omarandClaude Opus 5
f86501bf77
Both routers are past opkg: mini_router runs ImmortalWrt 25.12.1 and main_router OpenWrt 25.12.0, both with apk-tools 3.0.5, and main_router has no `opkg` binary at all. The 24.10 lane was building and signing a feed no device could consume. Removed jobs `build` and `release` with the scripts only they called (ci/build-feed.sh, ci/sdk-build.sh, ci/make-index.sh, ci/install-usign.sh) and the usign trust anchor dist/shater-feed.pub. A committed public key is an instruction: it invites the old install path for a feed that is no longer produced. The key is retired, not revoked -- git history keeps it, KEY_BUILD still holds the secret half, and a usign secret contains its own public half, so the identity is reconstructible if a 24.10 device ever needs serving. D7 is marked SUPERSEDED by the new D22 rather than deleted. Separately: the rolling `apk-latest-<arch>` release was frozen at 0.2.0 from 2026-07-24 while every tag run published its versioned release correctly. The publish loop was an either/or -- `TAG=apk-latest-<arch>` when VER=latest (workflow_dispatch only), ELSE `TAG=apk-<ver>-<arch>` -- so a `v*` tag run never touched the rolling pointer. Asset replacement was never the problem; ci/gitea-release.sh already deletes before recreating. A router pinned to the rolling URL sat on 0.2.0 while `apk update` reported success: silent staleness, the failure mode this repo keeps having to close. The rolling pointer is now published on EVERY run, tag runs included, and a new assert reads the release back over the API afterwards: our three tag-versioned packages at the built version plus the index and the key must be present (exit 13), and no package asset at any other version may survive (exit 14). Same class of check as sdk-build-apk.sh's package-version assert, added for the same reason -- the previous failure mode was silent. KEY_BUILD can now be deleted from the Gitea repo secrets; nothing references it. Docs state plainly that mini_router is deliberately pinned to a versioned URL and that the hand-edit per release is the price of pinning. Known consequence: the x86_64 QEMU testbed is still OpenWrt 24.10.3 and can no longer install our packages. Its 25.12 rebuild is in flight separately. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01H4PcWfrBRyg4eWN58axaGN
120 lines
6.1 KiB
Bash
Executable File
120 lines
6.1 KiB
Bash
Executable File
#!/bin/sh
|
|
# ci/build-feed-apk.sh — build the signed **apk** feed for ONE arch (25.12+;
|
|
# the only packaging lane shater has — see docs-shater/DECISIONS.md D22).
|
|
#
|
|
# Usage: ci/build-feed-apk.sh <ARCH> <SDK_URL> <OUTDIR>
|
|
# e.g. ci/build-feed-apk.sh aarch64_cortex-a53 \
|
|
# https://downloads.immortalwrt.org/releases/25.12.1/targets/mediatek/filogic/immortalwrt-sdk-25.12.1-mediatek-filogic_gcc-14.3.0_musl.Linux-x86_64.tar.zst \
|
|
# out-apk/aarch64_cortex-a53
|
|
#
|
|
# This is the per-arch entrypoint the Gitea workflow's `build-apk` job calls.
|
|
# It runs on the CI RUNNER and:
|
|
# 1. asserts the prebuilt shaterd binary for this arch was already staged by
|
|
# scripts/build-shaterd.sh (the artifact-order contract);
|
|
# 2. drives a plain `debian:bookworm` container (the job's workspace volume is
|
|
# shared into it with `--volumes-from $(hostname)`; a bare `-v $PWD:...`
|
|
# points at a host path that does not exist under act_runner's DinD) that
|
|
# downloads the ImmortalWrt 25.12 apk-SDK tarball and runs
|
|
# ci/sdk-build-apk.sh in it: compile the 4 packages as .apk, then
|
|
# `apk mkndx --sign` the per-arch `packages.adb` index. Indexing NEEDS the
|
|
# SDK's host `apk` tool, so index+sign happen inside the container.
|
|
#
|
|
# Why the ImmortalWrt SDK (not openwrt/sdk images): the 25.12 fleet runs
|
|
# BananaWRT 25.12-mtk-vendor = ImmortalWrt 25.12 base (target mediatek/filogic,
|
|
# pkg arch aarch64_cortex-a53), and Docker Hub has no immortalwrt/sdk
|
|
# mediatek-filogic 25.12 tag — hence the official SDK tarball.
|
|
#
|
|
# Env:
|
|
# KEY_APK EC (prime256v1) PRIVATE key PEM (Gitea repo secret). If set,
|
|
# packages.adb carries an embedded signature verifiable by
|
|
# dist/shater-apk.pem (routers: /etc/apk/keys/).
|
|
# If unset, an UNSIGNED index is produced (warning; not shippable —
|
|
# apk signatures are effectively mandatory).
|
|
set -eu
|
|
|
|
ARCH="${1:?arch required (x86_64 | aarch64_cortex-a53)}"
|
|
SDK_URL="${2:?ImmortalWrt SDK tarball URL required (.tar.zst)}"
|
|
OUT="${3:?output dir required}"
|
|
|
|
REPO="$(cd "$(dirname "$0")/.." && pwd)"
|
|
mkdir -p "$OUT"; OUT="$(cd "$OUT" && pwd)"
|
|
|
|
# --- 0) the prebuilt shaterd binary must already be staged for this arch ------
|
|
case "$ARCH" in
|
|
x86_64) sfx=amd64 ;;
|
|
aarch64_cortex-a53) sfx=arm64 ;;
|
|
*) echo "[apk-feed] ERROR: unsupported ARCH '$ARCH'"; exit 2 ;;
|
|
esac
|
|
if [ ! -f "$REPO/openwrt/shaterd/files/shaterd-$sfx.upx" ]; then
|
|
echo "[apk-feed] ERROR: openwrt/shaterd/files/shaterd-$sfx.upx not staged."
|
|
echo " Run scripts/build-shaterd.sh BEFORE ci/build-feed-apk.sh." >&2
|
|
exit 3
|
|
fi
|
|
|
|
[ -n "${KEY_APK:-}" ] || echo "[apk-feed] WARNING: KEY_APK not set — the apk index will be UNSIGNED"
|
|
|
|
chmod +x "$REPO"/ci/*.sh 2>/dev/null || true
|
|
|
|
# --- 0.4) package version from the git tag ------------------------------------
|
|
# The workflow puts these in the job env via `ci/version.sh --env >>
|
|
# $GITHUB_ENV`; recompute here when run standalone. Passed into the container
|
|
# below and re-exported to the unprivileged build user in ci/sdk-build-apk.sh.
|
|
if [ -z "${SHATER_PKG_VERSION:-}" ] || [ -z "${SHATER_PKG_RELEASE:-}" ]; then
|
|
eval "$(sh "$REPO/ci/version.sh" --env)"
|
|
fi
|
|
echo "[apk-feed] package version: ${SHATER_PKG_VERSION}-r${SHATER_PKG_RELEASE}"
|
|
|
|
# --- 0.5) runner-side caches --------------------------------------------------
|
|
# All under $REPO/.cache so (a) actions/cache in the workflow can persist them
|
|
# between runs and (b) the nested container sees them via --volumes-from.
|
|
# sdk/ SDK tarballs (keyed in the workflow by tarball basename)
|
|
# dl/ package source tarballs — becomes CONFIG_DOWNLOAD_FOLDER inside the
|
|
# SDK; PKG_HASH still verifies every file, so stale = re-downloaded.
|
|
# apt/ debian:bookworm .deb archives for the host-deps install.
|
|
# The nested container runs the build as an unprivileged user -> must be writable
|
|
# (same reason as the chmod 0777 "$OUT" above).
|
|
CACHE="$REPO/.cache"
|
|
mkdir -p "$CACHE/sdk" "$CACHE/dl" "$CACHE/apt"
|
|
chmod -R a+rwX "$CACHE/dl" "$CACHE/apt" 2>/dev/null || true
|
|
|
|
# feeds/ git checkouts (actions/cache key: feeds-apk-<release>) — symlinked
|
|
# over the SDK's feeds dir inside the container (ci/sdk-build-apk.sh) so
|
|
# `scripts/feeds update -a` fetches deltas instead of re-cloning the
|
|
# ImmortalWrt feeds every run. Top-level chmod only: contents are created and
|
|
# owned by the container's uid-1000 build user (restore preserves ownership).
|
|
FEEDS_CACHE="$CACHE/feeds/apk"
|
|
mkdir -p "$FEEDS_CACHE"
|
|
chmod a+rwX "$CACHE" "$CACHE/feeds" "$FEEDS_CACHE" 2>/dev/null || true
|
|
|
|
# Fetch the SDK tarball ON THE RUNNER (restored cache -> own Gitea release-asset
|
|
# mirror -> upstream with stall-kill + retries) instead of the old bare
|
|
# `wget` inside the container, which hung whole runs when
|
|
# downloads.immortalwrt.org stalled mid-transfer.
|
|
SDK_TAR="$CACHE/sdk/$(basename "$SDK_URL")"
|
|
sh "$REPO/ci/fetch-sdk.sh" "$SDK_URL" "$SDK_TAR"
|
|
|
|
# --- 1) SDK build + index + sign inside a debian container -------------------
|
|
# `--volumes-from $(hostname)` shares THIS job container's workspace volume into
|
|
# the nested container: a bare `-v $PWD:...` points at a host path that does not
|
|
# exist under the act_runner DinD setup.
|
|
echo "[apk-feed] SDK build arch=$ARCH (ImmortalWrt 25.12 apk-SDK)"
|
|
docker pull -q debian:bookworm
|
|
docker run --rm --volumes-from "$(hostname)" \
|
|
-e ARCH="$ARCH" -e REPO="$REPO" -e OUT="$OUT" -e SDK_URL="$SDK_URL" \
|
|
-e SDK_TAR="$SDK_TAR" -e DL_DIR="$CACHE/dl" -e APT_CACHE="$CACHE/apt" \
|
|
-e FEEDS_CACHE="$FEEDS_CACHE" -e KEY_APK="${KEY_APK:-}" \
|
|
-e SHATER_PKG_VERSION="$SHATER_PKG_VERSION" \
|
|
-e SHATER_PKG_RELEASE="$SHATER_PKG_RELEASE" \
|
|
debian:bookworm bash "$REPO/ci/sdk-build-apk.sh"
|
|
|
|
# --- 2) sanity: the per-arch apk repo dir must be complete -------------------
|
|
[ -s "$OUT/packages.adb" ] || { echo "[apk-feed] ERROR: $OUT/packages.adb missing/empty" >&2; exit 4; }
|
|
apks=$(find "$OUT" -maxdepth 1 -name '*.apk' | wc -l)
|
|
[ "$apks" -ge 4 ] || { echo "[apk-feed] ERROR: expected >=4 .apk in $OUT, found $apks" >&2; exit 5; }
|
|
if [ -n "${KEY_APK:-}" ] && [ ! -s "$OUT/shater-apk.pem" ]; then
|
|
echo "[apk-feed] ERROR: signed feed but shater-apk.pem missing from $OUT" >&2; exit 6
|
|
fi
|
|
|
|
echo "[apk-feed] done arch=$ARCH -> $OUT"
|
|
ls -l "$OUT"
|