wxwidgets, veracrypt: add new packages

[flatstik]

📦 Package Details

Maintainer: @flatstik

Description:
Add a console-only VeraCrypt package, and wxWidgets' non-GUI library (wxBase), which VeraCrypt needs, as its own shared-library package (one commit per package).

wxwidgets (libwxbase3.2), new:

• wxWidgets 3.2.11, the latest release of upstream's stable 3.2 series, which keeps the API and ABI compatible across 3.2.x: a security update of the library does not need VeraCrypt (or another user) to be rebuilt. The 3.3 releases are upstream's development branch, "API and ABI compatibility are not guaranteed".
• Only wxBase, as a shared library (libwx_baseu-3.2.so.0); ABI_VERSION:=3.2 follows the soname (as liblua5.4). wx-config is staged like gpg-error-config, so other packages can build against it.
• Built without networking, archive and compressed streams, regular expressions, file system watching and debug assertions (1.2 MB installed on mipsel). Enabling zlib, archives, regex and fswatcher would add about 400 KB; they can be turned on when a package needs them.

veracrypt:

• FUSE3 and wxBase from libwxbase3.2; x86 builds without assembler (NOASM), other targets use VeraCrypt's normal C/intrinsics code (ARMv8 hardware AES included)
• Runtime depends: libstdcpp, libwxbase, libfuse3, fuse3-utils, losetup, kmod-loop (mounts go through a loop device). No libatomic: neither veracrypt nor libwxbase imports any __atomic_* function on any target built (mips/mipsel only use __sync_*_4 from libgcc), so neither +libatomic nor ATOMIC64_DEPENDS (build: centralise libatomic dependencies for 64-bit atomics openwrt#25112) is needed
• --filesystem=ext4 needs e2fsprogs (mkfs.ext4), which stays optional
• Source: the official release tarball VeraCrypt_1.26.29_Source.tar.bz2; License.txt is installed to /usr/share/doc/veracrypt/ as the TrueCrypt License 3.0 requires
• /sbin/mount.veracrypt is upstream's helper. Without dmsetup (lvm2, not a dependency) VeraCrypt mounts and formats through FUSE3 (patch 040, merged upstream). With lvm2 installed it uses kernel dm-crypt as upstream does, which on OpenWrt needs kmod-crypto-xts (built in on x86_64) and supports AES only; for other ciphers and cascades --mount-options=nokernelcrypto (helper: -o nokernelcrypto) keeps FUSE
• Ships /etc/config/veracrypt (conffile) with global settings and commented example volumes; luci-app-veracrypt (luci-app-veracrypt: add optional LuCI UI luci#9069) edits it
• Patches, all backports of merged upstream commits:
  • 010: ARM CPU_Query* link fix (VC_INLINE), Crypto: use VC_INLINE for the ARM CPU_Query helpers veracrypt/VeraCrypt#1886 (veracrypt/VeraCrypt@5c7f60d)
  • 020: POSIX sh mount.veracrypt, Linux: make mount.veracrypt POSIX sh veracrypt/VeraCrypt#1895 (veracrypt/VeraCrypt@81cd94f)
  • 030: x86 NOASM link fix, Crypto: fix NOASM link failures on x86 veracrypt/VeraCrypt#1896 (veracrypt/VeraCrypt@a15c996)
  • 040: fall back to FUSE when dmsetup is not installed (so --create with ext4 and plain mounts work without lvm2), Linux: fall back to FUSE when dmsetup is not installed veracrypt/VeraCrypt#1898 (veracrypt/VeraCrypt@d24b821)
  • 050: fix the portable C code of Twofish, Camellia, Kuznyechik, SHA-2, BLAKE2s, Streebog and PBKDF2 on big-endian CPUs, avoid unaligned 64-bit accesses (SIGBUS on mips64) and extend the self-tests, Crypto: fix portable C code on big-endian CPUs veracrypt/VeraCrypt#1899 (veracrypt/VeraCrypt@425cea6)
  • 060: no unaligned 64-bit accesses on 32-bit ARM (Camellia/Whirlpool LDRD raised SIGBUS in the self-tests on arm_cortex-a15_neon-vfpv4), Crypto: no unaligned 64-bit accesses on 32-bit ARM veracrypt/VeraCrypt#1908 (veracrypt/VeraCrypt@cb1d9a4)
  • 070: alignment-safe word loads/stores for SHA-2, BLAKE2s, Twofish, Kuznyechik, Streebog and XTS on targets where unaligned access faults (32-bit ARM, MIPS); unchanged code on x86, x64, ARMv8 and PowerPC, Crypto: use alignment-safe loads and stores where unaligned access faults veracrypt/VeraCrypt#1909 (veracrypt/VeraCrypt@7c06e03)

The former patch 100 (wxWidgets build jobs) is gone with the bundled wxWidgets build.

Upstream: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29, https://github.com/wxWidgets/wxWidgets/releases/tag/v3.2.11

---

🧪 Run Testing Details

• OpenWrt Version: OpenWrt 25.12.5 (r33051-f5dae5ece4)
• OpenWrt Target/Subtarget: ramips/mt7621
• OpenWrt Device: ASUS RT-AX53U

Run-tested on the device above with the 25.12.5 SDK build of both packages (21 checks passed, 0 failed): libwxbase3.2 installed as a dependency and veracrypt resolves libwx_baseu-3.2.so.0 from it; --test self-tests, --create --filesystem=ext4 (formatted through FUSE, no dmsetup), mount/write/read/unmount, auto-hash mount, mount.veracrypt, and the luci-app-veracrypt backend.

Build-tested with the current snapshot SDK on mips_24kc (big-endian), mips64 big-endian (malta), arm_cortex-a15_neon-vfpv4, aarch64_generic and x86_64, plus the 25.12.5 SDK for mipsel_24kc; on all of them the binary's NEEDED list is libfuse3, libwx_baseu-3.2, libstdc++, libgcc_s and libc. The x86_64 build passes the generic runtime checks plus test.sh and test-version.sh in an OpenWrt rootfs. The packaged binaries pass veracrypt --text --test under qemu-user on arm_cortex-a15_neon-vfpv4 (-cpu cortex-a15 and cortex-a7), mipsel_24kc, mips_24kc, mips64 and aarch64_generic.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

• It can be applied using git am
• It has been refreshed to avoid offsets, fuzzes, etc., using

  make package/<your-package>/refresh V=s

• It is structured in a way that it is potentially upstreamable
  _{(e.g., subject line, commit description, etc.)
  We must try to upstream patches to reduce maintenance burden.}

[openwrt-ai]

Commit checks

• de9cc1a "veracrypt: add version 1.26.29" — the Signed-off-by: Ville Takio trailer appears twice; keep one.

---

Generated by Claude Code

[flatstik]

Pushed d061c88:

• Patches 101-103 (Crypto: fix portable C code on big-endian CPUs veracrypt/VeraCrypt#1899):
  • The big-endian Kuznyechik path no longer forms misaligned uint64* pointers.
  • The byte-wise helpers are inline functions, so each argument is evaluated once.
  • The XTS stack arrays are declared 8-byte aligned.
  • Little-endian object code is unchanged.
• New 901: the wxWidgets sub-build follows the OpenWrt jobserver instead of -j 4.
• test.sh: also checks the version.
• Commit message: states what was run-tested.

Verification:

• Quilt refresh leaves all 9 patches unchanged.
• An 11-target rebuild (4 big-endian) passes the self-tests, opens all official test volumes, and matches the known-answer output.
• The RT-AX53U (mipsel_24kc, 25.12.5) run passes 42/42.

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code

[flatstik]

Pushed f21dac1: veracrypt/VeraCrypt#1898 has been merged upstream, so the FUSE fallback is now 040-linux-fall-back-to-fuse-when-dmsetup-is-not-installed.patch. It is a backport of veracrypt/VeraCrypt@d24b82102a11 (Upstream-Status: Backport, same code as before).

Patch layout:

• 0xx: backports of merged upstream commits.
• 101-103: submitted in Crypto: fix portable C code on big-endian CPUs veracrypt/VeraCrypt#1899 and waiting for upstream review. They'll become backports once it is merged.
• 900/901: OpenWrt-specific.

Quilt refresh is clean. Run-tested again on an RT-AX53U (mipsel_24kc, 25.12.5).

[flatstik]

Pushed 02ead62: patches 101-103 regenerated from the updated veracrypt/VeraCrypt#1899 (maintainer review: fallback bswap_64 fixed, test buffer aligned, PBKDF2 tests compare the full output), and the From: of 040 now matches its Signed-off-by, like 010-030. Quilt refresh is clean. All 11 test targets (4 big-endian) pass the self-tests, the official test volumes and the known-answer checks. The run on an RT-AX53U (mipsel_24kc, 25.12.5) passes.

[flatstik]

Pushed 7811d5d: veracrypt/VeraCrypt#1899 has been merged upstream (squashed as veracrypt/VeraCrypt@425cea6c9c0d), so patches 101-103 are replaced by one backport, 050-crypto-fix-portable-c-code-on-big-endian-cpus.patch (Upstream-Status: Backport), with the same code. All patches are now either backports of merged upstream commits (010-050) or OpenWrt-specific (900, 901). Quilt refresh is clean. Built and tested again on mips_24kc (big-endian) and mipsel_24kc: the self-tests pass and the official test volumes open.

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code

[flatstik]

Pushed 9846b4b, answering the comments above:

• Patch 900: dropped. The FUSE fallback without dmsetup is upstream now (patch 040). The description explains what happens with lvm2 installed (kernel dm-crypt needs kmod-crypto-xts and supports AES only) and how to keep FUSE.
• Patch 901: replaced by 100-build-let-a-parent-make-control-the-wxwidgets-build-jobs.patch, which is the change submitted upstream as Build: let a parent make control the wxWidgets build jobs veracrypt/VeraCrypt#1903 (it references prosody: fix use of randomseed (prosody issue #439) #717). The package passes WX_MAKE_JOBS=, so the wx build always follows the OpenWrt job settings.
• Other changes:
  • The example files/veracrypt.config is cleaned up: no empty or obsolete options, no personal paths.
  • test.sh and test-version.sh use PKG_NAME/PKG_VERSION.

All patches are now upstream backports (010-050) or submitted upstream (100). Quilt refresh is clean. Tested:

• mips_24kc (big-endian) and mipsel_24kc: the self-tests pass and the official test volumes open;
• an RT-AX53U (mipsel_24kc, 25.12.5, no lvm2), on-device test 46/46, including mount.veracrypt without patch 900.

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code

[flatstik]

@BKPepe wxBase is now a separate package, as you suggested in your review: the PR has two commits.

• c82fca8 wxwidgets: add version 3.2.11 adds libs/wxwidgets, which builds wxBase (no GUI) as the shared library libwxbase3.2. 3.2 is upstream's stable, ABI-compatible series, so a wxWidgets security update only needs this package to be updated; wx-config is staged for other packages.
• f096a35 veracrypt: add version 1.26.29 depends on libwxbase and builds against the staged wx-config. It no longer downloads or builds wxWidgets, so the second source, WXSTATIC/WX_ROOT/WX_BUILD_DIR/WX_CONFIGURE_EXTRA_FLAGS and patch 100 are gone. The recipe now passes only NOASM (x86), NOGUI, WITHFUSE3, NOTEST, NOSTRIP, WX_CONFIG and the TC_EXTRA_* flags (OpenWrt's own CFLAGS/LDFLAGS).

Run-tested on ramips/mt7621 (ASUS RT-AX53U, 25.12.5) with both packages; details are in the PR description. Could you take another look?

[openwrt-ai]

Commit checks

• c82fca8 "wxwidgets: add version 3.2.11": "until now it built its own static copy" refers to an earlier revision of this PR. In the merged history VeraCrypt only arrives in the next commit, so drop that clause, e.g. "VeraCrypt (added next) links against it."

---

Generated by Claude Code

[flatstik]

Reworded the wxwidgets commit message as suggested in the review above ("VeraCrypt (added next) links against it."); the code is unchanged (same trees). The commits are now ddbb11b (wxwidgets, was c82fca8) and 9b9c4ee (veracrypt, was f096a35).

[map-b]

• libatomic depend "helper" build: centralise libatomic dependencies for 64-bit atomics openwrt#25112

[flatstik]

libatomic depend "helper" openwrt/openwrt#25112

Thanks, @map-b. I checked which atomics are actually used: neither veracrypt nor libwxbase imports any __atomic_* function on mips, mipsel, mips64, armv7, aarch64 or x86_64 (on mips/mipsel only __sync_*_4, which libgcc provides). VeraCrypt's Linux build has no 64-bit atomics at all; the -latomic was a leftover from the old static wxBase build. So instead of switching to $(ATOMIC64_DEPENDS), I dropped +libatomic and -latomic entirely (95ff724). Built on those six targets and run-tested again on ramips/mt7621 (25.12.5): the binary now needs only libfuse3, libwx_baseu-3.2, libstdc++, libgcc_s and libc.

@BKPepe the PR now has both packages as you asked; could you take another look?

[flatstik]

The arm_cortex-a15_neon-vfpv4 runtime test failed with Bus error in veracrypt --text --test (https://github.com/openwrt/packages/actions/runs/37618723855). It is a latent VeraCrypt bug that the new memory layout exposed: Crypto/config.h enables CRYPTOPP_ALLOW_UNALIGNED_DATA_ACCESS for every ARM with __ARM_FEATURE_UNALIGNED, but 32-bit ARM only handles unaligned single words, and camellia_set_key() loaded a 2-byte-aligned test key with ldrd (found with gdb under qemu-user -cpu cortex-a15).

Fixed in d10340a with patch 100, submitted upstream as veracrypt/VeraCrypt#1908: the macro is now defined only for AArch64 among the ARM targets. The armv7 build passes the self-tests under qemu with cortex-a15 and cortex-a7, the other targets are unchanged, and the mt7621 run-test passes again (21/21).

[flatstik]

Following up on the arm_cortex-a15 fix: I checked whether anything besides Camellia/Whirlpool does unaligned word accesses by running every cipher, hash, PBKDF2 and XTS on buffers at offsets 0..15 under qemu-user (armv7, mips, mipsel, mips64). SHA-2, BLAKE2s, Twofish, Kuznyechik, Streebog and the XTS whitening XOR could still fault when given an unaligned buffer. Real volume operations use aligned buffers, so this is latent, but b89a53a adds patch 101 (submitted upstream as veracrypt/VeraCrypt#1909) to make them alignment-safe. Output is unchanged (known-answer comparison at all offsets on x86_64, armv7, mips, mipsel and mips64), all targets build, the self-tests pass under qemu on armv7, mips, mipsel, mips64 and aarch64, and the mt7621 run-test passes (21/21).

[openwrt-ai]

Reviewed 2 new commits; no new issues found.

---

Generated by Claude Code

[flatstik]

LuCI apps for this package: openwrt/luci#9069 (luci-app-veracrypt, full-featured) and openwrt/luci#9119 (luci-app-veracrypt-lite, smaller). Both are optional and can be installed side by side.

[flatstik]

VeraCrypt merged veracrypt/VeraCrypt#1908 and veracrypt/VeraCrypt#1909, so patches 100/101 are now backports 060/070 of veracrypt/VeraCrypt@cb1d9a4 and veracrypt/VeraCrypt@7c06e03 (0526541). The patched source is unchanged: the mipsel binary is byte-identical to the one run-tested on the RT-AX53U (21/21).

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code