veracrypt: add version 1.26.29 by flatstik · Pull Request #30508 · openwrt/packages

flatstik · 2026-09-12T02:15:37Z

Add a console-only VeraCrypt package using FUSE3 and statically linked wxBase. Crypto is portable C so the package can be built for any OpenWrt target. Runtime depends on libstdcpp, libatomic, fuse3-utils and losetup.

📦 Package Details

Maintainer: @
_{(You can find this by checking the history of the package Makefile.)}

Description:

🧪 Run Testing Details

OpenWrt Version:
OpenWrt Target/Subtarget:
OpenWrt Device:

✅ Formalities

I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

It can be applied using git am
It has been refreshed to avoid offsets, fuzzes, etc., using
```
make package/<your-package>/refresh V=s
```
It is structured in a way that it is potentially upstreamable
_{(e.g., subject line, commit description, etc.)}
_{We must try to upstream patches to reduce maintenance burden.}

openwrt-ai · 2026-09-12T05:33:54Z

+VCOPTIONS=
+OPTIONS=
+
+[ "$#" -ge 3 ] && shift 3


When no options are given, mount invokes the helper as mount.veracrypt <dev> <dir>: $# is 2, nothing is shifted, and the loop below parses the device and mountpoint as option words, producing --fs-options=<dev>,<dir>. The fixed shift 3 is also wrong when mount passes -s/-f/-n/-v ahead of -o. Scan forward to -o instead.

Suggested change

[ "$#" -ge 3 ] && shift 3

shift 2

while [ "$#" -gt 0 ] && [ "$1" != "-o" ]; do shift; done

[ "$#" -gt 0 ] && shift

Generated by Claude Code

fixed, thanks

Generated by Claude Code

openwrt-ai · 2026-09-12T05:33:59Z

+		system)           VCOPTIONS="$VCOPTIONS --mount-options=system" ;;
+		fs=*)             VCOPTIONS="$VCOPTIONS --filesystem=${arg#*=}" ;;
+		keyfiles=*)       VCOPTIONS="$VCOPTIONS --keyfiles=${arg#*=}" ;;
+		password=*)       VCOPTIONS="$VCOPTIONS --password=${arg#*=}" ;;


The volume password ends up in the exec'd process's argv, readable by any local user from /proc/<pid>/cmdline while the mount runs. veracrypt has a --stdin switch ("Read password from standard input") — feeding the password there and keeping it off the command line would avoid the exposure.

Generated by Claude Code

fixed, thanks — solved by switching to --stdin.

Generated by Claude Code

openwrt-ai · 2026-09-12T05:34:05Z

+PKG_HASH:=60826731e2982b4bd231e3930e85a44391169638671a1b200c518f8c8b46cb2a
+
+PKG_MAINTAINER:=Ville Takio <ville+git@takio.fi>
+PKG_LICENSE:=Apache-2.0 AND LicenseRef-TrueCrypt-3.0


nit: the shipped binary statically links wxBase, so the wxWindows Licence also applies to it but appears in neither PKG_LICENSE nor PKG_LICENSE_FILES. Worth adding, since the bundled wxWidgets tarball is part of what this package builds and ships.

Generated by Claude Code

openwrt-ai · 2026-09-12T05:34:11Z

+define Package/veracrypt/install
+	$(INSTALL_DIR) $(1)/usr/bin $(1)/sbin
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/Main/veracrypt $(1)/usr/bin/veracrypt
+	$(INSTALL_BIN) ./files/mount.veracrypt $(1)/sbin/mount.veracrypt


nit: the generic CI version check runs every executable in a standard path with --version/--help; mount.veracrypt --version would exec veracrypt --fs-options=--version --version "" and fail rather than print the version. Does this need a test-version.sh (which per CONTRIBUTING.md skips the generic detection entirely) next to the existing test.sh?

Generated by Claude Code

fixed, thanks

Generated by Claude Code

Add a console-only VeraCrypt package using FUSE3 and statically linked wxBase. Crypto is portable C so the package can be built for any OpenWrt target. Runtime depends on libstdcpp, libatomic, fuse3-utils and losetup. Upstream: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 Tested: https://github.com/flatstik/veracrypt_mipsel_24kc Signed-off-by: Ville Takio <ville+git@takio.fi>

Unpack the official bz2 with -xjf so prepare is not tar-from-stdin. Parse mount.veracrypt options after -o, and pass the password on stdin. Add the wxWindows licence for static wxBase. Override the generic version probe so mount.veracrypt is not called with --version. Upstream: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 wxWindows licence: https://www.wxwidgets.org/about/licence/ Signed-off-by: Ville Takio <ville+git@takio.fi>

LuCI frontend for console VeraCrypt. Opening existing containers is the supported, tested path (password, mount point, nokernelcrypto). Create/token/header tools are included but less proven. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

Match mount.veracrypt: use veracrypt --stdin instead of --password so the passphrase is not visible in ps. Decrypt with --filesystem=none to fsck the mapper or loop device, then dismount. Prompt apk add when fsck tools are missing. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

mount.veracrypt already avoids --password. printf still shows the passphrase in ps; use a here-document with --stdin instead. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

Relicense original LuCI pages and rpcd helper under GNU GPL v2 only. https://www.gnu.org/licenses/old-licenses/gpl-2.0.html Signed-off-by: Ville Takio <ville+git@takio.fi>

License mount.veracrypt and OpenWrt packaging helpers under GNU GPL v2 only. VeraCrypt remains Apache-2.0 AND TrueCrypt License 3.0; wxWidgets remains the wxWindows Library Licence 3.1. https://www.gnu.org/licenses/old-licenses/gpl-2.0.html Signed-off-by: Ville Takio <ville+git@takio.fi>

Trim each dialog to flags that operation actually uses. Create and delete directories in the same modal, with confirmation. Long jobs gain Abort (kills veracrypt/fsck on the router). Stream the job log live, with copy and save; keep the dialog open when live output is checked. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

LuCI applications belong in openwrt/luci. Keep this feed package console-only. The optional web UI depends on veracrypt and is not bundled here. https://github.com/openwrt/luci Signed-off-by: Ville Takio <ville+git@takio.fi>

openwrt-ai

Commit checks

ebeef0ba / b726a874 / 200462be / 102ffaf6 add ~3.5k lines of utils/luci-app-veracrypt that c09ffe0d then deletes in full. Squash the four out so the series only adds utils/veracrypt.
471d6866 "veracrypt: keep password off printf argv" — reverts the pipe f749a954 introduced one commit earlier, and its stated reason (printf showing the passphrase in ps) does not hold on OpenWrt. Fold the final form into f749a954 rather than shipping the pair.

Generated by Claude Code

openwrt-ai · 2026-09-15T05:35:21Z

+define Build/Prepare
+	mkdir -p $(PKG_BUILD_DIR)
+	$(PKG_UNPACK)
+	$(HOST_TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(WX_FILE)
+endef


Open-coding the unpack drops $(Build/Patch), so any future patches/ directory here is silently ignored (along with the version.date and ./src/ steps). The mkdir is redundant — package.mk:247 already creates $(PKG_BUILD_DIR) before Build/Prepare runs, and Build/Prepare/Default invokes exactly the PKG_UNPACK override defined above.

Suggested change

define Build/Prepare

mkdir -p $(PKG_BUILD_DIR)

$(PKG_UNPACK)

$(HOST_TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(WX_FILE)

endef

define Build/Prepare

$(call Build/Prepare/Default)

$(HOST_TAR) -C $(PKG_BUILD_DIR) -xjf $(DL_DIR)/$(WX_FILE)

endef

Generated by Claude Code

openwrt-ai · 2026-09-15T05:35:29Z

+	/usr/bin/veracrypt --text --non-interactive --stdin \
+		$VCOPTIONS --fs-options="${OPTIONS%,}" "$DEV" "$MNTPT" <<EOF
+${PASS}
+EOF


An unquoted here-document still interprets \ before $, `, \ and newline, so a passphrase containing a backslash is mangled before veracrypt ever sees it and the mount fails with a wrong-password error. The ps exposure this replaced does not exist: printf is an ash builtin on OpenWrt (BUSYBOX_DEFAULT_ASH_PRINTF is y), so it forks no process with the passphrase in its argv.

Suggested change

/usr/bin/veracrypt --text --non-interactive --stdin \

$VCOPTIONS --fs-options="${OPTIONS%,}" "$DEV" "$MNTPT" <<EOF

${PASS}

EOF

printf '%s\n' "$PASS" | /usr/bin/veracrypt --text --non-interactive --stdin \

$VCOPTIONS --fs-options="${OPTIONS%,}" "$DEV" "$MNTPT"

Generated by Claude Code

openwrt-ai · 2026-09-15T05:35:36Z

+
+PKG_MAINTAINER:=Ville Takio <ville+git@takio.fi>
+PKG_LICENSE:=Apache-2.0 AND LicenseRef-TrueCrypt-3.0 AND LicenseRef-wxWindows-3.1 AND GPL-2.0-only
+PKG_LICENSE_FILES:=src/License.txt License.txt files/COPYING


nit: PKG_LICENSE_FILES entries are paths inside the unpacked source tree, so files/COPYING — which lives in the package directory — resolves to nothing; none of the ~1200 other PKG_LICENSE_FILES in this feed point outside the source. The SPDX tag in mount.veracrypt already covers the packaging helper, and the wxWidgets licence is at wxWidgets-$(WX_VERSION)/docs/licence.txt if you want it listed (WX_VERSION is defined below this line, so it would need reordering).

Suggested change

PKG_LICENSE_FILES:=src/License.txt License.txt files/COPYING

PKG_LICENSE_FILES:=src/License.txt License.txt

Generated by Claude Code

openwrt-ai · 2026-09-15T05:35:42Z

+	$(INSTALL_DIR) $(1)/usr/bin $(1)/sbin $(1)/usr/share/doc/veracrypt
+	$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/Main/veracrypt $(1)/usr/bin/veracrypt
+	$(INSTALL_BIN) ./files/mount.veracrypt $(1)/sbin/mount.veracrypt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/src/License.txt $(1)/usr/share/doc/veracrypt/License.txt
+	$(INSTALL_DATA) $(PKG_BUILD_DIR)/wxWidgets-$(WX_VERSION)/docs/licence.txt \
+		$(1)/usr/share/doc/veracrypt/wxWindows.txt


nit: shipping licence text to the device costs flash on targets that count it, and only 4 of ~1200 Makefiles in this feed install anything under /usr/share/doc. PKG_LICENSE / PKG_LICENSE_FILES is the channel for this metadata.

Suggested change

$(INSTALL_DIR) $(1)/usr/bin $(1)/sbin $(1)/usr/share/doc/veracrypt

$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/Main/veracrypt $(1)/usr/bin/veracrypt

$(INSTALL_BIN) ./files/mount.veracrypt $(1)/sbin/mount.veracrypt

$(INSTALL_DATA) $(PKG_BUILD_DIR)/src/License.txt $(1)/usr/share/doc/veracrypt/License.txt

$(INSTALL_DATA) $(PKG_BUILD_DIR)/wxWidgets-$(WX_VERSION)/docs/licence.txt \

$(1)/usr/share/doc/veracrypt/wxWindows.txt

$(INSTALL_DIR) $(1)/usr/bin $(1)/sbin

$(INSTALL_BIN) $(PKG_BUILD_DIR)/src/Main/veracrypt $(1)/usr/bin/veracrypt

$(INSTALL_BIN) ./files/mount.veracrypt $(1)/sbin/mount.veracrypt

Generated by Claude Code

openwrt Bot added Add package not following guidelines labels Sep 12, 2026

flatstik force-pushed the veracrypt-add branch from 9fedae8 to e37f100 Compare September 12, 2026 02:17

openwrt Bot removed the not following guidelines label Sep 12, 2026

flatstik force-pushed the veracrypt-add branch from e37f100 to b4535cd Compare September 12, 2026 02:23

openwrt-ai reviewed Sep 12, 2026

View reviewed changes

openwrt Bot added the not following guidelines label Sep 14, 2026

flatstik force-pushed the veracrypt-add branch from 1d88e9a to 7681f48 Compare September 14, 2026 11:50

openwrt Bot added not following guidelines and removed not following guidelines labels Sep 14, 2026

flatstik force-pushed the veracrypt-add branch from c9e981b to f658a57 Compare September 14, 2026 13:09

openwrt Bot removed the not following guidelines label Sep 14, 2026

flatstik force-pushed the veracrypt-add branch from f658a57 to 707cbe7 Compare September 14, 2026 13:13

flatstik requested a review from openwrt-ai September 14, 2026 14:59

openwrt Bot added the not following guidelines label Sep 14, 2026

flatstik added 7 commits September 14, 2026 19:18

veracrypt: keep password off printf argv

471d686

mount.veracrypt already avoids --password. printf still shows the passphrase in ps; use a here-document with --stdin instead. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

luci-app-veracrypt: use GPL-2.0-only

200462b

Relicense original LuCI pages and rpcd helper under GNU GPL v2 only. https://www.gnu.org/licenses/old-licenses/gpl-2.0.html Signed-off-by: Ville Takio <ville+git@takio.fi>

flatstik force-pushed the veracrypt-add branch from 0bb8590 to f5605b9 Compare September 14, 2026 16:18

openwrt Bot removed the not following guidelines label Sep 14, 2026

flatstik added 2 commits September 14, 2026 20:00

luci-app-veracrypt: drop from packages feed

c09ffe0

LuCI applications belong in openwrt/luci. Keep this feed package console-only. The optional web UI depends on veracrypt and is not bundled here. https://github.com/openwrt/luci Signed-off-by: Ville Takio <ville+git@takio.fi>

openwrt Bot added the Drop package label Sep 14, 2026

openwrt-ai reviewed Sep 15, 2026

View reviewed changes

Navigation Menu

veracrypt: add version 1.26.29 - #30508

veracrypt: add version 1.26.29#30508
flatstik wants to merge 9 commits into
openwrt:masterfrom
flatstik:veracrypt-add

flatstik commented Sep 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

openwrt-ai Sep 12, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai Sep 12, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai Sep 12, 2026

Uh oh!

openwrt-ai Sep 12, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai left a comment

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

openwrt-ai Sep 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-[ "$#" -ge 3 ] && shift 3
+shift 2
+while [ "$#" -gt 0 ] && [ "$1" != "-o" ]; do shift; done
+[ "$#" -gt 0 ] && shift

	PKG_LICENSE_FILES:=src/License.txt License.txt files/COPYING
	PKG_LICENSE_FILES:=src/License.txt License.txt

Conversation

flatstik commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Package Details

🧪 Run Testing Details

✅ Formalities

If your PR contains a patch:

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Commit checks

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

flatstik commented Sep 12, 2026 •

edited

Loading