From d4083bca222c8d6fc4eb450b11c9a6ca1699cbbc Mon Sep 17 00:00:00 2001 From: Tommaso Bailetti Date: Thu, 6 Aug 2026 09:55:31 +0200 Subject: [PATCH 1/5] fix(ns-plug): trimming initial v from the openwrt version --- packages/ns-plug/files/distfeed-setup | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/ns-plug/files/distfeed-setup b/packages/ns-plug/files/distfeed-setup index 7e570365b..bb018a1b6 100644 --- a/packages/ns-plug/files/distfeed-setup +++ b/packages/ns-plug/files/distfeed-setup @@ -8,12 +8,14 @@ # setup default variables . /etc/openwrt_release . /etc/os-release +openwrt_version="$(cat /etc/openwrt_version)" +openwrt_version="${openwrt_version#v}" cat << EOF > /etc/apk/repositories.d/99-defaults.list # This file is handled by nethsecurity and should not be edited manually. Changes will be overwritten. # Create a 98-overrides.list file to override these values if needed. set -default target_arch=$DISTRIB_TARGET set -default package_arch=$DISTRIB_ARCH -set -default openwrt_version=$(cat /etc/openwrt_version) +set -default openwrt_version=$openwrt_version set -default repo_channel=$(cat /etc/repo-channel) set -default version=$VERSION_ID EOF From a5280acba1d6ee6c53ec806286ac63d363bde6d3 Mon Sep 17 00:00:00 2001 From: Tommaso Bailetti Date: Thu, 6 Aug 2026 10:51:23 +0200 Subject: [PATCH 2/5] fix: not using custom feeds when automatic updating During nightly updates or click on the UI if the custom feeds is in, APK will use the repos and possible update by error packages from upstream. This will remove the custom feeds during updates by machine but not through the bare command `apk`. --- docs/design/distfeed.md | 6 ++++++ packages/ns-api/files/ns.update | 4 ++-- packages/ns-plug/Makefile | 1 + packages/ns-plug/files/apk-official | 26 ++++++++++++++++++++++++++ packages/ns-plug/files/update-packages | 6 +++--- 5 files changed, 38 insertions(+), 5 deletions(-) create mode 100755 packages/ns-plug/files/apk-official diff --git a/docs/design/distfeed.md b/docs/design/distfeed.md index 4a9a9a35f..559435129 100644 --- a/docs/design/distfeed.md +++ b/docs/design/distfeed.md @@ -118,3 +118,9 @@ https://downloads.openwrt.org/releases/${openwrt_version}/packages/${package_arc https://downloads.openwrt.org/releases/${openwrt_version}/packages/${package_arch}/routing/packages.adb EOF ``` + +Packages from `customfeeds.list` are not rebuilt or QA'd by NethSecurity, so the nightly +package-update cron and the UI's package update check/install flow never consider them: both +run `apk` through `/usr/sbin/apk-official`, which temporarily moves `customfeeds.list` aside for +the duration of a single `apk` call and restores it afterwards. Direct/manual `apk` invocations +are unaffected and still see `customfeeds.list` normally. diff --git a/packages/ns-api/files/ns.update b/packages/ns-api/files/ns.update index 0732af949..f7326e4b7 100755 --- a/packages/ns-api/files/ns.update +++ b/packages/ns-api/files/ns.update @@ -53,11 +53,11 @@ def check_package_updates(): try: # download metadata only if they are older than 5 minutes if (time.time() - last_package_check()) > 300: - subprocess.run(["/usr/bin/apk", "update"], check=True, capture_output=True) + subprocess.run(["/usr/sbin/apk-official", "update"], check=True, capture_output=True) except Exception as e: print(e, file=sys.stderr) return utils.generic_error("apk_update_failed") - p = subprocess.run(["/usr/bin/apk", "list", "--upgradable"], check=True, capture_output=True, text=True) + p = subprocess.run(["/usr/sbin/apk-official", "list", "--upgradable"], check=True, capture_output=True, text=True) for line in p.stdout.split("\n"): if not line: continue diff --git a/packages/ns-plug/Makefile b/packages/ns-plug/Makefile index 5442e0146..6bd1f0a0e 100644 --- a/packages/ns-plug/Makefile +++ b/packages/ns-plug/Makefile @@ -81,6 +81,7 @@ define Package/ns-plug/install $(INSTALL_BIN) ./files/ns-plug $(1)/usr/sbin/ns-plug $(INSTALL_BIN) ./files/ns-plug-alert-proxy $(1)/usr/sbin/ns-plug-alert-proxy $(INSTALL_BIN) ./files/distfeed-setup $(1)/usr/sbin/distfeed-setup + $(INSTALL_BIN) ./files/apk-official $(1)/usr/sbin/apk-official $(INSTALL_BIN) ./files/remote-backup $(1)/usr/sbin $(INSTALL_BIN) ./files/send-backup $(1)/usr/sbin $(INSTALL_BIN) ./files/send-heartbeat $(1)/usr/sbin diff --git a/packages/ns-plug/files/apk-official b/packages/ns-plug/files/apk-official new file mode 100755 index 000000000..65c4d03ad --- /dev/null +++ b/packages/ns-plug/files/apk-official @@ -0,0 +1,26 @@ +#!/bin/bash + +# +# Copyright (C) 2026 Nethesis S.r.l. +# SPDX-License-Identifier: GPL-2.0-only +# + +# Runs a single apk subcommand with the user-added customfeeds.list +# (docs/design/distfeed.md "Upstream OpenWrt repositories") temporarily +# excluded, so automatic update paths never install a package that bypassed +# the NethSecurity distfeed/QA channel. Serialized via flock so overlapping +# invocations (cron, UI, manual admin apk use) don't race on the file. + +LOCK=/var/run/apk-official.lock +CUSTOMFEEDS=/etc/apk/repositories.d/customfeeds.list +DISABLED="${CUSTOMFEEDS}.disabled" + +exec 9>"$LOCK" +flock 9 + +[ -f "$CUSTOMFEEDS" ] && mv "$CUSTOMFEEDS" "$DISABLED" +apk "$@" +status=$? +[ -f "$DISABLED" ] && mv "$DISABLED" "$CUSTOMFEEDS" + +exit $status diff --git a/packages/ns-plug/files/update-packages b/packages/ns-plug/files/update-packages index 92ce77f3d..54f3bc222 100644 --- a/packages/ns-plug/files/update-packages +++ b/packages/ns-plug/files/update-packages @@ -15,15 +15,15 @@ error_exit() { } # Update metadata, make sure to output even if in case of error -output=$(apk update 2>&1) +output=$(apk-official update 2>&1) status=$? echo "$output" | logger -s -t update-packages [ $status -ne 0 ] && error_exit "Failed to update metadata" error_count=0 # Upgrade each package individually and capture output -apk list --upgradable 2>/dev/null | grep -o '{[^}]*}' | tr -d '{}' | sed 's|.*/||' | while read -r package; do - output=$(apk upgrade "$package" 2>&1) +apk-official list --upgradable 2>/dev/null | grep -o '{[^}]*}' | tr -d '{}' | sed 's|.*/||' | while read -r package; do + output=$(apk-official upgrade "$package" 2>&1) status=$? [ $status -ne 0 ] && error_count=$((error_count + 1)) echo "$output" | logger -s -t update-packages From ad0c472a7d221aba4c80424117aaabcf99e3b656 Mon Sep 17 00:00:00 2001 From: Tommaso Bailetti Date: Thu, 6 Aug 2026 11:49:45 +0200 Subject: [PATCH 3/5] build: compiling nano and htop --- config/htop.conf | 2 ++ config/utils.conf | 2 ++ 2 files changed, 4 insertions(+) create mode 100644 config/htop.conf create mode 100644 config/utils.conf diff --git a/config/htop.conf b/config/htop.conf new file mode 100644 index 000000000..5878b2936 --- /dev/null +++ b/config/htop.conf @@ -0,0 +1,2 @@ +CONFIG_PACKAGE_htop=m +CONFIG_HTOP_LMSENSORS=y diff --git a/config/utils.conf b/config/utils.conf new file mode 100644 index 000000000..c6d105e18 --- /dev/null +++ b/config/utils.conf @@ -0,0 +1,2 @@ +CONFIG_PACKAGE_nano-full=m + \ No newline at end of file From d135a129d78093751867661fae12a1390e24cab9 Mon Sep 17 00:00:00 2001 From: Tommaso Bailetti Date: Mon, 10 Aug 2026 09:17:36 +0200 Subject: [PATCH 4/5] fix: removed space typo --- config/utils.conf | 1 - 1 file changed, 1 deletion(-) diff --git a/config/utils.conf b/config/utils.conf index c6d105e18..ef2673c38 100644 --- a/config/utils.conf +++ b/config/utils.conf @@ -1,2 +1 @@ CONFIG_PACKAGE_nano-full=m - \ No newline at end of file From 1ea58218c43ab289cf3e95017af55c3535448fbc Mon Sep 17 00:00:00 2001 From: Tommaso Bailetti Date: Wed, 26 Aug 2026 17:09:35 +0200 Subject: [PATCH 5/5] fix: removed lock --- packages/ns-plug/files/apk-official | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/packages/ns-plug/files/apk-official b/packages/ns-plug/files/apk-official index 65c4d03ad..a075403e0 100755 --- a/packages/ns-plug/files/apk-official +++ b/packages/ns-plug/files/apk-official @@ -8,16 +8,11 @@ # Runs a single apk subcommand with the user-added customfeeds.list # (docs/design/distfeed.md "Upstream OpenWrt repositories") temporarily # excluded, so automatic update paths never install a package that bypassed -# the NethSecurity distfeed/QA channel. Serialized via flock so overlapping -# invocations (cron, UI, manual admin apk use) don't race on the file. +# the NethSecurity distfeed/QA channel. -LOCK=/var/run/apk-official.lock CUSTOMFEEDS=/etc/apk/repositories.d/customfeeds.list DISABLED="${CUSTOMFEEDS}.disabled" -exec 9>"$LOCK" -flock 9 - [ -f "$CUSTOMFEEDS" ] && mv "$CUSTOMFEEDS" "$DISABLED" apk "$@" status=$?