veracrypt: add version 1.26.29 - #30508
Conversation
9fedae8 to
e37f100
Compare
Add a console-only VeraCrypt package using FUSE3 and statically linked wxBase. Crypto is portable C so the package can be built for any OpenWrt target. Runtime depends on libstdcpp, libatomic, fuse3-utils and losetup. Tested on OpenWrt 25.12.5, ramips/mt7621, ASUS RT-AX53U using a stripped build at https://github.com/flatstik/veracrypt_mipsel_24kc Signed-off-by: Ville Takio <ville+git@takio.fi>
e37f100 to
b4535cd
Compare
| $(eval $(call Download,wxwidgets)) | ||
|
|
||
| # Official source tarball has no top-level directory. | ||
| PKG_UNPACK:=$(HOST_TAR) -C $(PKG_BUILD_DIR) $(TAR_OPTIONS) |
There was a problem hiding this comment.
TAR_OPTIONS is -xf -, so this expands to tar -C <build_dir> -xf - with nothing piped into it — overriding PKG_UNPACK drops the bzcat $(DL_DIR)/$(PKG_SOURCE) | prefix that UNPACK_CMD normally supplies, and prepare reads an empty stdin. Decompress explicitly, the way net/tac_plus and net/etebase do.
| PKG_UNPACK:=$(HOST_TAR) -C $(PKG_BUILD_DIR) $(TAR_OPTIONS) | |
| PKG_UNPACK:=$(HOST_TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(PKG_SOURCE) |
Generated by Claude Code
| VCOPTIONS= | ||
| OPTIONS= | ||
|
|
||
| [ "$#" -ge 3 ] && shift 3 |
There was a problem hiding this comment.
When no options are given, mount invokes the helper as mount.veracrypt <dev> <dir>: $# is 2, nothing is shifted, and the loop below parses the device and mountpoint as option words, producing --fs-options=<dev>,<dir>. The fixed shift 3 is also wrong when mount passes -s/-f/-n/-v ahead of -o. Scan forward to -o instead.
| [ "$#" -ge 3 ] && shift 3 | |
| shift 2 | |
| while [ "$#" -gt 0 ] && [ "$1" != "-o" ]; do shift; done | |
| [ "$#" -gt 0 ] && shift |
Generated by Claude Code
| system) VCOPTIONS="$VCOPTIONS --mount-options=system" ;; | ||
| fs=*) VCOPTIONS="$VCOPTIONS --filesystem=${arg#*=}" ;; | ||
| keyfiles=*) VCOPTIONS="$VCOPTIONS --keyfiles=${arg#*=}" ;; | ||
| password=*) VCOPTIONS="$VCOPTIONS --password=${arg#*=}" ;; |
There was a problem hiding this comment.
The volume password ends up in the exec'd process's argv, readable by any local user from /proc/<pid>/cmdline while the mount runs. veracrypt has a --stdin switch ("Read password from standard input") — feeding the password there and keeping it off the command line would avoid the exposure.
Generated by Claude Code
| PKG_HASH:=60826731e2982b4bd231e3930e85a44391169638671a1b200c518f8c8b46cb2a | ||
|
|
||
| PKG_MAINTAINER:=Ville Takio <ville+git@takio.fi> | ||
| PKG_LICENSE:=Apache-2.0 AND LicenseRef-TrueCrypt-3.0 |
There was a problem hiding this comment.
nit: the shipped binary statically links wxBase, so the wxWindows Licence also applies to it but appears in neither PKG_LICENSE nor PKG_LICENSE_FILES. Worth adding, since the bundled wxWidgets tarball is part of what this package builds and ships.
Generated by Claude Code
| define Package/veracrypt/install | ||
| $(INSTALL_DIR) $(1)/usr/bin $(1)/sbin | ||
| $(INSTALL_BIN) $(PKG_BUILD_DIR)/src/Main/veracrypt $(1)/usr/bin/veracrypt | ||
| $(INSTALL_BIN) ./files/mount.veracrypt $(1)/sbin/mount.veracrypt |
There was a problem hiding this comment.
nit: the generic CI version check runs every executable in a standard path with --version/--help; mount.veracrypt --version would exec veracrypt --fs-options=--version --version "" and fail rather than print the version. Does this need a test-version.sh (which per CONTRIBUTING.md skips the generic detection entirely) next to the existing test.sh?
Generated by Claude Code
2 participants
Add a console-only VeraCrypt package using FUSE3 and statically linked wxBase. Crypto is portable C so the package can be built for any OpenWrt target. Runtime depends on libstdcpp, libatomic, fuse3-utils and losetup.
📦 Package Details
Maintainer: @
(You can find this by checking the history of the package
Makefile.)Description:
🧪 Run Testing Details
✅ Formalities
If your PR contains a patch:
git am(e.g., subject line, commit description, etc.)
We must try to upstream patches to reduce maintenance burden.