[flatstik]

📦 Package Details

Maintainer: @flatstik

Description:
Add a console-only VeraCrypt package and wxWidgets' non-GUI library (wxBase), which it needs, as a shared-library package (one commit per package).

wxwidgets (libwxbase3.2):

• wxWidgets 3.2.12 (stable 3.2 series, ABI-compatible across 3.2.x), wxBase only; ABI_VERSION:=3.2 follows the soname. wx-config is staged for other packages.
• Built without networking, archives, compressed streams, regex, file system watching and debug assertions (1.2 MB installed on mipsel).

veracrypt 1.26.31:

• FUSE3, no patches; x86 builds without assembler (NOASM).
• Without dmsetup (lvm2, optional) volumes are mounted and formatted through FUSE3; with lvm2, kernel dm-crypt is used (needs kmod-crypto-xts, AES only).
• /etc/config/veracrypt describes the volumes (also edited by luci-app-veracrypt, luci-app-veracrypt: add optional LuCI UI luci#9069). The init script and a block hotplug script mount volumes with auto_mount '1', reading the password from a root-only password_file on stdin; stop never forces an unmount.
• Source: the signed release tarball; License.txt is installed as the TrueCrypt License 3.0 requires.

Changelog: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.31 (VeraCrypt 1.26.31), https://github.com/wxWidgets/wxWidgets/releases/tag/v3.2.12 (wxWidgets 3.2.12)

---

🧪 Run Testing Details

• OpenWrt Version: OpenWrt 25.12.6 (r33311-981c978eff)
• OpenWrt Target/Subtarget: ramips/mt7621
• OpenWrt Device: ASUS RT-AX53U

Run-tested: self-tests, create, mount/write/read/unmount, mount.veracrypt, --stdin, the init script and the luci-app-veracrypt backend.

Build-tested: mipsel_24kc, mips_24kc, mips64, arm_cortex-a15_neon-vfpv4, aarch64_generic, x86_64.

---

✅ Formalities

• I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

[openwrt-ai]

Commit checks

• de9cc1a "veracrypt: add version 1.26.29" — the Signed-off-by: Ville Takio trailer appears twice; keep one.

---

Generated by Claude Code

[BKPepe]

Renamed: the LuCI apps now keep their settings and favorites in /etc/config/luci-veracrypt (openwrt/luci#9069 bba2be04d9, openwrt/luci#9119 f7ab1fe62e), so nothing is called veracrypt in UCI anymore.

No one is going to read AI wall of texts. It is just too exhausting to read it. It is wrong. Folder /etc/config is where UCI config files are. So, you should do it as other packages does. :)

UCI config belongs to the packages, not to the LuCI integration.

[flatstik]

OK, reluctantly: veracrypt ships /etc/config/veracrypt again (5897e99), with a note that it holds luci-app-veracrypt's settings and favorites, nothing is mounted at boot and no passwords are stored. The LuCI PRs are back to using it. Device test: 23 passed, 0 failed.

I'm still of the opinion that veracrypt and the luci-app are and will be separate packages. and the luci-app is naturally dependent of this package, but not the other way around.

[flatstik]

On VeraCrypt reading its own settings from /etc/config/veracrypt, I don't plan to patch that:

• VeraCrypt's settings are XML files (Configuration.xml, Favorite Volumes.xml), and /etc/config is for UCI only.
• One practical issue remains: root's ~/.config/VeraCrypt doesn't survive sysupgrade. Users who need that can add it to /etc/sysupgrade.conf; the console tool hardly uses it anyway, since everything is passed as options.
• It would be an OpenWrt-only patch to carry, which is exactly what reviewers push back on.

[karlp]

You don't normally patch the package to understand UCI config files. I don't think I've ever seen that done. Normally, the openwrt init script that you provide as part of your package, handles UCI config files and generates a suitable config file in the native format that the package expects. dnsmasq, snmpd, mosquitto come to mind as examples off the top of my head. As mentioned, that is part of this package. a Luci app would provide unified editing of that config, but is completely independent.

[flatstik]

@karlp Thanks, agreed that's the usual pattern for daemons like dnsmasq or mosquitto. VeraCrypt isn't a service, though: there's nothing to start at boot (automounting is out of scope, as it would mean storing the password on the router), and the console tool takes everything it needs as command-line options. An init script generating VeraCrypt's XML preferences from UCI would have nothing to do, so I think it's unnecessary.

The only config that's actually needed is the settings and favorites of luci-app-veracrypt, and that is the /etc/config/veracrypt shipped here. Then again, I think it should be part of luci-app-veracrypt, but not here..

[flatstik]

Updated (81378fe): this package ships no configuration anymore; /etc/config/veracrypt moved to luci-app-veracrypt (openwrt/luci#9069). It now has a small init script that only unmounts all VeraCrypt volumes gracefully on stop, reboot and shutdown. Nothing is mounted at boot. Everything works.

[flatstik]

Added START=99 (88ec1d9) to satisfy the check, but it starts absolutely nothing: the only intention of the script is to gracefully unmount all VeraCrypt volumes when the device is stopped, rebooted or shut down. Start and restart do nothing.

[BKPepe]

I don't think the current init script is sufficient for an OpenWrt package. If we provide /etc/config/veracrypt, the base package should actually consume it, rather than leaving volume management to the optional LuCI app.

I'd expect a UCI-driven init script that mounts only explicitly enabled volumes at boot and cleanly unmounts only the volumes it manages. The UCI configuration and its conffiles should live in this package, so the feature also works through the CLI, scripts and configuration management without LuCI.

START=99 is too late for volumes needed by services started earlier. Start after fstab has mounted the backing storage but before dependent services, and stop after those services have stopped. A one-shot rc.common script is sufficient; USE_PROCD=1 is not mandatory when there is no long-running process to supervise.

Please also define how unattended authentication works without storing passwords in UCI or exposing them in process arguments. If the init script generates VeraCrypt's native XML configuration, make sure it uses the correct configuration path and preserves per-volume options that the native favorites format cannot represent.

Finally, the current global unmount with an unconditional forced fallback and the mount helper's handling of ro, -f and password= need to be addressed before merging.

Also, please consider adding nasm/host to PKG_BUILD_DEPENDS instead of setting NOASM=1 on i386/x86_64, as NOASM=1 disables hardware AES-NI and SIMD acceleration on x86 targets.

---

Hey, I'll be honest, if you want to help, it's not the best way to keep reminding yourself on IRC and saying I'm the bad guy and that I'm driving you crazy.

No other pull request has as much attention as yours. Be a little considerate, I'm telling it like it is and we have 137 open pull requests here.

A lot of people are trying to help you, including @karlp, who says that the UCI config should just be here and we're going around in circles again. I understand that the AI ​​is answering me and that it's vibe-coded, but it takes a little self-reflection and taming the AI ​​a little, see #30782

Each of your force pushes contains so many changes that I simply cannot review them all over again. It really takes so much time that I can't even afford it.

[flatstik]

@BKPepe I'm very sorry if you got offended. The "driving me crazy" on IRC was purely about me not understanding your requests, not about you. Mea culpa.

Addressed in e2eb671:

• mount.veracrypt (080): ro sets VeraCrypt's read-only protection, -f no longer mounts, password= is passed on stdin (not argv), new passwordfile=.
• init script: no forced unmount; a volume still in use is left mounted and logged.
• NASM: right, NOASM loses AES-NI on x86. There is no nasm/host yet, though: devel/nasm is target-only (no HostBuild). I checked that nasm 2.16.01 assembles VeraCrypt's .asm files (AS=nasm), and on x86_64 they are PIE-safe. On i386 they aren't (448 absolute relocations in Aes_x86.o, which musl rejects as text relocations, see Linux: fix the i386 musl and sparc64 builds, and test both in CI veracrypt/VeraCrypt#1923), so i386 has to stay NOASM for now. I'd add a HostBuild to nasm and enable the asm on x86_64 as a follow-up, to keep this PR from growing again.
• Automount at boot: deliberately not added. It means keeping the secret on the router next to the volume.

To say it once more: VeraCrypt has no configuration of its own that it would read, and it never will. The command-line tool takes everything as options (its only optional per-user preferences are XML files under ~/.config/VeraCrypt, unrelated to UCI). /etc/config/veracrypt exists only so that luci-app-veracrypt can keep its favorite volumes and the operation timeout for whoever uses LuCI. VeraCrypt itself doesn't need it, which is why it ships with luci-app-veracrypt and not here.

Noted on the force pushes: from now on each push will be small, with a short list of what changed.

[BKPepe]

I disagree with keeping volume configuration and handling exclusively in LuCI.

OpenWrt routinely wraps CLI-only tools with UCI configuration and init scripts. etherwake, autossh, hd-idle, socat and ttyd are concrete examples. The fact that VeraCrypt itself doesn't read UCI is irrelevant — the integration layer is responsible for translating UCI settings into CLI invocations. LuCI should be an optional frontend to the base package's configuration, not the owner of it.

You have also just added passwordfile= support to mount.veracrypt for unattended mounting through /etc/fstab. Boot-time mounting should be an explicit opt-in (auto_mount '0' by default), with credentials supplied through user-managed keyfiles or password files and the security trade-offs documented. Different users have different threat models; that isn't a reason to rule out the feature entirely.

Please move /etc/config/veracrypt and its conffiles into the base package, implement UCI-driven mounting and safe shutdown handling in the init script, and have LuCI manage that same configuration. Mount only explicitly enabled volumes after their backing storage is available and before dependent services start; unmount only volumes managed by the integration.

If this PR is deliberately CLI-only, remove the init script. The current middle ground adds system integration without actually providing it. Personally, I don't consider a CLI-only package user-friendly enough, and I think proper OpenWrt integration should be part of this PR rather than postponed to a future one.

[BKPepe]

I don't understand why we're still arguing about this instead of implementing it properly.

I asked AI (Argon 4 High and GPT-6] as reviewer to draft a possible approach. The files below are not tested or reviewed by me, so treat them as a starting point, not a patch to merge blindly:

• Init script: https://gist.github.com/BKPepe/d8102c4dbf8c2334e7f9b67502a0a49d
• UCI config: https://gist.github.com/BKPepe/ab1db77d3ca31c02a40a119ba039a686

Could you explain what is actually wrong with this approach and why we couldn't have taken this direction from the beginning? We've been discussing this for three weeks, and I'd rather see concrete technical objections and a workable solution than keep going in circles about whether VeraCrypt itself reads UCI.

Regarding automount: the credentials don't necessarily have to be stored on the router next to the volume. They can come from a separate keyfile location, a password file populated at runtime, or a suitable hardware-token setup. Keep automount disabled by default, never store secrets in UCI, and let users choose their own threat model. That's no reason to omit an explicitly opt-in feature.

A CLI-only package is not user-friendly enough, and I don't want proper OpenWrt integration postponed to another PR.

[karlp]

Don't mind my comment about the config file being in this package, I was commenting generally to the perceived request that veracrypt grow a patch to handle uci config directly. I was (mistakenly, I don't know anything about veracrypt) that it was like ~any other packaged service and had an init script, the commentary was general.

[GeorgeSapkin]

I apologize for piling on to this lively discussion, especially considering I don't know anything about VeraCrypt, but shouldn't mounting be handled via fstab/crypttab? Without any services, etc. Unless there's some basic wire-up necessary. That way mounts can be added via the existing Mount Points UI:

I don't know how much crypttab support there is in the UI though. If none, perhaps that's the thing that should be added instead.

[flatstik]

@GeorgeSapkin OpenWrt's Mount Points (block-mount) only mounts block devices and has no crypttab. VeraCrypt volumes are often container files, opened by the veracrypt program itself (FUSE or dm-crypt), so fstab alone can't mount them.

The bigger point is security: a volume that mounts itself at boot needs its secret stored on the same router. If you don't need to enter a password, an attacker won't need to either. The usual setup is a fully encrypted system disk whose shortcuts mount the other encrypted disks; keyfiles on a USB stick avoid typing the password, but lower security a lot. My own use: a disk attached to the router that I unlock only occasionally and then use over the LAN via Samba.

For those who want it anyway, the package now has an opt-in init script; nothing is mounted unless a volume has auto_mount '1'.

[flatstik]

@BKPepe Thanks for the drafts. Done in 79a99f1, following their structure and option names: auto_mount, password_file, keyfiles, empty_password, read_only, start/stop <name>, restart = start; configured volumes are managed, never forced. /etc/config/veracrypt is a conffile of this package again, and openwrt/luci#9069 edits it.

Where the draft would not work on OpenWrt, I deviated:

• no stat or mountpoint in the default busybox: the permission check uses ls -ln, the mountpoint check /proc/mounts;
• mounting at boot runs in the background (key derivation takes minutes; a synchronous start would hold up uhttpd and everything after it). start <name> stays synchronous with a real return code;
• /etc/hotplug.d/block/90-veracrypt mounts a volume once its disk appears, as your review asked; a failed volume is not retried on every block event;
• the directories above password_file and the keyfiles must be root-only too, and an empty first line in password_file is refused (an empty password needs empty_password '1').

Patch 080 now has full git-am headers and is submitted upstream (veracrypt/VeraCrypt#1928).

[flatstik]

@BKPepe On the credentials: covered in 4560e09. Automount stays off by default, and secrets never go in UCI. password_file must be root-only, e.g. /etc/veracrypt/passwords, or a file written at runtime under a 0700 /tmp/veracrypt. Keyfiles can live elsewhere, e.g. on a USB stick; the volume is mounted once the keyfile is present. Security token keyfiles work with start <name> on a terminal or from LuCI. Unattended use would need --token-pin on the command line, where any user can read it, so the init script refuses that.

[openwrt-ai]

Commit checks

• 9b128db "veracrypt: add version 1.26.29": the run-test line still lists mount.veracrypt (-f, ro, passwordfile=), but the reworked patch 080 dropped passwordfile=, so the helper now passes it on as a filesystem option. Remove passwordfile= from the commit message, and from the PR description, which also says "password not in the process list".

---

Generated by Claude Code

[flatstik]

If someone doesn't want to wait for the merging, the builds are available here: https://github.com/flatstik/packages/releases/tag/veracrypt-1.26.30-wx3.2.12

[openwrt-ai]

Reviewed 2 new commits; no new issues found.

---

Generated by Claude Code

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

• The PR description says the new package is named libwxbase3.2 (and that VeraCrypt depends on… · New
• This hard-codes the host staging path as $(STAGING_DIR)/host/bin/wx-config, which is not… · New
• This environment assignment is unquoted (MP=${1%/} awk ...). If the mountpoint contains spaces,… · New

1 resolved since last review

• Missing fuse3 build dependency for FUSE3 headers and pkg-config

_{Review effort: Lite}

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 2 new commits; no new issues found.

---

Generated by Claude Code

[openwrt-ai]

Reviewed 1 new commits; no new issues found.

---

Generated by Claude Code