buildbot/docker, branch v28

buildmaster: build apk 3.0.5 from the OpenWrt sources mirror

2026-11-01T10:06:34Z

Bump apk-tools from a 2024 pre-release commit to 3.0.5, the version that OpenWrt main and openwrt-25.12 pin. scripts/signall.sh signs releases with this binary (apk adbsign), so it should match what OpenWrt builds. Fetch the release tarball from sources.openwrt.org and check its sha256, instead of cloning gitlab.alpinelinux.org, which is not always reachable. Build it with meson as a static musl binary, because the final image is Debian (glibc). Apply OpenWrt's patch "crypto_openssl: use deterministic ECDSA signatures" (OpenWrt commit e923974fc172). With it, signing the same data twice gives identical bytes, instead of a different signature each time from a random ECDSA nonce. Update the cram test for the new usage line of apk 3.0.5. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

docker: upgrade base images to debian:13

2026-11-01T10:06:28Z

Debian 11 (Bullseye) LTS support ends on August 31, 2026. Upgrading to Debian 13 (Trixie) ensures long-term support until June 30, 2030. While upgrading: - Replace deprecated libncurses5-dev package with libncurses-dev. - Install gnupg explicitly as it is no longer pre-installed. - Add legacy-cgi to pip packages. Debian 13 comes with Python 3.13, which removed the standard cgi module. Buildbot 3.11.8 / Twisted requires cgi at startup, so legacy-cgi is required as a drop-in replacement. Signed-off-by: Josef Schlehofer [ fixed alphabetical order of legacy-cgi ] Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

ci: rename OPENWRT_VERSION to BUILDBOT_CONFIG_SHA

2026-01-11T20:52:45Z

The old name was misleading as it suggested an OpenWrt release version. The variable holds the git SHA of this buildbot config repository, used for quick URL links to the configuration commit. Signed-off-by: Petr Štetiar

ci: add container version tag to BUILDWORKER_DESCRIPTION

2026-01-11T20:52:36Z

Add CONTAINER_TAG build argument to indicate whether the container was built from a tag (v25), PR (pr-73), or branch (main). This makes it easier to identify which version of the container is running. While at it, drop Docker prefix to make it shorter. Signed-off-by: Petr Štetiar

docker: fix Dockerfile deprecation warnings

2026-01-11T14:30:44Z

Replace deprecated MAINTAINER instruction with LABEL and update ENV statements from legacy "ENV key value" format to "ENV key=value" format. Signed-off-by: Petr Štetiar

phase1: add support for overriding feeds host

2025-12-14T05:09:49Z

Currently git.openwrt.org is sometimes overloaded, so lets implement a mechanism to override the source host for feeds. This introduces a `feeds_host_override` configuration option. When set, the buildmaster will temporarily modify `feeds.conf.default` to point to the alternate host (e.g., GitHub) before updating feeds, and restore the original configuration afterwards. This is particularly useful when the primary git server is returning 503 errors: Updating feed 'packages' from 'https://git.openwrt.org/feed/packages.git' ... Cloning into './feeds/packages'... fatal: unable to access 'https://git.openwrt.org/feed/packages.git/': The requested URL returned error: 503 failed. Signed-off-by: Petr Štetiar

docker,worker: install python3-cryptography

2024-11-25T10:12:20Z

Addition of OPTEE support along with STM32 added a requirment on python3-cryptography and without it buildbots for STM32 will fail with: Checking 'python3-cryptography'... failed. Checking 'python3-pyelftools'... ok. optee-os: Please install the Python3 cryptography module make[3]: *** [/builder/shared-workdir/build/include/prereq.mk:9: prereq] Error 1 So install python3-cryptography to satisfy it. Signed-off-by: Robert Marko Link: https://github.com/openwrt/buildbot/pull/61 Signed-off-by: Petr Štetiar

Allow signing of artifacts with key provided by GPG agent

2024-11-05T05:07:59Z

In our case the GPG agent serves 0x1D53D1877742E911 key stored on Nitrokey3 USB dongle. GPG key is bind mounted from the host. References: https://lists.openwrt.org/pipermail/openwrt-devel/2023-May/041044.html Signed-off-by: Petr Štetiar

docker,worker: install pyelftools

2024-11-04T06:35:02Z

Without it, errors may appear: WARNING: Makefile 'package/feeds/telephony/freeswitch/Makefile' has a dependency on 'libpcre', which does not exist make[2]: Entering directory '/builder/shared-workdir/build/scripts/config' make[2]: 'conf' is up to date. make[2]: Leaving directory '/builder/shared-workdir/build/scripts/config' Checking 'python3-pyelftools'... failed. Checking 'python3-dev'... ok. Checking 'python3-setuptools'... ok. Checking 'swig'... ok. u-boot: Please install the Python3 elftools module Fixes: 3ac7d39bd4c3 ("buildworker,buildmaster: bump Debian to version 12") Signed-off-by: Paul Spooren

Revert "buildworker,buildmaster: bump Debian to version 12"

2024-11-04T06:12:05Z

This reverts commit 3ac7d39bd4c364d76e78b3ba50c23a68e0b05c0f as it was decided to stay on Debian 11 for 24.10 release as well. Signed-off-by: Petr Štetiar