When adding suEXEC to the apache package, Alpine's package [1] served as
a template. Not enough attention was paid to the details.

Alpine uses a different layout. So for OpenWrt to use /var/www as
DocumentRoot does not make sense. /var is also volatile on OpenWrt. This
commit removes the configure argument. The default is htdocsdir.

This also does away with uidmin/gidmin 99. The default is 100, which is
fine.

Finally, the suexec binary is moved from /usr/sbin to
/usr/lib/apache2/suexec_dir. Upstream recommends installing suexec with
"4750" (see [2]) and the group set to the user's group. While that would
be possible, it would cause a few headaches on OpenWrt. The group would
need to be changed first in a post-install script and a call to chmod
would need to be made afterward, to make the binary SUID again.

It's easier to hide the SUID binary away from others in a directory.
This way we don't need to use chmod in the post-install script.

[1] https://github.com/alpinelinux/aports/tree/master/main/apache2
[2] https://httpd.apache.org/docs/2.4/suexec.html

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Hides away the contents of the log directory from others.

Signed-off-by: Sebastian Kemper <sebastian_ml@gmx.net>

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

This fixes:
  - CVE-2019-11048

Signed-off-by: Michael Heimpold <mhei@heimpold.de>

Shorewall: Bump to 5.2.4.5

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

Signed-off-by: W. van den Akker <wvdakker@wilsoft.nl>

nss: add -flto and makefile cleanup

nspr: nspr add -flto to compile

open-vm-tools: bump to version 11.1.0

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

libreswan: update to 3.32

nextdns: Update to version 1.5.8

npupnp updates

Signed-off-by: Olivier Poitrey <rs@nextdns.io>

python-atomicwrites: update to version 1.4.0

faad2: update to 2.9.2

golang: Various improvements/tweaks

Signed-off-by: Kagurazaka Kotori <kagurazakakotori@gmail.com>

python3: Add script to help find standard library dependencies

This adds a script that searches a Python package's source code to find
imports for separately-packaged standard library modules.

The script can be run by calling make with the configure target and
"PY3=stdlib V=s" arguments, e.g.

    make package/python3-lxml/configure PY3=stdlib V=s

This also updates the readme on how to call this script, as well as more
information on Python package dependencies in general.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

also add -flto to compiler flags

Signed-off-by: Lucian Cristian <lucian.cristian@gmail.com>

Because the first stage for building target Go is actually a host build,
the default platform options (GO386, GOARM, etc.) are detected from the
host. These values are written to a source file and kept when building
the second stage.

This modifies this source file to set the appropriate values for the
target platform, and reset values for other platforms to their
cross-compiling / most compatible defaults.

Signed-off-by: Jeffery To <jeffery.to@gmail.com>

etesync-server: add package and configuration for running with uwsgi on nginx [RFC]

Use the upstream value for NGX_MAX_PROCESSES (=1024) again.
So it is safe to use `worker_processes auto;` (which sets it to
the number of CPUs). Also use this directive in the conf instead
of calculating the number in the init and passing it as argument.

Signed-off-by: Peter Stadler <peter.stadler@student.uibk.ac.at>

redis: update to version 6.0.1

gerbera: set config file to 600 permissions

Only gerbera needs to read the file.

Added config file to conffiles to fix opkg update support.

Added several extra options to the UCI config. Manual editing is still required.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Note:
add explicit -latomic on 32-bit MIPS because 32-bit MIPS is not able to perform 64-bit atomics in hardware

Signed-off-by: Jan Pavlinec <jan.pavlinec@nic.cz>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Signed-off-by: Rosen Penev <rosenp@gmail.com>

Removed upstreamed patches.

Signed-off-by: Rosen Penev <rosenp@gmail.com>

sslh: Add http probe support

lvm2: Added script and updated Makefile to activate lvm2 at preinit t…

nginx: update all-module configurations

treewide: add conffiles

coremark: Add coremark package

readsb: new package

ifstat: make dependency on libnetsnmp conditional

mariadb: updates for config, auth-pam and init

Among other changes, this fixes compilation with mips16, working around
a gcc bug.

Signed-off-by: Eneas U de Queiroz <cotequeiroz@gmail.com>

knxd: bump to version 0.14.37

Signed-off-by: Othmar Truniger <github@truniger.ch>

The upstream package supports it with a configure switch.
Defaulting to 'with SNMP support' as it was before.

Signed-off-by: Christophe Lermytte <gentoo@lermytte.be>