laantungir/fips
1
0
Fork 0
mirror of https://github.com/jmcorgan/fips.git synced 2026-10-05 11:08:25 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
d1b8a725ac4d69c6aa035775c96ed23fcad61772
fips/packaging/openwrt-ipk/Makefile
T
Johnathan Corgan d1b8a725ac Build working OpenWrt packages from the SDK feed Makefile 
OpenWrt scans every package Makefile with DUMP=1 before it builds
anything, and that scan does not read the target config, so ARCH is
empty there. The unsupported-architecture error therefore fired on every
scan, the package's metadata came out empty, and make package/fips/compile
in the SDK built nothing at all. The error now applies only outside the
scan.

The SDK feed Makefile also declared no postinst, prerm or conffiles, so a
package built from it ran only OpenWrt's generated scripts. Their
default_postinst enables every init script a package ships on a fresh
install and starts every one on each install and upgrade, so such a
package enabled and started fips-gateway on a fresh install, started a
gateway the operator had disabled on every upgrade, and under opkg
replaced an edited fips.yaml. The Makefile now reads its postinst and
prerm bodies from scripts/, the same files build-ipk.sh and build-apk.sh
install, and lists fips.yaml as a conffile. Because the generated postinst
runs the package's body before the enable-and-start loop under opkg and
after it under apk, a new preinst, used only by the Makefile, leaves a
one-time hold in /var/run unless the gateway is enabled, and the gateway's
start_service, finding the hold, removes it, disables the service and
starts nothing. Under apk, where an upgrade runs no script of the old
package, the preinst also stops the services and leaves the upgrade
marker, as the old prerm does under opkg. The marker stays in /tmp,
because the prerm of an installed 0.5.2 package writes it there. The
prerm recognises an upgrade from PKG_UPGRADE as well as from its first
argument, since OpenWrt's default_prerm passes the script path first, and
the postinst clears the hold before re-enabling the gateway after an
upgrade from a package whose prerm disabled it.

An image build runs package scripts on the build host with IPKG_INSTROOT
naming the image root, so the preinst, postinst and prerm now do nothing
when it is set, rather than enabling and starting services on the host
and writing into its /tmp. The README tells image builders to pass
DISABLED_SERVICES=fips-gateway to keep the gateway off, and drops the
caveat that SDK builds lack the scripts.

Built in the openwrt/sdk 24.10.8 (ipk) and 25.12.5 (apk) images and
installed, upgraded and removed with the real opkg and apk in the
matching rootfs images: a fresh install leaves the gateway disabled and
stopped, an upgrade keeps it disabled or enabled as it was, and an
edited fips.yaml survives. A new scenario runs the same flows under ash
in local and GitHub CI and checks the scripts touch nothing on a build
host, and package-test.sh checks the Makefile names the scripts and the
conffile.
2026-10-01 14:21:40 +00:00

162 lines
5.9 KiB
Makefile
Raw Blame History

include $(TOPDIR)/rules.mk
PKG_NAME:=fips
PKG_VERSION:=0.1.0
PKG_RELEASE:=1
# Pin to a specific commit for reproducible builds.
# Update PKG_SOURCE_VERSION and PKG_MIRROR_HASH when upgrading.
PKG_SOURCE_PROTO:=git
PKG_SOURCE_URL:=https://github.com/jmcorgan/fips.git
PKG_SOURCE_VERSION:=master
PKG_MIRROR_HASH:=skip
PKG_MAINTAINER:=FIPS Network
PKG_LICENSE:=MIT
PKG_LICENSE_FILES:=LICENSE
# Rust host toolchain must be present in the build system.
# In the OpenWrt build system, enable via: make menuconfig → Advanced → Rust
PKG_BUILD_DEPENDS:=rust/host
PKG_BUILD_PARALLEL:=1
include $(INCLUDE_DIR)/package.mk
# ---------------------------------------------------------------------------
# Map OpenWrt ARCH to Rust target triple.
# All OpenWrt targets use musl libc.
# ---------------------------------------------------------------------------
ifeq ($(ARCH),aarch64)
RUST_TARGET:=aarch64-unknown-linux-musl
else ifeq ($(ARCH),x86_64)
RUST_TARGET:=x86_64-unknown-linux-musl
else ifeq ($(ARCH),mipsel)
RUST_TARGET:=mipsel-unknown-linux-musl
else ifeq ($(ARCH),mips)
RUST_TARGET:=mips-unknown-linux-musl
else ifeq ($(ARCH),arm)
# OpenWrt ARM targets predominantly use hardfloat ABI.
# Override RUST_TARGET in your build if your target uses softfloat.
RUST_TARGET:=arm-unknown-linux-musleabihf
else ifeq ($(DUMP),)
# Not while OpenWrt scans package metadata (DUMP=1): the scan does not read
# the target config, so ARCH is empty then, and stopping here would leave the
# package out of the build entirely.
$(error Unsupported architecture: $(ARCH). Add a RUST_TARGET mapping in packaging/openwrt-ipk/Makefile.)
endif
RUST_RELEASE_DIR:=$(PKG_BUILD_DIR)/target/$(RUST_TARGET)/release
define Package/fips
SECTION:=net
CATEGORY:=Network
TITLE:=FIPS Mesh Network Daemon
URL:=https://github.com/jmcorgan/fips
DEPENDS:=+kmod-tun +kmod-br-netfilter +kmod-nft-nat \
+kmod-nf-conntrack +ip-full
endef
define Package/fips/description
FIPS is a distributed, decentralized mesh networking daemon. It routes
traffic across nodes connected over UDP, TCP, or raw Ethernet (EtherType
0x2121). Provides a TUN interface (fips0) with ULA IPv6 mesh addressing
and a local DNS responder for .fips name resolution.
Four binaries are installed:
fips — mesh daemon
fipsctl — CLI control and inspection tool
fipstop — live TUI dashboard (requires a terminal)
fips-gateway — outbound LAN gateway (not started by default)
endef
# ---------------------------------------------------------------------------
# Build
#
# We write a temporary .cargo/config.toml to set the cross-linker without
# polluting the source tree. CARGO_HOME is scoped to the staging directory
# to avoid touching the developer's ~/.cargo during SDK builds.
# ---------------------------------------------------------------------------
define Build/Compile
mkdir -p $(PKG_BUILD_DIR)/.cargo
printf '[target.$(RUST_TARGET)]\nlinker = "$(TARGET_CC)"\n' \
> $(PKG_BUILD_DIR)/.cargo/config.toml
cd $(PKG_BUILD_DIR) && \
CARGO_HOME=$(STAGING_DIR_HOST)/share/cargo \
cargo build \
--release \
--target $(RUST_TARGET) \
--bin fips \
--bin fipsctl \
--bin fipstop \
--bin fips-gateway
endef
define Package/fips/install
# Binaries
$(INSTALL_DIR) $(1)/usr/bin
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fips $(1)/usr/bin/fips
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fipsctl $(1)/usr/bin/fipsctl
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fipstop $(1)/usr/bin/fipstop
$(INSTALL_BIN) $(RUST_RELEASE_DIR)/fips-gateway $(1)/usr/bin/fips-gateway
# 802.11s mesh backhaul setup helper
$(INSTALL_BIN) $(CURDIR)/files/usr/bin/fips-mesh-setup $(1)/usr/bin/fips-mesh-setup
# Open "FIPS" access SSID setup helper
$(INSTALL_BIN) $(CURDIR)/files/usr/bin/fips-ap-setup $(1)/usr/bin/fips-ap-setup
# procd init script
$(INSTALL_DIR) $(1)/etc/init.d
$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips $(1)/etc/init.d/fips
$(INSTALL_BIN) $(CURDIR)/files/etc/init.d/fips-gateway $(1)/etc/init.d/fips-gateway
# Default config, mode 0600. Package/fips/conffiles below is what keeps an
# edited copy across an upgrade.
$(INSTALL_DIR) $(1)/etc/fips
$(INSTALL_CONF) $(CURDIR)/files/etc/fips/fips.yaml $(1)/etc/fips/fips.yaml
# Firewall helper script (called by UCI include and hotplug)
$(INSTALL_BIN) $(CURDIR)/files/etc/fips/firewall.sh $(1)/etc/fips/firewall.sh
# sysctl: enable br_netfilter so AF_PACKET sees frames on bridge member ports
$(INSTALL_DIR) $(1)/etc/sysctl.d
$(INSTALL_DATA) $(CURDIR)/files/etc/sysctl.d/fips-bridge.conf $(1)/etc/sysctl.d/fips-bridge.conf
$(INSTALL_DATA) $(CURDIR)/files/etc/sysctl.d/fips-gateway.conf $(1)/etc/sysctl.d/fips-gateway.conf
# Hotplug: apply firewall rules when the FIPS TUN interface comes up
$(INSTALL_DIR) $(1)/etc/hotplug.d/net
$(INSTALL_BIN) $(CURDIR)/files/etc/hotplug.d/net/99-fips $(1)/etc/hotplug.d/net/99-fips
# UCI defaults: one-time first-boot firewall and module setup
$(INSTALL_DIR) $(1)/etc/uci-defaults
$(INSTALL_BIN) $(CURDIR)/files/etc/uci-defaults/90-fips-setup $(1)/etc/uci-defaults/90-fips-setup
# sysupgrade: preserve /etc/fips/ (config + identity key) across firmware upgrades
$(INSTALL_DIR) $(1)/lib/upgrade/keep.d
$(INSTALL_DATA) $(CURDIR)/files/lib/upgrade/keep.d/fips $(1)/lib/upgrade/keep.d/fips
endef
# A user's edits to the config survive an upgrade.
define Package/fips/conffiles
/etc/fips/fips.yaml
endef
# Maintainer scripts, read from scripts/ so this package runs the same
# postinst and prerm bodies that build-ipk.sh and build-apk.sh install. OpenWrt
# wraps those two in its generated scripts, around default_postinst and
# default_prerm. The preinst is used only here: it keeps fips-gateway disabled
# and stopped through default_postinst's enable-and-start loop.
define Package/fips/preinst
$(file < $(CURDIR)/scripts/preinst)
endef
define Package/fips/postinst
$(file < $(CURDIR)/scripts/postinst)
endef
define Package/fips/prerm
$(file < $(CURDIR)/scripts/prerm)
endef
$(eval $(call BuildPackage,fips))
Reference in New Issue View Git Blame Copy Permalink