From 0fb965638f1b4a51feb346e867198ecd3dedb9a3 Mon Sep 17 00:00:00 2001 From: v1me Date: Tue, 8 Sep 2026 15:15:55 +0800 Subject: [PATCH 1/3] migrate build containers from bullseye-based openwrt images to debian:13 bullseye LTS ended 2026-08-31; the bullseye-security repo was pulled from the main mirror network (pool pruned, last InRelease Valid-Until expired 2026-09-07), so every job's apt-get update/install inside the official openwrt/sdk and openwrt/imagebuilder images fails with exit 100. All BuildImage-all runs since 2026-09-03 are red because of this. - package jobs: run in debian:13 (trixie), download the official SDK tarball from downloads.openwrt.org in a Prepare step, recreate the /builder + buildbot layout, drop per-step apt calls - build_image: fetch the ImageBuilder tarball on the host and run build_image.sh in a debian:13 container with the tree bind-mounted at /builder; build_image.sh installs its own deps and creates buildbot - setup: discover versions from the downloads.openwrt.org releases index instead of Docker Hub tags - CLAUDE.md: document the new build environment Co-Authored-By: Claude Fable 5 --- .github/workflows/build_image_all.yml | 192 ++++++++++++++++++++++---- CLAUDE.md | 8 +- build_image.sh | 13 +- 3 files changed, 182 insertions(+), 31 deletions(-) diff --git a/.github/workflows/build_image_all.yml b/.github/workflows/build_image_all.yml index 7acc2bb..5795d22 100644 --- a/.github/workflows/build_image_all.yml +++ b/.github/workflows/build_image_all.yml @@ -17,13 +17,14 @@ jobs: run: | versions=() excludes=() + # 版本发现从 downloads.openwrt.org 的 releases 索引拿。不再查 + # Docker Hub 的 openwrt/sdk、openwrt/imagebuilder 标签——那两个镜像 + # 是 bullseye 底（buildbot buildworker），bullseye 2026-08-31 LTS + # 到期后 apt 源失效，本仓库已整体迁离这两个镜像 + index=$(curl -sf "https://downloads.openwrt.org/releases/") for prefix in 24.10 25.12; do - sdk=$(curl -sf "https://hub.docker.com/v2/repositories/openwrt/sdk/tags/?page_size=100&name=x86-64-${prefix}" \ - | jq -r '.results[].name' | grep -oP '(?<=x86-64-)\d+\.\d+\.\d+(-rc\d+)?$') - ib=$(curl -sf "https://hub.docker.com/v2/repositories/openwrt/imagebuilder/tags/?page_size=100&name=x86-64-${prefix}" \ - | jq -r '.results[].name' | grep -oP '(?<=x86-64-)\d+\.\d+\.\d+(-rc\d+)?$') - ver=$(comm -12 <(echo "$sdk" | sort) <(echo "$ib" | sort) \ - | sed 's/-rc/~rc/' | sort -V | tail -1 | sed 's/~rc/-rc/') + # 只匹配正式发布（href="25.12.5/"）；-rc 目录名带后缀，(?=/) 兜不住 + ver=$(echo "$index" | grep -oP "(?<=href=\")${prefix}\.\d+(?=/)" | sort -V | tail -1) if [[ -n "$ver" ]]; then versions+=("\"$ver\"") # mediatek-filogic（NRadio C8-668GL）只上 25.12+：官方对该设备的 @@ -43,14 +44,43 @@ jobs: matrix: ${{ fromJSON(needs.setup.outputs.matrix) }} name: Build Passwall for OpenWRT-${{ matrix.arch }}-${{ matrix.version }} runs-on: ubuntu-latest - container: - image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }} + # debian:13（trixie）裸容器 + 官方 SDK tarball：官方 openwrt/sdk 镜像是 + # bullseye 底，bullseye 2026-08-31 LTS 到期后 security 源下架，apt 必挂。 + # /builder 目录与 buildbot 用户在 Prepare 步里复刻官方镜像的布局 + container: + image: debian:13 options: --user root defaults: run: shell: bash steps: + - name: Prepare Debian 13 + OpenWrt SDK + run: | + set -e + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y --no-install-recommends \ + sudo git wget curl ca-certificates xz-utils zstd tree \ + build-essential gawk gettext file libncurses-dev zlib1g-dev \ + python3 python3-setuptools rsync unzip + useradd -M -d /builder -s /bin/bash buildbot + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "SDK tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p /builder + tar -xf "$file" -C /builder --strip-components=1 + rm -f "$file" sha256sums + chown -R buildbot:buildbot /builder + - name: Install golang run: | VERSION=$(curl -sL https://go.dev/VERSION?m=text | head -1) @@ -71,8 +101,6 @@ jobs: export GOROOT=/usr/local/go export PATH=$PATH:/usr/local/go/bin cd $BUILD_DIR - apt-get update - apt install sudo tree -y sudo -u $BUILDER echo "src-git passwall https://github.com/Openwrt-Passwall/openwrt-passwall.git;main" >> "feeds.conf.default" sudo -u $BUILDER echo "src-git passwall_packages https://github.com/Openwrt-Passwall/openwrt-passwall-packages.git;main" >> "feeds.conf.default" chown -R $BUILDER:$BUILDER $BUILD_DIR @@ -133,12 +161,37 @@ jobs: name: Build Argon for OpenWRT-${{ matrix.arch }}-${{ matrix.version }} runs-on: ubuntu-latest container: - image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }} + image: debian:13 options: --user root defaults: run: shell: bash steps: + - name: Prepare Debian 13 + OpenWrt SDK + run: | + set -e + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y --no-install-recommends \ + sudo git wget curl ca-certificates xz-utils zstd tree \ + build-essential gawk gettext file libncurses-dev zlib1g-dev \ + python3 python3-setuptools rsync unzip + useradd -M -d /builder -s /bin/bash buildbot + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "SDK tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p /builder + tar -xf "$file" -C /builder --strip-components=1 + rm -f "$file" sha256sums + chown -R buildbot:buildbot /builder - uses: actions/checkout@v5 - name: Set package extension run: | @@ -153,8 +206,6 @@ jobs: export BUILD_DIR="/builder" export BUILDER="buildbot" cd $BUILD_DIR - apt-get update - apt install sudo -y sudo -u $BUILDER git clone https://github.com/jerrykuku/luci-theme-argon.git package/luci-theme-argon while ! sudo -u $BUILDER ./scripts/feeds update -a; do echo "Try again"; done sudo -u $BUILDER make defconfig @@ -175,12 +226,37 @@ jobs: name: Build Bandix for OpenWRT-${{ matrix.arch }}-${{ matrix.version }} runs-on: ubuntu-latest container: - image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }} + image: debian:13 options: --user root defaults: run: shell: bash steps: + - name: Prepare Debian 13 + OpenWrt SDK + run: | + set -e + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y --no-install-recommends \ + sudo git wget curl ca-certificates xz-utils zstd tree \ + build-essential gawk gettext file libncurses-dev zlib1g-dev \ + python3 python3-setuptools rsync unzip + useradd -M -d /builder -s /bin/bash buildbot + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "SDK tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p /builder + tar -xf "$file" -C /builder --strip-components=1 + rm -f "$file" sha256sums + chown -R buildbot:buildbot /builder - uses: actions/checkout@v5 - name: Set package extension run: | @@ -195,8 +271,6 @@ jobs: export BUILD_DIR="/builder" export BUILDER="buildbot" cd $BUILD_DIR - apt-get update - apt install sudo -y # Clone both repositories sudo -u $BUILDER git clone https://github.com/timsaya/openwrt-bandix.git package/openwrt-bandix sudo -u $BUILDER git clone https://github.com/timsaya/luci-app-bandix.git package/luci-app-bandix @@ -232,12 +306,37 @@ jobs: name: Build Luci App Netdata for OpenWRT-${{ matrix.arch }}-${{ matrix.version }} runs-on: ubuntu-latest container: - image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }} + image: debian:13 options: --user root defaults: run: shell: bash steps: + - name: Prepare Debian 13 + OpenWrt SDK + run: | + set -e + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y --no-install-recommends \ + sudo git wget curl ca-certificates xz-utils zstd tree \ + build-essential gawk gettext file libncurses-dev zlib1g-dev \ + python3 python3-setuptools rsync unzip + useradd -M -d /builder -s /bin/bash buildbot + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "SDK tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p /builder + tar -xf "$file" -C /builder --strip-components=1 + rm -f "$file" sha256sums + chown -R buildbot:buildbot /builder - uses: actions/checkout@v5 - name: Set package extension run: | @@ -252,8 +351,6 @@ jobs: export BUILD_DIR="/builder" export BUILDER="buildbot" cd $BUILD_DIR - apt-get update - apt install sudo -y sudo -u $BUILDER git clone https://github.com/sirpdboy/luci-app-netdata package/luci-app-netdata while ! sudo -u $BUILDER ./scripts/feeds update -a; do echo "Try again"; done sudo -u $BUILDER ./scripts/feeds install -a @@ -291,12 +388,37 @@ jobs: name: Build UUplugin for OpenWRT-${{ matrix.arch }}-${{ matrix.version }} runs-on: ubuntu-latest container: - image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }} + image: debian:13 options: --user root defaults: run: shell: bash steps: + - name: Prepare Debian 13 + OpenWrt SDK + run: | + set -e + export DEBIAN_FRONTEND=noninteractive + apt-get update + apt-get install -y --no-install-recommends \ + sudo git wget curl ca-certificates xz-utils zstd tree \ + build-essential gawk gettext file libncurses-dev zlib1g-dev \ + python3 python3-setuptools rsync unzip + useradd -M -d /builder -s /bin/bash buildbot + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "SDK tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p /builder + tar -xf "$file" -C /builder --strip-components=1 + rm -f "$file" sha256sums + chown -R buildbot:buildbot /builder - uses: actions/checkout@v5 - name: Set package extension run: | @@ -311,8 +433,6 @@ jobs: export BUILD_DIR="/builder" export BUILDER="buildbot" cd $BUILD_DIR - apt-get update - apt install sudo tree -y # uuplugin DEPENDS +luci-app-passwall：编包只需要 feed 元数据能把依赖 # 解析出来；真正的 passwall 包由 build_passwall 任务产出并一起进镜像 sudo -u $BUILDER echo "src-git passwall https://github.com/Openwrt-Passwall/openwrt-passwall.git;main" >> "feeds.conf.default" @@ -393,11 +513,32 @@ jobs: run: | sudo systemctl stop docker.socket sudo systemctl stop docker - sudo mkdir -p ${{ github.workspace }}/docker - sudo mv /var/lib/docker ${{ github.workspace }}/docker + sudo mkdir -p ${{ github.workspace }}/docker + sudo mv /var/lib/docker ${{ github.workspace }}/docker sudo ln -sf ${{ github.workspace }}/docker /var/lib/docker sudo systemctl start docker + - name: Fetch ImageBuilder + run: | + set -e + # 官方 openwrt/imagebuilder 镜像同样是 bullseye 底（apt 源已失效）， + # 改为宿主机下载官方 tarball、挂进 debian:13 容器跑 + command -v zstd >/dev/null || sudo apt-get install -y zstd + case "${{ matrix.arch }}" in + x86-64) target=x86/64 ;; + rockchip-armv8) target=rockchip/armv8 ;; + mediatek-filogic) target=mediatek/filogic ;; + esac + base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target" + curl -sfO "$base/sha256sums" + file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-imagebuilder-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums) + echo "ImageBuilder tarball: $file" + wget -q "$base/$file" + grep -F "$file" sha256sums | sha256sum -c - + mkdir -p ${{ github.workspace }}/imagebuilder + tar -xf "$file" -C ${{ github.workspace }}/imagebuilder --strip-components=1 + rm -f "$file" sha256sums + - name: Prepare Packages run: | @@ -448,6 +589,7 @@ jobs: chmod +x $VOLUME_HOME/build_image.sh docker run -i --name openwrt-imagebuilder-${{ matrix.arch }}-${{ matrix.version }} \ --user root \ + -v $VOLUME_HOME/imagebuilder:$BUILD_DIR \ -v $VOLUME_HOME/mypackages/:$BUILD_DIR/packages/mypackages/ \ -v $VOLUME_HOME/openwrt_output/:/openwrt_output/ \ -v $VOLUME_HOME/build_image.sh:/build_image.sh \ @@ -457,7 +599,7 @@ jobs: -e KERNEL_SIZE=${{ env.kernel_size }} \ -e ARCH=${{ matrix.arch }} \ -e VERSION=${{ matrix.version }} \ - openwrt/imagebuilder:${{ matrix.arch }}-${{ matrix.version }} /build_image.sh + debian:13 /build_image.sh env: rootfs_size: 4096 diff --git a/CLAUDE.md b/CLAUDE.md index 5ff3b9c..90e0f0c 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -20,9 +20,11 @@ This repository contains GitHub Actions workflows for building custom OpenWRT fi Jobs run in parallel where possible; `build_image` depends on all package builds. -### Docker Images Used -- `openwrt/sdk:{arch}-{version}` - For compiling packages -- `openwrt/imagebuilder:{arch}-{version}` - For creating firmware images +### Build Environment +- Package builds run in `debian:13` (trixie) containers; the OpenWrt SDK tarball is downloaded from downloads.openwrt.org and unpacked to `/builder` by each job's Prepare step (recreating the `/builder` + `buildbot` user layout the official SDK images had) +- `build_image` downloads the ImageBuilder tarball on the host and runs `build_image.sh` in a `debian:13` container with the unpacked tree bind-mounted at `/builder` +- The official `openwrt/sdk` / `openwrt/imagebuilder` Docker images are no longer used: they are based on Debian bullseye, whose apt security repo was retired when bullseye LTS ended 2026-08-31, breaking every job's `apt-get update` +- Version discovery in the `setup` job parses the releases index at downloads.openwrt.org (no Docker Hub tag queries) ### Supported Targets - **Architectures**: `x86-64`, `rockchip-armv8`, `mediatek-filogic` (25.12+ only — the nradio profile was merged upstream after the 24.10 branch, so the setup job excludes filogic from the 24.10 matrix line) diff --git a/build_image.sh b/build_image.sh index 4484732..ee1934b 100644 --- a/build_image.sh +++ b/build_image.sh @@ -6,12 +6,19 @@ export BUILD_DIR="/builder" export BUILDER="buildbot" cd $BUILD_DIR + +# 容器是 debian:13（trixie）裸镜像，/builder 是宿主挂载进来的官方 +# imagebuilder 解包目录。官方 openwrt/imagebuilder 镜像是 bullseye 底， +# bullseye 2026-08-31 LTS 到期后 security 源下架，这一步 apt 必挂—— +# 所以迁到 trixie，buildbot 用户也在这里自建（官方镜像里预置的那个没了） +export DEBIAN_FRONTEND=noninteractive apt-get update -apt install sudo tree -y +apt-get install -y --no-install-recommends \ + sudo tree make rsync file zstd wget curl ca-certificates python3 perl +useradd -M -d /builder -s /bin/bash $BUILDER +chown -R $BUILDER:$BUILDER $BUILD_DIR tree packages/mypackages - -chown -R $BUILDER:$BUILDER packages sudo -u $BUILDER sed -i "s/CONFIG_TARGET_ROOTFS_PARTSIZE=[0-9]\+/CONFIG_TARGET_ROOTFS_PARTSIZE=$ROOTFS_SIZE/g;s/CONFIG_TARGET_KERNEL_PARTSIZE=[0-9]\+/CONFIG_TARGET_KERNEL_PARTSIZE=$KERNEL_SIZE/g" .config echo $PROFILE From 0d2530e71f42faa2d47fc6088735f04af8a234c8 Mon Sep 17 00:00:00 2001 From: v1me Date: Tue, 8 Sep 2026 15:24:07 +0800 Subject: [PATCH 2/3] add swig and python3-pyelftools to SDK prepare steps luci-base/host/compile triggers a global package prereq check; on rockchip/mediatek SDKs that includes uboot-*, which requires host swig and the python3 elftools module. The official bullseye-based sdk image (buildbot buildworker base) preinstalled both; debian:13 does not. Co-Authored-By: Claude Fable 5 --- .github/workflows/build_image_all.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/build_image_all.yml b/.github/workflows/build_image_all.yml index 5795d22..d4ea13f 100644 --- a/.github/workflows/build_image_all.yml +++ b/.github/workflows/build_image_all.yml @@ -62,7 +62,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends \ sudo git wget curl ca-certificates xz-utils zstd tree \ - build-essential gawk gettext file libncurses-dev zlib1g-dev \ + build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \ python3 python3-setuptools rsync unzip useradd -M -d /builder -s /bin/bash buildbot case "${{ matrix.arch }}" in @@ -174,7 +174,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends \ sudo git wget curl ca-certificates xz-utils zstd tree \ - build-essential gawk gettext file libncurses-dev zlib1g-dev \ + build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \ python3 python3-setuptools rsync unzip useradd -M -d /builder -s /bin/bash buildbot case "${{ matrix.arch }}" in @@ -239,7 +239,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends \ sudo git wget curl ca-certificates xz-utils zstd tree \ - build-essential gawk gettext file libncurses-dev zlib1g-dev \ + build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \ python3 python3-setuptools rsync unzip useradd -M -d /builder -s /bin/bash buildbot case "${{ matrix.arch }}" in @@ -319,7 +319,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends \ sudo git wget curl ca-certificates xz-utils zstd tree \ - build-essential gawk gettext file libncurses-dev zlib1g-dev \ + build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \ python3 python3-setuptools rsync unzip useradd -M -d /builder -s /bin/bash buildbot case "${{ matrix.arch }}" in @@ -401,7 +401,7 @@ jobs: apt-get update apt-get install -y --no-install-recommends \ sudo git wget curl ca-certificates xz-utils zstd tree \ - build-essential gawk gettext file libncurses-dev zlib1g-dev \ + build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \ python3 python3-setuptools rsync unzip useradd -M -d /builder -s /bin/bash buildbot case "${{ matrix.arch }}" in From 8c6374542e7feb2439a61548c6a0d4102093a956 Mon Sep 17 00:00:00 2001 From: v1me Date: Tue, 8 Sep 2026 16:08:42 +0800 Subject: [PATCH 3/3] add imagebuilder host prereqs (patch gawk unzip bzip2 xz-utils) make image fails its host prereq check on debian:13 without these; the official bullseye-based imagebuilder image preinstalled them. Co-Authored-By: Claude Fable 5 --- build_image.sh | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/build_image.sh b/build_image.sh index ee1934b..d37b038 100644 --- a/build_image.sh +++ b/build_image.sh @@ -14,7 +14,8 @@ cd $BUILD_DIR export DEBIAN_FRONTEND=noninteractive apt-get update apt-get install -y --no-install-recommends \ - sudo tree make rsync file zstd wget curl ca-certificates python3 perl + sudo tree make rsync file zstd wget curl ca-certificates python3 perl \ + patch gawk unzip bzip2 xz-utils useradd -M -d /builder -s /bin/bash $BUILDER chown -R $BUILDER:$BUILDER $BUILD_DIR