modules

-GLUON_FEEDS='openwrt gluon routing luci'
+GLUON_FEEDS='gluon packages routing'
 
-LEDE_REPO=https://git.lede-project.org/openwrt/openwrt.git
-LEDE_BRANCH=lede-17.01
-LEDE_COMMIT=2e26bdfeca2ffe381eb17fa9765724be7d45e1d8
-
-PACKAGES_OPENWRT_REPO=https://github.com/openwrt/packages.git
-PACKAGES_OPENWRT_BRANCH=lede-17.01
-PACKAGES_OPENWRT_COMMIT=82ef2fd773987a72678a32b862f50085c3f57d56
+OPENWRT_REPO=https://github.com/openwrt/openwrt.git
+OPENWRT_BRANCH=openwrt-24.10
+OPENWRT_COMMIT=63064db76599ac0455c2f7cd6309d63c61112ae1
 
 PACKAGES_GLUON_REPO=https://github.com/freifunk-gluon/packages.git
-PACKAGES_GLUON_COMMIT=7abd688e6ae7c4dae3f8dfee7e283c41400e870a
+PACKAGES_GLUON_COMMIT=bae34a0f53b25dbd691c57c8ab2d0b7cfe811517
 
-PACKAGES_ROUTING_REPO=https://github.com/openwrt-routing/packages.git
-PACKAGES_ROUTING_COMMIT=c5f18d5a2a83cb1109aa68ce52dfb05f4c307a4f
+PACKAGES_PACKAGES_REPO=https://github.com/openwrt/packages.git
+PACKAGES_PACKAGES_BRANCH=openwrt-24.10
+PACKAGES_PACKAGES_COMMIT=efe4a18b129cfe7f766a9b07a2f9b856ca2d478b
 
-PACKAGES_LUCI_REPO=https://github.com/openwrt/luci.git
-PACKAGES_LUCI_BRANCH=lede-17.01
-PACKAGES_LUCI_COMMIT=1f014bd2180b364bec4c3f6457f72a0621884f9a
+PACKAGES_ROUTING_REPO=https://github.com/openwrt/routing.git
+PACKAGES_ROUTING_BRANCH=openwrt-24.10
+PACKAGES_ROUTING_COMMIT=85d040f28c21c116c905aa15a66255dde80336e7

overlay/opkg.mk

-# LEDE doesn't have a nice way to set the list of feeds in
-# /etc/opkg/distfeeds.conf, so we use this overlay file (which is included by
-# the opkg package Makefile though LEDE's IncludeOverlay mechanism).
-
-# The following definitions make /etc/opkg/distfeeds.conf match the one included
-# in official LEDE builds (by default, FEEDS_DISABLED contains the original list
-# of feeds (which are unused by Gluon), and FEEDS_ENABLED our own feed list).
-
-FEEDS_ENABLED := $(FEEDS_DISABLED)
-FEEDS_DISABLED :=

package/features

-nodefault 'web-wizard'
+-- Feature definition file
+--
+-- See the page `dev/packages` (Developer Documentation / Package development)
+-- in the `docs` directory or on gluon.readthedocs.io for information on the
+-- file format
 
-packages 'web-wizard' \
-	'gluon-config-mode-hostname' \
-	'gluon-config-mode-geo-location' \
-	'gluon-config-mode-contact-info'
 
-packages 'web-wizard & autoupdater' \
-	'gluon-config-mode-autoupdater'
+feature('web-wizard', {
+	'gluon-config-mode-hostname',
+	'gluon-config-mode-geo-location',
+	'gluon-config-mode-contact-info',
+	'gluon-config-mode-outdoor',
+})
 
-packages 'web-wizard & (mesh-vpn-fastd | mesh-vpn-tunneldigger)' \
-	'gluon-config-mode-mesh-vpn'
+when(_'web-wizard' and _'autoupdater', {
+	'gluon-config-mode-autoupdater',
+})
 
+when(_'web-wizard' and (
+	_'mesh-vpn-fastd' or
+	_'mesh-vpn-fastd-l2tp' or
+	_'mesh-vpn-wireguard'
+), {
+	'gluon-config-mode-mesh-vpn',
+})
 
-nodefault 'web-advanced'
 
-packages 'web-advanced' \
-	'gluon-web-admin' \
-	'gluon-web-network' \
-	'gluon-web-wifi-config'
+feature('web-advanced', {
+	'gluon-web-admin',
+	'gluon-web-network',
+	'gluon-web-wifi-config',
+})
 
-packages 'web-advanced & autoupdater' \
-	'gluon-web-autoupdater'
+when(_'web-advanced' and _'autoupdater', {
+	'gluon-web-autoupdater',
+})
 
-packages 'web-advanced & mesh-vpn-fastd' \
-	'gluon-web-mesh-vpn-fastd'
+
+when(_'mesh-batman-adv-15', {
+	'gluon-ebtables-limit-arp',
+	'gluon-radvd',
+})
+
+when(_'status-page' and _'mesh-batman-adv-15', {
+	'gluon-status-page-mesh-batman-adv',
+})
+
+
+when(_'mesh-olsrd', {
+	'gluon-radvd',
+})
+
+
+when(not _'wireless-encryption-wpa3', {
+	'hostapd-mini',
+})

package/gluon-alfred/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-alfred
-PKG_VERSION:=1
-PKG_RELEASE:=1
-
-PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
 include ../gluon.mk
 
-
 define Package/gluon-alfred
-  SECTION:=gluon
-  CATEGORY:=Gluon
   DEPENDS:=+gluon-core +gluon-respondd +gluon-neighbour-info gluon-mesh-batman-adv +micrond +alfred
   TITLE:=Configure alfred
 endef
 
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-endef
-
-define Build/Configure
-endef
-
-define Build/Compile
-	$(call GluonSrcDiet,./luasrc,$(PKG_BUILD_DIR)/luadest/)
-endef
-
-define Package/gluon-alfred/install
-	$(CP) ./files/* $(1)/
-	$(CP) $(PKG_BUILD_DIR)/luadest/* $(1)/
-endef
-
-$(eval $(call BuildPackage,gluon-alfred))
+$(eval $(call BuildPackageGluon,gluon-alfred))

package/gluon-alfred/files/lib/gluon/reload.d/301-alfred-stop

+#!/bin/sh
+/etc/init.d/alfred stop

package/gluon-alfred/files/lib/gluon/reload.d/799-alfred-start

+#!/bin/sh
+/etc/init.d/alfred start

package/gluon-alfred/files/usr/lib/autoupdater/abort.d/60gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 start_enabled alfred

package/gluon-alfred/files/usr/lib/autoupdater/download.d/40gluon-alfred

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
-
 stop alfred

package/gluon-authorized-keys/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-authorized-keys
-PKG_VERSION:=2
-
-PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
 include ../gluon.mk
 
-
 define Package/gluon-authorized-keys
-  SECTION:=gluon
-  CATEGORY:=Gluon
   TITLE:=Fill /etc/dropbear/authorized_keys from site.conf
-  DEPENDS:=+gluon-core
-endef
-
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-endef
-
-define Build/Configure
-endef
-
-define Build/Compile
-	$(call GluonSrcDiet,./luasrc,$(PKG_BUILD_DIR)/luadest/)
-endef
-
-define Package/gluon-authorized-keys/install
-	$(CP) $(PKG_BUILD_DIR)/luadest/* $(1)/
-endef
-
-define Package/gluon-authorized-keys/postinst
-#!/bin/sh
-$(call GluonCheckSite,check_site.lua)
+  DEPENDS:=+gluon-core +gluon-lock-password
 endef
 
-$(eval $(call BuildPackage,gluon-authorized-keys))
+$(eval $(call BuildPackageGluon,gluon-authorized-keys))

package/gluon-authorized-keys/luasrc/lib/gluon/upgrade/100-authorized-keys

@@ -5,7 +5,7 @@ local file = '/etc/dropbear/authorized_keys'
 
 local keys = {}
 
-function load_keys()
+local function load_keys()
 	for line in io.lines(file) do
 		keys[line] = true
 	end

package/gluon-autoupdater/Config.in

+if PACKAGE_gluon-autoupdater
+
+config GLUON_AUTOUPDATER_BRANCH
+	string "Autoupdater branch"
+	default ""
+
+config GLUON_AUTOUPDATER_ENABLED
+	bool "Enable autoupdater by default"
+
+endif

package/gluon-autoupdater/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-autoupdater
-PKG_VERSION:=4
-
-PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
-
-PKG_CONFIG_DEPENDS := CONFIG_GLUON_BRANCH
-PKG_BUILD_DEPENDS := respondd
 
+PKG_CONFIG_DEPENDS := CONFIG_GLUON_AUTOUPDATER_BRANCH CONFIG_GLUON_AUTOUPDATER_ENABLED
 
 include ../gluon.mk
 
-
 define Package/gluon-autoupdater
-  SECTION:=gluon
-  CATEGORY:=Gluon
   DEPENDS:=+gluon-core +libgluonutil +micrond +autoupdater
   TITLE:=Automatically update firmware
 endef
 
 define Package/gluon-autoupdater/config
-config GLUON_BRANCH
-	string "Gluon autoupdater branch"
-	depends on PACKAGE_gluon-autoupdater
-	default ""
-endef
-
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-	$(CP) ./src/* $(PKG_BUILD_DIR)/
-endef
-
-define Build/Compile
-	$(call Build/Compile/Default)
-	$(call GluonSrcDiet,./luasrc,$(PKG_BUILD_DIR)/luadest/)
+	source "$(SOURCE)/Config.in"
 endef
 
 define Package/gluon-autoupdater/install
-	$(CP) ./files/* $(1)/
-	$(CP) $(PKG_BUILD_DIR)/luadest/* $(1)/
-
-	$(INSTALL_DIR) $(1)/lib/gluon/respondd
-	$(CP) $(PKG_BUILD_DIR)/respondd.so $(1)/lib/gluon/respondd/autoupdater.so
+	$(Gluon/Build/Install)
 
-ifneq ($(CONFIG_GLUON_BRANCH),"")
 	$(INSTALL_DIR) $(1)/lib/gluon/autoupdater
-	echo '$(call qstrip,$(CONFIG_GLUON_BRANCH))' > $(1)/lib/gluon/autoupdater/default_branch
+  ifneq ($(CONFIG_GLUON_AUTOUPDATER_BRANCH),"")
+	echo '$(call qstrip,$(CONFIG_GLUON_AUTOUPDATER_BRANCH))' > $(1)/lib/gluon/autoupdater/default_branch
+  endif
+  ifneq ($(CONFIG_GLUON_AUTOUPDATER_ENABLED),)
+	touch $(1)/lib/gluon/autoupdater/default_enabled
   endif
 endef
 
-define Package/gluon-autoupdater/postinst
-#!/bin/sh
-$(call GluonCheckSite,check_site.lua)
-endef
-
-$(eval $(call BuildPackage,gluon-autoupdater))
+$(eval $(call BuildPackageGluon,gluon-autoupdater))

package/gluon-autoupdater/check_site.lua

-need_string(in_site({'autoupdater', 'branch'}))
+local has_tls = (function()
+	local f = io.open((os.getenv('IPKG_INSTROOT') or '') .. '/lib/gluon/features/tls')
+	if f then
+		f:close()
+		return true
+	end
+	return false
+end)()
 
-need_table({'autoupdater', 'branches'}, function(branch)
+local branches = table_keys(need_table({'autoupdater', 'branches'}, function(branch)
 	need_alphanumeric_key(branch)
 
 	need_string(in_site(extend(branch, {'name'})))
-	need_string_array_match(extend(branch, {'mirrors'}), '^http://')
-	need_number(in_site(extend(branch, {'good_signatures'})))
-	need_string_array_match(in_site(extend(branch, {'pubkeys'})), '^%x+$')
+	need_array(extend(branch, {'mirrors'}), function(mirror)
+		alternatives(function()
+			need_string_match(mirror, 'http://')
+		end, function()
+			need_string_match(mirror, 'https://')
+			need(mirror, function() return has_tls end, nil,
+				"use HTTPS only if the 'tls' feature is enabled")
+		end, function()
+			need_string_match(mirror, '^//')
+		end)
 	end)
+
+	local pubkeys = need_string_array_match(in_site(extend(branch, {'pubkeys'})), '^%x+$')
+	need_number(in_site(extend(branch, {'good_signatures'})))
+	need(in_site(extend(branch, {'good_signatures'})), function(good_signatures)
+		return good_signatures <= #pubkeys
+	end, nil, string.format('be less than or equal to the number of public keys (%d)', #pubkeys))
+
+	obsolete(extend(branch, {'probability'}), 'Use GLUON_PRIORITY in site.mk instead.')
+end))
+
+need_one_of(in_site({'autoupdater', 'branch'}), branches, false)
+
+-- Check GLUON_AUTOUPDATER_BRANCH
+local default_branch
+local f = io.open((os.getenv('IPKG_INSTROOT') or '') .. '/lib/gluon/autoupdater/default_branch')
+if f then
+	default_branch = f:read('*line')
+	f:close()
+end
+need_one_of(value('GLUON_AUTOUPDATER_BRANCH', default_branch), branches, false)

package/gluon-autoupdater/files/usr/lib/autoupdater/abort.d/90gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 
 start_enabled cron
-start_enabled haveged
+start_enabled urngd
 start_enabled micrond
 start_enabled sysntpd

package/gluon-autoupdater/files/usr/lib/autoupdater/download.d/10gluon-autoupdater

 #!/bin/sh
 
+# shellcheck source=package/gluon-autoupdater/files/lib/gluon/autoupdater/lib.sh
 . /lib/gluon/autoupdater/lib.sh
 
 
 stop cron
-stop haveged
+stop urngd
 stop micrond
 stop sysntpd

package/gluon-autoupdater/luasrc/lib/gluon/upgrade/500-autoupdater

@@ -2,34 +2,69 @@
 
 local site = require 'gluon.site'
 local uci = require('simple-uci').cursor()
+local unistd = require 'posix.unistd'
 
+local has_tls = unistd.access('/lib/gluon/features/tls') ~= nil
+local default_scheme = has_tls and 'https:' or 'http:'
+
+local min_branch
+
+local function mirror_urls(mirrors)
+	local ret = {}
+
+	for _, mirror in ipairs(mirrors) do
+		if string.match(mirror, '^//') ~= nil then
+			table.insert(ret, default_scheme .. mirror)
+		else
+			table.insert(ret, mirror)
+		end
+	end
+
+	return ret
+end
 
 for name, config in pairs(site.autoupdater.branches()) do
 	uci:delete('autoupdater', name)
 	uci:section('autoupdater', 'branch', name, {
 		name = config.name,
-		mirror = config.mirrors,
+		mirror = mirror_urls(config.mirrors),
 		good_signatures = config.good_signatures,
 		pubkey = config.pubkeys,
 	})
-end
 
-if not uci:get('autoupdater', 'settings') then
-	local enabled = false
-	local branch = site.autoupdater.branch()
+	if not min_branch or (name < min_branch) then
+		min_branch = name
+	end
+end
 
+local function default_branch()
 	local f = io.open('/lib/gluon/autoupdater/default_branch')
 	if f then
-		enabled = true
-		branch = f:read('*line')
+		local ret = f:read('*line')
 		f:close()
+		return ret
+	end
+
+	return site.autoupdater.branch(min_branch)
+end
+
+local enabled, branch
+if not uci:get('autoupdater', 'settings') then
+	enabled = unistd.access('/lib/gluon/autoupdater/default_enabled') ~= nil
+end
+
+local old_branch = uci:get('autoupdater', 'settings', 'branch')
+if not old_branch or not uci:get('autoupdater', old_branch) then
+	branch = default_branch()
+	if not branch then
+		enabled = false
+	end
 end
 
 uci:section('autoupdater', 'autoupdater', 'settings', {
 	enabled = enabled,
 	branch = branch,
 })
-end
 
 uci:set('autoupdater', 'settings', 'version_file', '/lib/gluon/release')
 

package/gluon-autoupdater/src/respondd.c

-/*
-  Copyright (c) 2016, Matthias Schiffer <mschiffer@universe-factory.net>
-  All rights reserved.
-
-  Redistribution and use in source and binary forms, with or without
-  modification, are permitted provided that the following conditions are met:
-
-    1. Redistributions of source code must retain the above copyright notice,
-       this list of conditions and the following disclaimer.
-    2. Redistributions in binary form must reproduce the above copyright notice,
-       this list of conditions and the following disclaimer in the documentation
-       and/or other materials provided with the distribution.
-
-  THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
-  AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-  IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-  DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
-  FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-  DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
-  SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
-  CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
-  OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-  OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-*/
+/* SPDX-FileCopyrightText: 2016, Matthias Schiffer <mschiffer@universe-factory.net> */
+/* SPDX-License-Identifier: BSD-2-Clause */
 
 
 #include <respondd.h>

package/gluon-client-bridge/Makefile

 include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gluon-client-bridge
-PKG_VERSION:=1
-
-PKG_BUILD_DIR := $(BUILD_DIR)/$(PKG_NAME)
 
 include ../gluon.mk
 
-
 define Package/gluon-client-bridge
-  SECTION:=gluon
-  CATEGORY:=Gluon
   TITLE:=Provides a bridge and a wireless interface for clients to connect to
   DEPENDS:=+gluon-core +kmod-veth
 endef
 
-define Build/Prepare
-	mkdir -p $(PKG_BUILD_DIR)
-endef
-
-define Build/Configure
-endef
-
-define Build/Compile
-	$(call GluonSrcDiet,./luasrc,$(PKG_BUILD_DIR)/luadest/)
-endef
-
-define Package/gluon-client-bridge/install
-	$(CP) $(PKG_BUILD_DIR)/luadest/* $(1)/
-endef
-
-define Package/gluon-client-bridge/postinst
-#!/bin/sh
-$(call GluonCheckSite,check_site.lua)
-endef
-
-$(eval $(call BuildPackage,gluon-client-bridge))
+$(eval $(call BuildPackageGluon,gluon-client-bridge))

package/gluon-client-bridge/check_site.lua

@@ -8,8 +8,14 @@ need_string_match(in_domain({'next_node', 'ip6'}), '^[%x:]+$', false)
 
 
 for _, config in ipairs({'wifi24', 'wifi5'}) do
-	if need_table({config}, nil, false) then
-		need_string(in_domain({config, 'ap', 'ssid'}))
+	if need_table({config, 'ap'}, nil, false) then
 		need_boolean({config, 'ap', 'disabled'}, false)
+		if need_boolean({config, 'ap', 'owe_transition_mode'}, false) then
+			need_string_match(in_domain({config, 'ap', 'ssid'}), '^' .. ('.?'):rep(32) .. '$')
+			need_string_match(in_domain({config, 'ap', 'owe_ssid'}), '^' .. ('.?'):rep(32) .. '$')
+		else
+			need_string_match(in_domain({config, 'ap', 'ssid'}), '^' .. ('.?'):rep(32) .. '$', false)
+			need_string_match(in_domain({config, 'ap', 'owe_ssid'}), '^' .. ('.?'):rep(32) .. '$', false)
+		end
 	end
 end