buildbot/docker/buildmaster, branch v28

buildmaster: build apk 3.0.5 from the OpenWrt sources mirror

2026-11-01T10:06:34Z

Bump apk-tools from a 2024 pre-release commit to 3.0.5, the version that OpenWrt main and openwrt-25.12 pin. scripts/signall.sh signs releases with this binary (apk adbsign), so it should match what OpenWrt builds. Fetch the release tarball from sources.openwrt.org and check its sha256, instead of cloning gitlab.alpinelinux.org, which is not always reachable. Build it with meson as a static musl binary, because the final image is Debian (glibc). Apply OpenWrt's patch "crypto_openssl: use deterministic ECDSA signatures" (OpenWrt commit e923974fc172). With it, signing the same data twice gives identical bytes, instead of a different signature each time from a random ECDSA nonce. Update the cram test for the new usage line of apk 3.0.5. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

docker: upgrade base images to debian:13

2026-11-01T10:06:28Z

Debian 11 (Bullseye) LTS support ends on August 31, 2026. Upgrading to Debian 13 (Trixie) ensures long-term support until June 30, 2030. While upgrading: - Replace deprecated libncurses5-dev package with libncurses-dev. - Install gnupg explicitly as it is no longer pre-installed. - Add legacy-cgi to pip packages. Debian 13 comes with Python 3.13, which removed the standard cgi module. Buildbot 3.11.8 / Twisted requires cgi at startup, so legacy-cgi is required as a drop-in replacement. Signed-off-by: Josef Schlehofer [ fixed alphabetical order of legacy-cgi ] Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

ci: rename OPENWRT_VERSION to BUILDBOT_CONFIG_SHA

2026-01-11T20:52:45Z

The old name was misleading as it suggested an OpenWrt release version. The variable holds the git SHA of this buildbot config repository, used for quick URL links to the configuration commit. Signed-off-by: Petr Štetiar

docker: fix Dockerfile deprecation warnings

2026-01-11T14:30:44Z

Replace deprecated MAINTAINER instruction with LABEL and update ENV statements from legacy "ENV key value" format to "ENV key=value" format. Signed-off-by: Petr Štetiar

Allow signing of artifacts with key provided by GPG agent

2024-11-05T05:07:59Z

In our case the GPG agent serves 0x1D53D1877742E911 key stored on Nitrokey3 USB dongle. GPG key is bind mounted from the host. References: https://lists.openwrt.org/pipermail/openwrt-devel/2023-May/041044.html Signed-off-by: Petr Štetiar

Revert "buildworker,buildmaster: bump Debian to version 12"

2024-11-04T06:12:05Z

This reverts commit 3ac7d39bd4c364d76e78b3ba50c23a68e0b05c0f as it was decided to stay on Debian 11 for 24.10 release as well. Signed-off-by: Petr Štetiar

buildworker,buildmaster: Use venv for Pip

2024-09-26T11:19:16Z

Debian 12 complains if using Pip without a virtualenv since it could break the system. Signed-off-by: Paul Spooren

buildworker,buildmaster: bump Debian to version 12

2024-09-26T08:05:21Z

Debian 11 LTS support ends in June 2026, so it's probably around the time when support for the OpenWrt 24.10 release might end. Therefore, let's switch to Debian 12, which should have LTS support until June 2028 and is the latest and greatest. Signed-off-by: Petr Štetiar

buildmaster: add static apk utility

2024-09-25T19:45:02Z

We need a relatively recent `apk` that can sign package indexes. You can find more details in the referenced issue below. However, it has not been released yet and is not available as a prebuilt download. Therefore, until it becomes available, let's build a static version and use that in the meantime. Fixes: a94d4e15fdc1 ("add APK signing logic") References: https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/11008 Signed-off-by: Petr Štetiar

Revert "buildmaster: fix Twisted dependency hell by using twisted==22.10.0"

2024-04-13T04:57:20Z

This reverts commit bc17dd9af0d3a56e3e9cd724c41deacc5ae0de14 as it should be fine in buildbot v3.10.0 release. Signed-off-by: Petr Štetiar