CZ-NIC · rwappler · Dec 17, 2021 · Dec 17, 2021 · Mar 9, 2022 · Mar 11, 2022
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
@@ -8,7 +8,8 @@ collect/pakon-lists/ @mmtj
 hardware/ @miska
 hardware/crypto-wrapper/ @VojtechMyslivec
 hardware/mox/mox-otp/ @VojtechMyslivec
-hardware/mox/mox-uboot/ @pali @elkablo
+hardware/mox/mox-uboot-uboot/ @pali @elkablo
+hardware/mox/mox-a53-firmware/ @pali @elkablo
 hardware/omnia/omnia-uboot/ @pali @elkablo
 
 # Lang - Python Packages

diff --git a/.github/workflows/multi-arch-test-build.yml b/.github/workflows/multi-arch-test-build.yml
@@ -13,16 +13,12 @@ jobs:
           - powerpc_8540
         version:
           - master
-          - 19.07.8
-          - 21.02.0
+          - 21.02.1
         runtime_test: [false]
         include:
           - arch: aarch64_cortex-a53
             version: master
             runtime_test: true
-          - arch: aarch64_cortex-a53
-            version: 19.07.8
-            runtime_test: true
           - arch: aarch64_cortex-a53
             version: 21.02.0
             runtime_test: true
@@ -37,7 +33,7 @@ jobs:
       - name: Determine changed packages
         run: |
           # only detect packages with changed Makefiles
-          PACKAGES="$(git diff --diff-filter=d --name-only origin/develop \
+          PACKAGES="$(git diff --diff-filter=d --name-only origin/master \
             | grep -E 'Makefile$|test.sh$' | grep -Ev '/files/|/src/' \
             | awk -F/ '{ print $(NF-1) }' | tr '\n' ' ')"
 

diff --git a/.gitlab/CODEOWNERS b/.gitlab/CODEOWNERS
@@ -8,7 +8,8 @@ collect/pakon-lists/ @mmatejek
 hardware/ @mhrusecky
 hardware/crypto-wrapper/ @vmyslivec
 hardware/mox/mox-otp/ @vmyslivec
-hardware/mox/mox-uboot/ @prohar @mbehun
+hardware/mox/mox-uboot-uboot/ @prohar @mbehun
+hardware/mox/mox-a53-firmware/ @prohar @mbehun
 hardware/omnia/omnia-uboot/ @prohar @mbehun
 
 # Lang - Python Packages

diff --git a/WORKFLOW.adoc b/WORKFLOW.adoc
@@ -248,8 +248,21 @@ First find git hash for turris-os-packages feed from tag in turris-build. Then y
 can create appropriate tag.
 [,sh]
 ----------------------------------------------------------------------------------
-git tag -s -m "Turris OS X.Y.Z" vX.Y.Z HASH
-git push --tags origin vX.Y.Z
+git tag -s vX.Y.Z HASH
+----------------------------------------------------------------------------------
+Enter tag message containing changelog of the tagged version from NEWS.
+```
+Turris OS packages for Turris OS X.Y.Z
+
+* A NEW FEATURE
+* ANOTHER NEW FEATURE
+* ...
+```
+
+After creating the tag, it is necessary to push it to the remote repository.
+[,sh]
+----------------------------------------------------------------------------------
+git push origin vX.Y.Z
 ----------------------------------------------------------------------------------
 
 === Preparing next minor or major version of Turris OS
@@ -263,7 +276,15 @@ recursive merge (without merge conflicts).
 [,sh]
 ----------------------------------------------------------------------------------
 git checkout master
-git merge --no-ff --gpg-sign develop
+git merge --no-ff --no-commit develop
+----------------------------------------------------------------------------------
+
+Change the branch in .github/workflows/multi-arch-test-build.yml from develop
+to master.
+[,sh]
+----------------------------------------------------------------------------------
+git add .github/workflows/multi-arch-test-build.yml
+git commit --no-edit --gpg-sign
 git push origin master
 ----------------------------------------------------------------------------------
 

diff --git a/admin/cronie/Makefile b/admin/cronie/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=cronie
 PKG_VERSION:=1.5.7
-PKG_RELEASE:=2
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://github.com/cronie-crond/cronie/archive

diff --git a/collect/haas-proxy/Makefile b/collect/haas-proxy/Makefile
@@ -8,7 +8,7 @@
 include $(TOPDIR)/rules.mk
 PKG_NAME:=haas-proxy
 PKG_VERSION:=2.0.2
-PKG_RELEASE:=2
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE:=proxy-v$(PKG_VERSION).tar.gz
 PKG_SOURCE_URL:=https://gitlab.nic.cz/haas/proxy/-/archive/v$(PKG_VERSION)/
@@ -39,7 +39,6 @@ define Package/haas-proxy
 	+sentinel-firewall \
 	+@KERNEL_CFS_BANDWIDTH
   CONFLICTS:=mitmproxy
-  VARIANT:=python3
 endef
 
 define Package/haas-proxy/description

diff --git a/collect/pakon-lists/Makefile b/collect/pakon-lists/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=pakon-lists
 PKG_VERSION:=6
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/pakon-light-lists.git

diff --git a/collect/pakon/Makefile b/collect/pakon/Makefile
@@ -1,5 +1,5 @@
 #
-# Copyright (C) 2017-2020 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
+# Copyright (C) 2017-2022 CZ.NIC, z. s. p. o. (https://www.nic.cz/)
 #
 # This is free software, licensed under the GNU General Public License v2.
 # See /LICENSE for more information.
@@ -8,46 +8,67 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=pakon
-PKG_VERSION:=1.2.1
-PKG_RELEASE:=4
+PKG_VERSION:=1.3.1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/pakon.git
-PKG_MIRROR_HASH:=19ab1643d0133b6324eda6df2c5c4d2cf90cc3994ca8cb7e03fb3f265dcc72d2
+PKG_MIRROR_HASH:=04ab824e22a60378eb94018f3024e44c43397eceed99c4562f78b7d9b7f0fcc5
 PKG_SOURCE_VERSION:=v$(PKG_VERSION)
 
 PKG_MAINTAINER:=CZ.NIC <[email protected]>
 PKG_LICENSE:=GPL-3.0-only
 PKG_LICENSE_FILES:=LICENSE
 
-PKG_INSTALL:=0
-
 include $(INCLUDE_DIR)/package.mk
 
 define Package/pakon
   SECTION:=collect
   CATEGORY:=Collect
   TITLE:=PArental KONtrol - light
-  DEPENDS:=+suricata-pakon +xz +python3-light +python3-logging +python3-ctypes +python3-cachetools +python3-sqlite3 +sqlite3-cli +pakon-lists +ouidb +suricata-conntrack-flows
+  DEPENDS:=\
+    +suricata-pakon \
+    +suricata-conntrack-flows \
+    +pakon-lists \
+    +python3-light \
+    +python3-logging \
+    +python3-ctypes \
+    +python3-cachetools \
+    +python3-sqlite3 \
+    +sqlite3-cli \
+    +xz \
+    +ouidb \
+    +turris-auth \
+    +lighttpd-mod-proxy
 endef
 
 define Package/pakon/description
-  Simple daemon that is able to collect events from suricata, store them locally to SQLite DB.
+  Simple daemon that is able to collect events from suricata and store them locally to SQLite DB.
 endef
 
-define Build/Compile
-  true
-endef
-
-define Build/Install
-  true
-endef
+Build/Compile:=:
 
 define Package/pakon/conffiles
 /etc/config/pakon
 endef
 
 define Package/pakon/install
+	# WebApps
+	$(INSTALL_DIR) $(1)/usr/share/turris-webapps/
+	$(INSTALL_DATA) ./files/webapps-pakon.json $(1)/usr/share/turris-webapps/10_pakon.json
+	$(INSTALL_DIR) $(1)/www/webapps-icons/
+	$(INSTALL_DATA) ./files/pakon.png $(1)/www/webapps-icons/
+
+	# Web
+	$(INSTALL_DIR) $(1)/www/pakon
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/web/index.html $(1)/www/pakon
+	$(CP) -r $(PKG_BUILD_DIR)/web/static $(1)/www/pakon
+	$(INSTALL_DIR) $(1)/www/cgi-bin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/web/api.cgi $(1)/www/cgi-bin/pakon
+	$(INSTALL_DIR) $(1)/etc/lighttpd/conf.d/
+	$(INSTALL_DATA) ./files/lighttpd-pakon.conf $(1)/etc/lighttpd/conf.d/80-pakon.conf
+
+	# PaKon itself
 	$(INSTALL_DIR) $(1)/etc/suricata-pakon/output_conf.d
 	$(INSTALL_DATA) ./files/pakon-output.yaml $(1)/etc/suricata-pakon/output_conf.d/pakon.yaml
 	$(INSTALL_DIR) $(1)/etc/init.d
@@ -73,25 +94,33 @@ endef
 
 define Package/pakon/postinst
 #!/bin/sh
-[ -n "$$IPKG_INSTROOT" ] || {
+if [ -z "$$IPKG_INSTROOT" ]; then
 	/usr/libexec/pakon-light/create_db.py
 	# one time fix - convert all names to lowercase. Mixed case names shouldn't be saved anymore (fixed in monitor)
 	[ -f /var/lib/pakon.db ] && sqlite3 /var/lib/pakon.db "UPDATE traffic SET app_hostname = LOWER(app_hostname);" || true
-	[ -f /srv/pakon/pakon-archive.db ] && /usr/bin/sqlite3 /srv/pakon/pakon-archive.db "UPDATE traffic SET app_hostname = LOWER(app_hostname);" || true
-        /etc/init.d/pakon-monitor enable
-        /etc/init.d/pakon-monitor restart 2>/dev/null
-        /etc/init.d/pakon-handler enable
-        /etc/init.d/pakon-handler restart 2>/dev/null
+	[ -f /srv/pakon/pakon-archive.db ] && sqlite3 /srv/pakon/pakon-archive.db "UPDATE traffic SET app_hostname = LOWER(app_hostname);" || true
+	/etc/init.d/pakon-monitor enable
+	/etc/init.d/pakon-monitor restart 2>/dev/null
+	/etc/init.d/pakon-handler enable
+	/etc/init.d/pakon-handler restart 2>/dev/null
 	/etc/init.d/suricata-pakon restart 2>/dev/null
-}
+	/etc/init.d/lighttpd restart 2>/dev/null
+fi
+endef
+
+define Package/pakon/postrm
+#!/bin/sh
+if [ -z "$$IPKG_INSTROOT" ]; then
+	/etc/init.d/lighttpd restart 2>/dev/null
+fi
 endef
 
 define Package/pakon/prerm
 #!/bin/sh
-        /etc/init.d/pakon-monitor disable
-        /etc/init.d/pakon-monitor stop
-        /etc/init.d/pakon-handler disable
-        /etc/init.d/pakon-handler stop
+/etc/init.d/pakon-monitor disable
+/etc/init.d/pakon-monitor stop
+/etc/init.d/pakon-handler disable
+/etc/init.d/pakon-handler stop
 endef
 
 $(eval $(call BuildPackage,pakon))
diff --git a/collect/pakon/files/lighttpd-pakon.conf b/collect/pakon/files/lighttpd-pakon.conf
@@ -0,0 +1,18 @@
+## API CGI
+$HTTP["url"] =~ "^/pakon/api" {
+    cgi.assign += ( "" => "" )
+}
+
+# Set security
+$HTTP["url"] =~ "^/pakon/" {
+    fastcgi.server = ( "/" => ( turris_auth_scriptname => turris_auth ))
+}
+
+## Set URLs
+alias.url += (
+    "/pakon/api" => "/www/cgi-bin/pakon",
+    "/pakon/" => "/www/pakon/"
+)
+$HTTP["url"] =~ "^/pakon$" {
+    url.redirect = ( "^/pakon$" => "/pakon/" )
+}
diff --git a/collect/pakon/files/pakon.png b/collect/pakon/files/pakon.png
diff --git a/collect/pakon/files/webapps-pakon.json b/collect/pakon/files/webapps-pakon.json
@@ -0,0 +1,10 @@
+{
+    "id": "pakon",
+    "title": "PaKon",
+    "url": "/pakon/",
+    "icon": "/icons/pakon.png",
+    "description": {
+        "en": "Your network traffic history.",
+        "cs": "Záznam síťového provozu."
+    }
+}
diff --git a/collect/pakon/patches/cleanup-faster.patch b/collect/pakon/patches/cleanup-faster.patch
diff --git a/collect/sentinel/sentinel-certgen/Makefile b/collect/sentinel/sentinel-certgen/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sentinel-certgen
 PKG_VERSION:=6.2
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/sentinel/certgen.git
@@ -30,7 +30,6 @@ define Package/sentinel-certgen
   TITLE:=Certgen
   URL:=https://gitlab.nic.cz/turris/sentinel/certgen
   DEPENDS:=+python3-light +python3-six +python3-requests +python3-cryptography +crypto-wrapper
-  VARIANT:=python3
 endef
 
 define Package/sentinel-certgen/description

diff --git a/collect/sentinel/sentinel-dynfw-client/Makefile b/collect/sentinel/sentinel-dynfw-client/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sentinel-dynfw-client
 PKG_VERSION:=1.4.0
-PKG_RELEASE:=2
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/sentinel/dynfw-client.git

diff --git a/collect/sentinel/sentinel-eula/Makefile b/collect/sentinel/sentinel-eula/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sentinel-eula
 PKG_VERSION:=1.1
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_SOURCE_PROTO:=git
 PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/sentinel/eula.git

diff --git a/collect/sentinel/sentinel-firewall/Makefile b/collect/sentinel/sentinel-firewall/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sentinel-firewall
 PKG_VERSION:=0.1.2
-PKG_RELEASE:=1
+PKG_RELEASE:=$(AUTORELEASE)
 
 PKG_MAINTAINER:=CZ.NIC <[email protected]>
 

diff --git a/collect/sentinel/sentinel-fwlogs/Makefile b/collect/sentinel/sentinel-fwlogs/Makefile
@@ -1,5 +1,5 @@
 #
-## Copyright (C) 2020 CZ.NIC z.s.p.o. (https://www.nic.cz/)
+## Copyright (C) 2020, 2022 CZ.NIC z.s.p.o. (https://www.nic.cz/)
 #
 ## This is free software, licensed under the GNU General Public License v3.
 # See /LICENSE for more information.
@@ -8,13 +8,12 @@
 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=sentinel-fwlogs
-PKG_VERSION:=0.1.0
-PKG_RELEASE:=3
+PKG_VERSION:=0.3.0
+PKG_RELEASE:=$(AUTORELEASE)
 
-PKG_SOURCE_PROTO:=git
-PKG_SOURCE_URL:=https://gitlab.nic.cz/turris/sentinel/fwlogs.git
-PKG_MIRROR_HASH:=fdb2dae1d7f62d5f57ccf70232a7b1aeededea3844845002167701272340029b
-PKG_SOURCE_VERSION:=v$(PKG_VERSION)
+PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.gz
+PKG_SOURCE_URL:=https://gitlab.nic.cz/api/v4/projects/976/packages/generic/sentinel-fwlogs/$(PKG_VERSION)
+PKG_HASH:=e9df14ac2d2fef15b02a6291f0a580e998b74c9a5fe1c85cb6becbcbc167c8c7
 
 PKG_MAINTAINER:=CZ.NIC <[email protected]>
 PKG_LICENSE:=GPL-3.0-or-later
@@ -23,9 +22,9 @@ PKG_LICENSE_FILES:=LICENSE
 PKG_BUILD_DEPENDS:=argp-standalone
 
 PKG_INSTALL:=1
-PKG_FIXUP:=autoreconf
 
 include $(INCLUDE_DIR)/package.mk
+include $(INCLUDE_DIR)/autotools.mk
 
 define Package/sentinel-fwlogs
   SECTION:=collect
@@ -36,7 +35,7 @@ define Package/sentinel-fwlogs
   DEPENDS:=\
     +czmq \
     +msgpack-c \
-    +logc +logc-argp \
+    +logc +logc-argp +logc-czmq \
     +libnetfilter-log \
     +sentinel-firewall +iptables-mod-nflog \
     +sentinel-proxy