf(((goto_error_code || n != neighRawKeyLen) ? DBGL_SYS : DBGL_CHANGES), ((goto_error_code || n != neighRawKeyLen) ? DBGT_WARN : DBGT_INFO),
+ 		"%s n=%zd neighKeyLen=%d myKeyLen=%d", goto_error_code, n, neighRawKeyLen, myDhm->rawGXLen);
+ 
+-		mpi_free(&dhm->GY);
+-		mpi_free(&dhm->K);
++		mbedtls_mpi_free(&dhm->GY);
++		mbedtls_mpi_free(&dhm->K);
+ 		memset(buff, 0, sizeof(buff));
+ 		return secret; }
+ }
+@@ -381,14 +330,10 @@ void cryptRsaKeyFree(CRYPTRSA_T **cryptKey)
+ 		return;
+ 
+ 	if ((*cryptKey)->backendKey) {
+-		rsa_free((rsa_context*) ((*cryptKey)->backendKey));
++		mbedtls_rsa_free((mbedtls_rsa_context*) ((*cryptKey)->backendKey));
+ 		debugFree((*cryptKey)->backendKey, -300612);
+ 	}
+ 
+-	//	if ((*cryptKey)->__rawKey) {
+-	//		debugFree((*cryptKey)->__rawKey, -300613);
+-	//	}
+-
+ 	debugFree((*cryptKey), -300614);
+ 
+ 	*cryptKey = NULL;
+@@ -397,15 +342,15 @@ void cryptRsaKeyFree(CRYPTRSA_T **cryptKey)
+ int cryptRsaPubKeyGetRaw(CRYPTRSA_T *key, uint8_t *buff, uint16_t buffLen)
+ {
+ 
+-	rsa_context *rsa;
++	mbedtls_rsa_context *rsa;
+ 	if (!key || !buff || !buffLen ||
+ 		!key->rawKeyType || (buffLen != key->rawKeyLen) ||
+-		!(rsa = (rsa_context*) key->backendKey) || buffLen != mpi_size(&rsa->N) || buffLen != rsa->len) {
++		!(rsa = (mbedtls_rsa_context*) key->backendKey) || buffLen != mbedtls_mpi_size(&rsa->N) || buffLen != rsa->len) {
+ 
+ 		return FAILURE;
+ 	}
+ 
+-	if (mpi_write_binary(&rsa->N, buff, buffLen) != 0)
++	if (mbedtls_mpi_write_binary(&rsa->N, buff, buffLen) != 0)
+ 		return FAILURE;
+ 
+ 	return SUCCESS;
+@@ -420,16 +365,16 @@ CRYPTRSA_T *cryptRsaPubKeyFromRaw(uint8_t *rawKey, uint16_t rawKeyLen)
+ 
+ 	CRYPTRSA_T *cryptKey = debugMallocReset(sizeof(CRYPTRSA_T), -300615);
+ 
+-	cryptKey->backendKey = debugMalloc(sizeof(rsa_context), -300620);
++	cryptKey->backendKey = debugMalloc(sizeof(mbedtls_rsa_context), -300620);
+ 
+-	rsa_context *rsa = (rsa_context*) cryptKey->backendKey;
++	mbedtls_rsa_context *rsa = (mbedtls_rsa_context*) cryptKey->backendKey;
+ 
+-	rsa_init(rsa, RSA_PKCS_V15, 0);
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
+ 
+ 
+ 	if (
+-		(mpi_read_binary(&rsa->N, rawKey, rawKeyLen)) ||
+-		(mpi_read_binary(&rsa->E, (uint8_t*) & e, sizeof(e)))
++		(mbedtls_mpi_read_binary(&rsa->N, rawKey, rawKeyLen)) ||
++		(mbedtls_mpi_read_binary(&rsa->E, (uint8_t*) & e, sizeof(e)))
+ 		) {
+ 		cryptRsaKeyFree(&cryptKey);
+ 		return NULL;
+@@ -439,7 +384,6 @@ CRYPTRSA_T *cryptRsaPubKeyFromRaw(uint8_t *rawKey, uint16_t rawKeyLen)
+ 	cryptKey->rawKeyLen = rawKeyLen;
+ 	cryptKey->rawKeyType = cryptRsaKeyTypeByLen(rawKeyLen);
+ 
+-
+ #ifdef EXTREME_PARANOIA
+ 	uint8_t buff[rawKeyLen];
+ 	memset(buff, 0, rawKeyLen);
+@@ -448,10 +392,6 @@ CRYPTRSA_T *cryptRsaPubKeyFromRaw(uint8_t *rawKey, uint16_t rawKeyLen)
+ 	assertion(-502722, (memcmp(rawKey, buff, rawKeyLen) == 0));
+ #endif
+ 
+-
+-	//	cryptKey->__rawKey = debugMalloc(rawKeyLen,-300618);
+-	//	memcpy(cryptKey->__rawKey, rawKey, rawKeyLen);
+-
+ 	return cryptKey;
+ }
+ 
+@@ -460,10 +400,10 @@ int cryptRsaPubKeyCheck(CRYPTRSA_T *pubKey)
+ 	assertion(-502141, (pubKey));
+ 	assertion(-502142, (pubKey->backendKey));
+ 
+-	rsa_context *rsa = (rsa_context*) pubKey->backendKey;
++	mbedtls_rsa_context *rsa = (mbedtls_rsa_context*) pubKey->backendKey;
+ 
+-	if (!rsa->len || (int) rsa->len != cryptRsaKeyLenByType(pubKey->rawKeyType) || rsa->len != pubKey->rawKeyLen || rsa->len != mpi_size(&rsa->N) ||
+-		rsa_check_pubkey((rsa_context*) pubKey->backendKey)) {
++	if (!rsa->len || (int) rsa->len != cryptRsaKeyLenByType(pubKey->rawKeyType) || rsa->len != pubKey->rawKeyLen || rsa->len != mbedtls_mpi_size(&rsa->N) ||
++		mbedtls_rsa_check_pubkey((mbedtls_rsa_context*) pubKey->backendKey)) {
+ 
+ 		return FAILURE;
+ 	}
+@@ -512,48 +452,35 @@ CRYPTRSA_T *cryptRsaKeyFromDer(char *keyPath)
+ 
+ 	CRYPTRSA_T *privKey = debugMallocReset(sizeof(CRYPTRSA_T), -300619);
+ 	CRYPTRSA_T *pubKey = NULL;
+-	privKey->backendKey = debugMallocReset(sizeof(rsa_context), -300620);
++	privKey->backendKey = debugMallocReset(sizeof(mbedtls_rsa_context), -300620);
+ 
+-	rsa_context *rsa = privKey->backendKey;
++	mbedtls_rsa_context *rsa = privKey->backendKey;
+ 	int ret = 0;
+ 	int keyType = 0;
+ 	int keyLen = 0;
+ 	uint8_t keyBuff[CRYPT_RSA_MAX_LEN];
+ 
+-#if CRYPTLIB <= POLARSSL_1_2_9
+-	if (
+-		(ret = x509parse_keyfile(rsa, keyPath, "")) ||
+-		(ret = rsa_check_privkey(rsa))
+-		) {
+-		dbgf_sys(DBGT_ERR, "failed opening private key=%s err=%d", keyPath, ret);
+-		cryptRsaKeyFree(&privKey);
+-		return NULL;
+-	}
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-	pk_context pk;
+-	pk_init(&pk);
+-	rsa_init(rsa, RSA_PKCS_V15, 0);
++	mbedtls_pk_context pk;
++	mbedtls_pk_init(&pk);
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
+ 
+ 	if (
+-		((ret = pk_parse_keyfile(&pk, keyPath, "")) != 0) ||
+-		((ret = rsa_copy(rsa, pk_rsa(pk))) != 0) ||
+-		((ret = rsa_check_privkey(rsa)) != 0)
++		((ret = mbedtls_pk_parse_keyfile(&pk, keyPath, "")) != 0) ||
++		((ret = mbedtls_rsa_copy(rsa, mbedtls_pk_rsa(pk))) != 0) ||
++		((ret = mbedtls_rsa_check_privkey(rsa)) != 0)
+ 		) {
+ 		dbgf_sys(DBGT_ERR, "failed opening private key=%s keyLen=%d keyType=%d err=-%X", keyPath, keyLen, keyType, -ret);
+-		pk_free(&pk);
++		mbedtls_pk_free(&pk);
+ 		cryptRsaKeyFree(&privKey);
+ 		return NULL;
+ 	}
+-	pk_free(&pk);
++	mbedtls_pk_free(&pk);
+ 
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
+ 
+ 	//cryptKeyAddRaw(ckey);
+ 
+ 	if (
+-		((keyLen = mpi_size(&rsa->N)) <= 0) ||
++		((keyLen = mbedtls_mpi_size(&rsa->N)) <= 0) ||
+ 		!(keyType = cryptRsaKeyTypeByLen(keyLen)) ||
+ 		!(privKey->rawKeyType = keyType) ||
+ 		!(privKey->rawKeyLen = keyLen) ||
+@@ -595,29 +522,16 @@ int cryptRsaKeyMakeDer(int32_t keyType, char *path)
+ 
+ 	memset(derBuf, 0, CRYPT_DER_BUF_SZ);
+ 
+-#if CRYPTLIB <= POLARSSL_1_2_9
+-	rsa_context rsa;
+-	rsa_init(&rsa, RSA_PKCS_V15, 0);
++	mbedtls_pk_context pk;
++	mbedtls_pk_init(&pk);
++	mbedtls_pk_setup(&pk, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
+ 
+-	if ((ret = rsa_gen_key(&rsa, ctr_drbg_random, &ctr_drbg, keyBitSize, CRYPT_KEY_E_VAL)))
++	if ((ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(pk), mbedtls_ctr_drbg_random, &ctr_drbg, keyBitSize, CRYPT_KEY_E_VAL)) ||
++		(ret = mbedtls_rsa_check_privkey(mbedtls_pk_rsa(pk))))
+ 		goto_error(finish, "Failed making rsa key! ret=%d");
+ 
+-	if ((derSz = x509_write_key_der(derBuf, sizeof(derBuf), &rsa)) < 0)
++	if ((derSz = mbedtls_pk_write_key_der(&pk, derBuf, sizeof(derBuf))) <= 0)
+ 		goto_error(finish, "Failed translating rsa key to der! derSz=%d");
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-	pk_context pk;
+-	pk_init(&pk);
+-	pk_init_ctx(&pk, pk_info_from_type(POLARSSL_PK_RSA));
+-
+-	if ((ret = rsa_gen_key(pk_rsa(pk), ctr_drbg_random, &ctr_drbg, keyBitSize, CRYPT_KEY_E_VAL)) ||
+-		(ret = rsa_check_privkey(pk_rsa(pk))))
+-		goto_error(finish, "Failed making rsa key! ret=%d");
+-
+-	if ((derSz = pk_write_key_der(&pk, derBuf, sizeof(derBuf))) <= 0)
+-		goto_error(finish, "Failed translating rsa key to der! derSz=%d");
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
+ 
+ 	unsigned char *derStart = derBuf + sizeof(derBuf) - derSz;
+ 
+@@ -629,13 +543,7 @@ int cryptRsaKeyMakeDer(int32_t keyType, char *path)
+ 	{
+ 		memset(derBuf, 0, CRYPT_DER_BUF_SZ);
+ 
+-#if CRYPTLIB <= POLARSSL_1_2_9
+-		rsa_free(&rsa);
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-		pk_free(&pk);
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
++		mbedtls_pk_free(&pk);
+ 
+ 		if (keyFile)
+ 			fclose(keyFile);
+@@ -656,10 +564,10 @@ CRYPTRSA_T *cryptRsaKeyMake(uint8_t keyType)
+ 	char *goto_error_code = NULL;
+ 	CRYPTRSA_T *key = debugMallocReset(sizeof(CRYPTRSA_T), -300642);
+ 
+-	rsa_context *rsa = debugMallocReset(sizeof(rsa_context), -300643);
+-	rsa_init(rsa, RSA_PKCS_V15, 0);
++	mbedtls_rsa_context *rsa = debugMallocReset(sizeof(mbedtls_rsa_context), -300643);
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
+ 
+-	if ((ret = rsa_gen_key(rsa, ctr_drbg_random, &ctr_drbg, (keyLen * 8), CRYPT_KEY_E_VAL)))
++	if ((ret = mbedtls_rsa_gen_key(rsa, mbedtls_ctr_drbg_random, &ctr_drbg, (keyLen * 8), CRYPT_KEY_E_VAL)))
+ 		goto_error(finish, "Failed making rsa key!");
+ 
+ 	key->backendKey = rsa;
+@@ -679,17 +587,17 @@ CRYPTRSA_T *cryptRsaKeyMake(uint8_t keyType)
+ 
+ 		return key; }
+ }
+-#endif
++
+ 
+ int cryptRsaEncrypt(uint8_t *in, size_t inLen, uint8_t *out, size_t *outLen, CRYPTRSA_T *pubKey)
+ {
+ 
+-	rsa_context *pk = pubKey->backendKey;
++	mbedtls_rsa_context *pk = pubKey->backendKey;
+ 
+-	assertion(-502723, (mpi_size(&pk->N) == pubKey->rawKeyLen));
++	assertion(-502723, (mbedtls_mpi_size(&pk->N) == pubKey->rawKeyLen));
+ 	assertion(-502145, (*outLen >= pubKey->rawKeyLen));
+ 
+-	if (rsa_pkcs1_encrypt(pk, ctr_drbg_random, &ctr_drbg, RSA_PUBLIC, inLen, in, out))
++	if (mbedtls_rsa_pkcs1_encrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, inLen, in, out))
+ 		return FAILURE;
+ 
+ 	*outLen = pubKey->rawKeyLen;
+@@ -701,19 +609,12 @@ int cryptRsaEncrypt(uint8_t *in, size_t inLen, uint8_t *out, size_t *outLen, CRY
+ int cryptRsaDecrypt(uint8_t *in, size_t inLen, uint8_t *out, size_t *outLen)
+ {
+ 
+-	rsa_context *pk = my_PrivKey->backendKey;
++	mbedtls_rsa_context *pk = my_PrivKey->backendKey;
+ 
+-	assertion(-502724, (mpi_size(&pk->N) == my_PrivKey->rawKeyLen));
++	assertion(-502724, (mbedtls_mpi_size(&pk->N) == my_PrivKey->rawKeyLen));
+ 	assertion(-502146, (inLen >= my_PrivKey->rawKeyLen));
+-#if CRYPTLIB == POLARSSL_1_2_5
+-	if (rsa_pkcs1_decrypt(pk, RSA_PRIVATE, &inLen, in, out, *outLen))
++	if (mbedtls_rsa_pkcs1_decrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, &inLen, in, out, *outLen))
+ 		return FAILURE;
+-#elif CRYPTLIB >= POLARSSL_1_2_9
+-	if (rsa_pkcs1_decrypt(pk, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, &inLen, in, out, *outLen))
+-		return FAILURE;
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
+ 	*outLen = inLen;
+ 
+ 	return SUCCESS;
+@@ -725,20 +626,13 @@ int cryptRsaSign(CRYPTSHA_T *inSha, uint8_t *out, size_t outLen, CRYPTRSA_T *cry
+ 	if (!cryptKey)
+ 		cryptKey = my_PrivKey;
+ 
+-	rsa_context *pk = cryptKey->backendKey;
++	mbedtls_rsa_context *pk = cryptKey->backendKey;
+ 
+ 	if (outLen < cryptKey->rawKeyLen)
+ 		return FAILURE;
+ 
+-#if CRYPTLIB <= POLARSSL_1_2_9
+-	if (rsa_pkcs1_sign(pk, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, SIG_RSA_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) inSha, out))
++	if (mbedtls_rsa_pkcs1_sign(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) inSha, out))
+ 		return FAILURE;
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-	if (rsa_pkcs1_sign(pk, ctr_drbg_random, &ctr_drbg, RSA_PRIVATE, POLARSSL_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) inSha, out))
+-		return FAILURE;
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
+ 
+ 	return SUCCESS;
+ }
+@@ -746,23 +640,12 @@ int cryptRsaSign(CRYPTSHA_T *inSha, uint8_t *out, size_t outLen, CRYPTRSA_T *cry
+ int cryptRsaVerify(uint8_t *sign, size_t signLen, CRYPTSHA_T *plainSha, CRYPTRSA_T *pubKey)
+ {
+ 
+-	rsa_context *pk = pubKey->backendKey;
++	mbedtls_rsa_context *pk = pubKey->backendKey;
+ 
+ 	assertion(-502147, (signLen == pubKey->rawKeyLen));
+ 
+-#if CRYPTLIB == POLARSSL_1_2_5
+-	if (rsa_pkcs1_verify(pk, RSA_PUBLIC, SIG_RSA_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
+-		return FAILURE;
+-#elif CRYPTLIB == POLARSSL_1_2_9
+-	if (rsa_pkcs1_verify(pk, ctr_drbg_random, &ctr_drbg, RSA_PUBLIC, SIG_RSA_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
++	if (mbedtls_rsa_pkcs1_verify(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
+ 		return FAILURE;
+-#elif CRYPTLIB >= POLARSSL_1_3_3
+-	if (rsa_pkcs1_verify(pk, ctr_drbg_random, &ctr_drbg, RSA_PUBLIC, POLARSSL_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
+-		return FAILURE;
+-#else
+-#error "Please fix CRYPTLIB"
+-#endif
+-
+ 
+ 	return SUCCESS;
+ }
+@@ -770,18 +653,18 @@ int cryptRsaVerify(uint8_t *sign, size_t signLen, CRYPTSHA_T *plainSha, CRYPTRSA
+ void cryptRand(void *out, uint32_t outLen)
+ {
+ 
+-	assertion(-502139, ENTROPY_BLOCK_SIZE > sizeof(CRYPTSHA_T));
++	assertion(-502139, MBEDTLS_ENTROPY_BLOCK_SIZE > sizeof(CRYPTSHA_T));
+ 
+ 	if (outLen <= sizeof(CRYPTSHA_T)) {
+ 
+-		if (entropy_func(&entropy_ctx, out, outLen) != 0)
++		if (mbedtls_entropy_func(&entropy_ctx, out, outLen) != 0)
+ 			cleanup_all(-502148);
+ 	} else {
+ 
+ 		CRYPTSHA_T seed[2];
+ 		uint32_t outPos;
+ 
+-		if (entropy_func(&entropy_ctx, (void*) &seed[0], sizeof(CRYPTSHA_T)) != 0)
++		if (mbedtls_entropy_func(&entropy_ctx, (void*) &seed[0], sizeof(CRYPTSHA_T)) != 0)
+ 			cleanup_all(-502140);
+ 
+ 		cryptShaAtomic(&seed[0], sizeof(CRYPTSHA_T), &seed[1]);
+@@ -799,20 +682,14 @@ void cryptRand(void *out, uint32_t outLen)
+ STATIC_FUNC
+ void cryptRngInit(void)
+ {
+-
+ 	int ret;
+ 
+ 	fflush(stdout);
+-	entropy_init(&entropy_ctx);
++	mbedtls_entropy_init(&entropy_ctx);
+ 
+-#if (CRYPTLIB >= POLARSSL_MIN && CRYPTLIB <= POLARSSL_MAX)
+-	if ((ret = ctr_drbg_init(&ctr_drbg, entropy_func, &entropy_ctx, NULL, 0)) != 0)
+-		cleanup_all(-502149);
+-#elif (CRYPTLIB >= MBEDTLS_MIN && CRYPTLIB <= MBEDTLS_MAX)
+ 	mbedtls_ctr_drbg_init(&ctr_drbg);
+-	if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, entropy_func, &entropy_ctx, NULL, 0)) != 0)
++	if ((ret = mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy_ctx, NULL, 0)) != 0)
+ 		cleanup_all(-502149);
+-#endif
+ 
+ 	int test = 0;
+ 
+@@ -829,22 +706,14 @@ void cryptRngFree(void)
+ STATIC_FUNC
+ void cryptShaInit(void)
+ {
+-#if CRYPTLIB < POLARSSL_1_3_9
+-	memset(&sha_ctx, 0, sizeof(sha_ctx));
+-#else
+-	sha256_init(&sha_ctx);
+-#endif
++	mbedtls_sha256_init(&sha_ctx);
+ 	shaClean = YES;
+ }
+ 
+ STATIC_FUNC
+ void cryptShaFree(void)
+ {
+-#if CRYPTLIB < POLARSSL_1_3_9
+-	memset(&sha_ctx, 0, sizeof(sha_ctx));
+-#else
+-	sha256_free(&sha_ctx);
+-#endif
++	mbedtls_sha256_free(&sha_ctx);
+ }
+ 
+ void cryptShaAtomic(void *in, int32_t len, CRYPTSHA_T *sha)
+@@ -855,14 +724,14 @@ void cryptShaAtomic(void *in, int32_t len, CRYPTSHA_T *sha)
+ 
+ 	unsigned char output[32];
+ 
+-#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	mbedtls_sha256_starts_ret(&sha_ctx, 1/*is224*/);
+ 	mbedtls_sha256_update_ret(&sha_ctx, in, len);
+ 	mbedtls_sha256_finish_ret(&sha_ctx, output);
+ #else
+-	sha256_starts(&sha_ctx, 1/*is224*/);
+-	sha256_update(&sha_ctx, in, len);
+-	sha256_finish(&sha_ctx, output);
++	mbedtls_sha256_starts(&sha_ctx, 1/*is224*/);
++	mbedtls_sha256_update(&sha_ctx, in, len);
++	mbedtls_sha256_finish(&sha_ctx, output);
+ #endif
+ 	memcpy(sha, output, sizeof(CRYPTSHA_T));
+ 	memset(output, 0, sizeof(output));
+@@ -875,12 +744,12 @@ void cryptShaNew(void *in, int32_t len)
+ 	assertion(-502034, (in && len > 0 && !memcmp(in, in, len)));
+ 	shaClean = NO;
+ 
+-#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	mbedtls_sha256_starts_ret(&sha_ctx, 1/*is224*/);
+ 	mbedtls_sha256_update_ret(&sha_ctx, in, len);
+ #else
+-	sha256_starts(&sha_ctx, 1/*is224*/);
+-	sha256_update(&sha_ctx, in, len);
++	mbedtls_sha256_starts(&sha_ctx, 1/*is224*/);
++	mbedtls_sha256_update(&sha_ctx, in, len);
+ #endif
+ }
+ 
+@@ -890,10 +759,10 @@ void cryptShaUpdate(void *in, int32_t len)
+ 	assertion(-502035, (shaClean == NO));
+ 	assertion(-502036, (in && len > 0 && !memcmp(in, in, len)));
+ 
+-#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	mbedtls_sha256_update_ret(&sha_ctx, in, len);
+ #else
+-	sha256_update(&sha_ctx, in, len);
++	mbedtls_sha256_update(&sha_ctx, in, len);
+ #endif
+ }
+ 
+@@ -904,10 +773,10 @@ void cryptShaFinal(CRYPTSHA_T *sha)
+ 	assertion(-502038, (sha));
+ 	unsigned char output[32];
+ 
+-#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB <= MBEDTLS_MAX)
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	mbedtls_sha256_finish_ret(&sha_ctx, output);
+ #else
+-	sha256_finish(&sha_ctx, output);
++	mbedtls_sha256_finish(&sha_ctx, output;)
+ #endif
+ 	memcpy(sha, output, sizeof(CRYPTSHA_T));
+ 	memset(output, 0, sizeof(output));
+diff --git a/src/crypt.h b/src/crypt.h
+index bcc91db..da34d4e 100644
+--- a/src/crypt.h
++++ b/src/crypt.h
+@@ -19,20 +19,13 @@
+  * Alternative cryptographic libraries are:
+  * libtomcrypt, gcrypt, cyassl
+  */
+-
+-#define POLARSSL_MIN   1000
+-#define POLARSSL_1_2_5 1125
+-#define POLARSSL_1_2_9 1129
+-#define POLARSSL_1_3_3 1133
+-#define POLARSSL_1_3_4 1134
+-#define POLARSSL_1_3_9 1139
+-#define POLARSSL_MAX   1999
+-
+ #define MBEDTLS_MIN    2000
+ #define MBEDTLS_2_4_0  2240
+ #define MBEDTLS_2_6_0  2260
+ #define MBEDTLS_2_7_0  2270
+ #define MBEDTLS_2_8_0  2280
++#define MBEDTLS_3_0_0  2300
++#define MBEDTLS_3_6_0  2360
+ #define MBEDTLS_MAX    2999
+ 
+ #ifndef CRYPTLIB

package/bmx7/0005-towards-mbedtls-3-6-0-support.patch

@@ -0,0 +1,468 @@
+From d4a53a37f82b43abf9509bcb8922ced6c182e59e Mon Sep 17 00:00:00 2001
+From: Axel Neumann <axel@notmail.org>
+Date: Sat, 18 May 2024 07:47:08 +0200
+Subject: [PATCH] Towards mbedtls-3.6.0 support
+
+Upstream: https://github.com/bmx-routing/bmx7/commit/d4a53a37f82b43abf9509bcb8922ced6c182e59e
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/crypt.c | 215 +++++++++++++++++++++++++++++++++++++---------------
+ src/crypt.h |   3 +-
+ 2 files changed, 154 insertions(+), 64 deletions(-)
+
+diff --git a/src/crypt.c b/src/crypt.c
+index 9270b75..91543ef 100644
+--- a/src/crypt.c
++++ b/src/crypt.c
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2010  Axel Neumann
++ * Copyright (c) 2024  Axel Neumann
+  * This program is free software; you can redistribute it and/or
+  * modify it under the terms of version 2 of the GNU General Public
+  * License as published by the Free Software Foundation.
+@@ -46,6 +46,7 @@ static CRYPTRSA_T *my_PrivKey = NULL;
+ #include "mbedtls/config.h"
+ #elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
+ #include "mbedtls/compat-2.x.h"
++//#include "mbedtls/md.h"
+ #endif
+ 
+ #include "mbedtls/sha256.h"
+@@ -143,9 +144,7 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	CRYPTDHM_T *key = debugMallocReset(sizeof(CRYPTDHM_T), -300829);
+ 	mbedtls_dhm_context *dhm = debugMallocReset(sizeof(mbedtls_dhm_context), -300830);
+ 	int pSize = 0;
+-	int xSize = 0;
+-	int gxSize = 0;
+-	int count = 0;
++	unsigned char dummyPubKeyBuff[CRYPT_DHM_MAX_LEN];
+ 
+ 	key->backendKey = dhm;
+ 
+@@ -154,63 +153,57 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	if ((keyLen = cryptDhmKeyLenByType(keyType)) <= 0)
+ 		goto_error(finish, "Invalid size");
+ 
++	mbedtls_mpi dhm_P, dhm_G;
++	mbedtls_mpi_init(&dhm_P);
++	mbedtls_mpi_init(&dhm_G);
++    mbedtls_dhm_init(dhm);
+ 
+ 	if (keyType == CRYPT_DHM2048_TYPE) {
+ 		static const unsigned char modp2048P[(2048/8)] = MBEDTLS_DHM_RFC3526_MODP_2048_P_BIN;
+ 		static const unsigned char modp2048G[1] = MBEDTLS_DHM_RFC3526_MODP_2048_G_BIN;
+ 
+-		if ((ret = mbedtls_mpi_read_binary(&dhm->P, modp2048P, sizeof(modp2048P) )) != 0 || (ret = mbedtls_mpi_read_binary(&dhm->G, modp2048G, sizeof(modp2048G))) != 0)
+-			goto_error(finish, "Failed reading dhm2048 parameters!");
++		if (   (ret = mbedtls_mpi_read_binary(&dhm_P, modp2048P, sizeof(modp2048P) )) != 0
++			|| (ret = mbedtls_mpi_read_binary(&dhm_G, modp2048G, sizeof(modp2048G))) != 0)
++			goto_error(finish, "Failed setting dhm2048 parameters!");
+ 
+ 	} else if (keyType == CRYPT_DHM3072_TYPE) {
+ 		static const unsigned char modp3072P[(3072/8)] = MBEDTLS_DHM_RFC3526_MODP_3072_P_BIN;
+ 		static const unsigned char modp3072G[1] = MBEDTLS_DHM_RFC3526_MODP_3072_G_BIN;
+-		if ((ret = mbedtls_mpi_read_binary(&dhm->P, modp3072P, sizeof(modp3072P) )) != 0 || (ret = mbedtls_mpi_read_binary(&dhm->G, modp3072G, sizeof(modp3072G))) != 0)
+-			goto_error(finish, "Failed reading dhm3072 parameters!");
++
++		if (   (ret = mbedtls_mpi_read_binary(&dhm_P, modp3072P, sizeof(modp3072P) )) != 0
++			|| (ret = mbedtls_mpi_read_binary(&dhm_G, modp3072G, sizeof(modp3072G))) != 0)
++			goto_error(finish, "Failed setting dhm3072 parameters!");
++
+ 	} else {
+ 		goto_error(finish, "Unsupported dhm type!");
+ 	}
+ 
+-	if (mbedtls_mpi_cmp_int(&dhm->P, 0) == 0)
++	if (mbedtls_mpi_cmp_int(&dhm_P, 0) == 0)
+ 		goto_error(finish, "Empty dhm->P");
+ 
+-	// Generate X as large as possible ( < P )
+-	if ((pSize = mbedtls_mpi_size(&dhm->P)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm_P)) != keyLen)
+ 		goto_error(finish, "Invalid P size");
+ 
+-	do {
+-		if ((ret = mbedtls_mpi_fill_random(&dhm->X, pSize, mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
+-			goto_error(finish, "Failed allocating randomness");
+-
+-		while (mbedtls_mpi_cmp_mpi(&dhm->X, &dhm->P) >= 0) {
+-			if ((ret = mbedtls_mpi_shift_r(&dhm->X, 1)) != 0)
+-				goto_error(finish, "Failed shifting dhm->X param");
+-		}
+-
+-		if ((ret = count++) > 10)
+-			goto_error(finish, "Failed creating dhm->X param");
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if ((pSize = mbedtls_dhm_get_len(dhm)) != keyLen)
++		goto_error(finish, "Invalid P size");
++#endif
+ 
+-	} while ((ret = _cryptDhmCheckRange(&dhm->X, &dhm->P)) != SUCCESS);
++	if ((ret = mbedtls_dhm_set_group(dhm, &dhm_P, &dhm_G) != 0))
++		goto_error(finish, "Failed grouping dhm parameters!");
+ 
+-	// Calculate GX = G^X mod P
+-	if (mbedtls_mpi_exp_mod(&dhm->GX, &dhm->G, &dhm->X, &dhm->P, &dhm->RP) != 0)
+-		goto_error(finish, "Failed creating GX modulo");
+-	if (((int) (dhm->len = mbedtls_mpi_size(&dhm->P))) != keyLen)
+-		goto_error(finish, "Invalid len");
+-	if ((xSize = mbedtls_mpi_size(&dhm->X)) != keyLen)
+-		goto_error(finish, "Invalid X size");
+-	if ((gxSize = mbedtls_mpi_size(&dhm->GX)) != keyLen)
+-		goto_error(finish, "Invalid GX size");
+-	if ((ret = _cryptDhmCheckRange(&dhm->GX, &dhm->P)) != SUCCESS)
+-		goto_error(finish, "Invalid GX range");
++    if ((ret = mbedtls_dhm_make_public(dhm, (int) keyLen, dummyPubKeyBuff, keyLen,
++                                       mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
++		goto_error(finish, "Failed creating dhm key pair");
+ 
+ 	key->rawGXType = keyType;
+ 	key->rawGXLen = keyLen;
+ 
+ finish:
+ 	dbgf(goto_error_code ? DBGL_SYS : DBGL_CHANGES, goto_error_code ? DBGT_ERR : DBGT_INFO,
+-		"%s ret=%d keyType=%d keyLen=%d pSize=%d xSize=%d gxSize=%d count=%d attempt=%d",
+-		goto_error_code, ret, keyType, keyLen, pSize, xSize, gxSize, count, attempt);
++		"%s ret=%d keyType=%d keyLen=%d pSize=%d attempt=%d",
++		goto_error_code, ret, keyType, keyLen, pSize, attempt);
+ 
+ 	if (goto_error_code) {
+ 		cryptDhmKeyFree(&key);
+@@ -222,6 +215,9 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 		return NULL;
+ 	}
+ 
++	mbedtls_mpi_free(&dhm_G);
++	mbedtls_mpi_free(&dhm_P);
++
+ 	return key;
+ }
+ 
+@@ -231,9 +227,14 @@ void cryptDhmPubKeyGetRaw(CRYPTDHM_T* key, uint8_t* buff, uint16_t buffLen)
+ 		"Failed: key=%d buff=%d buffLen=%d key.GXLen=%d", !!key, !!buff, buffLen, key ? key->rawGXLen : 0);
+ 
+ 	mbedtls_dhm_context *dhm = key->backendKey;
+-
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	assertion_dbg(-502720, (dhm && buffLen == mbedtls_mpi_size(&dhm->GX) && buffLen == dhm->len),
+ 		"Failed: dhm.GXlen=%zd dhm.len=%zd", dhm ? mbedtls_mpi_size(&dhm->GX) : 0, dhm ? dhm->len : 0);
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	assertion_dbg(-502720, (dhm && buffLen == mbedtls_dhm_get_len(dhm)),
++		"Failed: dhm.len=%zd", dhm ? mbedtls_dhm_get_len(dhm) : 0);
++#endif
++
+ 
+ 	mbedtls_mpi_write_binary(&dhm->GX, buff, key->rawGXLen);
+ }
+@@ -256,6 +257,7 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 		goto_error(finish, "Missing type");
+ 	if ((keyLen = cryptDhmKeyLenByType(keyType)) <= 0)
+ 		goto_error(finish, "Invalid size");
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	if ((int) dhm->len != keyLen)
+ 		goto_error(finish, "Invalid len");
+ 	if ((pSize = mbedtls_mpi_size(&dhm->P)) != keyLen)
+@@ -270,6 +272,10 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 		goto_error(finish, "Invalid GX range");
+ 	if (_cryptDhmCheckRange(&dhm->GY, &dhm->P) != SUCCESS)
+ 		goto_error(finish, "Invalid GY range");
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if ((pSize = mbedtls_dhm_get_len(dhm)) != keyLen)
++		goto_error(finish, "Invalid len");
++#endif
+ 
+ 	return SUCCESS;
+ 
+@@ -293,10 +299,17 @@ CRYPTSHA_T *cryptDhmSecretForNeigh(CRYPTDHM_T *myDhm, uint8_t *neighRawKey, uint
+ 	if (!myDhm || !(dhm = myDhm->backendKey) || !myDhm->rawGXType)
+ 		goto_error(finish, "Disabled dhm link signing");
+ 
+-	if (((keyType = cryptDhmKeyTypeByLen(neighRawKeyLen)) != myDhm->rawGXType) || ((n = dhm->len) != neighRawKeyLen) || (sizeof(buff) < neighRawKeyLen))
+-		goto_error(finish, "Wrong type or keyLength");
++	if (((keyType = cryptDhmKeyTypeByLen(neighRawKeyLen)) != myDhm->rawGXType))
++		goto_error(finish, "Wrong type");
+ 
+-	if ((ret = mbedtls_mpi_read_binary(&dhm->GY, neighRawKey, neighRawKeyLen)) != 0)
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++	if (((n = dhm->len) != neighRawKeyLen) || (sizeof(buff) < neighRawKeyLen))
++		goto_error(finish, "Wrong keyLength");
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if (((n = mbedtls_dhm_get_len(dhm)) != neighRawKeyLen) || (sizeof(buff) < neighRawKeyLen))
++		goto_error(finish, "Wrong keyLength");
++#endif
++	if ((ret = mbedtls_dhm_read_public(dhm, neighRawKey, neighRawKeyLen)) != 0)
+ 		goto_error(finish, "Invalid GY");
+ 
+ 	if (cryptDhmKeyCheck(myDhm) != SUCCESS)
+@@ -311,14 +324,13 @@ CRYPTSHA_T *cryptDhmSecretForNeigh(CRYPTDHM_T *myDhm, uint8_t *neighRawKey, uint
+ 	secret = debugMallocReset(sizeof(CRYPTSHA_T), -300831);
+ 	cryptShaAtomic(buff, n, secret);
+ 
+-
+ finish:
+ 	{
+ 		dbgf(((goto_error_code || n != neighRawKeyLen) ? DBGL_SYS : DBGL_CHANGES), ((goto_error_code || n != neighRawKeyLen) ? DBGT_WARN : DBGT_INFO),
+ 		"%s n=%zd neighKeyLen=%d myKeyLen=%d", goto_error_code, n, neighRawKeyLen, myDhm->rawGXLen);
+ 
+-		mbedtls_mpi_free(&dhm->GY);
+-		mbedtls_mpi_free(&dhm->K);
++//		mbedtls_mpi_free(&dhm->GY);
++//		mbedtls_mpi_free(&dhm->K);
+ 		memset(buff, 0, sizeof(buff));
+ 		return secret; }
+ }
+@@ -345,12 +357,21 @@ int cryptRsaPubKeyGetRaw(CRYPTRSA_T *key, uint8_t *buff, uint16_t buffLen)
+ 	mbedtls_rsa_context *rsa;
+ 	if (!key || !buff || !buffLen ||
+ 		!key->rawKeyType || (buffLen != key->rawKeyLen) ||
+-		!(rsa = (mbedtls_rsa_context*) key->backendKey) || buffLen != mbedtls_mpi_size(&rsa->N) || buffLen != rsa->len) {
++		!(rsa = (mbedtls_rsa_context*) key->backendKey) ||
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++		buffLen != mbedtls_mpi_size(&rsa->N) || buffLen != rsa->len ||
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++#endif
++		buffLen != mbedtls_rsa_get_len(rsa)
++	   ) {
+ 
+ 		return FAILURE;
+ 	}
+ 
+-	if (mbedtls_mpi_write_binary(&rsa->N, buff, buffLen) != 0)
++	mbedtls_mpi mpi_N;
++	mbedtls_mpi_init(&mpi_N);
++	mbedtls_rsa_export(rsa, &mpi_N, NULL, NULL, NULL, NULL);
++	if (mbedtls_mpi_write_binary(&mpi_N, buff, buffLen) != 0)
+ 		return FAILURE;
+ 
+ 	return SUCCESS;
+@@ -368,10 +389,11 @@ CRYPTRSA_T *cryptRsaPubKeyFromRaw(uint8_t *rawKey, uint16_t rawKeyLen)
+ 	cryptKey->backendKey = debugMalloc(sizeof(mbedtls_rsa_context), -300620);
+ 
+ 	mbedtls_rsa_context *rsa = (mbedtls_rsa_context*) cryptKey->backendKey;
++	mbedtls_mpi rsa_N, rsa_E;
+ 
+-	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
+-
+-
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE);
++	/*
+ 	if (
+ 		(mbedtls_mpi_read_binary(&rsa->N, rawKey, rawKeyLen)) ||
+ 		(mbedtls_mpi_read_binary(&rsa->E, (uint8_t*) & e, sizeof(e)))
+@@ -379,8 +401,23 @@ CRYPTRSA_T *cryptRsaPubKeyFromRaw(uint8_t *rawKey, uint16_t rawKeyLen)
+ 		cryptRsaKeyFree(&cryptKey);
+ 		return NULL;
+ 	}
++	*/
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	mbedtls_rsa_init(rsa);
++#endif
++	mbedtls_mpi_init(&rsa_N);
++	mbedtls_mpi_init(&rsa_E);
++
++	if (
++		(mbedtls_mpi_read_binary(&rsa_N, rawKey, rawKeyLen)) ||
++		(mbedtls_mpi_read_binary(&rsa_E, (uint8_t*)&e, sizeof(e))) ||
++		(mbedtls_rsa_import(rsa, &rsa_N, NULL, NULL, NULL, &rsa_E))
++	) {
++		cryptRsaKeyFree(&cryptKey);
++		return NULL;
++	}
+ 
+-	rsa->len = rawKeyLen;
++	assertion(-500000, (mbedtls_rsa_get_len(rsa) == rawKeyLen));
+ 	cryptKey->rawKeyLen = rawKeyLen;
+ 	cryptKey->rawKeyType = cryptRsaKeyTypeByLen(rawKeyLen);
+ 
+@@ -401,9 +438,16 @@ int cryptRsaPubKeyCheck(CRYPTRSA_T *pubKey)
+ 	assertion(-502142, (pubKey->backendKey));
+ 
+ 	mbedtls_rsa_context *rsa = (mbedtls_rsa_context*) pubKey->backendKey;
++	size_t len = mbedtls_rsa_get_len(rsa);
+ 
+-	if (!rsa->len || (int) rsa->len != cryptRsaKeyLenByType(pubKey->rawKeyType) || rsa->len != pubKey->rawKeyLen || rsa->len != mbedtls_mpi_size(&rsa->N) ||
+-		mbedtls_rsa_check_pubkey((mbedtls_rsa_context*) pubKey->backendKey)) {
++	if (   !len
++	    || (int) len != cryptRsaKeyLenByType(pubKey->rawKeyType)
++		|| len != pubKey->rawKeyLen
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++		|| len != mbedtls_mpi_size(&rsa->N)
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++#endif
++		|| mbedtls_rsa_check_pubkey((mbedtls_rsa_context*) pubKey->backendKey)) {
+ 
+ 		return FAILURE;
+ 	}
+@@ -462,10 +506,18 @@ CRYPTRSA_T *cryptRsaKeyFromDer(char *keyPath)
+ 
+ 	mbedtls_pk_context pk;
+ 	mbedtls_pk_init(&pk);
+-	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE);
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	mbedtls_rsa_init(rsa);
++#endif
+ 
+ 	if (
+-		((ret = mbedtls_pk_parse_keyfile(&pk, keyPath, "")) != 0) ||
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++			((ret = mbedtls_pk_parse_keyfile(&pk, keyPath, "")) != 0) ||
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++			((ret = mbedtls_pk_parse_keyfile(&pk, keyPath, "", mbedtls_ctr_drbg_random, &ctr_drbg)) != 0) ||
++#endif
+ 		((ret = mbedtls_rsa_copy(rsa, mbedtls_pk_rsa(pk))) != 0) ||
+ 		((ret = mbedtls_rsa_check_privkey(rsa)) != 0)
+ 		) {
+@@ -478,9 +530,8 @@ CRYPTRSA_T *cryptRsaKeyFromDer(char *keyPath)
+ 
+ 
+ 	//cryptKeyAddRaw(ckey);
+-
+ 	if (
+-		((keyLen = mbedtls_mpi_size(&rsa->N)) <= 0) ||
++		((keyLen = mbedtls_rsa_get_len(rsa)) <= 0) ||
+ 		!(keyType = cryptRsaKeyTypeByLen(keyLen)) ||
+ 		!(privKey->rawKeyType = keyType) ||
+ 		!(privKey->rawKeyLen = keyLen) ||
+@@ -490,6 +541,10 @@ CRYPTRSA_T *cryptRsaKeyFromDer(char *keyPath)
+ 		cryptRsaKeyFree(&privKey);
+ 		return NULL;
+ 	}
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++	assertion(-502723, (((int)mbedtls_mpi_size(&rsa->N)) == keyLen));
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++#endif
+ 
+ 	my_PrivKey = privKey;
+ 	return pubKey;
+@@ -565,7 +620,12 @@ CRYPTRSA_T *cryptRsaKeyMake(uint8_t keyType)
+ 	CRYPTRSA_T *key = debugMallocReset(sizeof(CRYPTRSA_T), -300642);
+ 
+ 	mbedtls_rsa_context *rsa = debugMallocReset(sizeof(mbedtls_rsa_context), -300643);
+-	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, 0);
++
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++	mbedtls_rsa_init(rsa, MBEDTLS_RSA_PKCS_V15, MBEDTLS_MD_NONE);
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	mbedtls_rsa_init(rsa);
++#endif
+ 
+ 	if ((ret = mbedtls_rsa_gen_key(rsa, mbedtls_ctr_drbg_random, &ctr_drbg, (keyLen * 8), CRYPT_KEY_E_VAL)))
+ 		goto_error(finish, "Failed making rsa key!");
+@@ -591,30 +651,37 @@ CRYPTRSA_T *cryptRsaKeyMake(uint8_t keyType)
+ 
+ int cryptRsaEncrypt(uint8_t *in, size_t inLen, uint8_t *out, size_t *outLen, CRYPTRSA_T *pubKey)
+ {
+-
+ 	mbedtls_rsa_context *pk = pubKey->backendKey;
+-
+-	assertion(-502723, (mbedtls_mpi_size(&pk->N) == pubKey->rawKeyLen));
+ 	assertion(-502145, (*outLen >= pubKey->rawKeyLen));
++	assertion(-502723, (mbedtls_rsa_get_len(pk) == pubKey->rawKeyLen));
+ 
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	if (mbedtls_rsa_pkcs1_encrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, inLen, in, out))
+ 		return FAILURE;
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if (mbedtls_rsa_pkcs1_encrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, inLen, in, out))
++		return FAILURE;
++#endif
+ 
+ 	*outLen = pubKey->rawKeyLen;
+ 
+ 	return SUCCESS;
+-
+ }
+ 
+ int cryptRsaDecrypt(uint8_t *in, size_t inLen, uint8_t *out, size_t *outLen)
+ {
+-
+ 	mbedtls_rsa_context *pk = my_PrivKey->backendKey;
++	assertion(-502146, (inLen >= my_PrivKey->rawKeyLen));
++	assertion(-502724, (mbedtls_rsa_get_len(pk) == my_PrivKey->rawKeyLen));
+ 
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	assertion(-502724, (mbedtls_mpi_size(&pk->N) == my_PrivKey->rawKeyLen));
+-	assertion(-502146, (inLen >= my_PrivKey->rawKeyLen));
+ 	if (mbedtls_rsa_pkcs1_decrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, &inLen, in, out, *outLen))
+ 		return FAILURE;
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if (mbedtls_rsa_pkcs1_decrypt(pk, mbedtls_ctr_drbg_random, &ctr_drbg, &inLen, in, out, *outLen))
++		return FAILURE;
++#endif
+ 	*outLen = inLen;
+ 
+ 	return SUCCESS;
+@@ -631,8 +698,13 @@ int cryptRsaSign(CRYPTSHA_T *inSha, uint8_t *out, size_t outLen, CRYPTRSA_T *cry
+ 	if (outLen < cryptKey->rawKeyLen)
+ 		return FAILURE;
+ 
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	if (mbedtls_rsa_pkcs1_sign(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PRIVATE, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) inSha, out))
+ 		return FAILURE;
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if (mbedtls_rsa_pkcs1_sign(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) inSha, out))
++		return FAILURE;
++#endif
+ 
+ 	return SUCCESS;
+ }
+@@ -643,9 +715,26 @@ int cryptRsaVerify(uint8_t *sign, size_t signLen, CRYPTSHA_T *plainSha, CRYPTRSA
+ 	mbedtls_rsa_context *pk = pubKey->backendKey;
+ 
+ 	assertion(-502147, (signLen == pubKey->rawKeyLen));
++/*
++    mbedtls_rsa_context rsa;
++    mbedtls_mpi N, E;
++    mbedtls_rsa_init(&rsa);
++    mbedtls_mpi_init(&N);
++    mbedtls_mpi_init(&E);
++
++    if ((ret = mbedtls_mpi_read_file(&N, 16, f)) != 0 ||
++        (ret = mbedtls_mpi_read_file(&E, 16, f)) != 0 ||
++        (ret = mbedtls_rsa_import(&rsa, &N, NULL, NULL, NULL, &E) != 0))
++    	return FAILURE;
++*/
+ 
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	if (mbedtls_rsa_pkcs1_verify(pk, mbedtls_ctr_drbg_random, &ctr_drbg, MBEDTLS_RSA_PUBLIC, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
+ 		return FAILURE;
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if (mbedtls_rsa_pkcs1_verify(pk, MBEDTLS_MD_SHA224, sizeof(CRYPTSHA_T), (uint8_t*) plainSha, sign))
++		return FAILURE;
++#endif
+ 
+ 	return SUCCESS;
+ }
+@@ -776,7 +865,7 @@ void cryptShaFinal(CRYPTSHA_T *sha)
+ #if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	mbedtls_sha256_finish_ret(&sha_ctx, output);
+ #else
+-	mbedtls_sha256_finish(&sha_ctx, output;)
++	mbedtls_sha256_finish(&sha_ctx, output);
+ #endif
+ 	memcpy(sha, output, sizeof(CRYPTSHA_T));
+ 	memset(output, 0, sizeof(output));
+diff --git a/src/crypt.h b/src/crypt.h
+index da34d4e..119c788 100644
+--- a/src/crypt.h
++++ b/src/crypt.h
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2010  Axel Neumann
++ * Copyright (c) 2024  Axel Neumann
+  * This program is free software; you can redistribute it and/or
+  * modify it under the terms of version 2 of the GNU General Public
+  * License as published by the Free Software Foundation.
+@@ -30,6 +30,7 @@
+ 
+ #ifndef CRYPTLIB
+ #define CRYPTLIB MBEDTLS_2_8_0
++//#define CRYPTLIB MBEDTLS_3_6_0
+ #endif
+ 
+ #define CRYPT_DER_BUF_SZ 16000

package/bmx7/0006-support-mbedtls-3-6-0-also-disable-no-further-supported.patch

@@ -0,0 +1,396 @@
+From fb45b7d30899ee295a0580cdab6710b510150f73 Mon Sep 17 00:00:00 2001
+From: Axel Neumann <axel@notmail.org>
+Date: Sat, 18 May 2024 14:00:49 +0200
+Subject: [PATCH] Support mbedtls-3.6.0 Also disable no-further-supported
+ RSA896
+
+Upstream: https://github.com/bmx-routing/bmx7/commit/fb45b7d30899ee295a0580cdab6710b510150f73
+[thomas: backport to 7.1.1]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/Common.mk |  2 +-
+ src/crypt.c   | 71 ++++++++++++++++++++++++---------------------------
+ src/crypt.h   |  4 +--
+ src/msg.c     |  6 ++---
+ src/sec.c     | 28 ++++++++++++--------
+ src/sec.h     | 18 ++++++-------
+ 6 files changed, 67 insertions(+), 62 deletions(-)
+
+diff --git a/src/Common.mk b/src/Common.mk
+index 32b2d34..c73df44 100644
+--- a/src/Common.mk
++++ b/src/Common.mk
+@@ -2,7 +2,7 @@ GIT_REV ?= $(shell [ -r .git ] && git --no-pager log -n 1 --oneline | cut -d " "
+
+ CFLAGS += -pedantic -W -Wall -Wstrict-prototypes -Wno-unused-parameter -Os -g3 -std=gnu99 -DGIT_REV=\"$(GIT_REV)\"
+ # CFLAGS += -DHAVE_CONFIG_H
+-# CFLAGS += -DCRYPTLIB=MBEDTLS_2_4_0 # POLARSSL_1_2_5 POLARSSL_1_2_9 POLARSSL_1_3_3 POLARSSL_1_3_4 CYASSL_2_8_0
++# CFLAGS += -DCRYPTLIB=MBEDTLS_2_8_0 # -DCRYPTLIB=MBEDTLS_3_6_0
+
+ # optional defines:
+ # CFLAGS += -static
+diff --git a/src/crypt.c b/src/crypt.c
+index 91543ef..69918a1 100644
+--- a/src/crypt.c
++++ b/src/crypt.c
+@@ -66,18 +66,16 @@ static mbedtls_sha256_context sha_ctx;
+
+ uint8_t cryptDhmKeyTypeByLen(int len)
+ {
+-	return len == CRYPT_DHM1024_LEN ? CRYPT_DHM1024_TYPE : (
+-		len == CRYPT_DHM2048_LEN ? CRYPT_DHM2048_TYPE : (
++	return len == CRYPT_DHM2048_LEN ? CRYPT_DHM2048_TYPE : (
+ 		len == CRYPT_DHM3072_LEN ? CRYPT_DHM3072_TYPE : (
+-		0)));
++		0));
+ }
+
+ uint16_t cryptDhmKeyLenByType(int type)
+ {
+-	return type == CRYPT_DHM1024_TYPE ? CRYPT_DHM1024_LEN : (
+-		type == CRYPT_DHM2048_TYPE ? CRYPT_DHM2048_LEN : (
++	return type == CRYPT_DHM2048_TYPE ? CRYPT_DHM2048_LEN : (
+ 		type == CRYPT_DHM3072_TYPE ? CRYPT_DHM3072_LEN : (
+-		0)));
++		0));
+ }
+
+ char *cryptDhmKeyTypeAsString(int type)
+@@ -104,6 +102,7 @@ void cryptDhmKeyFree(CRYPTDHM_T **cryptKey)
+ 	*cryptKey = NULL;
+ }
+
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ /*
+  * Verify sanity of parameter with regards to P
+  *
+@@ -134,10 +133,10 @@ static int _cryptDhmCheckRange(const mbedtls_mpi *param, const mbedtls_mpi *P)
+ 	mbedtls_mpi_free(&U);
+ 	return( ret);
+ }
++#endif
+
+ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ {
+-
+ 	int ret = 0;
+ 	char *goto_error_code = NULL;
+ 	int keyLen = 0;
+@@ -184,11 +183,6 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+ 	if ((pSize = mbedtls_mpi_size(&dhm_P)) != keyLen)
+ 		goto_error(finish, "Invalid P size");
+
+-#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+-#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
+-	if ((pSize = mbedtls_dhm_get_len(dhm)) != keyLen)
+-		goto_error(finish, "Invalid P size");
+-#endif
+
+ 	if ((ret = mbedtls_dhm_set_group(dhm, &dhm_P, &dhm_G) != 0))
+ 		goto_error(finish, "Failed grouping dhm parameters!");
+@@ -197,19 +191,25 @@ CRYPTDHM_T *cryptDhmKeyMake(uint8_t keyType, uint8_t attempt)
+                                        mbedtls_ctr_drbg_random, &ctr_drbg)) != 0)
+ 		goto_error(finish, "Failed creating dhm key pair");
+
++#if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
++#elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
++	if ((pSize = mbedtls_dhm_get_len(dhm)) != keyLen)
++		goto_error(finish, "Invalid dhm len");
++#endif
++
+ 	key->rawGXType = keyType;
+ 	key->rawGXLen = keyLen;
+
+ finish:
+ 	dbgf(goto_error_code ? DBGL_SYS : DBGL_CHANGES, goto_error_code ? DBGT_ERR : DBGT_INFO,
+ 		"%s ret=%d keyType=%d keyLen=%d pSize=%d attempt=%d",
+-		goto_error_code, ret, keyType, keyLen, pSize, attempt);
++		goto_error_code?goto_error_code:"SUCCESS", ret, keyType, keyLen, pSize, attempt);
+
+ 	if (goto_error_code) {
+ 		cryptDhmKeyFree(&key);
+
+-		if ((++attempt) < 10)
+-			return cryptDhmKeyMake(keyType, attempt);
++//		if ((++attempt) < 10)
++//			return cryptDhmKeyMake(keyType, attempt);
+
+ 		assertion(-502718, (0));
+ 		return NULL;
+@@ -230,13 +230,19 @@ void cryptDhmPubKeyGetRaw(CRYPTDHM_T* key, uint8_t* buff, uint16_t buffLen)
+ #if (CRYPTLIB >= MBEDTLS_2_8_0 && CRYPTLIB < MBEDTLS_3_0_0)
+ 	assertion_dbg(-502720, (dhm && buffLen == mbedtls_mpi_size(&dhm->GX) && buffLen == dhm->len),
+ 		"Failed: dhm.GXlen=%zd dhm.len=%zd", dhm ? mbedtls_mpi_size(&dhm->GX) : 0, dhm ? dhm->len : 0);
++
++	mbedtls_mpi_write_binary(&dhm->GX, buff, key->rawGXLen);
++
+ #elif (CRYPTLIB >= MBEDTLS_3_0_0 && CRYPTLIB < MBEDTLS_MAX)
+ 	assertion_dbg(-502720, (dhm && buffLen == mbedtls_dhm_get_len(dhm)),
+ 		"Failed: dhm.len=%zd", dhm ? mbedtls_dhm_get_len(dhm) : 0);
+-#endif
+-
+
+-	mbedtls_mpi_write_binary(&dhm->GX, buff, key->rawGXLen);
++	mbedtls_mpi mpi_GX;
++	mbedtls_mpi_init(&mpi_GX);
++	mbedtls_dhm_get_value(dhm, MBEDTLS_DHM_PARAM_GX, &mpi_GX);
++	mbedtls_mpi_write_binary(&mpi_GX, buff, key->rawGXLen);
++	mbedtls_mpi_free(&mpi_GX);
++#endif
+ }
+
+ STATIC_FUNC
+@@ -247,9 +253,6 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 	uint8_t keyType = 0;
+ 	int keyLen = 0;
+ 	int pSize = 0;
+-	int xSize = 0;
+-	int gxSize = 0;
+-	int gySize = 0;
+
+ 	if (!(dhm = (mbedtls_dhm_context *) key->backendKey))
+ 		goto_error(finish, "Missing backend key");
+@@ -262,11 +265,11 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 		goto_error(finish, "Invalid len");
+ 	if ((pSize = mbedtls_mpi_size(&dhm->P)) != keyLen)
+ 		goto_error(finish, "Invalid P size");
+-	if ((xSize = mbedtls_mpi_size(&dhm->X)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm->X)) != keyLen)
+ 		goto_error(finish, "Invalid X size");
+-	if ((gxSize = mbedtls_mpi_size(&dhm->GX)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm->GX)) != keyLen)
+ 		goto_error(finish, "Invalid GX size");
+-	if ((gySize = mbedtls_mpi_size(&dhm->GY)) != keyLen)
++	if ((pSize = mbedtls_mpi_size(&dhm->GY)) != keyLen)
+ 		goto_error(finish, "Invalid GY size");
+ 	if (_cryptDhmCheckRange(&dhm->GX, &dhm->P) != SUCCESS)
+ 		goto_error(finish, "Invalid GX range");
+@@ -280,8 +283,7 @@ IDM_T cryptDhmKeyCheck(CRYPTDHM_T *key)
+ 	return SUCCESS;
+
+ finish:
+-	dbgf_track(DBGT_WARN, "%s keyType=%d keyLen=%d dhmLen=%zd pSize=%d xSize=%d gxSize=%d gySize=%d",
+-		goto_error_code, keyType, keyLen, dhm ? dhm->len : 0, pSize, xSize, gxSize, gySize);
++	dbgf_track(DBGT_WARN, "%s keyType=%d keyLen=%d dhmLen=%zd", goto_error_code, keyType, keyLen, pSize);
+
+ 	return FAILURE;
+ }
+@@ -641,7 +643,8 @@ finish:
+
+ 			cryptRsaKeyFree(&key);
+
+-			dbgf_sys(DBGT_ERR, "%s ret=%d", goto_error_code, ret);
++			dbgf_sys(DBGT_ERR, "%s ret=%d len=%d", goto_error_code, ret, keyLen);
++			assertion(-500000, 0);
+ 			return NULL;
+ 		}
+
+@@ -923,28 +926,22 @@ int cryptShasEqual(CRYPTSHA_T *shaA, CRYPTSHA_T *shaB)
+
+ uint8_t cryptRsaKeyTypeByLen(int len)
+ {
+-	return len == CRYPT_RSA512_LEN ? CRYPT_RSA512_TYPE : (
+-		len == CRYPT_RSA768_LEN ? CRYPT_RSA768_TYPE : (
+-		len == CRYPT_RSA896_LEN ? CRYPT_RSA896_TYPE : (
+-		len == CRYPT_RSA1024_LEN ? CRYPT_RSA1024_TYPE : (
++	return len == CRYPT_RSA1024_LEN ? CRYPT_RSA1024_TYPE : (
+ 		len == CRYPT_RSA1536_LEN ? CRYPT_RSA1536_TYPE : (
+ 		len == CRYPT_RSA2048_LEN ? CRYPT_RSA2048_TYPE : (
+ 		len == CRYPT_RSA3072_LEN ? CRYPT_RSA3072_TYPE : (
+ 		len == CRYPT_RSA4096_LEN ? CRYPT_RSA4096_TYPE : (
+-		0))))))));
++		0)))));
+ }
+
+ uint16_t cryptRsaKeyLenByType(int type)
+ {
+-	return type == CRYPT_RSA512_TYPE ? CRYPT_RSA512_LEN : (
+-		type == CRYPT_RSA768_TYPE ? CRYPT_RSA768_LEN : (
+-		type == CRYPT_RSA896_TYPE ? CRYPT_RSA896_LEN : (
+-		type == CRYPT_RSA1024_TYPE ? CRYPT_RSA1024_LEN : (
++	return 	type == CRYPT_RSA1024_TYPE ? CRYPT_RSA1024_LEN : (
+ 		type == CRYPT_RSA1536_TYPE ? CRYPT_RSA1536_LEN : (
+ 		type == CRYPT_RSA2048_TYPE ? CRYPT_RSA2048_LEN : (
+ 		type == CRYPT_RSA3072_TYPE ? CRYPT_RSA3072_LEN : (
+ 		type == CRYPT_RSA4096_TYPE ? CRYPT_RSA4096_LEN : (
+-		0))))))));
++		0)))));
+ }
+
+ char *cryptRsaKeyTypeAsString(int type)
+diff --git a/src/crypt.h b/src/crypt.h
+index 119c788..cae8df7 100644
+--- a/src/crypt.h
++++ b/src/crypt.h
+@@ -63,7 +63,7 @@
+ #define CRYPT_RSA4096_LEN  (4096/8) //512
+ #define CRYPT_RSA4096_NAME "RSA4096"
+
+-#define CRYPT_RSA_MIN_TYPE CRYPT_RSA512_TYPE
++#define CRYPT_RSA_MIN_TYPE CRYPT_RSA1024_TYPE
+ #define CRYPT_RSA_MAX_TYPE 8
+ #define CRYPT_RSA_MAX_LEN  512
+
+@@ -77,7 +77,7 @@
+ #define CRYPT_DHM3072_LEN  (3072/8)
+ #define CRYPT_DHM3072_NAME "DH3072M112"
+
+-#define CRYPT_DHM_MIN_TYPE CRYPT_DHM1024_TYPE
++#define CRYPT_DHM_MIN_TYPE CRYPT_DHM2048_TYPE
+ #define CRYPT_DHM_MAX_TYPE CRYPT_DHM3072_TYPE
+ #define CRYPT_DHM_MAX_LEN CRYPT_DHM3072_LEN
+
+diff --git a/src/msg.c b/src/msg.c
+index e04358c..22c22da 100644
+--- a/src/msg.c
++++ b/src/msg.c
+@@ -924,9 +924,9 @@ void tx_packets(void *unused)
+ 			assertion(-502442, (it.frame_type < FRAME_TYPE_SIGNATURE_ADV || it.frame_type > FRAME_TYPE_OGM_AGG_SQN_ADV));
+ 			assertion(-502443, (!it.frame_cache_msgs_size));
+ 			assertion(-500430, (it.frames_out_pos)); // single message larger than MAX_UDPD_SIZE
+-			assertion_dbg(-502444, IMPLIES((it.frame_type > FRAME_TYPE_OGM_AGG_SQN_ADV),
+-				it.frames_out_pos > (int) (FRM_SIGN_VERS_SIZE_MIN + ((my_RsaLinkKey && !my_DhmLinkKey) ? my_RsaLinkKey->rawKeyLen : 0))),
+-				"%d %d %lu %d+%d", it.frame_type, it.frames_out_pos, FRM_SIGN_VERS_SIZE_MIN, !!my_DhmLinkKey, (my_RsaLinkKey ? my_RsaLinkKey->rawKeyLen : 0));
++//			assertion_dbg(-502444, IMPLIES((it.frame_type > FRAME_TYPE_OGM_AGG_SQN_ADV),
++//				it.frames_out_pos > (int) (FRM_SIGN_VERS_SIZE_MIN + ((my_RsaLinkKey && !my_DhmLinkKey) ? my_RsaLinkKey->rawKeyLen : 0))),
++//				"%d %d %lu %d+%d", it.frame_type, it.frames_out_pos, FRM_SIGN_VERS_SIZE_MIN, !!my_DhmLinkKey, (my_RsaLinkKey ? my_RsaLinkKey->rawKeyLen : 0));
+ 		}
+
+ 		assertion_dbg(-502519, (++cnt) < 10000, "cnt=%d result=%d nextFType=%d fType=%d fLen=%d fPos=%d fPosMax=%d",
+diff --git a/src/sec.c b/src/sec.c
+index bbd65cf..cde3813 100644
+--- a/src/sec.c
++++ b/src/sec.c
+@@ -862,6 +862,8 @@ void createMyDhmLinkKey(IDM_T randomLifetime)
+
+ 	my_DhmLinkKey = cryptDhmKeyMake(linkDhmSignType, 0);
+
++	assertion(-500000, my_DhmLinkKey);
++
+ 	my_DhmLinkKey->endOfLife = (linkSignLifetime ? bmx_time_sec + thisSignLifetime : 0);
+
+ 	if (linkSignLifetime)
+@@ -913,7 +915,7 @@ int process_dsc_tlv_dhmLinkKey(struct rx_frame_iterator *it)
+ 	char *goto_error_code = NULL;
+ 	int32_t msgLen = it->f_dlen;
+ 	struct dsc_msg_dhm_link_key *msg = (struct dsc_msg_dhm_link_key*) (it->f_data);
+-
++	IDM_T TODO_Tolerate_unknown_dhm_link_keys_like_process_dsc_tlv_rsaPubKey;
+ 	if (it->op == TLV_OP_TEST) {
+
+ 		if (!msg)
+@@ -1017,7 +1019,7 @@ int create_dsc_tlv_rsaLinkKey(struct tx_frame_iterator *it)
+ }
+
+ STATIC_FUNC
+-int process_dsc_tlv_pubKey(struct rx_frame_iterator *it)
++int process_dsc_tlv_rsaPubKey(struct rx_frame_iterator *it)
+ {
+ 	char *goto_error_code = NULL;
+ 	CRYPTRSA_T *pkey = NULL;
+@@ -1026,14 +1028,20 @@ int process_dsc_tlv_pubKey(struct rx_frame_iterator *it)
+
+ 	if (it->op == TLV_OP_TEST) {
+
+-		if (!msg || !cryptRsaKeyTypeAsString(msg->type) || cryptRsaKeyLenByType(msg->type) != key_len)
++		if (!msg)
+ 			goto_error(finish, "1");
+
+-		if (!(pkey = cryptRsaPubKeyFromRaw(msg->key, key_len)))
+-			goto_error(finish, "2");
++		if (cryptRsaKeyLenByType(msg->type))
++		{
++			if (!cryptRsaKeyTypeAsString(msg->type) || cryptRsaKeyLenByType(msg->type) != key_len)
++				goto_error(finish, "2");
++
++			if (!(pkey = cryptRsaPubKeyFromRaw(msg->key, key_len)))
++				goto_error(finish, "3");
+
+-		if (cryptRsaPubKeyCheck(pkey) != SUCCESS)
+-			goto_error(finish, "3");
++			if (cryptRsaPubKeyCheck(pkey) != SUCCESS)
++				goto_error(finish, "4");
++		}
+
+ 	} else if (it->op == TLV_OP_DEL && it->f_type == BMX_DSC_TLV_RSA_LINK_PUBKEY && it->on->neigh) {
+
+@@ -1045,7 +1053,7 @@ int process_dsc_tlv_pubKey(struct rx_frame_iterator *it)
+ 		if (it->on->neigh->rsaLinkKey)
+ 			cryptRsaKeyFree(&it->on->neigh->rsaLinkKey);
+
+-		if (msg) {
++		if (msg  && cryptRsaKeyLenByType(msg->type)) {
+ 			it->on->neigh->rsaLinkKey = cryptRsaPubKeyFromRaw(msg->key, cryptRsaKeyLenByType(msg->type));
+ 			assertion(-502206, (it->on->neigh->rsaLinkKey && cryptRsaPubKeyCheck(it->on->neigh->rsaLinkKey) == SUCCESS));
+ 		}
+@@ -2398,7 +2406,7 @@ void init_sec(void)
+ 	handl.dextReferencing = (int32_t*) & fref_always_l1;
+ 	handl.dextCompression = (int32_t*) & never_fzip;
+ 	handl.tx_frame_handler = create_dsc_tlv_nodeKey;
+-	handl.rx_frame_handler = process_dsc_tlv_pubKey;
++	handl.rx_frame_handler = process_dsc_tlv_rsaPubKey;
+ 	handl.msg_format = pubkey_format;
+ 	register_frame_handler(description_tlv_db, BMX_DSC_TLV_NODE_PUBKEY, &handl);
+
+@@ -2427,7 +2435,7 @@ void init_sec(void)
+ 	handl.dextReferencing = (int32_t*) & fref_always_l1;
+ 	handl.dextCompression = (int32_t*) & never_fzip;
+ 	handl.tx_frame_handler = create_dsc_tlv_rsaLinkKey;
+-	handl.rx_frame_handler = process_dsc_tlv_pubKey;
++	handl.rx_frame_handler = process_dsc_tlv_rsaPubKey;
+ 	handl.msg_format = pubkey_format;
+ 	register_frame_handler(description_tlv_db, BMX_DSC_TLV_RSA_LINK_PUBKEY, &handl);
+
+diff --git a/src/sec.h b/src/sec.h
+index 2266a29..5619a37 100644
+--- a/src/sec.h
++++ b/src/sec.h
+@@ -70,28 +70,28 @@
+
+
+ #define ARG_NODE_RSA_TX_TYPE "nodeRsaKey"
+-#define MIN_NODE_RSA_TX_TYPE CRYPT_RSA512_TYPE
++#define MIN_NODE_RSA_TX_TYPE CRYPT_RSA_MIN_TYPE
+ #define MAX_NODE_RSA_TX_TYPE CRYPT_RSA4096_TYPE
+ #define DEF_NODE_RSA_TX_TYPE CRYPT_RSA2048_TYPE
+-#define HLP_NODE_RSA_TX_TYPE "sign own descriptions with given RSA key type (1:512, 2:768, 3:896, 4:1024, 5:1536, 6:2048, 7:3072, 8:4096)"
++#define HLP_NODE_RSA_TX_TYPE "sign own descriptions with given RSA key type (4:1024, 5:1536, 6:2048, 7:3072, 8:4096)"
+
+ #define ARG_NODE_RSA_RX_TYPES "nodeRsaKeys"
+-#define MIN_NODE_RSA_RX_TYPES (1<<CRYPT_RSA512_TYPE)
++#define MIN_NODE_RSA_RX_TYPES (1<<CRYPT_RSA_MIN_TYPE)
+ #define MAX_NODE_RSA_RX_TYPES ((1<<CRYPT_RSA_MAX_TYPE)-1)
+-#define DEF_NODE_RSA_RX_TYPES ((1<<CRYPT_RSA512_TYPE) | (1<<CRYPT_RSA768_TYPE) | (1<<CRYPT_RSA896_TYPE) | (1<<CRYPT_RSA1024_TYPE) | (1<<CRYPT_RSA1536_TYPE) | (1<<CRYPT_RSA2048_TYPE) | (1<<CRYPT_RSA3072_TYPE) | (1<<CRYPT_RSA4096_TYPE))
++#define DEF_NODE_RSA_RX_TYPES ((1<<CRYPT_RSA1024_TYPE) | (1<<CRYPT_RSA1536_TYPE) | (1<<CRYPT_RSA2048_TYPE) | (1<<CRYPT_RSA3072_TYPE) | (1<<CRYPT_RSA4096_TYPE))
+ #define HLP_NODE_RSA_RX_TYPES "verify description signatures of flag-given RSA key types"
+
+ #define ARG_LINK_RSA_TX_TYPE "linkRsaKey"
+ #define MIN_LINK_RSA_TX_TYPE 0
+ #define MAX_LINK_RSA_TX_TYPE CRYPT_RSA2048_TYPE
+-#define DEF_LINK_RSA_TX_TYPE CRYPT_RSA896_TYPE
+-#define HLP_LINK_RSA_TX_TYPE "sign outgoing packets with given RSA key type (0:None and rely on DHM, 1:512, 2:768, 3:896, 4:1024, 5:1536, 6:2048)"
++#define DEF_LINK_RSA_TX_TYPE CRYPT_RSA1024_TYPE
++#define HLP_LINK_RSA_TX_TYPE "sign outgoing packets with given RSA key type (0:None and rely on DHM, 4:1024, 5:1536, 6:2048)"
+ extern int32_t linkRsaSignType;
+
+ #define ARG_LINK_RSA_RX_TYPES "linkRsaKeys"
+ #define MIN_LINK_RSA_RX_TYPES 0
+ #define MAX_LINK_RSA_RX_TYPES ((1<<CRYPT_RSA_MAX_TYPE)-1)
+-#define DEF_LINK_RSA_RX_TYPES ((1<<CRYPT_RSA512_TYPE) | (1<<CRYPT_RSA768_TYPE) | (1<<CRYPT_RSA896_TYPE) | (1<<CRYPT_RSA1024_TYPE) | (1<<CRYPT_RSA1536_TYPE) | (1<<CRYPT_RSA2048_TYPE))
++#define DEF_LINK_RSA_RX_TYPES ((1<<CRYPT_RSA1024_TYPE) | (1<<CRYPT_RSA1536_TYPE) | (1<<CRYPT_RSA2048_TYPE))
+ #define HLP_LINK_RSA_RX_TYPES "verify incoming link (packet) signaturs of flag-given RSA key types"
+
+ #define ARG_LINK_DHM_TX_TYPE "linkDhmKey"
+@@ -166,8 +166,8 @@ extern int32_t maxDhmNeighs;
+
+
+ extern CRYPTRSA_T *my_NodeKey;
+-extern CRYPTRSA_T *my_RsaLinkKey;
+-extern CRYPTDHM_T *my_DhmLinkKey;
++//extern CRYPTRSA_T *my_RsaLinkKey;
++//extern CRYPTDHM_T *my_DhmLinkKey;
+
+ typedef struct {
+ 	uint8_t u8[sizeof(CRYPTSHA112_T)];
+--
+2.50.0

package/bmx7/0007-detect-mbedtls-2-8-0-or-mbedtls-3-6-0-based-on-mbedtls-version-h.patch

@@ -0,0 +1,32 @@
+From 9020896f89006bc5d3487222eefc7ddea9e8b2bd Mon Sep 17 00:00:00 2001
+From: Axel Neumann <axel@notmail.org>
+Date: Sun, 19 May 2024 07:53:57 +0200
+Subject: [PATCH] Detect mbedtls-2.8.0 or mbedtls-3.6.0 based on
+ mbedtls/version.h
+
+Upstream: https://github.com/bmx-routing/bmx7/commit/9020896f89006bc5d3487222eefc7ddea9e8b2bd
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/crypt.h | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/src/crypt.h b/src/crypt.h
+index cae8df7..2dff0da 100644
+--- a/src/crypt.h
++++ b/src/crypt.h
+@@ -28,9 +28,13 @@
+ #define MBEDTLS_3_6_0  2360
+ #define MBEDTLS_MAX    2999
+ 
+-#ifndef CRYPTLIB
++#include "mbedtls/version.h"
++#ifndef MBEDTLS_VERSION_NUMBER
+ #define CRYPTLIB MBEDTLS_2_8_0
+-//#define CRYPTLIB MBEDTLS_3_6_0
++#elif (MBEDTLS_VERSION_NUMBER >= 0x01000000 && MBEDTLS_VERSION_NUMBER < 0x03000000)
++#define CRYPTLIB MBEDTLS_2_8_0
++#elif (MBEDTLS_VERSION_NUMBER >= 0x03000000)
++#define CRYPTLIB MBEDTLS_3_6_0
+ #endif
+ 
+ #define CRYPT_DER_BUF_SZ 16000

package/ca-certificates/ca-certificates.hash

@@ -1,4 +1,4 @@
 # hashes from: $(CA_CERTIFICATES_SITE)/ca-certificates_$(CA_CERTIFICATES_VERSION).dsc :
-sha256  dd8286d0a9dd35c756fea5f1df3fed1510fb891f376903891b003cd9b1ad7e03  ca-certificates_20241223.tar.xz
+sha256  33b44ef78653ecd3f0f2f13e5bba6be466be2e7da72182f737912b81798ba5d2  ca-certificates_20250419.tar.xz
 # Locally computed
 sha256  e85e1bcad3a915dc7e6f41412bc5bdeba275cadd817896ea0451f2140a93967c  debian/copyright

package/ca-certificates/ca-certificates.mk

@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-CA_CERTIFICATES_VERSION = 20241223
+CA_CERTIFICATES_VERSION = 20250419
 CA_CERTIFICATES_SOURCE = ca-certificates_$(CA_CERTIFICATES_VERSION).tar.xz
-CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20241223T143500Z/pool/main/c/ca-certificates
+CA_CERTIFICATES_SITE = https://snapshot.debian.org/archive/debian/20250419T084132Z/pool/main/c/ca-certificates
 CA_CERTIFICATES_DEPENDENCIES = host-openssl host-python3
 CA_CERTIFICATES_LICENSE = GPL-2.0+ (script), MPL-2.0 (data)
 CA_CERTIFICATES_LICENSE_FILES = debian/copyright

package/chartjs/chartjs.hash

@@ -1,3 +1,3 @@
 # Locally computed:
 sha256  111e0751796f087a51e94dfed910ccfb1278fd30e584a6e48514dba9ae7e72c6  chart.js-3.9.1.tgz
-sha256  5a0877ad6d818529be4f33009d0942cdf7e2ed7656156f4aba7308459a546030  package/LICENSE.md
+sha256  5a0877ad6d818529be4f33009d0942cdf7e2ed7656156f4aba7308459a546030  LICENSE.md

package/cifs-utils/cifs-utils.hash

@@ -1,5 +1,5 @@
 # Locally calculated after checking pgp signature
-sha256  c4e1eb5f4ad880d96e16d95a1cdbc7ec978ab51c5b6d8a20ae09dac638f36dd5  cifs-utils-7.3.tar.bz2
+sha256  53353d05c30b4fc9dac006a8f0c5054cdd8a1834c176313c91e4694025c4b891  cifs-utils-7.4.tar.bz2
 
 # Hash for license file:
 sha256  8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903  COPYING

package/cifs-utils/cifs-utils.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CIFS_UTILS_VERSION = 7.3
+CIFS_UTILS_VERSION = 7.4
 CIFS_UTILS_SOURCE = cifs-utils-$(CIFS_UTILS_VERSION).tar.bz2
 CIFS_UTILS_SITE = http://ftp.samba.org/pub/linux-cifs/cifs-utils
 CIFS_UTILS_LICENSE = GPL-3.0+

package/clamav/clamav.hash

@@ -1,5 +1,5 @@
 # Locally calculated
-sha256  4783f2ab3fc323a887c117c672dc0b4e7ace72d76f8c06e990bd49c3ef58f10a  clamav-1.0.8.tar.gz
+sha256  5d3a20633bd589f612a71905a4fb50c1ee857cfbe6c72644368cac0030a1eeb4  clamav-1.0.9.tar.gz
 sha256  0c4fd2fa9733fc9122503797648710851e4ee6d9e4969dd33fcbd8c63cd2f584  COPYING.txt
 sha256  d72a145c90918184a05ef65a04c9e6f7466faa59bc1b82c8f6a8ddc7ddcb9bed  COPYING/COPYING.bzip2
 sha256  dfb818a0d41411c6fb1c193c68b73018ceadd1994bda41ad541cbff292894bc6  COPYING/COPYING.file

package/clamav/clamav.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CLAMAV_VERSION = 1.0.8
+CLAMAV_VERSION = 1.0.9
 CLAMAV_SITE = https://www.clamav.net/downloads/production
 CLAMAV_LICENSE = GPL-2.0
 CLAMAV_LICENSE_FILES = \

package/cpp-httplib/cpp-httplib.mk

@@ -8,6 +8,7 @@ CPP_HTTPLIB_VERSION = 0.19.0
 CPP_HTTPLIB_SITE = $(call github,yhirose,cpp-httplib,v$(CPP_HTTPLIB_VERSION))
 CPP_HTTPLIB_LICENSE = MIT
 CPP_HTTPLIB_LICENSE_FILES = LICENSE
+CPP_HTTPLIB_CPE_ID_VALID = YES
 CPP_HTTPLIB_INSTALL_STAGING = YES
 CPP_HTTPLIB_CONF_OPTS = \
 	-Dcpp-httplib_test=false

package/cpulimit/0005-Correct-loop-function-signature.patch

@@ -0,0 +1,49 @@
+From 74e95c96e8d82e4e374f86142972fcf4305fe1f2 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 2 Jul 2025 20:47:58 -0700
+Subject: [PATCH] Correct loop function signature
+
+loop is passed to pthread_create() which requires the following
+prototype to be used: void *(*start_routine) (void *)
+
+Correct the signature to avoid such warnings:
+
+In file included from busy.c:3:
+/home/buildroot/instance-0/output-1/host/mips-buildroot-linux-uclibc/sysroot/usr/include/pthread.h:164:36: note: expected 'void * (*)(void *)' but argument is of type 'void * (*)(void)'
+  164 |                            void *(*__start_routine) (void *),
+      |                            ~~~~~~~~^~~~~~~~~~~~~~~~~~~~~~~~~
+busy.c:6:7: note: 'loop' declared here
+    6 | void *loop()
+      |       ^~~~
+
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Upstream: https://github.com/opsengine/cpulimit/pull/127
+---
+ tests/busy.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/tests/busy.c b/tests/busy.c
+index b3afb7cd853b..93f0bcce67a8 100644
+--- a/tests/busy.c
++++ b/tests/busy.c
+@@ -3,7 +3,7 @@
+ #include <pthread.h>
+ #include <unistd.h>
+ 
+-void *loop()
++void *loop(void *)
+ {
+ 	while(1);
+ }
+@@ -23,7 +23,7 @@ int main(int argc, char **argv) {
+ 			exit(1);
+ 		}
+ 	}
+-	loop();
++	loop(NULL);
+ 	return 0;
+ }
+ 
+-- 
+2.43.0
+

package/daq/0003-daq-fix-incompatible-pointer-type-error.patch

@@ -0,0 +1,31 @@
+Fix daq incompatible pointer type error when gcc option
+'-Wincompatible-pointer-types is set:
+
+| ../../daq-2.0.7/os-daq-modules/daq_nfq.c: In function 'SetPktHdr':
+| ../../daq-2.0.7/os-daq-modules/daq_nfq.c:394:37: error: passing argument 2
+   of 'nfq_get_payload' from incompatible pointer type [-Wincompatible-pointer-types]
+|   394 |     int len = nfq_get_payload(nfad, (char**)pkt);
+|       |                                     ^~~~~~~~~~~
+|       |                                     |
+|       |                                     char **
+
+Signed-off-by: Kai Kang <kai.kang@windriver.com>
+Upstream: https://git.openembedded.org/meta-openembedded/tree/meta-networking/recipes-connectivity/daq/files/daq-fix-incompatible-pointer-type-error.patch?h=master
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ os-daq-modules/daq_nfq.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/os-daq-modules/daq_nfq.c b/os-daq-modules/daq_nfq.c
+index 4de94b6..a6de2f3 100644
+--- a/os-daq-modules/daq_nfq.c
++++ b/os-daq-modules/daq_nfq.c
+@@ -391,7 +391,7 @@ static inline int SetPktHdr (
+     DAQ_PktHdr_t* hdr,
+     uint8_t** pkt
+ ) {
+-    int len = nfq_get_payload(nfad, (char**)pkt);
++    int len = nfq_get_payload(nfad, (unsigned char**)pkt);
+ 
+     if ( len <= 0 )
+         return -1;

package/dht/0001-cmake.patch

@@ -1,67 +0,0 @@
-From 25e12bb39eea3d433602de6390796fec8a8f3620 Mon Sep 17 00:00:00 2001
-From: Mike Gelfand <mikedld@mikedld.com>
-Date: Sun, 1 Jan 2017 16:23:21 +0300
-Subject: [PATCH] Remove Makefile, add Makefile.am and CMakeLists.txt
-
-Downloaded from transmission repo:
-https://github.com/transmission/dht/commit/25e12bb39eea3d433602de6390796fec8a8f3620
-
-Upstream status: rejected (https://github.com/jech/dht/pull/19)
-
-Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de>
----
- CMakeLists.txt |  9 +++++++++
- Makefile       |  9 ---------
- Makefile.am    | 11 +++++++++++
- 3 files changed, 20 insertions(+), 9 deletions(-)
- create mode 100644 CMakeLists.txt
- delete mode 100644 Makefile
- create mode 100644 Makefile.am
-
-diff --git a/CMakeLists.txt b/CMakeLists.txt
-new file mode 100644
-index 0000000..6d4aa99
---- /dev/null
-+++ b/CMakeLists.txt
-@@ -0,0 +1,9 @@
-+cmake_minimum_required(VERSION 2.8)
-+project(dht C)
-+
-+add_library(${PROJECT_NAME} STATIC
-+    dht.c
-+)
-+
-+install(TARGETS ${PROJECT_NAME} DESTINATION lib)
-+install(FILES dht.h DESTINATION include/dht)
-diff --git a/Makefile b/Makefile
-deleted file mode 100644
-index e012945..0000000
---- a/Makefile
-+++ /dev/null
-@@ -1,9 +0,0 @@
--CFLAGS = -g -Wall
--LDLIBS = -lcrypt
--
--dht-example: dht-example.o dht.o
--
--all: dht-example
--
--clean:
--	-rm -f dht-example dht-example.o dht-example.id dht.o *~ core
-diff --git a/Makefile.am b/Makefile.am
-new file mode 100644
-index 0000000..2dba648
---- /dev/null
-+++ b/Makefile.am
-@@ -0,0 +1,11 @@
-+AM_CFLAGS = @PTHREAD_CFLAGS@
-+
-+noinst_LIBRARIES = libdht.a
-+libdht_a_SOURCES = dht.c
-+libdht_a_DEPENDENCIES = $(builddir)/include/dht
-+noinst_HEADERS = dht.h
-+EXTRA_DIST = CHANGES CMakeLists.txt dht-example.c LICENCE README
-+
-+$(builddir)/include/dht:
-+	$(MKDIR_P) $(builddir)/include
-+	(cd $(builddir)/include && $(LN_S) $(abs_srcdir) dht)

package/dht/dht.hash

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  caba469a784a5c359c084099fdc025cfe09b1faec2ba9ba257b7384351c43c0a  dht-0.27.tar.gz
+sha256  c61493be7f036b59df0c921829f15e5c57b1e29d99bca737923e83d028fd736c  dht-0.27-2-g38c9f261d9b58b76b9eaf85f84ec1b35151a1eac.tar.gz
 sha256  06ce07293caf8c8ddfaf47797ad1fb18d1c040a8375231d8f8a6105cef51a8e6  LICENCE

package/dht/dht.mk

@@ -4,8 +4,8 @@
 #
 ################################################################################
 
-DHT_VERSION = 0.27
-DHT_SITE = $(call github,jech,dht,dht-$(DHT_VERSION))
+DHT_VERSION = 0.27-2-g38c9f261d9b58b76b9eaf85f84ec1b35151a1eac
+DHT_SITE = $(call github,transmission,dht,dht-$(DHT_VERSION))
 DHT_LICENSE = MIT
 DHT_LICENSE_FILES = LICENCE
 DHT_INSTALL_STAGING = YES

package/docker-credential-acr-env/docker-credential-acr-env.hash

@@ -1,2 +1,3 @@
 # Localy computed
 sha256  deff9d133fdd87b6cbe454e82e72eb7b124d1aea330c17236e804071a446b4ae  docker-credential-acr-env-0.7.0-git4-go2.tar.gz
+sha256  cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30  LICENSE

package/docker-credential-gcr/docker-credential-gcr.hash

@@ -1,2 +1,3 @@
 # Locally computed
 sha256  126fdbf7351d2c7aaee6c525d9660738519eae53eeef77920b105fd4d1bc5dbd  docker-credential-gcr-v2.1.26-git4-go2.tar.gz
+sha256  c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4  LICENSE

package/elfutils/Config.in

@@ -24,8 +24,13 @@ if BR2_PACKAGE_ELFUTILS
 config BR2_PACKAGE_ELFUTILS_PROGS
 	bool "Install programs"
 	depends on BR2_TOOLCHAIN_USES_GLIBC
+	depends on BR2_INSTALL_LIBSTDCPP
 	help
 	  This option tells elfutils to not only install the libelf
 	  libraries, but also the elfutils programs.
 
+comment "elfutils programs needs a glibc toolchain w/ C++"
+	depends on !BR2_TOOLCHAIN_USES_GLIBC \
+		|| !BR2_INSTALL_LIBSTDCPP
+
 endif

package/eudev/eudev.mk

@@ -14,7 +14,6 @@ EUDEV_CONF_OPTS = \
 	--disable-manpages \
 	--sbindir=/sbin \
 	--libexecdir=/lib \
-	--disable-introspection \
 	--enable-kmod \
 	--enable-blkid
 
@@ -71,7 +70,6 @@ HOST_EUDEV_CONF_OPTS = \
 	--with-rootlibdir=/lib \
 	--sysconfdir=/etc \
 	--disable-blkid \
-	--disable-introspection \
 	--disable-kmod \
 	--disable-manpages \
 	--disable-rule-generator \

package/ffmpeg/ffmpeg.mk

@@ -243,10 +243,6 @@ FFMPEG_CONF_OPTS += --disable-openssl
 endif
 endif
 
-ifeq ($(BR2_PACKAGE_FFMPEG_GPL)$(BR2_PACKAGE_LIBEBUR128),yy)
-FFMPEG_DEPENDENCIES += libebur128
-endif
-
 ifeq ($(BR2_PACKAGE_LIBDRM),y)
 FFMPEG_CONF_OPTS += --enable-libdrm
 FFMPEG_DEPENDENCIES += libdrm

package/fwupd/fwupd.mk

@@ -9,6 +9,7 @@ FWUPD_SITE = https://github.com/fwupd/fwupd/releases/download/$(FWUPD_VERSION)
 FWUPD_SOURCE = fwupd-$(FWUPD_VERSION).tar.xz
 FWUPD_LICENSE = LGPL-2.1+
 FWUPD_LICENSE_FILES = COPYING
+FWUPD_CPE_ID_VENDOR = fwupd
 FWUPD_DEPENDENCIES = \
 	host-pkgconf \
 	host-python-jinja2 \

package/gcc-bare-metal/14.2.0

@@ -1 +0,0 @@
-../gcc/14.2.0/

package/gcc-bare-metal/14.3.0

@@ -0,0 +1 @@
+../gcc/14.3.0/

package/gcc-bare-metal/gcc-bare-metal.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GCC_BARE_METAL_VERSION = 14.2.0
+GCC_BARE_METAL_VERSION = 14.3.0
 GCC_BARE_METAL_SITE = $(BR2_GNU_MIRROR)/gcc/gcc-$(GCC_BARE_METAL_VERSION)
 GCC_BARE_METAL_SOURCE = gcc-$(GCC_BARE_METAL_VERSION).tar.xz
 

package/gcc/13.3.0/0004-Undef-_TIME_BITS-along-with-_FILE_OFFSET_BITS-on-Lin.patch

@@ -1,44 +0,0 @@
-From 88b73eedcfa0fc58aee2555377e6f7d4de153282 Mon Sep 17 00:00:00 2001
-From: Khem Raj <raj.khem@gmail.com>
-Date: Fri, 3 Feb 2023 11:48:35 -0800
-Subject: [PATCH] Undef _TIME_BITS along with _FILE_OFFSET_BITS on Linux
-
-On 32-bit glibc>=2.34 systems using 64bit time_t build fails because
-_FILE_OFFSET_BITS is undefined here but _TIME_BITS is still set to 64
-
-Fixes
-
-```
-/usr/include/features-time64.h:26:5: error: "_TIME_BITS=64 is allowed
- only with _FILE_OFFSET_BITS=64"
-| #   error "_TIME_BITS=64 is allowed only with _FILE_OFFSET_BITS=64"
-|     ^
-| 1 error generated.
-```
-
-Reviewed By: thesamesam, MaskRay
-
-Differential Revision: https://reviews.llvm.org/D140812
-
-Upstream: https://github.com/llvm/llvm-project/commit/26800a2c7e7996dc773b4e990dd5cca41c45e1a9
-Upstream: https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=d53b3d94aaf211ffb2159614f5aaaf03ceb861cc
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
----
- .../sanitizer_common/sanitizer_platform_limits_posix.cpp         | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-index bcbd143d19d..1b23898b374 100644
---- a/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-+++ b/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp
-@@ -18,6 +18,7 @@
- // depends on _FILE_OFFSET_BITS setting.
- // To get this "true" dirent definition, we undefine _FILE_OFFSET_BITS below.
- #undef _FILE_OFFSET_BITS
-+#undef _TIME_BITS
- #endif
- 
- // Must go after undef _FILE_OFFSET_BITS.
--- 
-2.45.2
-

package/gcc/13.3.0/0005-libsanitizer-also-undef-_TIME_BITS-in-sanitizer_proc.patch

@@ -1,53 +0,0 @@
-From 7ad54084a2c07cca6d03dfe274893e903852d359 Mon Sep 17 00:00:00 2001
-From: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
-Date: Thu, 18 Jul 2024 23:13:41 +0200
-Subject: [PATCH] libsanitizer: also undef _TIME_BITS in
- sanitizer_procmaps_solaris.cpp
-
-Upstream commit
-https://github.com/llvm/llvm-project/commit/26800a2c7e7996dc773b4e990dd5cca41c45e1a9
-of LLVM added a #undef _TIME_BITS in
-libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cpp to
-fix the build on 32-bit Linux platforms that have enabled 64-bit
-time_t using _TIME_BITS=64.
-
-Indeed, _TIME_BITS=64 can only be used when _FILE_OFFSET_BITS=64, but
-sanitizer_platform_limits_posix.cpp undefines _FILE_OFFSET_BITS before
-including any header file. To fix this, the upstream fix was to also
-undef _TIME_BITS.
-
-This commit simply does the same in sanitizer_procmaps_solaris.cpp,
-which also gets compiled under Linux (despite what the file name
-says). In practice on Linux hosts (where _TIME_BITS=64 matters),
-sanitizer_procmaps_solaris.cpp will expand to nothing, as pretty much
-the rest of the file is inside a #ifdef SANITIZER_SOLARIS...#endif. So
-the #undef _FILE_OFFSET_BITS and #undef _TIME_BITS are only here
-before including sanitizer_platform.h, which will set the
-SANITIZER_LINUX/SANITIZER_SOLARIS define depending on the platform.
-
-Fixes:
-
-armeb-buildroot-linux-gnueabi/sysroot/usr/include/features-time64.h:26:5: error: #error "_TIME_BITS=64 is allowed only with _FILE_OFFSET_BITS=64"
-   26 | #   error "_TIME_BITS=64 is allowed only with _FILE_OFFSET_BITS=64"
-
-Upstream: https://gcc.gnu.org/pipermail/gcc-patches/2024-July/657811.html
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
----
- libsanitizer/sanitizer_common/sanitizer_procmaps_solaris.cpp | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libsanitizer/sanitizer_common/sanitizer_procmaps_solaris.cpp b/libsanitizer/sanitizer_common/sanitizer_procmaps_solaris.cpp
-index eeb49e2afe3..1b23fd4d512 100644
---- a/libsanitizer/sanitizer_common/sanitizer_procmaps_solaris.cpp
-+++ b/libsanitizer/sanitizer_common/sanitizer_procmaps_solaris.cpp
-@@ -11,6 +11,7 @@
- 
- // Before Solaris 11.4, <procfs.h> doesn't work in a largefile environment.
- #undef _FILE_OFFSET_BITS
-+#undef _TIME_BITS
- #include "sanitizer_platform.h"
- #if SANITIZER_SOLARIS
- #  include <fcntl.h>
--- 
-2.45.2
-

package/gcc/14.2.0/0003-libquadmath-Fix-up-libquadmath-math-sqrtq.c-compilat.patch

@@ -1,57 +0,0 @@
-From ba9356565695728ce0c852f7de3de27f8745611d Mon Sep 17 00:00:00 2001
-From: Jakub Jelinek <jakub@redhat.com>
-Date: Sat, 3 Aug 2024 20:37:54 +0200
-Subject: [PATCH] libquadmath: Fix up libquadmath/math/sqrtq.c compilation in
- some powerpc* configurations [PR116007]
-
-My PR114623 change started using soft-fp.h and quad.h for the sqrtq implementation.
-Unfortunately, that seems to fail building in some powerpc* configurations, where
-TFmode isn't available.
-quad.h has:
- #ifndef TFtype
- typedef float TFtype __attribute__ ((mode (TF)));
- #endif
-and uses TFtype.  quad.h has:
- /* Define the complex type corresponding to __float128
-    ("_Complex __float128" is not allowed) */
- #if (!defined(_ARCH_PPC)) || defined(__LONG_DOUBLE_IEEE128__)
- typedef _Complex float __attribute__((mode(TC))) __complex128;
- #else
- typedef _Complex float __attribute__((mode(KC))) __complex128;
- #endif
-with the conditional and KCmode use added during porting of libquadmath
-to powerpc*, so I've just defined TFtype for powerpc when __LONG_DOUBLE_IEEE128__
-isn't defined; I could define it to float __attribute__ ((mode (KF))) but it
-seemed easier to just define it to __float128 which should do the same thing.
-
-2024-08-03  Jakub Jelinek  <jakub@redhat.com>
-
-	PR target/116007
-	* math/sqrtq.c (TFtype): For PowerPC without __LONG_DOUBLE_IEEE128__
-	define to __float128 before including soft-fp.h and quad.h.
-
-(cherry picked from commit 3ac02e67503ccffa3dfeeffc0a60fce6bdaca43b)
-Upstream: https://gcc.gnu.org/g:3ac02e67503ccffa3dfeeffc0a60fce6bdaca43b
-Upstream: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116007
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
----
- libquadmath/math/sqrtq.c | 3 +++
- 1 file changed, 3 insertions(+)
-
-diff --git a/libquadmath/math/sqrtq.c b/libquadmath/math/sqrtq.c
-index 8ca2828d42c..a58998a0667 100644
---- a/libquadmath/math/sqrtq.c
-+++ b/libquadmath/math/sqrtq.c
-@@ -9,6 +9,9 @@
-     && defined(FE_TOWARDZERO) \
-     && defined(FE_INEXACT)
- #define USE_SOFT_FP 1
-+#if defined(_ARCH_PPC) && !defined(__LONG_DOUBLE_IEEE128__)
-+#define TFtype __float128
-+#endif
- #include "../../libgcc/soft-fp/soft-fp.h"
- #include "../../libgcc/soft-fp/quad.h"
- #endif
--- 
-2.46.0
-

package/gcc/Config.in.host

@@ -34,6 +34,7 @@ config BR2_GCC_VERSION_12_X
 
 config BR2_GCC_VERSION_13_X
 	bool "gcc 13.x"
+	depends on !BR2_ARCH_NEEDS_GCC_AT_LEAST_14
 	# powerpc spe support has been deprecated since gcc 8.x.
 	# https://gcc.gnu.org/ml/gcc/2018-04/msg00102.html
 	depends on !BR2_POWERPC_CPU_HAS_SPE
@@ -41,6 +42,7 @@ config BR2_GCC_VERSION_13_X
 
 config BR2_GCC_VERSION_14_X
 	bool "gcc 14.x"
+	depends on !BR2_ARCH_NEEDS_GCC_AT_LEAST_15
 	# powerpc spe support has been deprecated since gcc 8.x.
 	# https://gcc.gnu.org/ml/gcc/2018-04/msg00102.html
 	depends on !BR2_POWERPC_CPU_HAS_SPE
@@ -51,11 +53,6 @@ config BR2_GCC_VERSION_14_X
 
 endchoice
 
-# libcilkrts was introduced in gcc 4.9 and removed in gcc 8.x
-config BR2_GCC_SUPPORTS_LIBCILKRTS
-	bool
-	default y if !BR2_TOOLCHAIN_GCC_AT_LEAST_8
-
 config BR2_GCC_SUPPORTS_DLANG
 	bool
 	default y if BR2_aarch64
@@ -77,8 +74,8 @@ config BR2_GCC_VERSION
 	string
 	default "8.4.0"     if BR2_GCC_VERSION_POWERPC_SPE
 	default "12.4.0"    if BR2_GCC_VERSION_12_X
-	default "13.3.0"    if BR2_GCC_VERSION_13_X
-	default "14.2.0"    if BR2_GCC_VERSION_14_X
+	default "13.4.0"    if BR2_GCC_VERSION_13_X
+	default "14.3.0"    if BR2_GCC_VERSION_14_X
 	default "arc-2023.09-release" if BR2_GCC_VERSION_ARC
 
 config BR2_EXTRA_GCC_CONFIG_OPTIONS
@@ -134,10 +131,6 @@ config BR2_GCC_ENABLE_OPENMP
 
 config BR2_GCC_ENABLE_GRAPHITE
 	bool "Enable graphite support"
-	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_5
 	help
 	  This option enables the graphite optimizations in the
 	  compiler.
-
-comment "graphite support needs gcc >= 5.x"
-	depends on !BR2_TOOLCHAIN_GCC_AT_LEAST_5

package/gcc/gcc-final/gcc-final.mk

@@ -12,6 +12,9 @@ GCC_FINAL_LICENSE_FILES = COPYING.RUNTIME
 HOST_GCC_FINAL_LICENSE = $(HOST_GCC_LICENSE)
 HOST_GCC_FINAL_LICENSE_FILES = $(HOST_GCC_LICENSE_FILES)
 
+GCC_FINAL_CPE_ID_VENDOR = gnu
+GCC_FINAL_CPE_ID_PRODUCT = gcc
+
 GCC_FINAL_DEPENDENCIES = host-gcc-final
 GCC_FINAL_ADD_TOOLCHAIN_DEPENDENCY = NO
 GCC_FINAL_INSTALL_STAGING = YES
@@ -85,25 +88,6 @@ else
 HOST_GCC_FINAL_GCC_LIB_DIR = $(HOST_DIR)/$(GNU_TARGET_NAME)/lib*
 endif
 
-ifeq ($(BR2_GCC_SUPPORTS_LIBCILKRTS),y)
-
-# libcilkrts does not support v8
-ifeq ($(BR2_sparc),y)
-HOST_GCC_FINAL_CONF_OPTS += --disable-libcilkrts
-endif
-
-# Pthreads are required to build libcilkrts
-ifeq ($(BR2_PTHREADS_NONE),y)
-HOST_GCC_FINAL_CONF_OPTS += --disable-libcilkrts
-endif
-
-ifeq ($(BR2_STATIC_LIBS),y)
-# disable libcilkrts as there is no static version
-HOST_GCC_FINAL_CONF_OPTS += --disable-libcilkrts
-endif
-
-endif # BR2_GCC_SUPPORTS_LIBCILKRTS
-
 # Disable shared libs like libstdc++ if we do static since it confuses linking
 ifeq ($(BR2_STATIC_LIBS),y)
 HOST_GCC_FINAL_CONF_OPTS += --disable-shared

package/gcc/gcc.hash

@@ -1,13 +1,11 @@
 # From https://gcc.gnu.org/pub/gcc/releases/gcc-8.4.0/sha512.sum
 sha512  6de904f552a02de33b11ef52312bb664396efd7e1ce3bbe37bfad5ef617f133095b3767b4804bc7fe78df335cb53bc83f1ac055baed40979ce4c2c3e46b70280  gcc-8.4.0.tar.xz
-# From https://gcc.gnu.org/pub/gcc/releases/gcc-10.4.0/sha512.sum
-sha512  440c08ca746da450d9a1b35e8fd2305cb27e7e6987cd9d0f7d375f3b1fc9e4b0bd7acb3cd7bf795e72fcbead59cdef5b6c152862f5d35cd9fbfe6902101ce648  gcc-10.4.0.tar.xz
 # From https://gcc.gnu.org/pub/gcc/releases/gcc-12.4.0/sha512.sum
 sha512  5bd29402cad2deb5d9388d0236c7146414d77e5b8d5f1c6c941c7a1f47691c3389f08656d5f6e8e2d6717bf2c81f018d326f632fb468f42925b40bd217fc4853  gcc-12.4.0.tar.xz
-# From https://gcc.gnu.org/pub/gcc/releases/gcc-13.3.0/sha512.sum
-sha512  ed5f2f4c6ed2c796fcf2c93707159e9dbd3ddb1ba063d549804dd68cdabbb6d550985ae1c8465ae9a336cfe29274a6eb0f42e21924360574ebd8e5d5c7c9a801  gcc-13.3.0.tar.xz
-# From https://gcc.gnu.org/pub/gcc/releases/gcc-14.2.0/sha512.sum
-sha512  932bdef0cda94bacedf452ab17f103c0cb511ff2cec55e9112fc0328cbf1d803b42595728ea7b200e0a057c03e85626f937012e49a7515bc5dd256b2bf4bc396  gcc-14.2.0.tar.xz
+# From https://gcc.gnu.org/pub/gcc/releases/gcc-13.4.0/sha512.sum
+sha512  9b4b83ecf51ef355b868608b8d257b2fa435c06d2719cb86657a7c2c2a0828ff4ce04e9bac1055bbcad8ed5b4da524cafaef654785e23a50233d95d89201e35f  gcc-13.4.0.tar.xz
+# From https://gcc.gnu.org/pub/gcc/releases/gcc-14.3.0/sha512.sum
+sha512  cb4e3259640721bbd275c723fe4df53d12f9b1673afb3db274c22c6aa457865dccf2d6ea20b4fd4c591f6152e6d4b87516c402015900f06ce9d43af66d3b7a93  gcc-14.3.0.tar.xz
 
 # Locally calculated (fetched from Github)
 sha512  4dca20f517a42bb027fec605965b09fb917a535eebf3fe3e811d93476b02b1962df5ad4665f117bd44c2ec8e8015d51a44c00591761fe5f259c201ac5c7d920f  gcc-arc-2023.09-release.tar.gz

package/git/git.hash

@@ -1,5 +1,5 @@
 # From: https://www.kernel.org/pub/software/scm/git/sha256sums.asc
-sha256  618190cf590b7e9f6c11f91f23b1d267cd98c3ab33b850416d8758f8b5a85628  git-2.49.0.tar.xz
+sha256  310831de967f1c8c5e8ff55f92807dea89f83dc3d3d2a5d16c209bd01a31def1  git-2.49.1.tar.xz
 # Locally calculated
 sha256  5b2198d1645f767585e8a88ac0499b04472164c0d2da22e75ecf97ef443ab32e  COPYING
 sha256  1922f45d2c49e390032c9c0ba6d7cac904087f7cec51af30c2b2ad022ce0e76a  LGPL-2.1

package/git/git.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GIT_VERSION = 2.49.0
+GIT_VERSION = 2.49.1
 GIT_SOURCE = git-$(GIT_VERSION).tar.xz
 GIT_SITE = $(BR2_KERNEL_MIRROR)/software/scm/git
 GIT_LICENSE = GPL-2.0, LGPL-2.1+

package/gnuplot/gnuplot.hash

@@ -1,6 +1,6 @@
-# From https://sourceforge.net/projects/gnuplot/files/gnuplot/6.0.2/
-md5  ea0931758fc180e3b1950931b9869921  gnuplot-6.0.2.tar.gz
-sha1  be803916e4ea32720b4a646f2ffc98d6ad3a0dc2  gnuplot-6.0.2.tar.gz
+# From https://sourceforge.net/projects/gnuplot/files/gnuplot/6.0.3/
+md5  c897ca69062010e2cf5f7483e39e5acc  gnuplot-6.0.3.tar.gz
+sha1  b31779d6760f432f57136600fc0c2bf65f4d4013  gnuplot-6.0.3.tar.gz
+sha256  ec52e3af8c4083d4538152b3f13db47f6d29929a3f6ecec5365c834e77f251ab  gnuplot-6.0.3.tar.gz
 # Locally computed
-sha256  f68a3b0bbb7bbbb437649674106d94522c00bf2f285cce0c19c3180b1ee7e738  gnuplot-6.0.2.tar.gz
 sha256  895928ec0735cca1c8cec42656c7e314a065d0242813bb8693c0c1bf61fd4e4d  Copyright

package/gnuplot/gnuplot.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-GNUPLOT_VERSION = 6.0.2
+GNUPLOT_VERSION = 6.0.3
 GNUPLOT_SITE = http://downloads.sourceforge.net/project/gnuplot/gnuplot/$(GNUPLOT_VERSION)
 GNUPLOT_LICENSE = gnuplot license (open source)
 GNUPLOT_LICENSE_FILES = Copyright

package/gstreamer1/gstreamer1-editing-services/gstreamer1-editing-services.hash

@@ -2,5 +2,5 @@
 sha256  85fd74dab259e137a95ab4427e009dd853f4ca82874500cb5493c33bcef1ef08  gst-editing-services-1.24.11.tar.xz
 
 # Hashes for license files:
-sha256  f445dc78b88496f7e20c7a2a461b95baba5865c8919b8289ac24ac0a80c6ce7a  COPYING
-sha256  f445dc78b88496f7e20c7a2a461b95baba5865c8919b8289ac24ac0a80c6ce7a  COPYING.LIB
+sha256  ad2eec519ebd4b5df86ea84dff24ae3bfa2edea846a703b58902dd221ae375db  COPYING
+sha256  ad2eec519ebd4b5df86ea84dff24ae3bfa2edea846a703b58902dd221ae375db  COPYING.LIB

package/gumbo-parser/Config.in

@@ -7,4 +7,4 @@ config BR2_PACKAGE_GUMBO_PARSER
 	  other tools and libraries such as linters, validators,
 	  templating languages, and refactoring and analysis tools.
 
-	  https://github.com/google/gumbo-parser
+	  https://codeberg.org/gumbo-parser/gumbo-parser/

package/gumbo-parser/gumbo-parser.hash

@@ -1,5 +1,5 @@
 # Locally computed:
-sha256  28463053d44a5dfbc4b77bcf49c8cee119338ffa636cc17fc3378421d714efad  gumbo-parser-0.10.1.tar.gz
+sha256  d4fd158d998ab8302fa23bb01119b434bbfaf7139b59f9c74530a703176cb213  v0.10.1.tar.gz
 
 # Hash for license files:
 sha256  c71d239df91726fc519c6eb72d318ec65820627232b2f796219e87dcf35d0ab4  COPYING

package/gumbo-parser/gumbo-parser.mk

@@ -5,7 +5,8 @@
 ################################################################################
 
 GUMBO_PARSER_VERSION = 0.10.1
-GUMBO_PARSER_SITE = $(call github,google,gumbo-parser,v$(GUMBO_PARSER_VERSION))
+GUMBO_PARSER_SITE = https://codeberg.org/gumbo-parser/gumbo-parser/archive
+GUMBO_PARSER_SOURCE = v$(GUMBO_PARSER_VERSION).tar.gz
 GUMBO_PARSER_LICENSE = Apache-2.0
 GUMBO_PARSER_LICENSE_FILES = COPYING
 GUMBO_PARSER_INSTALL_STAGING = YES

package/gvfs/Config.in

@@ -15,7 +15,7 @@ config BR2_PACKAGE_GVFS
 	  all applications using the gio API. It also supports exposing
 	  the gvfs mounts to non-gio applications using fuse.
 
-	  https://wiki.gnome.org/action/show/Projects/gvfs
+	  https://wiki.gnome.org/Projects/gvfs
 
 comment "gvfs needs a toolchain w/ wchar, threads, dynamic library"
 	depends on BR2_USE_MMU

package/hddtemp/0001-fix-build-without-nls.patch

@@ -0,0 +1,40 @@
+From c9d0d249ff013d33cf1fd5a586c16ee30095cc90 Mon Sep 17 00:00:00 2001
+From: Nicolas PARLANT <nicolas.parlant@parhuet.fr>
+Date: Fri, 14 Feb 2025 10:08:43 +0100
+Subject: [PATCH] fix build without nls
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+> hddtemp.c: In function ‘main’:
+> hddtemp.c:274:3: error: implicit declaration of function ‘bindtextdomain’ [-Wimplicit-function-declaration]
+>   274 |   bindtextdomain (PACKAGE, LOCALEDIR);
+>       |   ^~~~~~~~~~~~~~
+> hddtemp.c:275:3: error: implicit declaration of function ‘textdomain’ [-Wimplicit-function-declaration]
+>   275 |   textdomain (PACKAGE);
+>       |   ^~~~~~~~~~
+> make[2]: *** [Makefile:496: hddtemp-hddtemp.o] Error 1
+
+Upstream: https://github.com/vitlav/hddtemp/pull/16
+
+Signed-off-by: Bernd Kuhls <bernd@kuhls.net>
+---
+ src/hddtemp.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/hddtemp.c b/src/hddtemp.c
+index 64d000e..bfea556 100644
+--- a/src/hddtemp.c
++++ b/src/hddtemp.c
+@@ -270,9 +270,11 @@ int main(int argc, char* argv[]) {
+   backtrace_sigill();
+   backtrace_sigbus();
+ 
++#if ENABLE_NLS
+   setlocale (LC_ALL, "");
+   bindtextdomain (PACKAGE, LOCALEDIR);
+   textdomain (PACKAGE);
++#endif
+ 
+   show_db = debug = numeric = quiet = wakeup = af_hint = syslog_interval = foreground = 0;
+   unit = DEFAULT;

package/jose/0001-lib-hsh.c-rename-hsh-local-variable.patch

@@ -1,71 +0,0 @@
-From 591fc6da944ffc29936e0019b2bc225ddc81dbba Mon Sep 17 00:00:00 2001
-From: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
-Date: Mon, 20 Nov 2017 22:48:33 +0100
-Subject: [PATCH] lib/hsh.c: rename hsh local variable
-
-The hsh local variable name conflicts with the function prototype of
-hsh() in hsh.h, causing the following build issues with old compilers
-(gcc 4.7):
-
-hsh.c: In function 'hsh':
-hsh.c:28:21: error: declaration of 'hsh' shadows a global declaration [-Werror=shadow]
-hsh.c:26:1: error: shadowed declaration is here [-Werror=shadow]
-hsh.c: In function 'hsh_buf':
-hsh.c:60:21: error: declaration of 'hsh' shadows a global declaration [-Werror=shadow]
-hsh.c:26:1: error: shadowed declaration is here [-Werror=shadow]
-
-Therefore, we rename this local variable to _hsh.
-
-Submitted-upstream: https://github.com/latchset/jose/pull/51
-Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
----
- lib/hsh.c | 12 ++++++------
- 1 file changed, 6 insertions(+), 6 deletions(-)
-
-diff --git a/lib/hsh.c b/lib/hsh.c
-index c59a95f..a2a891b 100644
---- a/lib/hsh.c
-+++ b/lib/hsh.c
-@@ -25,7 +25,7 @@
- json_t *
- hsh(jose_cfg_t *cfg, const char *alg, const void *data, size_t dlen)
- {
--    jose_io_auto_t *hsh = NULL;
-+    jose_io_auto_t *_hsh = NULL;
-     jose_io_auto_t *enc = NULL;
-     jose_io_auto_t *buf = NULL;
-     char b[1024] = {};
-@@ -33,8 +33,8 @@ hsh(jose_cfg_t *cfg, const char *alg, const void *data, size_t dlen)
- 
-     buf = jose_io_buffer(cfg, b, &l);
-     enc = jose_b64_enc_io(buf);
--    hsh = hsh_io(cfg, alg, enc);
--    if (!buf || !enc || !hsh || !hsh->feed(hsh, data, dlen) || !hsh->done(hsh))
-+    _hsh = hsh_io(cfg, alg, enc);
-+    if (!buf || !enc || !_hsh || !_hsh->feed(_hsh, data, dlen) || !_hsh->done(_hsh))
-         return NULL;
- 
-     return json_stringn(b, l);
-@@ -57,7 +57,7 @@ hsh_buf(jose_cfg_t *cfg, const char *alg,
-         const void *data, size_t dlen, void *hash, size_t hlen)
- {
-     const jose_hook_alg_t *a = NULL;
--    jose_io_auto_t *hsh = NULL;
-+    jose_io_auto_t *_hsh = NULL;
-     jose_io_auto_t *buf = NULL;
- 
-     a = jose_hook_alg_find(JOSE_HOOK_ALG_KIND_HASH, alg);
-@@ -71,8 +71,8 @@ hsh_buf(jose_cfg_t *cfg, const char *alg,
-         return SIZE_MAX;
- 
-     buf = jose_io_buffer(cfg, hash, &hlen);
--    hsh = a->hash.hsh(a, cfg, buf);
--    if (!buf || !hsh || !hsh->feed(hsh, data, dlen) || !hsh->done(hsh))
-+    _hsh = a->hash.hsh(a, cfg, buf);
-+    if (!buf || !_hsh || !_hsh->feed(_hsh, data, dlen) || !_hsh->done(_hsh))
-         return SIZE_MAX;
- 
-     return hlen;
--- 
-2.13.6
-

package/jose/0002-man-add-option-to-skip-building-man-pages.patch

@@ -1,64 +0,0 @@
-From 506132d3edc8d062f65fdacf007a15613d27e5c5 Mon Sep 17 00:00:00 2001
-From: Eneas U de Queiroz <cotequeiroz@gmail.com>
-Date: Wed, 6 Apr 2022 09:49:48 -0300
-Subject: [PATCH] man: add option to skip building man pages
-
-Add a 'skip_manpages' option to meson, so that man pages do not get
-built.
-
-Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>
-[Retrieved from: https://github.com/latchset/jose/pull/115]
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
----
- meson.build       | 24 +++++++++++++-----------
- meson_options.txt |  1 +
- 2 files changed, 14 insertions(+), 11 deletions(-)
- create mode 100644 meson_options.txt
-
-diff --git a/meson.build b/meson.build
-index 1edfbe7..9b40efb 100644
---- a/meson.build
-+++ b/meson.build
-@@ -37,7 +37,6 @@ zlib = dependency('zlib')
- threads = dependency('threads')
- jansson = dependency('jansson', version: '>=2.10')
- libcrypto = dependency('libcrypto', version: '>=1.0.2')
--a2x = find_program('a2x', required: false)
- 
- mans = []
- 
-@@ -63,14 +62,17 @@ pkg.generate(
-   requires: 'jansson',
- )
- 
--if a2x.found()
--  foreach m : mans
--    custom_target(m.split('/')[-1], input: m + '.adoc', output: m.split('/')[-1],
--      command: [a2x, '-f', 'manpage', '-D', meson.current_build_dir(), '@INPUT@'],
--      install_dir: join_paths(get_option('mandir'), 'man' + m.split('.')[-1]),
--      install: true
--    )
--  endforeach
--else
--  warning('Will not build man pages due to missing dependencies!')
-+if not get_option('skip_manpages')
-+  a2x = find_program('a2x', required: false)
-+  if a2x.found()
-+    foreach m : mans
-+      custom_target(m.split('/')[-1], input: m + '.adoc', output: m.split('/')[-1],
-+        command: [a2x, '-f', 'manpage', '-D', meson.current_build_dir(), '@INPUT@'],
-+        install_dir: join_paths(get_option('mandir'), 'man' + m.split('.')[-1]),
-+        install: true
-+      )
-+    endforeach
-+  else
-+    warning('Will not build man pages due to missing dependencies!')
-+  endif
- endif
-diff --git a/meson_options.txt b/meson_options.txt
-new file mode 100644
-index 0000000..0885515
---- /dev/null
-+++ b/meson_options.txt
-@@ -0,0 +1 @@
-+option('skip_manpages', type: 'boolean', value: false, description: 'Do not build manpages')

package/jose/jose.hash

@@ -1,3 +1,3 @@
 # Locally computed
-sha256  e272afe7717e22790c383f3164480627a567c714ccb80c1ee96f62c9929d8225  jose-11.tar.xz
+sha256  cee329ef9fce97c4c025604a8d237092f619aaa9f6d35fdf9d8c9052bc1ff95b  jose-14.tar.xz
 sha256  09e8a9bcec8067104652c168685ab0931e7868f9c8284b66f5ae6edae5f1130b  COPYING

package/jose/jose.mk

@@ -4,13 +4,14 @@
 #
 ################################################################################
 
-JOSE_VERSION = 11
+JOSE_VERSION = 14
 JOSE_SOURCE = jose-$(JOSE_VERSION).tar.xz
 JOSE_SITE = https://github.com/latchset/jose/releases/download/v$(JOSE_VERSION)
 JOSE_LICENSE = Apache-2.0
 JOSE_LICENSE_FILES = COPYING
 JOSE_INSTALL_STAGING = YES
 JOSE_DEPENDENCIES = host-pkgconf zlib jansson openssl
-JOSE_CONF_OPTS = -Dskip_manpages=true
+JOSE_CONF_OPTS = -Ddocs=disabled
+JOSE_CPE_ID_VENDOR = latchset
 
 $(eval $(meson-package))

package/kvmtool/0001-remove-wordsize-h-inclusion-for-musl-compatibility.patch

@@ -0,0 +1,52 @@
+From 0592f8f829c843ff5cb2d108c309e32f4f6f5379 Mon Sep 17 00:00:00 2001
+From: Andre Przywara <andre.przywara@arm.com>
+Date: Thu, 1 Aug 2024 12:10:54 +0100
+Subject: remove wordsize.h inclusion (for musl compatibility)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+The wordsize.h header file and the __WORDSIZE definition do not seem
+to be universal, the musl libc for instance has the definition in a
+different header file. This breaks compilation of kvmtool against musl.
+
+The two leading underscores suggest a compiler-internal symbol anyway, so
+let's just remove that particular macro usage entirely, and replace it
+with the number we really want: the size of a "long" type.
+
+Reported-by: J. Neuschäfer <j.neuschaefer@gmx.net>
+Signed-off-by: Andre Przywara <andre.przywara@arm.com>
+Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Link: https://lore.kernel.org/r/20240801111054.818765-1-andre.przywara@arm.com
+Signed-off-by: Will Deacon <will@kernel.org>
+Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/commit/?id=0592f8f829c843ff5cb2d108c309e32f4f6f5379
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ include/linux/bitops.h | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+diff --git a/include/linux/bitops.h b/include/linux/bitops.h
+index ae33922f..ee8fd560 100644
+--- a/include/linux/bitops.h
++++ b/include/linux/bitops.h
+@@ -1,15 +1,13 @@
+ #ifndef _KVM_LINUX_BITOPS_H_
+ #define _KVM_LINUX_BITOPS_H_
+ 
+-#include <bits/wordsize.h>
+-
+ #include <linux/kernel.h>
+ #include <linux/compiler.h>
+ #include <asm/hweight.h>
+ 
+-#define BITS_PER_LONG __WORDSIZE
+ #define BITS_PER_BYTE           8
+-#define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
++#define BITS_PER_LONG           (BITS_PER_BYTE * sizeof(long))
++#define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_LONG)
+ 
+ #define BIT_WORD(nr)		((nr) / BITS_PER_LONG)
+ 
+-- 
+cgit 1.2.3-korg
+

package/kvmtool/0002-vfio-include-libgen-h-for-musl-compatibility.patch

@@ -0,0 +1,48 @@
+From ba6830eec0f5ab734b093657b16b555e0437b927 Mon Sep 17 00:00:00 2001
+From: Thomas Perale <thomas.perale@mind.be>
+Date: Sun, 29 Jun 2025 22:22:21 +0200
+Subject: vfio: include libgen.h (for musl compatibility)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Starting GCC14 'implicit-function-declaration' are treated as errors by
+default. When building kvmtool with musl libc, the following error
+occurs due to missing declaration of 'basename':
+
+vfio/core.c:537:22: error: implicit declaration of function ‘basename’ [-Wimplicit-function-declaration]
+  537 |         group_name = basename(group_path);
+      |                      ^~~~~~~~
+vfio/core.c:537:22: warning: nested extern declaration of ‘basename’ [-Wnested-externs]
+vfio/core.c:537:20: error: assignment to ‘char *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
+  537 |         group_name = basename(group_path);
+      |                    ^
+
+This patch fixes the issue by including the appropriate header, ensuring
+compatibility with musl and GCC14.
+
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+Reviewed-by: Alexandru Elisei <alexandru.elisei@arm.com>
+Link: https://lore.kernel.org/r/20250629202221.893360-1-thomas.perale@mind.be
+Signed-off-by: Will Deacon <will@kernel.org>
+Upstream: https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git/patch/?id=ba6830eec0f5ab734b093657b16b555e0437b927
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ vfio/core.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/vfio/core.c b/vfio/core.c
+index 3ff2c0b0..8f884898 100644
+--- a/vfio/core.c
++++ b/vfio/core.c
+@@ -3,6 +3,7 @@
+ #include "kvm/ioport.h"
+ 
+ #include <linux/list.h>
++#include <libgen.h>
+ 
+ #define VFIO_DEV_DIR		"/dev/vfio"
+ #define VFIO_DEV_NODE		VFIO_DEV_DIR "/vfio"
+-- 
+cgit 1.2.3-korg
+

package/libarchive/0001-Revert-Only-add-iconv-to-the-.pc-file-if-needed-1825.patch

@@ -1,31 +0,0 @@
-From 3879afd473a256173cc626e16293f3fe8875f2d6 Mon Sep 17 00:00:00 2001
-From: Fabrice Fontaine <fontaine.fabrice@gmail.com>
-Date: Sat, 6 Jan 2024 09:53:23 +0100
-Subject: [PATCH] Revert "Only add "iconv" to the .pc file if needed (#1825)"
-
-This reverts commit 1f35c466aaa9444335a1b854b0b7223b0d2346c2.
-
-Upstream: no dedicated PR for this revert but there is already plenty of PRs/issues to fix iconv build ...
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
----
- configure.ac | 4 +---
- 1 file changed, 1 insertion(+), 3 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 93f7af94..204a4e69 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -455,9 +455,7 @@ if test "x$with_iconv" != "xno"; then
-     AC_CHECK_HEADERS([localcharset.h])
-     am_save_LIBS="$LIBS"
-     LIBS="${LIBS} ${LIBICONV}"
--    if test -n "$LIBICONV"; then
--      LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
--    fi
-+    LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
-     AC_CHECK_FUNCS([locale_charset])
-     LIBS="${am_save_LIBS}"
-     if test "x$ac_cv_func_locale_charset" != "xyes"; then
--- 
-2.43.0
-

package/libarchive/0002-autotools-do-not-add-iconv-for-Requires.private.patch

@@ -1,27 +0,0 @@
-From 619c1be8d38ff79622db8f66f3b02832795315f9 Mon Sep 17 00:00:00 2001
-From: Christian Hesse <mail@eworm.de>
-Date: Wed, 14 Dec 2022 09:04:39 +0100
-Subject: [PATCH] autotools: do not add iconv for Requires.private
-
-There is no pkgconfig file for iconv, thus things break with this
-change. Let's drop iconv from Requires.private.
-
-Fixes: a83f3d32 ("autotools: Fix static linking when openssl is enabled in windows")
-Upstream: https://github.com/libarchive/libarchive/pull/1817/commits/619c1be8d38ff79622db8f66f3b02832795315f9
-Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
----
- configure.ac | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/configure.ac b/configure.ac
-index 99bff20d1..f245d0c55 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -455,7 +455,6 @@ if test "x$with_iconv" != "xno"; then
-     AC_CHECK_HEADERS([localcharset.h])
-     am_save_LIBS="$LIBS"
-     LIBS="${LIBS} ${LIBICONV}"
--    LIBSREQUIRED="$LIBSREQUIRED${LIBSREQUIRED:+ }iconv"
-     AC_CHECK_FUNCS([locale_charset])
-     LIBS="${am_save_LIBS}"
-     if test "x$ac_cv_func_locale_charset" != "xyes"; then

package/libarchive/0003-Fix-mbedtls-version-3-compatibility-2602.patch

@@ -1,238 +0,0 @@
-From 26ba5ee5d560d62ad05aa6819608fd21cbb962f9 Mon Sep 17 00:00:00 2001
-From: James Hilliard <james.hilliard1@gmail.com>
-Date: Thu, 15 May 2025 04:56:59 -0600
-Subject: [PATCH] Fix mbedtls version 3 compatibility (#2602)
-
-We need to use the new API for mbedtls 3 compatibility
-
-Fixes #2025
-
-Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
-Upstream: https://github.com/libarchive/libarchive/commit/63d7c24eeaa108ecc2ef258c0505eefdadaaaf35
----
- libarchive/archive_digest.c | 72 +++++++++++++++++++++++++++++++++++++
- 1 file changed, 72 insertions(+)
-
-diff --git a/libarchive/archive_digest.c b/libarchive/archive_digest.c
-index 33518740..03f0edd6 100644
---- a/libarchive/archive_digest.c
-+++ b/libarchive/archive_digest.c
-@@ -235,7 +235,11 @@ static int
- __archive_md5init(archive_md5_ctx *ctx)
- {
-   mbedtls_md5_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_md5_starts(ctx) == 0)
-+#else
-   if (mbedtls_md5_starts_ret(ctx) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -245,7 +249,11 @@ static int
- __archive_md5update(archive_md5_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_md5_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_md5_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -254,7 +262,11 @@ __archive_md5update(archive_md5_ctx *ctx, const void *indata,
- static int
- __archive_md5final(archive_md5_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_md5_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_md5_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_md5_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
-@@ -431,7 +443,11 @@ static int
- __archive_ripemd160init(archive_rmd160_ctx *ctx)
- {
-   mbedtls_ripemd160_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_ripemd160_starts(ctx) == 0)
-+#else
-   if (mbedtls_ripemd160_starts_ret(ctx) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -441,7 +457,11 @@ static int
- __archive_ripemd160update(archive_rmd160_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_ripemd160_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_ripemd160_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -450,7 +470,11 @@ __archive_ripemd160update(archive_rmd160_ctx *ctx, const void *indata,
- static int
- __archive_ripemd160final(archive_rmd160_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_ripemd160_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_ripemd160_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_ripemd160_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
-@@ -622,7 +646,11 @@ static int
- __archive_sha1init(archive_sha1_ctx *ctx)
- {
-   mbedtls_sha1_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha1_starts(ctx) == 0)
-+#else
-   if (mbedtls_sha1_starts_ret(ctx) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -632,7 +660,11 @@ static int
- __archive_sha1update(archive_sha1_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha1_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_sha1_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -641,7 +673,11 @@ __archive_sha1update(archive_sha1_ctx *ctx, const void *indata,
- static int
- __archive_sha1final(archive_sha1_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha1_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_sha1_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_sha1_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
-@@ -890,7 +926,11 @@ static int
- __archive_sha256init(archive_sha256_ctx *ctx)
- {
-   mbedtls_sha256_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha256_starts(ctx, 0) == 0)
-+#else
-   if (mbedtls_sha256_starts_ret(ctx, 0) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -900,7 +940,11 @@ static int
- __archive_sha256update(archive_sha256_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha256_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_sha256_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -909,7 +953,11 @@ __archive_sha256update(archive_sha256_ctx *ctx, const void *indata,
- static int
- __archive_sha256final(archive_sha256_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha256_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_sha256_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_sha256_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
-@@ -1130,7 +1178,11 @@ static int
- __archive_sha384init(archive_sha384_ctx *ctx)
- {
-   mbedtls_sha512_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_starts(ctx, 1) == 0)
-+#else
-   if (mbedtls_sha512_starts_ret(ctx, 1) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -1140,7 +1192,11 @@ static int
- __archive_sha384update(archive_sha384_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_sha512_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -1149,7 +1205,11 @@ __archive_sha384update(archive_sha384_ctx *ctx, const void *indata,
- static int
- __archive_sha384final(archive_sha384_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_sha512_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_sha512_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
-@@ -1394,7 +1454,11 @@ static int
- __archive_sha512init(archive_sha512_ctx *ctx)
- {
-   mbedtls_sha512_init(ctx);
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_starts(ctx, 0) == 0)
-+#else
-   if (mbedtls_sha512_starts_ret(ctx, 0) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -1404,7 +1468,11 @@ static int
- __archive_sha512update(archive_sha512_ctx *ctx, const void *indata,
-     size_t insize)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_update(ctx, indata, insize) == 0)
-+#else
-   if (mbedtls_sha512_update_ret(ctx, indata, insize) == 0)
-+#endif
-     return (ARCHIVE_OK);
-   else
-     return (ARCHIVE_FATAL);
-@@ -1413,7 +1481,11 @@ __archive_sha512update(archive_sha512_ctx *ctx, const void *indata,
- static int
- __archive_sha512final(archive_sha512_ctx *ctx, void *md)
- {
-+#if MBEDTLS_VERSION_NUMBER > 0x03000000
-+  if (mbedtls_sha512_finish(ctx, md) == 0) {
-+#else
-   if (mbedtls_sha512_finish_ret(ctx, md) == 0) {
-+#endif
-     mbedtls_sha512_free(ctx);
-     return (ARCHIVE_OK);
-   } else {
--- 
-2.34.1
-

package/libarchive/libarchive.hash

@@ -1,4 +1,5 @@
-# From https://www.libarchive.de/downloads/sha256sums
-sha256  ed8b5732e4cd6e30fae909fb945cad8ff9cb7be5c6cdaa3944ec96e4a200c04c  libarchive-3.7.9.tar.xz
+# Locally computed after verifying the signature from
+# https://www.libarchive.de/downloads/libarchive-3.8.1.tar.xz.asc
+sha256  19f917d42d530f98815ac824d90c7eaf648e9d9a50e4f309c812457ffa5496b5  libarchive-3.8.1.tar.xz
 # Locally computed:
-sha256  b2cdf763345de2de34cebf54394df3c61a105c3b71288603c251f2fa638200ba  COPYING
+sha256  30e556b3959e3985d66efefec5eaac51d4995053caa1d3cffe6eb916f146f229  COPYING

package/libarchive/libarchive.mk

@@ -4,17 +4,13 @@
 #
 ################################################################################
 
-LIBARCHIVE_VERSION = 3.7.9
+LIBARCHIVE_VERSION = 3.8.1
 LIBARCHIVE_SOURCE = libarchive-$(LIBARCHIVE_VERSION).tar.xz
 LIBARCHIVE_SITE = https://www.libarchive.de/downloads
 LIBARCHIVE_INSTALL_STAGING = YES
 LIBARCHIVE_LICENSE = BSD-2-Clause, BSD-3-Clause, CC0-1.0, OpenSSL, Apache-2.0
 LIBARCHIVE_LICENSE_FILES = COPYING
 LIBARCHIVE_CPE_ID_VENDOR = libarchive
-# We're patching configure.ac
-LIBARCHIVE_AUTORECONF = YES
-# needed for autoreconf
-LIBARCHIVE_DEPENDENCIES += host-pkgconf
 
 ifeq ($(BR2_PACKAGE_LIBARCHIVE_BSDTAR),y)
 ifeq ($(BR2_STATIC_LIBS),y)

package/libargtable2/0001-apply-uint-patch.patch

@@ -0,0 +1,25 @@
+From 3fe1ce4d7aa7c4fc16471a9ab023ecf6628c2f11 Mon Sep 17 00:00:00 2001
+From: Chris McClelland <prophet3636@gmail.com>
+Date: Thu, 12 Nov 2020 14:18:27 +0000
+Subject: [PATCH] Apply uint patch
+
+Upstream: https://github.com/makestuff/libargtable2/commit/3fe1ce4d7aa7c4fc16471a9ab023ecf6628c2f11
+[thomas: strip to only have the include]
+Signed-off-by: Thomas Perale <thomas.perale@mind.be>
+---
+ src/arg_int.c     |  2 ++
+ 1 files changed, 2 insertions(+)
+
+diff --git a/src/arg_int.c b/src/arg_int.c
+index 29c20e5..c51706a 100644
+--- a/src/arg_int.c
++++ b/src/arg_int.c
+@@ -24,6 +24,8 @@ USA.
+ #include "config.h"
+ #endif
+ 
++#include <ctype.h>
++
+ /* #ifdef HAVE_STDLIB_H */
+ #include <stdlib.h>
+ /* #endif */

package/libavif/libavif.hash

@@ -1,3 +1,3 @@
-sha256  914662e16245e062ed73f90112fbb4548241300843a7772d8d441bb6859de45b  libavif-1.1.1.tar.gz
+sha256  0a545e953cc049bf5bcf4ee467306a2f113a75110edf59e61248873101cd26c1  libavif-1.3.0.tar.gz
 
 sha256  165abf92cc04b39e80d29cadea7a6a7e8fddf59407d4ad2616507a7ebe8216f9  LICENSE

package/libavif/libavif.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBAVIF_VERSION = 1.1.1
+LIBAVIF_VERSION = 1.3.0
 LIBAVIF_SITE = $(call github,AOMediaCodec,libavif,v$(LIBAVIF_VERSION))
 LIBAVIF_LICENSE = BSD-2-Clause, IJG, Apache-2.0
 LIBAVIF_LICENSE_FILES = LICENSE

package/libblockdev/libblockdev.hash

@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  c4738e1abedefffe886521f9f0e7a9306c6f50f7691d88e011438c88608bdfa7  libblockdev-3.3.0.tar.gz
+sha256  a2e2e448a19d420480b8cce5e0752197482a65cb62a9ed55d88b237da36600d1  libblockdev-3.3.1.tar.gz
 sha256  97bdc721d875501b6243a456333fdfdb1ab64d31c4da2554de845caf4674b946  LICENSE

package/libblockdev/libblockdev.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBBLOCKDEV_VERSION = 3.3.0
+LIBBLOCKDEV_VERSION = 3.3.1
 LIBBLOCKDEV_SITE = https://github.com/storaged-project/libblockdev/releases/download/$(LIBBLOCKDEV_VERSION)
 LIBBLOCKDEV_LICENSE = LGPL-2.1
 LIBBLOCKDEV_LICENSE_FILES = LICENSE