v1.2.0 — Correctness & Hardening Release

v1.2.0 — Correctness & Hardening Release

Note: v1.1.0 was tagged against an older commit and is superseded by this release.

This release audits and corrects the previous build's scripts, build system, and CI. No new features; every change below is a fix.

Security

• OpenSSL 3.3.7 → 3.5.7 (LTS). The 3.3.x branch left upstream support in April 2026. 3.5 is the current LTS branch, supported until April 2030, and keeps the same libssl.so.3 ABI — a drop-in replacement. 3.5.7 additionally fixes CVE-2026-45447 (heap use-after-free in PKCS7_verify()), CVE-2026-34182, CVE-2026-34183, CVE-2026-42764, and others.
• Update checker no longer disables TLS verification. check_update.sh previously used wget --no-check-certificate. It now prefers the bundled curl (linked against the patched OpenSSL) with certificate verification, and it now checks this repository's releases instead of the upstream fork's — previously it would report "updates" from a different project entirely.
• CGI input validation tightened.
  • validate.sh gains the missing validateDT() — set_configs.sh has been calling it since the fork, so TIMELAPSE_DT changes were silently rejected.
  • validateDir() and eventsfile.sh now use an allowlist (record directories are machine-generated alphanumeric names) instead of a character blocklist.
  • The remaining blocklists (eventsfiledel.sh, eventsdirdel.sh, validate.sh) now also reject backticks, |, <, >, &, and — where filenames permit — /. The previous lists allowed slashes.
  • Fixed the if ! $(validateX ...) anti-pattern (executes the function's output rather than checking its status) in proxy.sh, preset.sh, service.sh, and set_configs.sh.

Bug fixes

• README restored. A prior commit truncated README.md mid-code-block, deleting the final deploy steps, the config-hardening instructions, and the entire build guide.
• service.sh: mismatched [[ ... ] bracket broke the watermark check in ONVIF profile setup.
• snapshot.sh: OUTPUT_FILE=$(validateFile ...) captured the function's empty output and wiped the filename, silently breaking snapshot-to-file.
• record.sh: invalid time values were never rejected — the script compared the variable against a string the validator never produces. Now checks the validator's return status.
• ptz_presets.sh: removed a redundant --* case pattern shadowed by -*.
• system.sh: ~ inside quotes never expands, so the .ash_history → /dev/null symlink check always re-ran; now uses $HOME.
• launch.sh: self-unquoting debug_flag="-d "$debug_level"" assignments (×3) fixed.
• .gitattributes was named gitattributes (no dot), so the line-ending rules were never applied.

Build & CI

• ShellCheck lint now gates the build. The step previously ended in || true (could never fail) and excluded codes from an outdated shellcheck, flooding logs with 553 findings. The job now uses a documented busybox-ash exclusion list, and the tree is lint-clean under it.
• Mosquitto build target uses the same extract guard as other packages instead of wiping and re-extracting each run.
• scripts/ renamed to toolchain/ (it only contains cross-compile definition files); Makefile and Dockerfile references

v1.1.1.1: Critical Bug Fixes & Modernized Packages

A massive update fixing critical shell-level bugs found in the original firmware scripts, unlocking the full ONVIF event suite, and replacing end-of-life bundled binaries with modern, patched versions.

🚀 What's New

• ONVIF Server Crash Loop Fix (Critical): Wrapped onvif_simple_server in setsid to safely detach it from the controlling terminal, preventing segfaults and exit code 1 errors when backgrounded from init.
• ONVIF Event Pipeline Fix: Corrected boot ordering so ipc2file, onvif_notify_server, and wsd_simple_server all start before onvif_simple_server blocks. Motion events now work reliably on boot.
• Full ONVIF Event Suite: Fixed events=3 → events=6 so all 6 detection events are registered: Motion, People, Vehicles, Animals, Baby Crying, and General Sound.
• RTSP Network Buffer Tuning: Injected sysctl commands to increase network buffers (rmem_max, wmem_max), resulting in smoother, stutter-free high-resolution RTSP streams.
• Dynamic Multi-WiFi Support: Added WIFI_MULTI=yes functionality to bypass single-network restrictions and read a custom wpa_supplicant.conf from the SD card.
• Persistent Camera State Memory: Camera now intelligently restores its software on/off state after a reboot by reading camera.conf at boot.
• cloudAPI Always Updated: Replaced fragile version-comparison logic with a direct cp -f so cloudAPI and cloudAPI_fake are always pushed to flash on boot.
• MQTT Conditional Start: MQTT daemon now only starts if explicitly enabled in config, saving memory and CPU for users who don't use smart home integrations.
• Crontab Overwrite Bug Fix: Corrected > → >> in system.sh to stop cron jobs silently wiping out existing scheduled tasks.
• All AI Detection On By Default: camera.conf now ships with all AI detection features enabled.

🛡️ Updated Packages

All bundled binaries have been replaced with current, patched versions cross-compiled for arm-hisiv300-linux (ARMv5te, uClibc 0.9.33.2):

• Mosquitto 2.1.2 (Major version bump, hardened network packet handling, memory leak fixes)
• libfuse3 3.18.1 (14 minor versions of cumulative bug fixes and performance stabilization)
• OpenSSL 3.3.7 (Fixes CVE-2025-9230, CVE-2025-9231, CVE-2025-15467, CVE-2025-69421, and CVE-2026-series)
• curl 8.20.0 (~3 years of critical upstream security patches)
• dropbear 2025.89 (Fixes CVE-2025-14282 privilege escalation)
• pure-ftpd 1.0.54 (Multiple hardening fixes across PureDB, PAM, and quota handling)
• cJSON 1.7.18 (New core dependency required to support modern Mosquitto 2.x builds)

🐛 Shell & CGI Bug Fixes

• RTSP watchdog: $RTSP_PORT used instead of $RRTSP_PORT fixed, allowing locked-stream recovery to finally trigger.
• Web UI persistence: Toggling camera on/off, LED, IR, sensitivity, and rotation via the web UI is now properly written and persisted to camera.conf.
• CGI Guards: Fixed path traversal guards (DIR="none" and FILE="none") in event deletion scripts.
• MQTT Home Assistant: Fixed undefined CONF_SYSTEM_FILE, corrected MQTT_ADV_TELEMETRY_QOS key, and anchored grep to prevent partial key matches.
• Default Configs: Added CAMERA_ENABLED=yes to system.conf and all missing AI detection keys to camera.conf.

v1.1.0 — Security hardening, bug fixes, ONVIF/RTSP stability

What's New in v1.1.0

This release is a major stability and security overhaul. All changes have been tested on a live Yi Home 1080p camera (Hi3518ev200).

---

Bug Fixes

Camera & ONVIF

• Fixed camera on/off state not persisting across reboots — camera would get stuck permanently off after toggling via web UI
• Fixed ONVIF never starting on fresh installs — onvif_simple_server was not on PATH, now auto-copied to bin/ on boot
• Fixed WS-Discovery (wsd_simple_server) not starting automatically — now correctly controlled by the ONVIF_WSDD=yes config key on boot

RTSP

• Fixed RTSP watchdog locked-process detection — $RTSP_PORT typo in wd_rtsp.sh meant a frozen stream was never detected or recovered

Web UI / CGI

• Fixed all camera settings (LED, IR, motion sensitivity, rotation, sound detection) not persisting across reboots — settings written to web UI were never saved to camera.conf
• Fixed motion detection and AI human detection having no CGI handlers despite being ONVIF event sources

Shell Scripts

• Fixed 13 additional shell/CGI bugs in the original firmware including cron entry overwrites, undefined variables, broken path traversal guards, wrong config key reads, and missing grep anchors

Config Templates

• Fixed missing CAMERA_ENABLED key in system.conf default template
• Fixed 7 missing keys in camera.conf default template that web UI could write but boot scripts could never restore

---

Build System

• Upgraded CMake to 3.25.3 in the Docker build environment — mosquitto 2.1.x requires CMake 3.18+ and Ubuntu 18.04 only ships 3.10.2
• Fixed mosquitto GTest configure failure during cross-compilation — find_package(GTest) in mosquitto's top-level CMakeLists.txt is now patched out at configure time
• Fixed OpenSSL library paths for CMake 3.25 strict path resolution
• Fixed cJSON CMake variable names (CJSON_INCLUDE_DIR / CJSON_LIBRARY singular) for mosquitto 2.1.x compatibility
• Fixed TC_BIN path in build.sh — was pointing to non-existent target/bin/ instead of bin/
• Fixed CMake sysroot in hisiv300.cmake — was pointing to target/armv5te_arm9_soft/ causing crt1.o not found errors

---

Updated Packages

Package	Original	Updated
OpenSSL	1.1.x (EOL)	3.3.7
curl	7.86.0-DEV	8.20.0
dropbear	2018.76	2026.91
mosquitto	1.5.8	2.1.2
pure-ftpd	1.0.47	1.0.54
libfuse3	3.4.2	3.18.2
cJSON	—	1.7.18

---

UniFi Protect

ONVIF and WS-Discovery are functional. However auto-discovery will not work if your camera is on a different VLAN or subnet than your UniFi controller — WS-Discovery uses multicast which does not cross subnet boundaries.

To add the camera manually in UniFi Protect:

• IP: your camera's IP address (check your router's DHCP table)
• Port: 8080
• Username: admin

---

Known Issues

• Two wd_rtsp.sh instances may appear in ps output after the first boot — clears automatically on the next reboot
• UniFi Protect full adoption not verified across all network topologies — ONVIF configuration completes correctly but camera adoption depends on your specific setup

Hardened Firmware v1.0.0

Security update: patched CVE-2026-33150 and stabilized core logic. Includes hardened binaries for Dropbear, OpenSSL, and Mosquitto.

Latest Build

Automated build of yi-hack-v5-updated. Extract the contents to your SD card.