wxwidgets, veracrypt: add new packages by flatstik · Pull Request #30597 · openwrt/packages

flatstik · 2026-09-25T15:13:53Z

📦 Package Details

Maintainer: @flatstik

Description:
Add a console-only VeraCrypt package, and wxWidgets' non-GUI library (wxBase), which VeraCrypt needs, as its own shared-library package (one commit per package).

wxwidgets (libwxbase3.2), new:

wxWidgets 3.2.11, the latest release of upstream's stable 3.2 series, which keeps the API and ABI compatible across 3.2.x: a security update of the library does not need VeraCrypt (or another user) to be rebuilt. The 3.3 releases are upstream's development branch, "API and ABI compatibility are not guaranteed".
Only wxBase, as a shared library (libwx_baseu-3.2.so.0); ABI_VERSION:=3.2 follows the soname (as liblua5.4). wx-config is staged like gpg-error-config, so other packages can build against it.
Built without networking, archive and compressed streams, regular expressions, file system watching and debug assertions (1.2 MB installed on mipsel). Enabling zlib, archives, regex and fswatcher would add about 400 KB; they can be turned on when a package needs them.

veracrypt:

FUSE3 and wxBase from libwxbase3.2; x86 builds without assembler (NOASM), other targets use VeraCrypt's normal C/intrinsics code (ARMv8 hardware AES included)
Runtime depends: libstdcpp, libwxbase, libfuse3, fuse3-utils, losetup, kmod-loop (mounts go through a loop device). No libatomic: neither veracrypt nor libwxbase imports any __atomic_* function on any target built (mips/mipsel only use __sync_*_4 from libgcc), so neither +libatomic nor ATOMIC64_DEPENDS (build: centralise libatomic dependencies for 64-bit atomics openwrt#25112) is needed
--filesystem=ext4 needs e2fsprogs (mkfs.ext4), which stays optional
Source: the official release tarball VeraCrypt_1.26.29_Source.tar.bz2; License.txt is installed to /usr/share/doc/veracrypt/ as the TrueCrypt License 3.0 requires
/sbin/mount.veracrypt is upstream's helper. Without dmsetup (lvm2, not a dependency) VeraCrypt mounts and formats through FUSE3 (patch 040, merged upstream). With lvm2 installed it uses kernel dm-crypt as upstream does, which on OpenWrt needs kmod-crypto-xts (built in on x86_64) and supports AES only; for other ciphers and cascades --mount-options=nokernelcrypto (helper: -o nokernelcrypto) keeps FUSE
/etc/config/veracrypt (conffile) describes the volumes; luci-app-veracrypt (luci-app-veracrypt: add optional LuCI UI luci#9069) edits the same sections. /etc/init.d/veracrypt (START=45, STOP=85) mounts volumes with auto_mount '1' (none by default) in the background at boot, and /etc/hotplug.d/block/90-veracrypt mounts them when their disk appears. Unattended mounts read the password from a root-only password_file on stdin, never UCI or argv; keyfiles may live elsewhere, e.g. on a USB stick; security token keyfiles need a terminal (their PIN can't be passed safely); an empty password needs empty_password '1'. start <name> mounts one volume (asking on a terminal without password_file); stop unmounts the configured volumes, never forced.
Patches, all backports of merged upstream commits:
- 010: ARM CPU_Query* link fix (VC_INLINE), Crypto: use VC_INLINE for the ARM CPU_Query helpers veracrypt/VeraCrypt#1886 (veracrypt/VeraCrypt@5c7f60d)
- 020: POSIX sh mount.veracrypt, Linux: make mount.veracrypt POSIX sh veracrypt/VeraCrypt#1895 (veracrypt/VeraCrypt@81cd94f)
- 080: mount.veracrypt: the last of ro/rw sets both VeraCrypt's read-only protection and the filesystem, -f only checks the options, -N and unknown or malformed arguments are errors, password= goes on stdin instead of argv (new passwordfile=, first line only), both need root; and veracrypt --stdin decodes the whole first line and fails on missing or invalid input instead of using a shortened or empty password. Submitted as Linux: mount.veracrypt: honour ro and -f, keep the password off argv veracrypt/VeraCrypt#1928 (src/ part)
- 030: x86 NOASM link fix, Crypto: fix NOASM link failures on x86 veracrypt/VeraCrypt#1896 (veracrypt/VeraCrypt@a15c996)
- 040: fall back to FUSE when dmsetup is not installed (so --create with ext4 and plain mounts work without lvm2), Linux: fall back to FUSE when dmsetup is not installed veracrypt/VeraCrypt#1898 (veracrypt/VeraCrypt@d24b821)
- 050: fix the portable C code of Twofish, Camellia, Kuznyechik, SHA-2, BLAKE2s, Streebog and PBKDF2 on big-endian CPUs, avoid unaligned 64-bit accesses (SIGBUS on mips64) and extend the self-tests, Crypto: fix portable C code on big-endian CPUs veracrypt/VeraCrypt#1899 (veracrypt/VeraCrypt@425cea6)
- 060: no unaligned 64-bit accesses on 32-bit ARM (Camellia/Whirlpool LDRD raised SIGBUS in the self-tests on arm_cortex-a15_neon-vfpv4), Crypto: no unaligned 64-bit accesses on 32-bit ARM veracrypt/VeraCrypt#1908 (veracrypt/VeraCrypt@cb1d9a4)
- 070: alignment-safe word loads/stores for SHA-2, BLAKE2s, Twofish, Kuznyechik, Streebog and XTS on targets where unaligned access faults (32-bit ARM, MIPS); unchanged code on x86, x64, ARMv8 and PowerPC, Crypto: use alignment-safe loads and stores where unaligned access faults veracrypt/VeraCrypt#1909 (veracrypt/VeraCrypt@7c06e03)

The former patch 100 (wxWidgets build jobs) is gone with the bundled wxWidgets build.

Upstream: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29, https://github.com/wxWidgets/wxWidgets/releases/tag/v3.2.11

🧪 Run Testing Details

OpenWrt Version: OpenWrt 25.12.5 (r33051-f5dae5ece4)
OpenWrt Target/Subtarget: ramips/mt7621
OpenWrt Device: ASUS RT-AX53U

Run-tested on the device above with the 25.12.5 SDK build of both packages (47 checks passed, 0 failed): libwxbase3.2 installed as a dependency and veracrypt resolves libwx_baseu-3.2.so.0 from it; --test self-tests, --create --filesystem=ext4 (formatted through FUSE, no dmsetup), mount/write/read/unmount, auto-hash mount, mount.veracrypt (-f, ro, passwordfile=, password not in the process list), the init script (auto_mount with password_file, start/stop <name>, busy volume not forced), and the luci-app-veracrypt backend.

Build-tested with the current snapshot SDK on mips_24kc (big-endian), mips64 big-endian (malta), arm_cortex-a15_neon-vfpv4, aarch64_generic and x86_64, plus the 25.12.5 SDK for mipsel_24kc; on all of them the binary's NEEDED list is libfuse3, libwx_baseu-3.2, libstdc++, libgcc_s and libc. The x86_64 build passes the generic runtime checks plus test.sh and test-version.sh in an OpenWrt rootfs. The packaged binaries pass veracrypt --text --test under qemu-user on arm_cortex-a15_neon-vfpv4 (-cpu cortex-a15 and cortex-a7), mipsel_24kc, mips_24kc, mips64 and aarch64_generic.

✅ Formalities

I have reviewed the CONTRIBUTING.md file for detailed contributing guidelines.

If your PR contains a patch:

It can be applied using git am
It has been refreshed to avoid offsets, fuzzes, etc., using
```
make package/<your-package>/refresh V=s
```
It is structured in a way that it is potentially upstreamable
_{(e.g., subject line, commit description, etc.)}
_{We must try to upstream patches to reduce maintenance burden.}

Web UI for the console veracrypt package (packages feed): openwrt/packages#30597 Not bundled into veracrypt; apk add luci-app-veracrypt depends on +veracrypt. Calls veracrypt --text only. The current password is passed on stdin (--stdin), never --password. New password, hidden volume password and token PIN are fed on stdin, not via --new-password, --protection-password or --token-pin. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

openwrt-ai

Commit checks

de9cc1a "veracrypt: add version 1.26.29" — the Signed-off-by: Ville Takio trailer appears twice; keep one.

Generated by Claude Code

Web UI for the console veracrypt package (packages feed): openwrt/packages#30597 Not bundled into veracrypt; apk add luci-app-veracrypt depends on +veracrypt. Calls veracrypt --text only. The current password is passed on stdin (--stdin), never --password. New password, hidden volume password and token PIN are fed on stdin, not via --new-password, --protection-password or --token-pin. CLI reference: https://www.veracrypt.fr/en/Command%20Line%20Usage.html Signed-off-by: Ville Takio <ville+git@takio.fi>

flatstik · 2026-10-08T17:44:30Z

LuCI apps for this package: openwrt/luci#9069 (luci-app-veracrypt, full-featured) and openwrt/luci#9119 (luci-app-veracrypt-lite, smaller). Both are optional and can be installed side by side.

flatstik · 2026-10-09T12:34:54Z

VeraCrypt merged veracrypt/VeraCrypt#1908 and veracrypt/VeraCrypt#1909, so patches 100/101 are now backports 060/070 of veracrypt/VeraCrypt@cb1d9a4 and veracrypt/VeraCrypt@7c06e03 (0526541). The patched source is unchanged: the mipsel binary is byte-identical to the one run-tested on the RT-AX53U (21/21).

openwrt-ai

Reviewed 1 new commits; no new issues found.

Generated by Claude Code

BKPepe

The package ships /etc/config/veracrypt with an example config volume, but there is no init script consuming these entries. Currently, these are LuCI favorites, not boot-time mounts.

Should automatic mounting at boot be supported? If so, I'd expect an /etc/init.d/veracrypt script that mounts explicitly enabled volumes once their backing storage is available and dismounts them on shutdown.

Credentials need a clear design, too. Passwords should not be stored directly in UCI or passed via --password (visible in process arguments). A password_file reference with strict root-only permissions, fed to VeraCrypt via --stdin, could support unattended mounts, but the plaintext-at-rest limitation must be documented. Otherwise, unlocking should remain interactive.

If autostart is out of scope, please document that explicitly so the example UCI volume configuration isn't mistaken for a boot-time mounting mechanism.

flatstik · 2026-10-14T09:40:30Z

@BKPepe Thanks, you're right: nothing consumed those entries at boot, and the CLI never reads /etc/config/veracrypt at all. Automatic mounting at boot is out of scope for this package, so I've removed the UCI configuration from it:

veracrypt no longer ships /etc/config/veracrypt: no conffile, no example config volume. It is a plain command-line package, and there is no init script.
The file now belongs to the optional LuCI apps (luci-app-veracrypt: add optional LuCI UI luci#9069, luci-app-veracrypt-lite: add new package luci#9119). Each creates it with a uci-defaults script when it is missing; favorites there are mounted only on request, with the password entered at that time. Passwords are never stored in UCI, and the backend passes the password via --stdin, never --password.

If unattended mounting at boot is wanted later, I'd do it as a separate change along the lines you describe: an init script for explicitly enabled volumes, a root-only password_file fed through --stdin, and a documented plaintext-at-rest limitation.

Updated in 576c607 (and in openwrt/luci#9069 and openwrt/luci#9119). The packaged binary is byte-identical to the one tested before. The three packages were installed together as an upgrade on the RT-AX53U, and the device test passed 23 checks with 0 failures. Two of those checks are new: veracrypt no longer owns the config, and the LuCI app created it.

BKPepe · 2026-10-14T09:42:31Z

Automatic mounting at boot is out of scope for this package, so I've removed the UCI configuration from it

Why it is out of scope?

The file now belongs to the optional LuCI apps

Why? That should not be there at all. What your AI is doing? 🤔

flatstik · 2026-10-14T10:44:11Z

Why it is out of scope?

Because I think automounting encrypted volumes is insecure. An unattended mount means the password (or keyfile) has to be stored on the router itself, usually on the same device as the volume it protects. Anyone who gets the router or the disk then gets the data, which defeats the point of encrypting it. VeraCrypt has no boot-time mount mechanism on any platform either, and I'd rather not invent a credential store for it in OpenWrt.

Why? That should not be there at all.

Agreed for the veracrypt package, and that's what changed: VeraCrypt itself has no system configuration file (only per-user preferences under ~/.config/VeraCrypt), and the command-line tool is configured by its options alone. As of 576c607, this package ships no /etc/config/veracrypt and no init script.

The UCI file was only ever used by the LuCI app, for its own UI state: the operation timeout, an optional PKCS #11 library path, and the favorites list (volume path, mount point, PIM, keyfile paths; never passwords). So it now lives with the LuCI apps (openwrt/luci#9069, openwrt/luci#9119) and no longer concerns this PR. If you'd prefer, I can rename it to /etc/config/luci-veracrypt there, so it can't be mistaken for a VeraCrypt configuration.

flatstik · 2026-10-14T11:53:51Z

Renamed: the LuCI apps now keep their settings and favorites in /etc/config/luci-veracrypt (openwrt/luci#9069 bba2be04d9, openwrt/luci#9119 f7ab1fe62e), so nothing is called veracrypt in UCI anymore. This package is unchanged. The three packages pass the device test on the RT-AX53U again (23 passed, 0 failed).

BKPepe · 2026-10-14T12:01:49Z

Renamed: the LuCI apps now keep their settings and favorites in /etc/config/luci-veracrypt (openwrt/luci#9069 bba2be04d9, openwrt/luci#9119 f7ab1fe62e), so nothing is called veracrypt in UCI anymore.

No one is going to read AI wall of texts. It is just too exhausting to read it. It is wrong. Folder /etc/config is where UCI config files are. So, you should do it as other packages does. :)

UCI config belongs to the packages, not to the LuCI integration.

flatstik · 2026-10-14T13:13:36Z

OK, reluctantly: veracrypt ships /etc/config/veracrypt again (5897e99), with a note that it holds luci-app-veracrypt's settings and favorites, nothing is mounted at boot and no passwords are stored. The LuCI PRs are back to using it. Device test: 23 passed, 0 failed.

I'm still of the opinion that veracrypt and the luci-app are and will be separate packages. and the luci-app is naturally dependent of this package, but not the other way around.

flatstik · 2026-10-14T17:25:59Z

On VeraCrypt reading its own settings from /etc/config/veracrypt, I don't plan to patch that:

VeraCrypt's settings are XML files (Configuration.xml, Favorite Volumes.xml), and /etc/config is for UCI only.
One practical issue remains: root's ~/.config/VeraCrypt doesn't survive sysupgrade. Users who need that can add it to /etc/sysupgrade.conf; the console tool hardly uses it anyway, since everything is passed as options.
It would be an OpenWrt-only patch to carry, which is exactly what reviewers push back on.

karlp · 2026-10-14T21:27:32Z

You don't normally patch the package to understand UCI config files. I don't think I've ever seen that done. Normally, the openwrt init script that you provide as part of your package, handles UCI config files and generates a suitable config file in the native format that the package expects. dnsmasq, snmpd, mosquitto come to mind as examples off the top of my head. As mentioned, that is part of this package. a Luci app would provide unified editing of that config, but is completely independent.

flatstik · 2026-10-14T21:36:03Z

@karlp Thanks, agreed that's the usual pattern for daemons like dnsmasq or mosquitto. VeraCrypt isn't a service, though: there's nothing to start at boot (automounting is out of scope, as it would mean storing the password on the router), and the console tool takes everything it needs as command-line options. An init script generating VeraCrypt's XML preferences from UCI would have nothing to do, so I think it's unnecessary.

The only config that's actually needed is the settings and favorites of luci-app-veracrypt, and that is the /etc/config/veracrypt shipped here. Then again, I think it should be part of luci-app-veracrypt, but not here..

flatstik · 2026-10-15T15:08:57Z

Updated (81378fe): this package ships no configuration anymore; /etc/config/veracrypt moved to luci-app-veracrypt (openwrt/luci#9069). It now has a small init script that only unmounts all VeraCrypt volumes gracefully on stop, reboot and shutdown. Nothing is mounted at boot. Everything works.

flatstik · 2026-10-15T15:14:59Z

Added START=99 (88ec1d9) to satisfy the check, but it starts absolutely nothing: the only intention of the script is to gracefully unmount all VeraCrypt volumes when the device is stopped, rebooted or shut down. Start and restart do nothing.

BKPepe

I don't think the current init script is sufficient for an OpenWrt package. If we provide /etc/config/veracrypt, the base package should actually consume it, rather than leaving volume management to the optional LuCI app.

I'd expect a UCI-driven init script that mounts only explicitly enabled volumes at boot and cleanly unmounts only the volumes it manages. The UCI configuration and its conffiles should live in this package, so the feature also works through the CLI, scripts and configuration management without LuCI.

START=99 is too late for volumes needed by services started earlier. Start after fstab has mounted the backing storage but before dependent services, and stop after those services have stopped. A one-shot rc.common script is sufficient; USE_PROCD=1 is not mandatory when there is no long-running process to supervise.

Please also define how unattended authentication works without storing passwords in UCI or exposing them in process arguments. If the init script generates VeraCrypt's native XML configuration, make sure it uses the correct configuration path and preserves per-volume options that the native favorites format cannot represent.

Finally, the current global unmount with an unconditional forced fallback and the mount helper's handling of ro, -f and password= need to be addressed before merging.

Also, please consider adding nasm/host to PKG_BUILD_DEPENDS instead of setting NOASM=1 on i386/x86_64, as NOASM=1 disables hardware AES-NI and SIMD acceleration on x86 targets.

Hey, I'll be honest, if you want to help, it's not the best way to keep reminding yourself on IRC and saying I'm the bad guy and that I'm driving you crazy.

No other pull request has as much attention as yours. Be a little considerate, I'm telling it like it is and we have 137 open pull requests here.

A lot of people are trying to help you, including @karlp, who says that the UCI config should just be here and we're going around in circles again. I understand that the AI is answering me and that it's vibe-coded, but it takes a little self-reflection and taming the AI a little, see #30782

Each of your force pushes contains so many changes that I simply cannot review them all over again. It really takes so much time that I can't even afford it.

flatstik · 2026-10-15T21:21:59Z

@BKPepe I'm very sorry if you got offended. The "driving me crazy" on IRC was purely about me not understanding your requests, not about you. Mea culpa.

Addressed in e2eb671:

mount.veracrypt (080): ro sets VeraCrypt's read-only protection, -f no longer mounts, password= is passed on stdin (not argv), new passwordfile=.
init script: no forced unmount; a volume still in use is left mounted and logged.
NASM: right, NOASM loses AES-NI on x86. There is no nasm/host yet, though: devel/nasm is target-only (no HostBuild). I checked that nasm 2.16.01 assembles VeraCrypt's .asm files (AS=nasm), and on x86_64 they are PIE-safe. On i386 they aren't (448 absolute relocations in Aes_x86.o, which musl rejects as text relocations, see Linux: fix the i386 musl and sparc64 builds, and test both in CI veracrypt/VeraCrypt#1923), so i386 has to stay NOASM for now. I'd add a HostBuild to nasm and enable the asm on x86_64 as a follow-up, to keep this PR from growing again.
Automount at boot: deliberately not added. It means keeping the secret on the router next to the volume.

To say it once more: VeraCrypt has no configuration of its own that it would read, and it never will. The command-line tool takes everything as options (its only optional per-user preferences are XML files under ~/.config/VeraCrypt, unrelated to UCI). /etc/config/veracrypt exists only so that luci-app-veracrypt can keep its favorite volumes and the operation timeout for whoever uses LuCI. VeraCrypt itself doesn't need it, which is why it ships with luci-app-veracrypt and not here.

Noted on the force pushes: from now on each push will be small, with a short list of what changed.

BKPepe · 2026-10-15T21:35:31Z

I disagree with keeping volume configuration and handling exclusively in LuCI.

OpenWrt routinely wraps CLI-only tools with UCI configuration and init scripts. etherwake, autossh, hd-idle, socat and ttyd are concrete examples. The fact that VeraCrypt itself doesn't read UCI is irrelevant — the integration layer is responsible for translating UCI settings into CLI invocations. LuCI should be an optional frontend to the base package's configuration, not the owner of it.

You have also just added passwordfile= support to mount.veracrypt for unattended mounting through /etc/fstab. Boot-time mounting should be an explicit opt-in (auto_mount '0' by default), with credentials supplied through user-managed keyfiles or password files and the security trade-offs documented. Different users have different threat models; that isn't a reason to rule out the feature entirely.

Please move /etc/config/veracrypt and its conffiles into the base package, implement UCI-driven mounting and safe shutdown handling in the init script, and have LuCI manage that same configuration. Mount only explicitly enabled volumes after their backing storage is available and before dependent services start; unmount only volumes managed by the integration.

If this PR is deliberately CLI-only, remove the init script. The current middle ground adds system integration without actually providing it. Personally, I don't consider a CLI-only package user-friendly enough, and I think proper OpenWrt integration should be part of this PR rather than postponed to a future one.

BKPepe · 2026-10-15T21:53:54Z

I don't understand why we're still arguing about this instead of implementing it properly.

I asked AI (Argon 4 High and GPT-6] as reviewer to draft a possible approach. The files below are not tested or reviewed by me, so treat them as a starting point, not a patch to merge blindly:

Init script: https://gist.github.com/BKPepe/d8102c4dbf8c2334e7f9b67502a0a49d
UCI config: https://gist.github.com/BKPepe/ab1db77d3ca31c02a40a119ba039a686

Could you explain what is actually wrong with this approach and why we couldn't have taken this direction from the beginning? We've been discussing this for three weeks, and I'd rather see concrete technical objections and a workable solution than keep going in circles about whether VeraCrypt itself reads UCI.

Regarding automount: the credentials don't necessarily have to be stored on the router next to the volume. They can come from a separate keyfile location, a password file populated at runtime, or a suitable hardware-token setup. Keep automount disabled by default, never store secrets in UCI, and let users choose their own threat model. That's no reason to omit an explicitly opt-in feature.

A CLI-only package is not user-friendly enough, and I don't want proper OpenWrt integration postponed to another PR.

karlp · 2026-10-15T22:23:31Z

Don't mind my comment about the config file being in this package, I was commenting generally to the perceived request that veracrypt grow a patch to handle uci config directly. I was (mistakenly, I don't know anything about veracrypt) that it was like ~any other packaged service and had an init script, the commentary was general.

GeorgeSapkin · 2026-10-15T23:21:45Z

I apologize for piling on to this lively discussion, especially considering I don't know anything about VeraCrypt, but shouldn't mounting be handled via fstab/crypttab? Without any services, etc. Unless there's some basic wire-up necessary. That way mounts can be added via the existing Mount Points UI:

I don't know how much crypttab support there is in the UI though. If none, perhaps that's the thing that should be added instead.

flatstik · 2026-10-17T22:01:38Z

@GeorgeSapkin OpenWrt's Mount Points (block-mount) only mounts block devices and has no crypttab. VeraCrypt volumes are often container files, opened by the veracrypt program itself (FUSE or dm-crypt), so fstab alone can't mount them.

The bigger point is security: a volume that mounts itself at boot needs its secret stored on the same router. If you don't need to enter a password, an attacker won't need to either. The usual setup is a fully encrypted system disk whose shortcuts mount the other encrypted disks; keyfiles on a USB stick avoid typing the password, but lower security a lot. My own use: a disk attached to the router that I unlock only occasionally and then use over the LAN via Samba.

For those who want it anyway, the package now has an opt-in init script; nothing is mounted unless a volume has auto_mount '1'.

flatstik · 2026-10-17T22:01:39Z

@BKPepe Thanks for the drafts. Done in 79a99f1, following their structure and option names: auto_mount, password_file, keyfiles, empty_password, read_only, start/stop <name>, restart = start; configured volumes are managed, never forced. /etc/config/veracrypt is a conffile of this package again, and openwrt/luci#9069 edits it.

Where the draft would not work on OpenWrt, I deviated:

no stat or mountpoint in the default busybox: the permission check uses ls -ln, the mountpoint check /proc/mounts;
mounting at boot runs in the background (key derivation takes minutes; a synchronous start would hold up uhttpd and everything after it). start <name> stays synchronous with a real return code;
/etc/hotplug.d/block/90-veracrypt mounts a volume once its disk appears, as your review asked; a failed volume is not retried on every block event;
the directories above password_file and the keyfiles must be root-only too, and an empty first line in password_file is refused (an empty password needs empty_password '1').

Patch 080 now has full git-am headers and is submitted upstream (veracrypt/VeraCrypt#1928).

flatstik · 2026-10-18T00:00:59Z

@BKPepe On the credentials: covered in 4560e09. Automount stays off by default, and secrets never go in UCI. password_file must be root-only, e.g. /etc/veracrypt/passwords, or a file written at runtime under a 0700 /tmp/veracrypt. Keyfiles can live elsewhere, e.g. on a USB stick; the volume is mounted once the keyfile is present. Security token keyfiles work with start <name> on a terminal or from LuCI. Unattended use would need --token-pin on the command line, where any user can read it, so the init script refuses that.

Add a console-only VeraCrypt package using FUSE3 and wxBase from libwxbase. x86 builds without assembler (NOASM); other targets use VeraCrypt's C/intrinsics code, including ARMv8 hardware AES. Runtime depends on libstdcpp, libwxbase, libfuse3, fuse3-utils, losetup and kmod-loop (volumes are mounted through a loop device). Patches 010-070 are backports from upstream: with 040, VeraCrypt mounts and formats volumes through FUSE3 when dmsetup (lvm2) is not installed; 050 fixes the portable crypto code on big-endian targets (mips, powerpc), avoids unaligned 64-bit accesses (mips64) and extends the self-tests; 060 and 070 make the crypto code use alignment-safe word accesses on strict-alignment CPUs (32-bit ARM, MIPS), where unaligned accesses raised SIGBUS (seen in the self-tests on cortex-a15). test.sh checks the version and runs the algorithm self-tests. 080 fixes the fstab helper mount.veracrypt: the last of ro/rw sets both VeraCrypt's read-only protection and the filesystem, -f (fake mount) only checks the options, -N and unknown or malformed arguments are errors, and password= is passed on stdin instead of veracrypt's command line (new: passwordfile=, the secure form, first line only); both need mount to run as root. It also makes veracrypt --stdin decode the whole first line and fail on missing or invalid input instead of mounting with a shortened or empty password. Submitted upstream as veracrypt/VeraCrypt#1928. /etc/config/veracrypt (conffile) describes the volumes; luci-app-veracrypt edits the same sections. /etc/init.d/veracrypt (START=45, STOP=85) mounts the volumes with auto_mount '1', none by default, in the background at boot, as key derivation takes minutes; /etc/hotplug.d/block/90-veracrypt retries when a disk appears. 'start <name>' mounts one volume and asks for the password on a terminal. Unattended mounts read the password from a root-only password_file on stdin (never UCI or the command line); keyfiles may live elsewhere, e.g. on a USB stick, security token keyfiles need a terminal (their PIN cannot be passed safely), and an empty password needs empty_password '1'. Stop unmounts the configured volumes, never forced: a volume in use stays mounted and is logged. Upstream: https://github.com/veracrypt/VeraCrypt/releases/tag/VeraCrypt_1.26.29 Run-tested on ramips/mt7621 (ASUS RT-AX53U, mipsel_24kc) with OpenWrt 25.12.5 (no lvm2), with libwxbase3.2: self-tests, create, FUSE mount (explicit and autodetected hash), unmount, mount.veracrypt (-f, ro, passwordfile=) and the init script (auto_mount with password_file, start/stop <name>, busy volume not forced). Signed-off-by: Ville Takio <ville+git@takio.fi>

openwrt Bot added the Add package label Sep 25, 2026

flatstik mentioned this pull request Sep 25, 2026

luci-app-veracrypt: add optional LuCI UI openwrt/luci#9069

Open

1 task done

flatstik force-pushed the veracrypt-add branch from 0d4699c to 5d2e55b Compare September 25, 2026 16:51

openwrt-ai reviewed Sep 26, 2026

View reviewed changes

Comment thread utils/veracrypt/files/mount.veracrypt Outdated

Comment thread utils/veracrypt/test.sh Outdated

flatstik force-pushed the veracrypt-add branch from 5d2e55b to 82411df Compare September 26, 2026 07:14

openwrt-ai reviewed Sep 27, 2026

View reviewed changes

Comment thread utils/veracrypt/Makefile Outdated

openwrt Bot added the not following guidelines label Sep 27, 2026

flatstik force-pushed the veracrypt-add branch from 84b7180 to 19d0a0a Compare September 27, 2026 16:21

openwrt Bot removed the not following guidelines label Sep 27, 2026

flatstik requested a review from openwrt-ai September 27, 2026 16:30

flatstik force-pushed the veracrypt-add branch from 19d0a0a to 82b98b5 Compare September 27, 2026 18:24

openwrt Bot added the not following guidelines label Sep 27, 2026

flatstik force-pushed the veracrypt-add branch 2 times, most recently from 5f8a33b to 19d0a0a Compare September 27, 2026 18:36

openwrt Bot removed the not following guidelines label Sep 27, 2026

flatstik force-pushed the veracrypt-add branch from 19d0a0a to 9b0133f Compare September 27, 2026 18:57

flatstik force-pushed the veracrypt-add branch from 9b0133f to b4ccd75 Compare September 27, 2026 19:06

flatstik force-pushed the veracrypt-add branch from b4ccd75 to de9cc1a Compare September 27, 2026 19:11

openwrt-ai reviewed Sep 27, 2026

View reviewed changes

Comment thread utils/veracrypt/Makefile Outdated

Comment thread utils/veracrypt/test.sh Outdated

flatstik force-pushed the veracrypt-add branch from de9cc1a to 8ece9cb Compare September 27, 2026 20:14

openwrt-ai reviewed Oct 10, 2026

View reviewed changes

BKPepe requested changes Oct 14, 2026

View reviewed changes

openwrt-ai reviewed Oct 15, 2026

View reviewed changes

Comment thread utils/veracrypt/Makefile Outdated

plappermaul requested changes Oct 15, 2026

View reviewed changes

Comment thread utils/veracrypt/patches/020-mount.veracrypt-posix-sh.patch

Comment thread utils/veracrypt/patches/020-mount.veracrypt-posix-sh.patch

BKPepe requested changes Oct 15, 2026

View reviewed changes

openwrt-ai reviewed Oct 16, 2026

View reviewed changes

Comment thread ...veracrypt/patches/080-linux-mount.veracrypt-read-only-fake-mount-and-password-on-stdin.patch Outdated

openwrt-ai reviewed Oct 18, 2026

View reviewed changes

Comment thread utils/veracrypt/files/veracrypt.config

flatstik mentioned this pull request Oct 19, 2026

OpenWrt: drop the bash dependency veracrypt/VeraCrypt#1932

Open

Conversation

flatstik commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

📦 Package Details

🧪 Run Testing Details

✅ Formalities

If your PR contains a patch:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Commit checks

Uh oh!

Uh oh!

Uh oh!

flatstik commented Oct 8, 2026

Uh oh!

flatstik commented Oct 9, 2026

Uh oh!

openwrt-ai left a comment

Choose a reason for hiding this comment

Uh oh!

BKPepe left a comment

Choose a reason for hiding this comment

Uh oh!

flatstik commented Oct 14, 2026

Uh oh!

BKPepe commented Oct 14, 2026

Uh oh!

flatstik commented Oct 14, 2026

Uh oh!

flatstik commented Oct 14, 2026

Uh oh!

BKPepe commented Oct 14, 2026

Uh oh!

flatstik commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

flatstik commented Oct 14, 2026

Uh oh!

karlp commented Oct 14, 2026

Uh oh!

flatstik commented Oct 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

flatstik commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

flatstik commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

BKPepe left a comment

Choose a reason for hiding this comment

Uh oh!

flatstik commented Oct 15, 2026

Uh oh!

BKPepe commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

BKPepe commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

karlp commented Oct 15, 2026

Uh oh!

GeorgeSapkin commented Oct 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

flatstik commented Oct 17, 2026

Uh oh!

flatstik commented Oct 17, 2026

Uh oh!

flatstik commented Oct 18, 2026

Uh oh!

Uh oh!

flatstik commented Sep 25, 2026 •

edited

Loading

flatstik commented Oct 14, 2026 •

edited

Loading

flatstik commented Oct 14, 2026 •

edited

Loading

flatstik commented Oct 15, 2026 •

edited

Loading

flatstik commented Oct 15, 2026 •

edited

Loading

BKPepe commented Oct 15, 2026 •

edited

Loading

BKPepe commented Oct 15, 2026 •

edited

Loading

GeorgeSapkin commented Oct 15, 2026 •

edited

Loading