Build working OpenWrt packages from the SDK feed Makefile

OpenWrt scans every package Makefile with DUMP=1 before it builds
anything, and that scan does not read the target config, so ARCH is
empty there. The unsupported-architecture error therefore fired on every
scan, the package's metadata came out empty, and make package/fips/compile
in the SDK built nothing at all. The error now applies only outside the
scan.

The SDK feed Makefile also declared no postinst, prerm or conffiles, so a
package built from it ran only OpenWrt's generated scripts. Their
default_postinst enables every init script a package ships on a fresh
install and starts every one on each install and upgrade, so such a
package enabled and started fips-gateway on a fresh install, started a
gateway the operator had disabled on every upgrade, and under opkg
replaced an edited fips.yaml. The Makefile now reads its postinst and
prerm bodies from scripts/, the same files build-ipk.sh and build-apk.sh
install, and lists fips.yaml as a conffile. Because the generated postinst
runs the package's body before the enable-and-start loop under opkg and
after it under apk, a new preinst, used only by the Makefile, leaves a
one-time hold in /var/run unless the gateway is enabled, and the gateway's
start_service, finding the hold, removes it, disables the service and
starts nothing. Under apk, where an upgrade runs no script of the old
package, the preinst also stops the services and leaves the upgrade
marker, as the old prerm does under opkg. The marker stays in /tmp,
because the prerm of an installed 0.5.2 package writes it there. The
prerm recognises an upgrade from PKG_UPGRADE as well as from its first
argument, since OpenWrt's default_prerm passes the script path first, and
the postinst clears the hold before re-enabling the gateway after an
upgrade from a package whose prerm disabled it.

An image build runs package scripts on the build host with IPKG_INSTROOT
naming the image root, so the preinst, postinst and prerm now do nothing
when it is set, rather than enabling and starting services on the host
and writing into its /tmp. The README tells image builders to pass
DISABLED_SERVICES=fips-gateway to keep the gateway off, and drops the
caveat that SDK builds lack the scripts.

Built in the openwrt/sdk 24.10.8 (ipk) and 25.12.5 (apk) images and
installed, upgraded and removed with the real opkg and apk in the
matching rootfs images: a fresh install leaves the gateway disabled and
stopped, an upgrade keeps it disabled or enabled as it was, and an
edited fips.yaml survives. A new scenario runs the same flows under ash
in local and GitHub CI and checks the scripts touch nothing on a build
host, and package-test.sh checks the Makefile names the scripts and the
conffile.

packaging/openwrt-ipk/Makefile

@@ -38,7 +38,10 @@ else ifeq ($(ARCH),arm)
   # OpenWrt ARM targets predominantly use hardfloat ABI.
   # Override RUST_TARGET in your build if your target uses softfloat.
   RUST_TARGET:=arm-unknown-linux-musleabihf
-else
+else ifeq ($(DUMP),)
+  # Not while OpenWrt scans package metadata (DUMP=1): the scan does not read
+  # the target config, so ARCH is empty then, and stopping here would leave the
+  # package out of the build entirely.
   $(error Unsupported architecture: $(ARCH). Add a RUST_TARGET mapping in packaging/openwrt-ipk/Makefile.)
 endif
 
@@ -107,7 +110,8 @@ define Package/fips/install
 	$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips $(1)/etc/init.d/fips
 	$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips-gateway $(1)/etc/init.d/fips-gateway
 
-	# Default config — installed as CONF so opkg will not overwrite it on upgrade
+	# Default config, mode 0600. Package/fips/conffiles below is what keeps an
+	# edited copy across an upgrade.
 	$(INSTALL_DIR) $(1)/etc/fips
 	$(INSTALL_CONF) $(CURDIR)/files/etc/fips/fips.yaml $(1)/etc/fips/fips.yaml
 
@@ -132,4 +136,26 @@ define Package/fips/install
 	$(INSTALL_DATA) $(CURDIR)/files/lib/upgrade/keep.d/fips $(1)/lib/upgrade/keep.d/fips
 endef
 
+# A user's edits to the config survive an upgrade.
+define Package/fips/conffiles
+/etc/fips/fips.yaml
+endef
+
+# Maintainer scripts, read from scripts/ so this package runs the same
+# postinst and prerm bodies that build-ipk.sh and build-apk.sh install. OpenWrt
+# wraps those two in its generated scripts, around default_postinst and
+# default_prerm. The preinst is used only here: it keeps fips-gateway disabled
+# and stopped through default_postinst's enable-and-start loop.
+define Package/fips/preinst
+$(file < $(CURDIR)/scripts/preinst)
+endef
+
+define Package/fips/postinst
+$(file < $(CURDIR)/scripts/postinst)
+endef
+
+define Package/fips/prerm
+$(file < $(CURDIR)/scripts/prerm)
+endef
+
 $(eval $(call BuildPackage,fips))

packaging/openwrt-ipk/README.md

@@ -95,11 +95,12 @@ make package/fips/compile V=s
 
 The resulting `.ipk` is placed in `bin/packages/<arch>/`.
 
-A package built from this `Makefile` carries none of the maintainer scripts in
+Installed on a router, the package enables and starts `fips` and leaves
-`scripts/`. Those scripts enable and start `fips` on install and implement the
+`fips-gateway` disabled. Built into a firmware image, it is different: the
-gateway-enablement and upgrade behavior described below, so that description
+maintainer scripts do nothing at image build time, and the image build enables
-does not cover a package built this way. Released packages are built by
+every init script a package ships, `fips-gateway` included. To build an image
-`build-ipk.sh` (and `../openwrt-apk/build-apk.sh`), which install those scripts.
+with the gateway off, pass `DISABLED_SERVICES="fips-gateway"` to the image
+builder's `make image`.
 
 ### 4. Pin the source version
 

packaging/openwrt-ipk/files/etc/init.d/fips-gateway

@@ -34,6 +34,8 @@ GW_PIDFILE=/var/run/fips-gateway.pid
 # Seconds a stopping gateway gets after SIGTERM before it is killed; under
 # procd's own 5 s, after which procd kills only the supervise shell.
 GW_KILL_AFTER=3
+# Left by the package's preinst when the gateway is not enabled; see below.
+INSTALL_HOLD=/var/run/fips-gateway-install-hold
 
 # Global-scope IPv6 prefix assigned to br-lan so Android/Chrome clients
 # believe they have full IPv6 and actually send AAAA queries.
@@ -41,6 +43,18 @@ GW_KILL_AFTER=3
 GLOBAL_PREFIX="2001:2:f1b5::1/64"
 
 start_service() {
+	# OpenWrt's generic postinst enables and starts every init script a
+	# package ships. A package built from the SDK feed Makefile runs it, and
+	# its preinst leaves this hold unless the gateway was enabled, so that
+	# installing or upgrading the package does not switch the gateway on.
+	# Honoured once.
+	if [ -e "$INSTALL_HOLD" ]; then
+		rm -f "$INSTALL_HOLD"
+		disable
+		logger -t fips-gateway "left disabled and stopped by the package installation"
+		return 0
+	fi
+
 	# The gateway daemon exits when gateway.enabled is not true, so without
 	# this check starting a disabled gateway would still take dnsmasq's .fips
 	# upstream away from the daemon and point it at a port nothing listens on.

packaging/openwrt-ipk/scripts/postinst

@@ -23,8 +23,24 @@
 # Under apk, a fresh install runs this as post-install and the gateway stays
 # off. An upgrade runs it as post-upgrade, after the .apk pre-upgrade script
 # (the prerm body) has stopped the services and left the marker.
+#
+# A package built from the SDK feed Makefile runs this body from OpenWrt's
+# generated postinst, beside a generic loop that enables and starts every init
+# script; the preinst there leaves a hold that keeps the gateway out of that
+# loop. When this body decides the gateway is to be enabled, it removes the
+# hold first. See scripts/preinst.
+#
+# The upgrade marker stays in /tmp: an installed 0.5.2 package's prerm writes
+# it there, and this script must find it to leave a disabled gateway disabled.
+
+# An image build (OpenWrt's image builder or buildroot) runs this on the build
+# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
+# host, so it does nothing there; see the README for the gateway in images.
+
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
 
 UPGRADE_MARKER=/tmp/fips-prerm-upgrade
+INSTALL_HOLD=/var/run/fips-gateway-install-hold
 
 # Run first-boot UCI setup (the script deletes itself when done).
 if [ -x /etc/uci-defaults/90-fips-setup ]; then
@@ -38,6 +54,7 @@ if [ "${PKG_UPGRADE:-0}" = "1" ]; then
     if [ -e "$UPGRADE_MARKER" ]; then
         rm -f "$UPGRADE_MARKER"
     else
+        rm -f "$INSTALL_HOLD"
         /etc/init.d/fips-gateway enable
     fi
 

packaging/openwrt-ipk/scripts/preinst

@@ -0,0 +1,43 @@
+#!/bin/sh
+# Maintainer script run before the FIPS package's files are unpacked.
+#
+# Used only by the OpenWrt SDK feed Makefile, as the package's preinst under
+# opkg and its pre-install and pre-upgrade scripts under apk. build-ipk.sh and
+# build-apk.sh ship a postinst of their own and do not need it.
+#
+# A package built in the SDK gets OpenWrt's generated postinst, whose
+# default_postinst enables every init script the package installs on a fresh
+# install and starts every one on every install and upgrade. The package's own
+# postinst body runs before that loop under opkg and after it under apk, so the
+# body cannot keep the gateway off by itself. Instead, unless the gateway is
+# enabled now, this leaves a hold that init.d/fips-gateway honours once: its
+# start_service removes the hold, disables the service and starts nothing. A
+# fresh install therefore leaves the gateway disabled and stopped, and an
+# upgrade does not start a gateway the operator disabled.
+#
+# An apk upgrade runs no script of the outgoing package, so nothing else stops
+# the services or tells the postinst body that enablement survived the upgrade.
+# This does what the outgoing package's prerm does on an opkg upgrade.
+
+# An image build (OpenWrt's image builder or buildroot) runs this on the build
+# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
+# host, so it does nothing there; see the README for the gateway in images.
+
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
+
+INSTALL_HOLD=/var/run/fips-gateway-install-hold
+UPGRADE_MARKER=/tmp/fips-prerm-upgrade
+
+# opkg passes "install" or "upgrade <old-version>"; apk passes versions only.
+if [ "${PKG_UPGRADE:-0}" = "1" ] && [ "${1:-}" != "upgrade" ]; then
+    : > "$UPGRADE_MARKER" 2>/dev/null || true
+    /etc/init.d/fips-gateway stop 2>/dev/null || true
+    /etc/init.d/fips stop         2>/dev/null || true
+fi
+
+if ! /etc/init.d/fips-gateway enabled 2>/dev/null; then
+    mkdir -p "${INSTALL_HOLD%/*}" 2>/dev/null
+    : > "$INSTALL_HOLD" 2>/dev/null || true
+fi
+
+exit 0

packaging/openwrt-ipk/scripts/prerm

@@ -10,10 +10,21 @@
 # because nothing records it anywhere else, so an upgrade only stops them and
 # leaves a marker telling the incoming postinst that enablement survived.
 # A real removal stops and disables both, as before.
+#
+# A package built from the SDK feed Makefile runs this body from OpenWrt's
+# generated prerm, which passes the script's own path first, so "upgrade" is
+# then the second argument. opkg exports PKG_UPGRADE=1 for an upgrade either
+# way, and apk runs this only on a removal.
+
+# An image build (OpenWrt's image builder or buildroot) runs this on the build
+# host with IPKG_INSTROOT naming the image's root. Nothing here may touch the
+# host, so it does nothing there; see the README for the gateway in images.
+
+[ -n "${IPKG_INSTROOT:-}" ] && exit 0
 
 UPGRADE_MARKER=/tmp/fips-prerm-upgrade
 
-if [ "$1" = "upgrade" ]; then
+if [ "${1:-}" = "upgrade" ] || [ "${PKG_UPGRADE:-0}" = "1" ]; then
     : > "$UPGRADE_MARKER" 2>/dev/null || true
     /etc/init.d/fips-gateway stop 2>/dev/null || true
     /etc/init.d/fips stop         2>/dev/null || true

testing/openwrt/maintainer-scripts-test.sh

@@ -57,6 +57,7 @@ docker run --rm --network none \
     -e APK_SCRIPTS=/apk \
     -e "POSTINST=${POSTINST:-}" \
     -e "PRERM=${PRERM:-}" \
+    -e "PREINST=${PREINST:-}" \
     -e "INIT_GATEWAY=${INIT_GATEWAY:-}" \
     "$IMAGE" sh /src/testing/openwrt/scenarios.sh
 rc=$?

testing/openwrt/package-test.sh

@@ -281,7 +281,8 @@ for path in ./postinst ./prerm; do
 done
 
 # ── P4. No source still names the drop-in ───────────────────────────────────
-# This is the only check on the SDK feed Makefile, which nothing here builds.
+# With P5, one of the two checks on the SDK feed Makefile, which nothing here
+# builds.
 # grep exits 1 when nothing matches and 2 when it could not read a path; only
 # the first is a pass.
 (cd "$PROJECT_ROOT" && grep -rlF 'dnsmasq.d/fips.conf' \
@@ -301,6 +302,31 @@ else
     ok "P4 the drop-in source file is gone"
 fi
 
+# ── P5. The SDK feed Makefile ships the same maintainer scripts ─────────────
+# Read, not built: building it needs the OpenWrt SDK. Each script must be the
+# file in scripts/ that the scenarios run, and fips.yaml must be a conffile.
+MAKEFILE="$PROJECT_ROOT/packaging/openwrt-ipk/Makefile"
+[[ -r "$MAKEFILE" ]] || harness_fail "cannot read $MAKEFILE"
+for script in preinst postinst prerm; do
+    if awk -v want="define Package/fips/$script" -v body="\$(file < \$(CURDIR)/scripts/$script)" '
+        $0 == want { inside = 1; next }
+        inside && $0 == body { found = 1 }
+        inside && $0 == "endef" { inside = 0 }
+        END { exit !found }' "$MAKEFILE"; then
+        ok "P5 the SDK Makefile's $script is scripts/$script"
+    else
+        bad "P5 the SDK Makefile does not define Package/fips/$script as scripts/$script"
+    fi
+done
+if awk '$0 == "define Package/fips/conffiles" { inside = 1; next }
+        inside && $0 == "/etc/fips/fips.yaml" { found = 1 }
+        inside && $0 == "endef" { inside = 0 }
+        END { exit !found }' "$MAKEFILE"; then
+    ok "P5 the SDK Makefile lists /etc/fips/fips.yaml as a conffile"
+else
+    bad "P5 the SDK Makefile does not list /etc/fips/fips.yaml as a conffile"
+fi
+
 # ── Hand the scripts to the ash scenarios ───────────────────────────────────
 if [[ -n "$KEEP" ]]; then
     for phase in $WANT_PHASES; do

testing/openwrt/scenarios.sh

@@ -8,7 +8,7 @@
 # exercised is the scripts' behaviour given that contract, not opkg itself.
 # A real `opkg upgrade` on a router image stays uncovered.
 #
-# POSTINST, PRERM and INIT_GATEWAY may be pointed at other files. That is the
+# PREINST, POSTINST, PRERM and INIT_GATEWAY may be pointed at other files. That is the
 # seam used to see a scenario red against the previously released scripts, and
 # to re-break the fixed ones during a break-check.
 #
@@ -23,6 +23,7 @@ set -u
 
 REPO="${REPO:-/src}"
 POSTINST="${POSTINST:-$REPO/packaging/openwrt-ipk/scripts/postinst}"
+PREINST="${PREINST:-$REPO/packaging/openwrt-ipk/scripts/preinst}"
 PRERM="${PRERM:-$REPO/packaging/openwrt-ipk/scripts/prerm}"
 RELEASED_PRERM="$REPO/testing/openwrt/fixtures/released-prerm"
 INIT_GATEWAY="${INIT_GATEWAY:-$REPO/packaging/openwrt-ipk/files/etc/init.d/fips-gateway}"
@@ -1140,9 +1141,204 @@ scenario_supervise() {
     return 0
 }
 
+# ── 16. A package built from the SDK feed Makefile ─────────────────────────
+# OpenWrt generates that package's postinst and prerm around default_postinst
+# and default_prerm (package/base-files/files/lib/functions.sh, read at OpenWrt
+# main and openwrt-24.10). After its own steps, default_postinst runs a loop
+# over the package's init scripts: "enable" unless PKG_UPGRADE is 1, then
+# "start". Under opkg the package's postinst body is sourced before that loop;
+# under apk it is appended to the generated script and runs after it.
+# default_prerm sources the prerm body with the generated script's own path as
+# $1, then disables (on a removal) and stops each init script. The preinst is
+# the package's own, run as opkg runs it ("install" or "upgrade <old>") or as
+# apk runs it (versions only, PKG_UPGRADE=1 exported on an upgrade).
+#
+# /etc/init.d/fips is the recording stub. /etc/init.d/fips-gateway is the real
+# script, run through a stand-in rc.common that keeps enablement as the
+# /etc/rc.d links OpenWrt's does and records whether start_service opened a
+# procd instance, which is what starting the gateway means.
+
+install_sdk_env() {
+    install_uci_stub
+    printf '#!/bin/sh\nexit 0\n' > "$STUB_BIN/logger"
+    chmod 0755 "$STUB_BIN/logger"
+    rm -rf /etc/rc.d
+    mkdir -p /etc/rc.d /etc/fips /var/run
+    cp "$SHIPPED_YAML" /etc/fips/fips.yaml
+    cp "$INIT_GATEWAY" /etc/init.d/fips-gateway
+    chmod 0755 /etc/init.d/fips-gateway
+    rm -f /var/run/fips-gateway-install-hold
+    cat > /etc/rc.common <<'SHIM'
+#!/bin/sh
+# Stand-in for OpenWrt's rc.common: enablement as /etc/rc.d links, and start
+# runs start_service with procd's calls recorded instead of made.
+initscript="$1"
+action="$2"
+shift 2
+name="${initscript##*/}"
+enable() { ln -sf "../init.d/$name" "/etc/rc.d/S${START}$name"; ln -sf "../init.d/$name" "/etc/rc.d/K${STOP}$name"; }
+disable() { rm -f /etc/rc.d/S??"$name" /etc/rc.d/K??"$name"; }
+enabled() { [ -L "/etc/rc.d/S${START}$name" ]; }
+procd_open_instance() { echo "$name instance" >> "$CALLS"; }
+procd_set_param() { :; }
+procd_close_instance() { :; }
+stop_service() { :; }
+. "$initscript"
+sysctl() { :; }
+modprobe() { :; }
+gateway_add_global_prefix() { :; }
+gateway_add_ra_route() { :; }
+stop_service() { :; }
+echo "$name $action" >> "$CALLS"
+case "$action" in
+start) start_service ;;
+stop) stop_service ;;
+*) "$action" "$@" ;;
+esac
+SHIM
+    chmod 0755 /etc/rc.common
+    return 0
+}
+
+remove_sdk_env() {
+    rm -rf /etc/rc.d /etc/fips "$STUB_BIN"
+    rm -f /etc/rc.common /var/run/fips-gateway-install-hold
+    return 0
+}
+
+sdk_loop() {
+    # The init-script loop of default_postinst.
+    for i in /etc/init.d/fips /etc/init.d/fips-gateway; do
+        if [ "${PKG_UPGRADE:-0}" != "1" ]; then
+            "$i" enable
+        fi
+        "$i" start
+    done
+    return 0
+}
+
+sdk_postinst() {
+    # sdk_postinst ipk|apk
+    if [ "$1" = "ipk" ]; then
+        ( set -- /usr/lib/opkg/info/fips.postinst configure; . "$POSTINST" ) >/dev/null 2>&1
+        sdk_loop >/dev/null 2>&1
+    else
+        sdk_loop >/dev/null 2>&1
+        sh "$POSTINST" 2.0-r1 >/dev/null 2>&1
+    fi
+    return 0
+}
+
+sdk_prerm_upgrade_ipk() {
+    # default_prerm for the outgoing SDK-built package on an opkg upgrade.
+    ( set -- /usr/lib/opkg/info/fips.prerm upgrade 2.0-r1; . "$PRERM" ) >/dev/null 2>&1
+    for i in /etc/init.d/fips /etc/init.d/fips-gateway; do
+        "$i" stop >/dev/null 2>&1
+    done
+    return 0
+}
+
+sdk_preinst() {
+    # sdk_preinst <args...>, run as a script, as opkg and apk run it.
+    if [ ! -f "$PREINST" ]; then
+        bad "there is no preinst at $PREINST"
+        return 0
+    fi
+    sh "$PREINST" "$@" >/dev/null 2>&1
+    return 0
+}
+
+assert_gateway() {
+    # assert_gateway <enabled|disabled> <started|stopped> <case>
+    if [ -L /etc/rc.d/S96fips-gateway ]; then got=enabled; else got=disabled; fi
+    assert_equals "$got" "$1" "$3: fips-gateway ends $1"
+    if grep -qxF "fips-gateway instance" "$CALLS"; then got=started; else got=stopped; fi
+    assert_equals "$got" "$2" "$3: fips-gateway is $2"
+    assert_absent /var/run/fips-gateway-install-hold "$3: no install hold is left behind"
+    return 0
+}
+
+scenario_sdk_package() {
+    note "scenario 16: SDK feed package, default_postinst and default_prerm"
+    saved_path="$PATH"
+    PATH="$STUB_BIN:$PATH"
+    export PATH
+
+    for fmt in ipk apk; do
+        reset_state
+        install_sdk_env
+        if [ "$fmt" = "ipk" ]; then
+            PKG_UPGRADE=0 sdk_preinst install
+            PKG_UPGRADE=0 sdk_postinst ipk
+        else
+            sdk_preinst 2.0-r1
+            sdk_postinst apk
+        fi
+        assert_called "fips start" "$fmt fresh install: the daemon is started"
+        assert_file_is "$FIPS_STATE" "1" "$fmt fresh install: the daemon is enabled"
+        assert_gateway disabled stopped "$fmt fresh install"
+        remove_sdk_env
+
+        for gw in enabled disabled; do
+            reset_state
+            install_sdk_env
+            echo 1 > "$FIPS_STATE"
+            [ "$gw" = "enabled" ] && /etc/init.d/fips-gateway enable >/dev/null 2>&1
+            : > "$CALLS"
+            if [ "$fmt" = "ipk" ]; then
+                PKG_UPGRADE=1 sdk_prerm_upgrade_ipk
+                PKG_UPGRADE=1 sdk_preinst upgrade 1.0-r1
+                PKG_UPGRADE=1 sdk_postinst ipk
+            else
+                PKG_UPGRADE=1 sdk_preinst 2.0-r1 1.0-r1
+                PKG_UPGRADE=1 sdk_postinst apk
+            fi
+            if [ "$gw" = "enabled" ]; then
+                assert_gateway enabled started "$fmt upgrade, gateway enabled"
+            else
+                assert_gateway disabled stopped "$fmt upgrade, gateway disabled"
+            fi
+            assert_absent "$UPGRADE_MARKER" "$fmt upgrade, gateway $gw: the upgrade marker is removed"
+            remove_sdk_env
+        done
+    done
+
+    # An opkg upgrade from a released package, whose prerm disabled the
+    # gateway and left no marker: the postinst body re-enables and starts it,
+    # as with build-ipk.sh, which needs it to clear the hold first.
+    reset_state
+    install_sdk_env
+    echo 1 > "$FIPS_STATE"
+    /etc/init.d/fips-gateway enable >/dev/null 2>&1
+    : > "$CALLS"
+    PKG_UPGRADE=1 sh "$RELEASED_PRERM" upgrade 2.0-r1 >/dev/null 2>&1
+    PKG_UPGRADE=1 sdk_preinst upgrade 0.5.1
+    PKG_UPGRADE=1 sdk_postinst ipk
+    assert_gateway enabled started "ipk upgrade from a released package"
+    remove_sdk_env
+
+    # An image build runs the scripts on the build host, with IPKG_INSTROOT
+    # naming the image root: they must not touch the host at all.
+    reset_state
+    rm -f /var/run/fips-gateway-install-hold "$UPGRADE_MARKER"
+    for pkg_upgrade in 0 1; do
+        IPKG_INSTROOT=/tmp/fips-image-root PKG_UPGRADE=$pkg_upgrade sh "$PREINST" install >/dev/null 2>&1
+        IPKG_INSTROOT=/tmp/fips-image-root PKG_UPGRADE=$pkg_upgrade sh "$POSTINST" configure >/dev/null 2>&1
+        IPKG_INSTROOT=/tmp/fips-image-root PKG_UPGRADE=$pkg_upgrade sh "$PRERM" upgrade 2.0-r1 >/dev/null 2>&1
+        IPKG_INSTROOT=/tmp/fips-image-root PKG_UPGRADE=$pkg_upgrade sh "$PRERM" remove >/dev/null 2>&1
+    done
+    assert_equals "$(calls_oneline)" "" "image build: no script touches the build host's services"
+    assert_absent /var/run/fips-gateway-install-hold "image build: the preinst leaves no hold on the build host"
+    assert_absent "$UPGRADE_MARKER" "image build: the prerm leaves no marker on the build host"
+
+    PATH="$saved_path"
+    return 0
+}
+
 echo "OpenWrt maintainer-script scenarios (shell: $(readlink -f /proc/$$/exe 2>/dev/null || echo sh))"
 echo "  postinst: $POSTINST"
 echo "  prerm:    $PRERM"
+echo "  preinst:  $PREINST"
 echo "  apk:      ${APK_SCRIPTS:-(not set)}"
 
 scenario_fresh_install
@@ -1160,6 +1356,7 @@ scenario_default_port_parity
 scenario_swap_cleanup
 scenario_listen_migration
 scenario_supervise
+scenario_sdk_package
 
 echo ""
 if [ "$FAILURES" -eq 0 ]; then