Roarcannotprogramming · Roarcannotprogramming · Sep 9, 2026 · Sep 8, 2026 · Sep 8, 2026 · Sep 8, 2026
diff --git a/.github/workflows/build_image_all.yml b/.github/workflows/build_image_all.yml
@@ -17,13 +17,14 @@ jobs:
         run: |
           versions=()
           excludes=()
+          # 版本发现从 downloads.openwrt.org 的 releases 索引拿。不再查
+          # Docker Hub 的 openwrt/sdk、openwrt/imagebuilder 标签——那两个镜像
+          # 是 bullseye 底（buildbot buildworker），bullseye 2026-08-31 LTS
+          # 到期后 apt 源失效，本仓库已整体迁离这两个镜像
+          index=$(curl -sf "https://downloads.openwrt.org/releases/")
           for prefix in 24.10 25.12; do
-            sdk=$(curl -sf "https://hub.docker.com/v2/repositories/openwrt/sdk/tags/?page_size=100&name=x86-64-${prefix}" \
-              | jq -r '.results[].name' | grep -oP '(?<=x86-64-)\d+\.\d+\.\d+(-rc\d+)?$')
-            ib=$(curl -sf "https://hub.docker.com/v2/repositories/openwrt/imagebuilder/tags/?page_size=100&name=x86-64-${prefix}" \
-              | jq -r '.results[].name' | grep -oP '(?<=x86-64-)\d+\.\d+\.\d+(-rc\d+)?$')
-            ver=$(comm -12 <(echo "$sdk" | sort) <(echo "$ib" | sort) \
-              | sed 's/-rc/~rc/' | sort -V | tail -1 | sed 's/~rc/-rc/')
+            # 只匹配正式发布（href="25.12.5/"）；-rc 目录名带后缀，(?=/) 兜不住
+            ver=$(echo "$index" | grep -oP "(?<=href=\")${prefix}\.\d+(?=/)" | sort -V | tail -1)
             if [[ -n "$ver" ]]; then
               versions+=("\"$ver\"")
               # mediatek-filogic（NRadio C8-668GL）只上 25.12+：官方对该设备的
@@ -43,14 +44,43 @@ jobs:
       matrix: ${{ fromJSON(needs.setup.outputs.matrix) }}
     name: Build Passwall for OpenWRT-${{ matrix.arch }}-${{ matrix.version }}
     runs-on: ubuntu-latest
-    container: 
-      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }}
+    # debian:13（trixie）裸容器 + 官方 SDK tarball：官方 openwrt/sdk 镜像是
+    # bullseye 底，bullseye 2026-08-31 LTS 到期后 security 源下架，apt 必挂。
+    # /builder 目录与 buildbot 用户在 Prepare 步里复刻官方镜像的布局
+    container:
+      image: debian:13
       options: --user root
     defaults:
       run:
         shell: bash
     steps:
 
+    - name: Prepare Debian 13 + OpenWrt SDK
+      run: |
+        set -e
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          sudo git wget curl ca-certificates xz-utils zstd tree \
+          build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \
+          python3 python3-setuptools rsync unzip
+        useradd -M -d /builder -s /bin/bash buildbot
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "SDK tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p /builder
+        tar -xf "$file" -C /builder --strip-components=1
+        rm -f "$file" sha256sums
+        chown -R buildbot:buildbot /builder
+
     - name: Install golang
       run: |
         VERSION=$(curl -sL https://go.dev/VERSION?m=text | head -1)
@@ -71,8 +101,6 @@ jobs:
         export GOROOT=/usr/local/go
         export PATH=$PATH:/usr/local/go/bin
         cd $BUILD_DIR
-        apt-get update
-        apt install sudo tree -y
         sudo -u $BUILDER echo "src-git passwall https://github.com/Openwrt-Passwall/openwrt-passwall.git;main" >> "feeds.conf.default"
         sudo -u $BUILDER echo "src-git passwall_packages https://github.com/Openwrt-Passwall/openwrt-passwall-packages.git;main" >> "feeds.conf.default"
         chown -R $BUILDER:$BUILDER $BUILD_DIR
@@ -133,12 +161,37 @@ jobs:
     name: Build Argon for OpenWRT-${{ matrix.arch }}-${{ matrix.version }}
     runs-on: ubuntu-latest
     container:
-      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }}
+      image: debian:13
       options: --user root
     defaults:
       run:
         shell: bash
     steps:
+    - name: Prepare Debian 13 + OpenWrt SDK
+      run: |
+        set -e
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          sudo git wget curl ca-certificates xz-utils zstd tree \
+          build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \
+          python3 python3-setuptools rsync unzip
+        useradd -M -d /builder -s /bin/bash buildbot
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "SDK tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p /builder
+        tar -xf "$file" -C /builder --strip-components=1
+        rm -f "$file" sha256sums
+        chown -R buildbot:buildbot /builder
     - uses: actions/checkout@v5
     - name: Set package extension
       run: |
@@ -153,8 +206,6 @@ jobs:
         export BUILD_DIR="/builder"
         export BUILDER="buildbot"
         cd $BUILD_DIR
-        apt-get update
-        apt install sudo -y
         sudo -u $BUILDER git clone https://github.com/jerrykuku/luci-theme-argon.git package/luci-theme-argon
         while ! sudo -u $BUILDER ./scripts/feeds update -a; do echo "Try again"; done
         sudo -u $BUILDER make defconfig
@@ -175,12 +226,37 @@ jobs:
     name: Build Bandix for OpenWRT-${{ matrix.arch }}-${{ matrix.version }}
     runs-on: ubuntu-latest
     container:
-      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }}
+      image: debian:13
       options: --user root
     defaults:
       run:
         shell: bash
     steps:
+    - name: Prepare Debian 13 + OpenWrt SDK
+      run: |
+        set -e
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          sudo git wget curl ca-certificates xz-utils zstd tree \
+          build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \
+          python3 python3-setuptools rsync unzip
+        useradd -M -d /builder -s /bin/bash buildbot
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "SDK tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p /builder
+        tar -xf "$file" -C /builder --strip-components=1
+        rm -f "$file" sha256sums
+        chown -R buildbot:buildbot /builder
     - uses: actions/checkout@v5
     - name: Set package extension
       run: |
@@ -195,8 +271,6 @@ jobs:
         export BUILD_DIR="/builder"
         export BUILDER="buildbot"
         cd $BUILD_DIR
-        apt-get update
-        apt install sudo -y
         # Clone both repositories
         sudo -u $BUILDER git clone https://github.com/timsaya/openwrt-bandix.git package/openwrt-bandix
         sudo -u $BUILDER git clone https://github.com/timsaya/luci-app-bandix.git package/luci-app-bandix
@@ -232,12 +306,37 @@ jobs:
     name: Build Luci App Netdata for OpenWRT-${{ matrix.arch }}-${{ matrix.version }}
     runs-on: ubuntu-latest
     container:
-      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }}
+      image: debian:13
       options: --user root
     defaults:
       run:
         shell: bash
     steps:
+    - name: Prepare Debian 13 + OpenWrt SDK
+      run: |
+        set -e
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          sudo git wget curl ca-certificates xz-utils zstd tree \
+          build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \
+          python3 python3-setuptools rsync unzip
+        useradd -M -d /builder -s /bin/bash buildbot
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "SDK tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p /builder
+        tar -xf "$file" -C /builder --strip-components=1
+        rm -f "$file" sha256sums
+        chown -R buildbot:buildbot /builder
     - uses: actions/checkout@v5
     - name: Set package extension
       run: |
@@ -252,8 +351,6 @@ jobs:
         export BUILD_DIR="/builder"
         export BUILDER="buildbot"
         cd $BUILD_DIR
-        apt-get update
-        apt install sudo -y
         sudo -u $BUILDER git clone https://github.com/sirpdboy/luci-app-netdata package/luci-app-netdata
         while ! sudo -u $BUILDER ./scripts/feeds update -a; do echo "Try again"; done
         sudo -u $BUILDER ./scripts/feeds install -a
@@ -291,12 +388,37 @@ jobs:
     name: Build UUplugin for OpenWRT-${{ matrix.arch }}-${{ matrix.version }}
     runs-on: ubuntu-latest
     container:
-      image: openwrt/sdk:${{ matrix.arch }}-${{ matrix.version }}
+      image: debian:13
       options: --user root
     defaults:
       run:
         shell: bash
     steps:
+    - name: Prepare Debian 13 + OpenWrt SDK
+      run: |
+        set -e
+        export DEBIAN_FRONTEND=noninteractive
+        apt-get update
+        apt-get install -y --no-install-recommends \
+          sudo git wget curl ca-certificates xz-utils zstd tree \
+          build-essential gawk gettext file libncurses-dev zlib1g-dev swig python3-pyelftools \
+          python3 python3-setuptools rsync unzip
+        useradd -M -d /builder -s /bin/bash buildbot
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-sdk-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "SDK tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p /builder
+        tar -xf "$file" -C /builder --strip-components=1
+        rm -f "$file" sha256sums
+        chown -R buildbot:buildbot /builder
     - uses: actions/checkout@v5
     - name: Set package extension
       run: |
@@ -311,8 +433,6 @@ jobs:
         export BUILD_DIR="/builder"
         export BUILDER="buildbot"
         cd $BUILD_DIR
-        apt-get update
-        apt install sudo tree -y
         # uuplugin DEPENDS +luci-app-passwall：编包只需要 feed 元数据能把依赖
         # 解析出来；真正的 passwall 包由 build_passwall 任务产出并一起进镜像
         sudo -u $BUILDER echo "src-git passwall https://github.com/Openwrt-Passwall/openwrt-passwall.git;main" >> "feeds.conf.default"
@@ -393,11 +513,32 @@ jobs:
       run: |
         sudo systemctl stop docker.socket
         sudo systemctl stop docker
-        sudo mkdir -p ${{ github.workspace }}/docker 
-        sudo mv /var/lib/docker ${{ github.workspace }}/docker 
+        sudo mkdir -p ${{ github.workspace }}/docker
+        sudo mv /var/lib/docker ${{ github.workspace }}/docker
         sudo ln -sf ${{ github.workspace }}/docker /var/lib/docker
         sudo systemctl start docker
 
+    - name: Fetch ImageBuilder
+      run: |
+        set -e
+        # 官方 openwrt/imagebuilder 镜像同样是 bullseye 底（apt 源已失效），
+        # 改为宿主机下载官方 tarball、挂进 debian:13 容器跑
+        command -v zstd >/dev/null || sudo apt-get install -y zstd
+        case "${{ matrix.arch }}" in
+          x86-64) target=x86/64 ;;
+          rockchip-armv8) target=rockchip/armv8 ;;
+          mediatek-filogic) target=mediatek/filogic ;;
+        esac
+        base="https://downloads.openwrt.org/releases/${{ matrix.version }}/targets/$target"
+        curl -sfO "$base/sha256sums"
+        file=$(awk '{name=$2; sub(/^\*/,"",name)} name ~ /^openwrt-imagebuilder-.*\.tar\.(xz|zst)$/ {print name; exit}' sha256sums)
+        echo "ImageBuilder tarball: $file"
+        wget -q "$base/$file"
+        grep -F "$file" sha256sums | sha256sum -c -
+        mkdir -p ${{ github.workspace }}/imagebuilder
+        tar -xf "$file" -C ${{ github.workspace }}/imagebuilder --strip-components=1
+        rm -f "$file" sha256sums
+
 
     - name: Prepare Packages
       run: |
@@ -448,6 +589,7 @@ jobs:
         chmod +x $VOLUME_HOME/build_image.sh
         docker run -i --name openwrt-imagebuilder-${{ matrix.arch }}-${{ matrix.version }} \
          --user root \
+         -v $VOLUME_HOME/imagebuilder:$BUILD_DIR \
          -v $VOLUME_HOME/mypackages/:$BUILD_DIR/packages/mypackages/ \
          -v $VOLUME_HOME/openwrt_output/:/openwrt_output/ \
          -v $VOLUME_HOME/build_image.sh:/build_image.sh \
@@ -457,7 +599,7 @@ jobs:
          -e KERNEL_SIZE=${{ env.kernel_size }} \
          -e ARCH=${{ matrix.arch }} \
          -e VERSION=${{ matrix.version }} \
-         openwrt/imagebuilder:${{ matrix.arch }}-${{ matrix.version }} /build_image.sh 
+         debian:13 /build_image.sh
 
       env:
         rootfs_size: 4096

diff --git a/CLAUDE.md b/CLAUDE.md
@@ -20,9 +20,11 @@ This repository contains GitHub Actions workflows for building custom OpenWRT fi
 
 Jobs run in parallel where possible; `build_image` depends on all package builds.
 
-### Docker Images Used
-- `openwrt/sdk:{arch}-{version}` - For compiling packages
-- `openwrt/imagebuilder:{arch}-{version}` - For creating firmware images
+### Build Environment
+- Package builds run in `debian:13` (trixie) containers; the OpenWrt SDK tarball is downloaded from downloads.openwrt.org and unpacked to `/builder` by each job's Prepare step (recreating the `/builder` + `buildbot` user layout the official SDK images had)
+- `build_image` downloads the ImageBuilder tarball on the host and runs `build_image.sh` in a `debian:13` container with the unpacked tree bind-mounted at `/builder`
+- The official `openwrt/sdk` / `openwrt/imagebuilder` Docker images are no longer used: they are based on Debian bullseye, whose apt security repo was retired when bullseye LTS ended 2026-08-31, breaking every job's `apt-get update`
+- Version discovery in the `setup` job parses the releases index at downloads.openwrt.org (no Docker Hub tag queries)
 
 ### Supported Targets
 - **Architectures**: `x86-64`, `rockchip-armv8`, `mediatek-filogic` (25.12+ only — the nradio profile was merged upstream after the 24.10 branch, so the setup job excludes filogic from the 24.10 matrix line)

diff --git a/build_image.sh b/build_image.sh
@@ -6,12 +6,20 @@ export BUILD_DIR="/builder"
 export BUILDER="buildbot"
 
 cd $BUILD_DIR
+
+# 容器是 debian:13（trixie）裸镜像，/builder 是宿主挂载进来的官方
+# imagebuilder 解包目录。官方 openwrt/imagebuilder 镜像是 bullseye 底，
+# bullseye 2026-08-31 LTS 到期后 security 源下架，这一步 apt 必挂——
+# 所以迁到 trixie，buildbot 用户也在这里自建（官方镜像里预置的那个没了）
+export DEBIAN_FRONTEND=noninteractive
 apt-get update
-apt install sudo tree -y
+apt-get install -y --no-install-recommends \
+    sudo tree make rsync file zstd wget curl ca-certificates python3 perl \
+    patch gawk unzip bzip2 xz-utils
+useradd -M -d /builder -s /bin/bash $BUILDER
+chown -R $BUILDER:$BUILDER $BUILD_DIR
 
 tree packages/mypackages
-
-chown -R $BUILDER:$BUILDER packages
 sudo -u $BUILDER sed -i "s/CONFIG_TARGET_ROOTFS_PARTSIZE=[0-9]\+/CONFIG_TARGET_ROOTFS_PARTSIZE=$ROOTFS_SIZE/g;s/CONFIG_TARGET_KERNEL_PARTSIZE=[0-9]\+/CONFIG_TARGET_KERNEL_PARTSIZE=$KERNEL_SIZE/g" .config
 echo $PROFILE