buildbot/tests/cram, branch master

tests: add apk release signing regression test

2026-11-01T10:06:34Z

Add a cram test that runs scripts/signall.sh in a container from the master image on a tarball with a small apk index, using a throwaway P-256 key and a config.ini shaped like the production one. The test starts its own container, because it needs only the tools in the image, not a running buildmaster. The test checks that the signed index verifies with the buildmaster apk, that signing the same tarball twice gives identical packages.adb files, which only works with the deterministic ECDSA patch, and that sha256sums matches the signed index. It then verifies the signed index with the apk of the OpenWrt rootfs images x86-64-main, x86-64-openwrt-25.12 and x86-64-25.12.6. A copy of the index with one changed payload byte must fail with "UNTRUSTED signature". With the patch removed from the buildmaster image, the test fails at the determinism check. The config.ini has a dummy last option, because signall.sh reads back an empty key when the key is the last entry and then skips signing without an error. That bug will be fixed separately. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

buildmaster: build apk 3.0.5 from the OpenWrt sources mirror

2026-11-01T10:06:34Z

Bump apk-tools from a 2024 pre-release commit to 3.0.5, the version that OpenWrt main and openwrt-25.12 pin. scripts/signall.sh signs releases with this binary (apk adbsign), so it should match what OpenWrt builds. Fetch the release tarball from sources.openwrt.org and check its sha256, instead of cloning gitlab.alpinelinux.org, which is not always reachable. Build it with meson as a static musl binary, because the final image is Debian (glibc). Apply OpenWrt's patch "crypto_openssl: use deterministic ECDSA signatures" (OpenWrt commit e923974fc172). With it, signing the same data twice gives identical bytes, instead of a different signature each time from a random ECDSA nonce. Update the cram test for the new usage line of apk 3.0.5. Signed-off-by: Petr Štetiar Link: https://github.com/openwrt/buildbot/pull/84 Signed-off-by: Christian Marangi

buildmaster: add static apk utility

2024-09-25T19:45:02Z

We need a relatively recent `apk` that can sign package indexes. You can find more details in the referenced issue below. However, it has not been released yet and is not available as a prebuilt download. Therefore, until it becomes available, let's build a static version and use that in the meantime. Fixes: a94d4e15fdc1 ("add APK signing logic") References: https://gitlab.alpinelinux.org/alpine/apk-tools/-/issues/11008 Signed-off-by: Petr Štetiar

ci: improve QA with cram based tests

2023-12-22T10:58:33Z

Currently we've broken master container but we're not aware about it as current tests are very lame, so lets improve it a bit with some more reliable, extensible solution. Signed-off-by: Petr Štetiar