staging/stintel/package/Makefile, branch master

package: reuse the rootfs if its inputs did not change

2026-09-22T16:18:58Z

The rootfs is installed from scratch on every build: apk add, then the post-install and init scripts of every package, one after the other. This takes about 1.5 s, even if no package changed. Build a key from the package index, which holds a hash of every package, the install list, .config, SOURCE_DATE_EPOCH, the files overlay, apk, tar, gzip and the Makefiles that create the rootfs. Save a copy of the rootfs with the key, and restore it from the copy if the key did not change. Later build steps modify the rootfs, so it is always restored from the copy and never reused in place. prepare_rootfs runs tar and gzip over the apk script archive, so the key holds those two host tools as well. With mklibs it also runs rstrip.sh, which the key then holds too. The install list now holds the base-files, libc and kernel versions too, so that the key can use it. Only the APK path uses the cache. The copy costs disk: the build directory carries the root filesystem twice, once as root and root.orig and once in the cache. Signed-off-by: John Crispin

build: merge the packages only when the set of packages changed

2026-09-22T16:18:58Z

package/merge deletes the symlink farm of every built package and creates it again on every build. package/merge-index then reads all of those packages to create the index. With two thousand packages both steps take a third of a second, and the cost grows with the size of the configuration. Record the name, the size and the timestamp of every package file. Skip both steps while that list is unchanged and the index is present. A rebuild of the symlinks drops the index, so merge-index creates it again. This takes the time of package/install on an unchanged tree from 1.05 s to 0.60 s for the OpenWrt One. Signed-off-by: John Crispin

build: rebuild the package index only when a package changed

2026-09-22T16:18:58Z

package/index runs apk mkndx and make-index-json.py over every package on each build, which takes 1.2 s of a no-op build of this tree with 1258 packages. The result depends only on the package files. Skip the pass while packages.adb and index.json exist and no package file, and no directory, is newer than index.json. The directory covers a package that was added or removed, because neither changes a file that is left. The comparison uses index.json rather than packages.adb, because apk mkndx writes packages.adb through a rename, which sets the mtime of the directory to that of the file it wrote. The directory would then tie with packages.adb and the skip would rest on the two comparing equal. index.json is written after it, so the directory is older. Signed-off-by: John Crispin

build: clean the package root dir only if the packages can have changed

2026-09-22T16:18:58Z

The stamp of package/cleanup depends on tmp/.build, which is touched on every make call, so every build deletes $(STAGING_DIR_ROOT) and every package copies its files into it again, one after the other under a lock. With all packages selected, this takes 5 s of a build that has nothing to do, most of it in the 1102 kmods of package/kernel/linux. Only clean it if .config, the package metadata or a file below package/ changed since the last cleanup. An edit of the source in a build directory alone does not clean it, so a file that such an edit removes from a package stays until then. make package/cleanup cleans it at any time. Signed-off-by: John Crispin

build: add CycloneDX SBOM processing to apk

2026-05-17T10:21:09Z

Currently, there is no SBOM generation in imagebuilder when the package system 'apk' is used. This commit adds this feature back. This already worked for the package system 'opkg'. Furthermore, generating the SBOM using perl is not reproducible if the input data has not changed. A different file is always generated. This is not the case with Python. For this reason, Python is now used to generate the SBOM for the imagebuilder. The script has already been prepared so that it can also process the opkg package system for generating the SBOM. Signed-off-by: Florian Eckert

build: propagate errors when generating apk indexes

2026-02-13T20:17:21Z

The build would continue even if the some of the intermediate commands failed, as long as the last command in the final iteration of the loop was successful. Add 'set -e' to the subshell so that we immediately exit. Previously, only the exit status of the final make-index-json.py mattered. Fixes: https://github.com/openwrt/openwrt/issues/21981 Signed-off-by: Matt Merhar Link: https://github.com/openwrt/openwrt/pull/21993 Signed-off-by: Robert Marko

build: use STAGING_DIR for special APK package versions

2026-02-01T10:16:54Z

Removing tmp/ after having built base-files or toolchain currently breaks rootfs generation: $ rm -rf tmp $ make V=w ... make[2] package/install cat: .../openwrt/tmp/base-files.version: No such file or directory cat: .../openwrt/openwrt/tmp/libc.version: No such file or directory ERROR: 'base-files=' is not a valid world dependency, format is name(@tag)([<>~=]version) make[2]: *** [package/Makefile:100: package/install] Error 99 The only way to recover from here is to clean toolchain and base-files via $ make package/{base-files,toolchain}/clean tmp is supposed to be ephemeral, so clearing it is an expected action, which normally just triggers a regeneration of all files there. Fix this by moving the version files to $(STAGING_DIR). Fixes: 63e178f067 ("build: lock versions for special APK packages") Signed-off-by: Jonas Gorski Link: https://github.com/openwrt/openwrt/pull/21803 Signed-off-by: Robert Marko

build: avoid errors during release candidate kernel packaging

2025-12-20T10:06:47Z

The build system allows to use Linux release candidate kernels (-rcX). For this a target/linux/generic/kernel-6.XY as follows is needed: LINUX_VERSION-6.XY = -rc1 LINUX_KERNEL_HASH-6.XY-rc1 = 18ba6ebd72f46b881e0d73e390b2888b7b43... Sadly the builds fail with a packaging error. fakeroot /home/openwrt/openwrt/openwrt/staging_dir/host/bin/apk mkpkg --info "name:kernel" --info "version:6.15-rc1~c4bf...1f6-r1" ERROR: info field 'version' has invalid value: package version is invalid The apk metadata specification reads: "... Currently the APK version specification is as follows: number{.number}...{letter}{_suffix{number}}...{~hash}{-r#} ... Optionally one or more _suffix{number} components can follow. The list of valid suffixes (and their sorting order) is: alpha, beta, pre, rc, , cvs, svn, git, hg, p." Given that the kernel uses "-rcX" naming scheme and apk requires "_rcX" instead, simply translate the dash to an underscore for these builds. Signed-off-by: Markus Stockhausen Link: https://github.com/openwrt/openwrt/pull/21214 Signed-off-by: Robert Marko

package: do not sign individual APK packages

2025-10-09T10:52:43Z

APK, unlike OPKG, can sign individual packages and not just indexes. Since OpenWrt uses a distributed build infrastructure and only the build master owns the private keys, signing of individual buildworkers doesn't work. Right now, each buildworker creates a temporary build key to sign packages, then transmits the package index to the buildmaster for a signature. As a result, all individual packages contain a nonsensical signature, making them harder to reproduce. This commit removes the individual package signing. Since APK requires signatures per default, explicitly allow installation of unsigned packages during the build process. The config option here is for historical reasons misleading, SIGNED_PACKAGES refers to the package index, not the individual packages. Signed-off-by: Paul Spooren

package: generate sha256sums by default

2025-10-03T09:00:23Z

Right now the sha256sums are only created for the targets/ folder (i.e. firmware images) and only the buildbot generates those sha256sums. Instead, let the build system create the sha256sums directly. Signed-off-by: Paul Spooren