docs/multidomain-site-example/site.conf

@@ -39,7 +39,15 @@
     branches = {
       stable = {
         name = 'stable',
-        mirrors = {'http://update.example.org/stable/sysupgrade'},
+        mirrors = {
+          'http://1.updates.example.org/stable/sysupgrade',
+
+          -- Requires the tls feature in image-customization.lua
+          -- 'https://2.updates.example.org/stable/sysupgrade',
+
+          -- Uses http or https depending on the tls feature in image-customization.lua
+          '//3.updates.example.org/stable/sysupgrade',
+        },
         good_signatures = 2,
         pubkeys = {
           'xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx', -- Alice

docs/site-example/site.conf

@@ -174,7 +174,15 @@
         name = 'stable',
 
         -- List of mirrors to fetch images from. IPv6 required!
-        mirrors = {'http://1.updates.services.ffhl/stable/sysupgrade'},
+        mirrors = {
+          'http://1.updates.example.org/stable/sysupgrade',
+
+          -- Requires the tls feature in image-customization.lua
+          -- 'https://2.updates.example.org/stable/sysupgrade',
+
+          -- Uses http or https depending on the tls feature in image-customization.lua
+          '//3.updates.example.org/stable/sysupgrade',
+        },
 
         -- Number of good signatures required.
         -- Have multiple maintainers sign your build and only

docs/user/site.rst

@@ -467,7 +467,10 @@ autoupdater \: package
           name = 'stable',
           mirrors = {
             'http://[fdca:ffee:babe:1::fec1]/firmware/stable/sysupgrade/',
-            'http://autoupdate.alpha-centauri.freifunk.net/firmware/stable/sysupgrade/',
+            -- Requires the tls feature in image-customization.lua
+            'https://autoupdate.alpha-centauri.freifunk.net/firmware/stable/sysupgrade/',
+            -- Uses http or https depending on the tls feature in image-customization.lua
+            '//autoupdate2.alpha-centauri.freifunk.net/firmware/stable/sysupgrade/',
           },
           -- Number of good signatures required
           good_signatures = 2,
@@ -482,6 +485,16 @@ autoupdater \: package
   All configured mirrors must be reachable from the nodes via IPv6. If you don't want to set an IPv6 address
   explicitly, but use a hostname (which is recommended), see also the :ref:`FAQ <faq-dns>`.
 
+  HTTPS URLs can be used if the **tls** feature is enabled in **image-customization.lua**.
+
+  Use protocol-less ``//server/path`` URLs to use HTTPS if the **tls** feature is available,
+  but fall back to HTTP otherwise. The server **must** allow HTTPS connections and provide
+  a valid certificate in this case; the autoupdater will not fall back to HTTP if the **tls**
+  feature is enabled, but the HTTPS connection fails.
+
+  Note that the validity period of TLS certificates is checked as well, so care must be taken
+  to provide working NTP servers in addition to the update mirrors when using HTTPS.
+
 .. _user-site-config_mode:
 
 config_mode \: optional

docs/user/supported_devices.rst

@@ -540,9 +540,10 @@ ramips-mt76x8
 
 * Xiaomi
 
-  - Xiaomi Mi Router 4A (100M Edition)
-  - Xiaomi Mi Router 4A (100M International Edition)
-  - Xiaomi Mi Router 4C
+  - Xiaomi Mi Router 4A (100M Edition) - MIR4A
+  - Xiaomi Mi Router 4A (100M International Edition) - R4AC
+  - Xiaomi Mi Router 4A (100M International Edition v2) - R4ACv2
+  - Xiaomi Mi Router 4C - R4CM
 
 rockchip-armv8
 --------------

package/gluon-alfred/files/usr/lib/autoupdater/abort.d/60gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 start_enabled alfred

package/gluon-alfred/files/usr/lib/autoupdater/download.d/40gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 stop alfred

package/gluon-autoupdater/check_site.lua

+local has_tls = (function()
+	local f = io.open((os.getenv('IPKG_INSTROOT') or '') .. '/lib/gluon/features/tls')
+	if f then
+		f:close()
+		return true
+	end
+	return false
+end)()
+
 local branches = table_keys(need_table({'autoupdater', 'branches'}, function(branch)
 	need_alphanumeric_key(branch)
 
 	need_string(in_site(extend(branch, {'name'})))
-	need_string_array_match(extend(branch, {'mirrors'}), '^http://')
+	need_array(extend(branch, {'mirrors'}), function(mirror)
+		alternatives(function()
+			need_string_match(mirror, 'http://')
+		end, function()
+			need_string_match(mirror, 'https://')
+			need(mirror, function() return has_tls end, nil,
+				"use HTTPS only if the 'tls' feature is enabled")
+		end, function()
+			need_string_match(mirror, '^//')
+		end)
+	end)
 
 	local pubkeys = need_string_array_match(in_site(extend(branch, {'pubkeys'})), '^%x+$')
 	need_number(in_site(extend(branch, {'good_signatures'})))

package/gluon-autoupdater/files/usr/lib/autoupdater/abort.d/90gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 

package/gluon-autoupdater/files/usr/lib/autoupdater/download.d/10gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 

package/gluon-autoupdater/luasrc/lib/gluon/upgrade/500-autoupdater

@@ -4,14 +4,30 @@ local site = require 'gluon.site'
 local uci = require('simple-uci').cursor()
 local unistd = require 'posix.unistd'
 
+local has_tls = unistd.access('/lib/gluon/features/tls') ~= nil
+local default_scheme = has_tls and 'https:' or 'http:'
 
 local min_branch
 
+local function mirror_urls(mirrors)
+	local ret = {}
+
+	for _, mirror in ipairs(mirrors) do
+		if string.match(mirror, '^//') ~= nil then
+			table.insert(ret, default_scheme .. mirror)
+		else
+			table.insert(ret, mirror)
+		end
+	end
+
+	return ret
+end
+
 for name, config in pairs(site.autoupdater.branches()) do
 	uci:delete('autoupdater', name)
 	uci:section('autoupdater', 'branch', name, {
 		name = config.name,
-		mirror = config.mirrors,
+		mirror = mirror_urls(config.mirrors),
 		good_signatures = config.good_signatures,
 		pubkey = config.pubkeys,
 	})

package/gluon-core/files/lib/gluon/label_mac.sh

 #!/bin/sh
 
+# shellcheck disable=SC1091
+
 . /lib/functions/system.sh
 
 get_mac_label

package/gluon-core/files/lib/netifd/proto/gluon_mesh.sh

 #!/bin/sh
 
+# shellcheck disable=SC1091
+
 . /lib/functions.sh
 . ../netifd-proto.sh
 init_proto "$@"

package/gluon-core/files/lib/netifd/proto/gluon_wired.sh

 #!/bin/sh
 
+# shellcheck disable=SC1091
+
 . /lib/functions.sh
 . ../netifd-proto.sh
 init_proto "$@"
@@ -17,7 +19,8 @@ xor2() {
 }
 
 is_layer3_device () {
-	local addrlen="$(cat "/sys/class/net/$1/addr_len")"
+	local addrlen
+	addrlen="$(cat "/sys/class/net/$1/addr_len")"
 	test "$addrlen" -eq 0
 }
 
@@ -34,7 +37,8 @@ interface_linklocal() {
 		return
 	fi
 
-	local macaddr="$(ubus call network.device status '{"name": "'"$1"'"}' | jsonfilter -e '@.macaddr')"
+	local macaddr
+	macaddr="$(ubus call network.device status '{"name": "'"$1"'"}' | jsonfilter -e '@.macaddr')"
 	local oldIFS="$IFS"; IFS=':'; set -- $macaddr; IFS="$oldIFS"
 
 	echo "fe80::$(xor2 "$1")$2:$3ff:fe$4:$5$6"

package/gluon-ebtables-limit-arp/files/usr/lib/autoupdater/abort.d/15start-arp-limiter

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 # Start after network

package/gluon-ebtables-limit-arp/files/usr/lib/autoupdater/upgrade.d/05stop-arp-limiter

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 # Stop before network

package/gluon-mesh-batman-adv/files/lib/netifd/proto/gluon_bat0.sh

 #!/bin/sh
 
+# shellcheck disable=SC1091,SC2034
+
 . /lib/functions.sh
 . ../netifd-proto.sh
 init_proto "$@"
@@ -37,7 +39,8 @@ proto_gluon_bat0_renew() {
 proto_gluon_bat0_setup() {
 	local config="$1"
 
-	local routing_algo="$(lookup_site 'mesh.batman_adv.routing_algo' 'BATMAN_IV')"
+	local routing_algo
+	routing_algo="$(lookup_site 'mesh.batman_adv.routing_algo' 'BATMAN_IV')"
 
 	local gw_mode
 	json_get_vars gw_mode
@@ -54,7 +57,8 @@ proto_gluon_bat0_setup() {
 			batctl gw_mode "server"
 		;;
 		client)
-			local gw_sel_class="$(lookup_site 'mesh.batman_adv.gw_sel_class')"
+			local gw_sel_class
+			gw_sel_class="$(lookup_site 'mesh.batman_adv.gw_sel_class')"
 			if [ -n "$gw_sel_class" ]; then
 				batctl gw_mode "client" "$gw_sel_class"
 			else
@@ -67,7 +71,8 @@ proto_gluon_bat0_setup() {
 	esac
 
 
-	local primary0_mac="$(lua -e 'print(require("gluon.util").generate_mac(3))')"
+	local primary0_mac
+	primary0_mac="$(lua -e 'print(require("gluon.util").generate_mac(3))')"
 
 	ip link add primary0 type dummy
 	echo 1 > /proc/sys/net/ipv6/conf/primary0/disable_ipv6

package/gluon-mesh-batman-adv/files/usr/lib/autoupdater/abort.d/10start-network

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 pidof netifd >/dev/null || start_enabled network

package/gluon-mesh-batman-adv/files/usr/lib/autoupdater/upgrade.d/10stop-network

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 wifi down

package/gluon-mesh-olsrd/files/usr/lib/autoupdater/abort.d/10olsrd

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 

package/gluon-mesh-olsrd/files/usr/lib/autoupdater/upgrade.d/10olsrd

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh