head	1.21;
access;
symbols
	pkgsrc-2026Q2:1.19.0.2
	pkgsrc-2026Q2-base:1.19
	pkgsrc-2026Q1:1.12.0.2
	pkgsrc-2026Q1-base:1.12
	pkgsrc-2025Q4:1.4.0.2
	pkgsrc-2025Q4-base:1.4;
locks; strict;
comment	@# @;


1.21
date	2026.07.13.19.17.24;	author adam;	state Exp;
branches;
next	1.20;
commitid	ASuQJWvKEbkpJwNG;

1.20
date	2026.07.08.18.32.36;	author bsiegert;	state Exp;
branches;
next	1.19;
commitid	cDbYxmIrkrXYDSMG;

1.19
date	2026.06.05.10.21.47;	author bsiegert;	state Exp;
branches
	1.19.2.1;
next	1.18;
commitid	jt8yVpLxXvatZAIG;

1.18
date	2026.06.03.05.08.56;	author adam;	state Exp;
branches;
next	1.17;
commitid	5q8B5sB1L1W6kjIG;

1.17
date	2026.05.24.05.41.36;	author adam;	state Exp;
branches;
next	1.16;
commitid	nKPTyDdLjSvgP1HG;

1.16
date	2026.05.19.18.16.38;	author adam;	state Exp;
branches;
next	1.15;
commitid	C5XnxjGfKDTeasGG;

1.15
date	2026.05.07.18.50.03;	author bsiegert;	state Exp;
branches;
next	1.14;
commitid	MMrI2EXGAt3HJUEG;

1.14
date	2026.04.16.12.40.07;	author adam;	state Exp;
branches;
next	1.13;
commitid	lwt9rqTbEvKombCG;

1.13
date	2026.04.08.05.45.06;	author bsiegert;	state Exp;
branches;
next	1.12;
commitid	FFJx9trbRMg7k7BG;

1.12
date	2026.03.11.06.35.28;	author adam;	state Exp;
branches
	1.12.2.1;
next	1.11;
commitid	iTRfCZ6nvMLgvwxG;

1.11
date	2026.03.06.21.08.00;	author bsiegert;	state Exp;
branches;
next	1.10;
commitid	AQtIeR1eh5qvuXwG;

1.10
date	2026.02.27.11.47.25;	author adam;	state Exp;
branches;
next	1.9;
commitid	YoGipvwaSC6kC0wG;

1.9
date	2026.02.24.08.45.34;	author bsiegert;	state Exp;
branches;
next	1.8;
commitid	IrpU9bGVDwSIHBvG;

1.8
date	2026.02.23.13.22.14;	author adam;	state Exp;
branches;
next	1.7;
commitid	ZaEMcJWvhhxzgvvG;

1.7
date	2026.02.23.08.38.47;	author adam;	state Exp;
branches;
next	1.6;
commitid	XrSJvWCMADebHtvG;

1.6
date	2026.01.26.19.49.19;	author bsiegert;	state Exp;
branches;
next	1.5;
commitid	yzzTb7tKWPopjWrG;

1.5
date	2026.01.15.19.54.51;	author bsiegert;	state Exp;
branches;
next	1.4;
commitid	Zuo9UmMrkrU4HwqG;

1.4
date	2025.12.08.21.03.23;	author adam;	state Exp;
branches;
next	1.3;
commitid	NN6HsWPya3tgiElG;

1.3
date	2025.12.04.07.42.04;	author adam;	state Exp;
branches;
next	1.2;
commitid	g82vhVv0duawZ3lG;

1.2
date	2025.12.02.19.25.17;	author bsiegert;	state Exp;
branches;
next	1.1;
commitid	269raRGxaHJBWRkG;

1.1
date	2025.12.01.08.54.32;	author adam;	state Exp;
branches;
next	;
commitid	GJpUpDKNTLUauGkG;

1.19.2.1
date	2026.07.14.00.36.00;	author maya;	state Exp;
branches;
next	1.19.2.2;
commitid	sHC3bIiGgkiEuyNG;

1.19.2.2
date	2026.07.17.01.54.39;	author maya;	state Exp;
branches;
next	;
commitid	5qA3BkRF0ayXPWNG;

1.12.2.1
date	2026.04.22.14.32.11;	author maya;	state Exp;
branches;
next	;
commitid	iDHLLUhOplH6NXCG;


desc
@@


1.21
log
@adguardhome: updated to 0.107.78

0.107.78

Security

AdGuard Home is now more resistant to JIGGLE attacks.

This is GHSA-p5f5-3p5g-rfjw. We thank @@Nora-Qiu for reporting this security issue.

AdGuard Home now validates responses from DoH upstreams more strictly.

This is GHSA-4qjf-2hgm-92q6. We thank @@wallace0409 for reporting this security issue.

QUIC connections are now protected from unbounded reads.

This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @@wallace0409 for reporting this security issue.

AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

We thank Damir (@@Evelynkaz) for reporting this security issue.

Added

Improved updater logging to give users more insight into the problem with version updating

Changed

The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

Configuration changes

The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.
Fixed

Invalid AA flag in DNS responses

The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type

Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
@
text
@# $NetBSD: Makefile,v 1.20 2026/07/08 18:32:36 bsiegert Exp $

AGH_VERSION=	0.107.78
DISTNAME=	adguardhome-${AGH_VERSION}
CATEGORIES=	security
MASTER_SITES=	${MASTER_SITE_GITHUB:=AdguardTeam/}
GITHUB_TAG=	v${PKGVERSION_NOREV}
GITHUB_PROJECT=	AdGuardHome

MAINTAINER=	pkgsrc-users@@NetBSD.org
HOMEPAGE=	https://github.com/AdguardTeam/AdGuardHome
COMMENT=	Powerful network-wide ads and trackers blocking DNS server
LICENSE=	gnu-gpl-v3

FRONTEND=		adguardhome_frontend-${AGH_VERSION}.tar.gz
SITES.${FRONTEND}=	-${MASTER_SITE_GITHUB:=AdguardTeam/}${GITHUB_PROJECT}/releases/download/${GITHUB_TAG}/AdGuardHome_frontend.tar.gz

DISTFILES=	${DEFAULT_DISTFILES} ${FRONTEND}
EXTRACT_ONLY=	${DEFAULT_DISTFILES} ${FRONTEND}

CHECK_RELRO_SKIP+=	bin/AdGuardHome

OWN_DIRS+=	libdata/adguardhome

.include "go-modules.mk"

GOFLAGS=		--ldflags='-s -w \
			-X github.com/AdguardTeam/AdGuardHome/internal/version.version=v${PKGVERSION_NOREV} \
			-X github.com/AdGuardTeam/AdGuardHome/internal/version..channel=release'
GO_BUILD_PATTERN=	.
INSTALLATION_DIRS+=	libdata/adguardhome
PKG_SYSCONFSUBDIR=	adguardhome
RCD_SCRIPTS+=		adguardhome

SUBST_CLASSES+=		rcconf
SUBST_STAGE.rcconf=	pre-configure
SUBST_MESSAGE.rcconf=	Subsituting pkgsrc variables.
SUBST_FILES.rcconf=	internal/ossvc/config_netbsd.go
SUBST_VARS.rcconf=	PKG_SYSCONFDIR PREFIX RCD_SCRIPTS_SHELL VARBASE

# Hack: see https://github.com/AdguardTeam/AdGuardHome/pull/8142
post-patch:
	${LN} ${WRKSRC}/internal/aghnet/net_freebsd.go ${WRKSRC}/internal/aghnet/net_netbsd.go
	${CP} -R ${WRKDIR}/build/static ${WRKSRC}/build/

.include "../../lang/go/go-module.mk"
.include "../../mk/bsd.pkg.mk"
@


1.20
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.19 2026/06/05 10:21:47 bsiegert Exp $
d3 1
a3 1
AGH_VERSION=	0.107.77
a4 1
PKGREVISION=	2
@


1.19
log
@Revbump all Go packages after go126 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.18 2026/06/03 05:08:56 adam Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.19.2.1
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.19 2026/06/05 10:21:47 bsiegert Exp $
d5 1
a5 1
PKGREVISION=	2
@


1.19.2.2
log
@Pullup ticket #7183 - requested by taca
security/adguardhome: Security fix

Revisions pulled up:
- security/adguardhome/Makefile                                 1.21
- security/adguardhome/distinfo                                 1.11
- security/adguardhome/go-modules.mk                            1.9

---
   Module Name:	pkgsrc
   Committed By:	adam
   Date:		Mon Jul 13 19:17:24 UTC 2026

   Modified Files:
   	pkgsrc/security/adguardhome: Makefile distinfo go-modules.mk

   Log Message:
   adguardhome: updated to 0.107.78

   0.107.78

   Security

   AdGuard Home is now more resistant to JIGGLE attacks.

   This is GHSA-p5f5-3p5g-rfjw. We thank @@Nora-Qiu for reporting this security issue.

   AdGuard Home now validates responses from DoH upstreams more strictly.

   This is GHSA-4qjf-2hgm-92q6. We thank @@wallace0409 for reporting this security issue.

   QUIC connections are now protected from unbounded reads.

   This is GHSA-qr92-rwvw-mhgh and GHSA-cccx-2r6r-m9r4. We thank @@wallace0409 for reporting this security issue.

   AdGuard Home now validates responses from DNSCrypt upstreams more strictly.

   The H2C connection establishment via HTTP/1.1 request upgrade is no longer supported. See RFC 9113.

   Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.5.

   The size of rulelists is limited. This is necessary to prevent a user's machine from becoming overloaded if the filter source misbehaves.

   We thank Damir (@@Evelynkaz) for reporting this security issue.

   Added

   Improved updater logging to give users more insight into the problem with version updating

   Changed

   The interval of filter updates can now be set to any number of hours between 0 and 8760 (365 days) in the configuration file.

   Configuration changes

   The filtering object of the YAML configuration now includes a new property, max_http_size, which defines the maximum size of the HTTP request for rulelists. To disable the limitation, set a large size, such as 1 TB.
   Fixed

   Invalid AA flag in DNS responses

   The parsing of the ech parameter in DNS rewrite rules for the HTTPS record type

   Blocked services check on the Custom filtering rules page does not work properly without specifying of a client.
@
text
@d1 1
a1 1
# $NetBSD$
d3 1
a3 1
AGH_VERSION=	0.107.78
d5 1
@


1.18
log
@adguardhome: updated to 0.107.77

0.107.77

Security

Authorization in GLiNET mode is no longer vulnerable to path traversal attacks.
NOTE: This is CVE-2026-41448. We thank @@djnnvx for reporting this security issue.

Added

New reason query parameter in GET /control/querylog. See openapi/openapi.yaml for the full description.

Deprecated

Query parameter response_status in GET /control/querylog is now deprecated. Use new reason query parameter instead.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.17 2026/05/24 05:41:36 adam Exp $
d5 1
@


1.17
log
@adguardhome: updated to 0.107.76

0.107.76

Changed

Duration values in YAML configuration file now support d (days) units and has been updated.
NOTE: Any rollback to version below the v0.107.76 should convert the values back to hours.

Fixed

DNS caching with disabled DNSSEC
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.16 2026/05/19 18:16:38 adam Exp $
d3 1
a3 1
AGH_VERSION=	0.107.76
@


1.16
log
@adguardhome: updated to 0.107.75

0.107.75

We’ve fixed a critical vulnerability affecting DNS-over-QUIC and DNS-over-HTTPS
that could put your DNS privacy at risk. The gap is now closed, and your
encrypted traffic is back to traveling through a properly armored tunnel.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.15 2026/05/07 18:50:03 bsiegert Exp $
d3 1
a3 1
AGH_VERSION=	0.107.75
@


1.15
log
@Revbump all Go packages after go126 security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.14 2026/04/16 12:40:07 adam Exp $
d3 1
a3 1
AGH_VERSION=	0.107.74
a4 1
PKGREVISION=	1
@


1.14
log
@adguardhome: updated to 0.107.74

0.107.74

Security

Frontend libraries has been updated to prevent the possibility of exploiting the vulnerability described in CVE-2026-40175.
Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.26.2.

Changed

Configuration changes

Fixed

Incorrect forwarding of root domain requests when domain-specific upstreams are configured
The strict SNI check setting is not persisted when the TLS configuration is changed
Status reported by the launchd service implementation in cases of scheduled service restart.
Fixed clients block/unblock when moving clients between allowed and disallowed lists.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.13 2026/04/08 05:45:06 bsiegert Exp $
d5 1
@


1.13
log
@Revbump all Go packages after security update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.12 2026/03/11 06:35:28 adam Exp $
d3 1
a3 1
AGH_VERSION=	0.107.73
a4 1
PKGREVISION=	1
@


1.12
log
@adguardhome: updated to 0.107.73

0.107.73

Security

Authentication is now applied to requests that have been upgraded from HTTP/2 Cleartext (H2C) requests to public resources.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.11 2026/03/06 21:08:00 bsiegert Exp $
d5 1
@


1.12.2.1
log
@Revbump all Go packages after go126 security fix
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.12 2026/03/11 06:35:28 adam Exp $
a4 1
PKGREVISION=	1
@


1.11
log
@Revbump all Go packages after go126 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.10 2026/02/27 11:47:25 adam Exp $
d3 1
a3 1
AGH_VERSION=	0.107.72
a4 1
PKGREVISION=	2
@


1.10
log
@adguardhome: fetch frontend properly
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.9 2026/02/24 08:45:34 bsiegert Exp $
d5 1
a5 1
PKGREVISION=	1
@


1.9
log
@Revbump all Go packages after default version bump
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.8 2026/02/23 13:22:14 adam Exp $
d3 2
a4 1
DISTNAME=	adguardhome-0.107.72
d16 2
a17 7
# Because frontend is not versioned, fetch it, rename to
# adguardhome_frontend-${PKGVERSION_NOREV}.tar.gz
# and upload to MASTER_SITE_LOCAL (make upload-distfiles).
#FRONTEND=		AdGuardHome_frontend.tar.gz
#SITES.${FRONTEND}=	${MASTER_SITE_GITHUB:=AdguardTeam/}${GITHUB_PROJECT}/releases/download/${GITHUB_TAG}/
FRONTEND=		adguardhome_frontend-${PKGVERSION_NOREV}.tar.gz
SITES.${FRONTEND}=	${MASTER_SITE_LOCAL}
@


1.8
log
@adguardhome: fix for NetBSD
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.7 2026/02/23 08:38:47 adam Exp $
d4 1
@


1.7
log
@adguardhome: updated to 0.107.72

0.107.72

Security

Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.7.

Added

AdGuard Home now tracks the TLS certificate and key files for updates and reloads them after any updates are detected.

New query parameter recent in GET /control/stats/ defines statistics lookback period in millieseconds. See openapi/openapi.yaml for details.

New field "ignored_enabled" in GetStatsConfigResponse or GetQueryLogConfigResponse. See openapi/openapi.yaml for details.

Changed

In addition to modifying the contents of a hosts file, deleting or renaming the file now also updates runtime clients and DNS filtering results.

Fixed

Executable permissions in some Docker installations.

Unknown blocked services from both global and client configuration now logged instead of causing server crash.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.6 2026/01/26 19:49:19 bsiegert Exp $
d39 6
@


1.6
log
@Move non-pattern Go flags to GOFLAGS.

GO_BUILD_PATTERN is only for patterns, as announced on tech-pkg@@.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.5 2026/01/15 19:54:51 bsiegert Exp $
d3 1
a3 2
DISTNAME=	adguardhome-0.107.71
PKGREVISION=	1
@


1.5
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.4 2025/12/08 21:03:23 adam Exp $
d32 1
a32 1
GO_BUILD_PATTERN=	--ldflags='-s -w \
d35 1
@


1.4
log
@adguardhome: updated to 0.107.71

0.107.71

As it turns out, our changes to optimistic DNS cache in the previous update
were a little too optimistic, and we’ve broken it a little bit in the process.
This hotfix brings everything back to normal, and, as a bonus, we’re adding new
settings for users to manually set the upper age limit and TTL for optimistic
cache’s stale answers.

Changed

Stale records in optimistic DNS cache now have an upper age limit controlled by
dns.cache_optimistic_max_age. The default value is 12 hours.

TTL for stale answers from optimistic DNS cache is now controlled by
dns.cache_optimistic_answer_ttl. The default value is 30 seconds.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.3 2025/12/04 07:42:04 adam Exp $
d4 1
@


1.3
log
@adguardhome: updated to 0.107.70

0.107.70

Security

Go version has been updated to prevent the possibility of exploiting the Go vulnerabilities fixed in 1.25.5.

Added

New field "start_time" in the GET /control/status response.

Changed

Stale records in optimistic DNS cache now have an upper age limit of 12 hours.
New blocked services UI.

Fixed

Generated mobileconfig could not be installed on macOS 26.1.
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.2 2025/12/02 19:25:17 bsiegert Exp $
d3 1
a3 1
DISTNAME=	adguardhome-0.107.70
@


1.2
log
@Revbump all Go packages after go125 update
@
text
@d1 1
a1 1
# $NetBSD: Makefile,v 1.1 2025/12/01 08:54:32 adam Exp $
d3 1
a3 2
DISTNAME=	adguardhome-0.107.69
PKGREVISION=	1
d14 7
a20 2
STATIC_DIST=		${PKGNAME_NOREV}-static${EXTRACT_SUFX}
SITES.${STATIC_DIST}=	${MASTER_SITE_LOCAL}
d22 2
a23 3
# comment out these for: make generate-static
DISTFILES=	${DEFAULT_DISTFILES} ${STATIC_DIST}
EXTRACT_ONLY=	${DEFAULT_DISTFILES} ${STATIC_DIST}
d38 1
a38 1
# Hack
d41 1
a41 7

# Install lang/nodejs and run this target.
.PHONY: generate-static
generate-static:
	cd ${WRKSRC}/client && npm install && npm run build-prod
	cd ${WRKDIR} && ${TAR} -zcf ${DISTDIR}/${PKGNAME_NOREV}-static.tar.gz AdGuardHome-${PKGVERSION_NOREV}/build/static
	@@${ECHO} "Run: make upload-distfiles"
@


1.1
log
@adguardhome: added version 0.107.69

AdGuard Home is a network-wide software for blocking ads and tracking. After
you set it up, it'll cover ALL your home devices, and you don't need any
client-side software for that.

It operates as a DNS server that re-routes tracking domains to a "black hole",
thus preventing your devices from connecting to those servers. It's based on
software we use for our public AdGuard DNS servers, and both share a lot of
code.
@
text
@d1 1
a1 1
# $NetBSD$
d4 1
@