strongswan: drop legacy frontend from full package - #30349
Conversation
strongswan-full currently installs both the legacy ipsec/stroke frontend and swanctl. This provides two init scripts for the same Charon daemon and can cause conflicts when both services are enabled. Drop strongswan-ipsec and strongswan-mod-stroke from the meta-package, leaving swanctl as its supported frontend. The legacy packages remain available for users who explicitly need them. Refs: openwrt#21989 Signed-off-by: Dharmik Parmar <[email protected]>
97bc676 to
55c64e4
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit. The commit message matches the diff, PKG_RELEASE is correctly incremented for a DEPENDS change, and dropping the stroke frontend from strongswan-full is consistent with strongswan-default, which already ships swanctl only. One inline note about the legacy packages no longer being kept together — nothing blocking.
Generated by Claude Code
| +strongswan-mod-sql \ | ||
| +strongswan-mod-sqlite \ | ||
| +strongswan-mod-sshkey \ | ||
| +strongswan-mod-stroke \ |
There was a problem hiding this comment.
Dropping these two together leaves the legacy frontend without a package that keeps them paired. strongswan-full was, in practice, the only thing guaranteeing that strongswan-ipsec and strongswan-mod-stroke were installed together; Package/strongswan-ipsec declares only DEPENDS:= strongswan.
That matters because strongswan-ipsec ships /etc/init.d/ipsec, whose PROG=/usr/lib/ipsec/starter is installed by the stroke plugin, not by strongswan-ipsec itself — Plugin/stroke/install is the only place starter comes from. Same for /etc/ipsec.d/, which Package/strongswan-ipsec/conffiles registers but Plugin/stroke/install creates.
So after this change a user following "the legacy packages remain available" and installing just strongswan-ipsec gets an init script that cannot start. This is a pre-existing gap in strongswan-ipsec's DEPENDS, but this PR is what removes the meta-package that was papering over it. Worth adding +strongswan-mod-stroke (and the frontend deps it needs) to Package/strongswan-ipsec — either here or as a separate patch in the series.
Generated by Claude Code
2 participants
📦 Package Details
Maintainer: @pprindeville, @Thermi
Description:
strongswan-full currently installs both the legacy ipsec/stroke frontend and swanctl. This provides two init scripts for the same Charon daemon and can cause conflicts if both services are enabled.
Remove strongswan-ipsec and strongswan-mod-stroke from the meta-package, leaving swanctl as the supported frontend. The legacy packages remain available for users who explicitly need them.
This deliberately leaves the policy-based/XFRM choice unchanged.
Related: #21989
🧪 Run Testing Details
f1bf2d18392e)x86/64Verified the generated strongswan-full package metadata. It reports version 6.0.7-r8, retains strongswan-swanctl and strongswan-mod-vici, and no longer includes strongswan-ipsec or strongswan-mod-stroke.
Also verified with git diff --check.
✅ Formalities