GitLab

Flask-session does not look maintained anymore, thus we use our own copy
bundled with reforis.

sha256 for firmware file:
- b423a8580ca62adf5b6ae7d10caa2c4b10aaaa7101acd58cf7b874cdacb6f541 secure-firmware-devel.bin

Fixes:
Makefile:32: WARNING: skipping initial-config -- package has no install section

This was simply a copy-paste error. The correct variable is device.

reForis now support device modes, so we no longer need to ship separate
version of reForis Shield.

ca.pem is a CA certificate bundle and we are going to rotate Sentinel
Root CA to a production one. Also add comments to each certificate for
better orientation

The issue this fixes is that git reports same commit as being ancestor
of itself. It kind of makes sense but it breaks check if branch is based
on master or develop. In such case the common base between develop and
target branch and master and target branch is the same.

This changes the logic. Because git merge-base does effectively the
operation of 'less than or equal' we have to swap compare order and
negate the result. This way we get effectively the 'less than'
operation.

Fixes: turris-nor-update: Make it work again
("27ffdc9e")

Fix two conditions that were wrongly written and prevent script from
running and also remove debugging leftover that made every run dry-run.

This includes updates of translations from weblate.

This should contain the workaround for MOX reboot issue.

It is version two of workaround to solve reboot issue on some MOX
devices.

https://gitlab.nic.cz/turris/mox-boot-builder/-/releases/v2021.01.22

Remove upstreamed patch

New packages should not be introduced in upstream for stable release, but it happened so.
Commit:
https://github.com/openwrt/packages/commit/01ab015a9afbdac1a0d77b0bf271e07dee59677d

Let's remove it and use the upstream variant, which is the same as ours
(version, and so on). The only difference is that they are using
codeload from GitHub.

* Improve Updater behavior
* Add & update translations
* Add hostname settings
* Add password confirmation
* Add env variables to Makefile
* Fix redirect to the original router's IP address
* Fix WAN 6in4 tunnel MTU range to 1480
* Fix public IPv4 input as not required in WAN6Form
* Drop versions of paho-mqtt & extras dependencies
* Other small improvements

On package installation the uci_default is run before service start.
As the last step in uci_default the Firewall is reloaded but rule inject
fails due to missing ipset.
In normal operation the sentinel-dynfw-client is started before firewall
but during installation this can't be done.

The solution is to just create ipset anytime we start firewall. This
makes it so rules is always added and it really doesn't matter who
creates the ipset. With this either sentinel-dynfw-client creates it or
firewall, which ever comes first.