staging/nbd/include, branch master

build: make GL.iNet metadata reproducible

2026-07-23T12:39:19Z

The GL.iNet specific metadata contains a `date`-field which takes the current timestamp instead of using SOURCE_DATE_EPOCH. This commits make use of the variable, if available. Signed-off-by: Paul Spooren

build: gate firmware image signing behind SIGN_FIRMWARE

2026-07-20T08:33:41Z

Firmware image signing in append-metadata/append-gl-metadata was conditional only by the presence of the build key. Add an explicit SIGN_FIRMWARE option (default enabled except with BUILDBOT) so appending the fwtool signature can be toggled on its own. It's disable on buildbot since we use a decentralized building with no individual keys on builders. Instead, a fake key is currently used, which adds an insecure signature. The future of signing firmware and key distribution across the build infrastructure should be discussed separately. Link: https://github.com/openwrt/openwrt/pull/24291 Signed-off-by: Paul Spooren

kernel: use iremap for assembly

2026-07-17T19:43:03Z

Currently assembly code of the Kernel may contain the build path, resulting in unreproducible firmware images (and Kernels). Fix this by adding a iremap KAFLAG. Before: strings "/path/to/vmlinux" | grep linux-6.18.38 /path/to/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.18.38 /path/to/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.18.38 After strings "/path/to/vmlinux" | grep linux-6.18.38 target-x86_64_musl/linux-x86_64/linux-6.18.38 target-x86_64_musl/linux-x86_64/linux-6.18.38 Link: https://github.com/openwrt/openwrt/pull/24271 Signed-off-by: Paul Spooren

kernel: set MACOSX_DEPLOYMENT_TARGET to host version

2026-07-16T20:58:21Z

Fix a warning interpreted as error when building the Linux kernel on macOS host, by setting MACOSX_DEPLOYMENT_TARGET to the version of the host. Fixes: make[5]: Entering directory '/Volumes/test/openwrt/build_dir/target-x86_64_musl/linux-x86_64/linux-6.18.38' HOSTCC scripts/mod/modpost.o scripts/mod/modpost.c:1719:9: error: 'strchrnul' is only available on macOS 15.4 or newer [-Werror,-Wunguarded-availability-new] 1719 | sep = strchrnul(namespace, ','); | ^~~~~~~~~ Signed-off-by: Georgi Valkov Link: https://github.com/openwrt/openwrt/pull/24251 Signed-off-by: Robert Marko

build: support git-src override for host builds

2026-07-07T08:46:12Z

Extend the git-src source tree override to host builds. It is opt-in via HOST_USE_GIT_SRC, since by default the host build keeps using the tarball. Move the git-src detection and checkout recipe into unpack.mk so both the target and host build reuse the same code. Signed-off-by: Felix Fietkau

build: don't store timestamps in APK packages

2026-06-30T16:53:03Z

This commit statically sets SOURCE_DATE_EPOCH to 0, which causes `apk mkpkg` to drop the date from generated packages. This improves reproducibility while leaving package specific SOURCE_DATE_EPOCH untouched. The latter can be interesting for i.e. packages like busybox, which prominently show that date on the login shell. Without this commit, packages that live inside feed repositories (openwrt.git, packages.git etc) like `mtd` or `attendedsysupgrade-common` would have random timestamps since no "full" git log was available. Below an example with different source dates (0, 1): │ 0755 root:wheel - - / │ 0755 root:wheel - - lib/ │ 0755 root:wheel - - lib/apk/ │ 0755 root:wheel - - lib/apk/packages/ │ -0644 root:wheel 1970-01-01T00:00:01Z 10 lib/apk/packages/mtd.list │ +0644 root:wheel - 10 lib/apk/packages/mtd.list │ 0755 root:wheel - - sbin/ │ -0755 root:wheel 1970-01-01T00:00:01Z 24595 sbin/mtd │ +0755 root:wheel - 24595 sbin/mtd Link: https://github.com/openwrt/openwrt/pull/24005 Signed-off-by: Paul Spooren

kernel: split nf-nathelper-extra into individual packages

2026-06-24T11:26:32Z

Split kmod-nf-nathelper-extra into separate helper packages and keep the original package as a compatibility meta-package. This allows selecting only the required protocol helpers instead of installing all helper modules and dependencies. Signed-off-by: Mieczyslaw Nalewaj Link: https://github.com/openwrt/openwrt/pull/23690 Signed-off-by: Robert Marko

prereq-build/u-boot: add Python 3.14 support

2026-06-16T10:51:01Z

Python 3.14 is the default version on Fedora 43/44. Signed-off-by: Etienne Champetier Link: https://github.com/openwrt/openwrt/pull/23243 Signed-off-by: Test Dev

prereq-build: add clang support

2026-06-16T08:56:46Z

The Apple g++ check is really clang in disguise. Furthermore, testing on Linux hosts reveals that clang can sufficiently replace gcc. Minimum version of clang is 12 because of ccache. Signed-off-by: Rosen Penev Link: https://github.com/openwrt/openwrt/pull/17259 Signed-off-by: Jonas Jelonek

build: fixup version.date creation for source archives

2026-06-12T15:41:09Z

Published sources archives may contain a mixture of MTIMEs, so taking the time of the first file found varies based on filesystem order. To fix this, sort all MTIMEs and take the latest. Since piping into a file directly creates that file, we also need to specifically tell `find` to ignore `version.date`. Furthermore, move this prior to the ./src copy step, since for some packages, the OpenWrt build system ships extra ./src files, which would introduce the wrong timestamps again. Fix: e36c2946b7b build: derive PKG_SOURCE_DATE_EPOCH from the unpacked source tree Link: https://github.com/openwrt/openwrt/pull/23756 Signed-off-by: Paul Spooren