buildbot, branch v28

tests: add apk release signing regression test

2026-11-01T10:06:34Z

Add a cram test that runs scripts/signall.sh in a container from the master image on a tarball with a small apk index, using a throwaway P-256 key and a config.ini shaped like the production one. The test starts its own container, because it needs only the tools in the image, not a running buildmaster. The test checks that the signed index verifies with the buildmaster apk, that signing the same tarball twice gives identical packages.adb files, which only works with the deterministic ECDSA patch, and that sha256sums matches the signed index. It then verifies the signed index with the apk of the OpenWrt rootfs images x86-64-main, x86-64-openwrt-25.12 and x86-64-25.12.6. A copy of the index with one changed payload byte must fail with "UNTRUSTED signature". With the patch removed from the buildmaster image, the test fails at the determinism check. The config.ini has a dummy last option, because signall.sh reads back an empty key when the key is the last entry and then skips signing without an error. That bug will be fixed separately. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

buildmaster: build apk 3.0.5 from the OpenWrt sources mirror

2026-11-01T10:06:34Z

Bump apk-tools from a 2024 pre-release commit to 3.0.5, the version that OpenWrt main and openwrt-25.12 pin. scripts/signall.sh signs releases with this binary (apk adbsign), so it should match what OpenWrt builds. Fetch the release tarball from sources.openwrt.org and check its sha256, instead of cloning gitlab.alpinelinux.org, which is not always reachable. Build it with meson as a static musl binary, because the final image is Debian (glibc). Apply OpenWrt's patch "crypto_openssl: use deterministic ECDSA signatures" (OpenWrt commit e923974fc172). With it, signing the same data twice gives identical bytes, instead of a different signature each time from a random ECDSA nonce. Update the cram test for the new usage line of apk 3.0.5. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

ci: run black in --check mode

2026-11-01T10:06:33Z

The lint job ran `black phase1/master.cfg`, which rewrites the file inside the CI checkout and always succeeds. Run it with `--check --diff`, so unformatted code fails the job and the log shows the needed changes. Also run it on phase*/master.cfg, the same files that ruff and flake8 check, so phase2 is covered too. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

phase2: reformat master.cfg with black 26.10.1

2026-11-01T10:06:33Z

Formatting only, no functional change. This prepares for running `black --check` on phase2 too. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

phase1: reformat master.cfg with black 26.10.1

2026-11-01T10:06:32Z

Formatting only, no functional change. This prepares for running `black --check` in CI. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

ci: bump lint tools and use `ruff check`

2026-11-01T10:06:32Z

Update requirements-dev.txt to the latest releases: black 23.12.1 -> 26.10.1 ruff 0.1.9 -> 0.17.3 flake8 6.1.0 -> 7.4.1 cram 0.7 (unchanged, already the latest) Ruff 0.17 requires the `check` subcommand and expects the settings in .ruff.toml under a `lint` table, so update both. Ruff 0.17 also enables more rules by default and reports 58 style findings in the master.cfg files, mostly percent-format to str.format conversions. The configs have no tests, so rewriting them is not worth the risk. Select the previous default rules (E4, E7, E9, F) explicitly instead. flake8 needs no changes. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

ci: run test-lint on Python 3.13

2026-11-01T10:06:31Z

The containers are now based on Debian 13, which ships Python 3.13. Run the lint job with the same version instead of 3.11. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

docker: upgrade base images to debian:13

2026-11-01T10:06:28Z

Debian 11 (Bullseye) LTS support ends on August 31, 2026. Upgrading to Debian 13 (Trixie) ensures long-term support until June 30, 2030. While upgrading: - Replace deprecated libncurses5-dev package with libncurses-dev. - Install gnupg explicitly as it is no longer pre-installed. - Add legacy-cgi to pip packages. Debian 13 comes with Python 3.13, which removed the standard cgi module. Buildbot 3.11.8 / Twisted requires cgi at startup, so legacy-cgi is required as a drop-in replacement. Signed-off-by: Josef Schlehofer [ fixed alphabetical order of legacy-cgi ] Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

phase2: fix not signing each package

2026-06-15T08:06:35Z

This commit fixes the previous commit. While manual testing falsely gave the impression of it working, this should now really do the trick (via more manual testing). Fixes: e29de99 phase2: don't sign each package Signed-off-by: Paul Spooren

CI(deps): Bump docker/metadata-action from 5 to 6

2026-06-09T13:53:43Z

Bumps [docker/metadata-action](https://github.com/docker/metadata-action) from 5 to 6. - [Release notes](https://github.com/docker/metadata-action/releases) - [Commits](https://github.com/docker/metadata-action/compare/v5...v6) --- updated-dependencies: - dependency-name: docker/metadata-action dependency-version: '6' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot]