strongswan: fix build with wolfSSL 5.9.2 - #30380
Conversation
wolfSSL 5.9.2 removed mlkem.h. Backport the upstream change to use wc_mlkem.h directly. Fixes: openwrt#30291 Signed-off-by: Dharmik Parmar <dharmikparmar2004@yahoo.com> (cherry picked from commit 2edf6a0)
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit (a8a424d). Backport fidelity checks out:
- The
(cherry picked from commit 2edf6a0af0cc722436643e4bc4a1f72d670f8fc4)trailer points at a real commit onmasterwith the same subject, author and body. - Diffing the two commits, the only difference is the surrounding
PKG_VERSION/PKG_RELEASEcontext (6.0.7 / 6→7 on master vs 6.0.3 / 1→2 here). The new patch file is byte-identical, and thePKG_RELEASEbump for adding a patch without a version change is correct. - Patch number 0905 does not collide with the 0903/0904 patches already on
openwrt-25.12.
Nothing here blocks a merge. One optional refresh question inline.
On CI: five of the ten build targets are red, but the one I looked at (Test x86_64) fails in the apk index step with ERROR: wget: exited with error 8 / UNTRUSTED signature while fetching downloads.openwrt.org/.../packages.adb, which looks like feed infrastructure rather than anything this change did — and strongSwan itself built fine on the five green targets, which also confirms the patch applies. Worth a re-run, but I'd leave that call to the maintainer.
Generated by Claude Code
|
|
||
| --- a/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c | ||
| +++ b/src/libstrongswan/plugins/wolfssl/wolfssl_kem.c | ||
| @@ -25,10 +25,7 @@ |
There was a problem hiding this comment.
nit (optional, not a blocker): this hunk header is carried over verbatim from the master version of the patch, but the two branches build different strongSwan releases — master is at PKG_VERSION:=6.0.7 (Makefile on 2edf6a0) while openwrt-25.12 is at 6.0.3. The @@ -25,10 +25,7 @@ line numbers were never recomputed against the 6.0.3 tarball, and the "refreshed to avoid offsets or fuzz" box in the PR description is left unchecked.
It does apply — several CI targets built the package successfully — so this is only about whether it applies at an offset. Could you run make package/strongswan/refresh V=s against 6.0.3 and re-commit if the hunk header shifts? If you already checked and it applies clean, feel free to ignore.
Generated by Claude Code
|
gentle ping on this |
|
Ping as well, was going to deploy ipsec this weekend and couldn't due to the packages going missing. Running 25.12 on ramips/mt7621. The checks seem to be spurious failures (truncated packages index, etc.), need to be re-attempted. |
5 participants
📦 Package Details
Maintainer: @pprindeville
Description:
wolfSSL 5.9.2 removed the
mlkem.hheader, causing strongSwan 6.0.3 to fail to build on theopenwrt-25.12branch.Backport the upstream strongSwan change to include
wc_mlkem.hdirectly. This is the same fix already merged into the packages master branch.Fixes #30291
🧪 Run Testing Details
✅ Formalities
If your PR contains a patch:
It can be applied using
git amIt has been refreshed to avoid offsets or fuzz using:
It is structured in a way that is potentially upstreamable
The patch is backported from strongSwan upstream commit
98b133c54c5e3f66f46a5bb11c9b09d06fdc8469.