feeds: Vendor repository indexes

Keep the native APK indexes alongside the expanded package
metadata so image builds do not fetch mutable repository state.

Generate pins atomically and retry transient generation failures.

flake.nix

@@ -19,20 +19,72 @@
         { release = "25.12.5"; target = "realtek/rtl930x"; }
       ];
 
+      vendorIndexes = pkgs.writeShellApplication {
+        name = "vendor-openwrt-indexes";
+        runtimeInputs = [ pkgs.curl pkgs.python3 ];
+        text = ''
+          exec python3 ${./vendor-indexes.py} "$@"
+        '';
+      };
+
       update = pkgs.writeShellApplication {
         name = "update-openwrt-feeds";
-        runtimeInputs = [ openwrt-imagebuilder.packages.${system}.release2nix ];
+        runtimeInputs = [ pkgs.coreutils openwrt-imagebuilder.packages.${system}.release2nix vendorIndexes ];
         text = ''
-          root="''${1:-$PWD}"
+          release_filter="''${1:-}"
+          root="''${2:-$PWD}"
           if [ ! -e "$root/flake.nix" ]; then
             echo "update-openwrt-feeds: $root is not the repository root" >&2
             exit 1
           fi
           cd "$root"
 
+          generated=$(mktemp -d)
+          trap 'rm -rf "$generated"' EXIT
+
+          generate_release() {
+            local release="$1"
+            local target="$2"
+            local destination="$generated/$release"
+
+            for attempt in 1 2 3; do
+              rm -rf "$destination"
+              if release2nix -o "$destination" "$release" "$target" \
+                && vendor-openwrt-indexes "$destination"; then
+                return
+              fi
+              if [ "$attempt" -lt 3 ]; then
+                echo "Failed to generate $release; retrying ($attempt/3)" >&2
+                sleep 10
+              fi
+            done
+            echo "Failed to generate a consistent $release cache" >&2
+            return 1
+          }
+
+          matched=false
           ${builtins.concatStringsSep "\n" (map
-            ({ release, target }: "release2nix '${release}' '${target}'")
+            ({ release, target }: ''
+              if [ -z "$release_filter" ] || [ "$release_filter" = '${release}' ]; then
+                matched=true
+                generate_release '${release}' '${target}'
+              fi
+            '')
             pins)}
+
+          ${builtins.concatStringsSep "\n" (map
+            ({ release, ... }: ''
+              if [ -d "$generated/${release}" ]; then
+                rm -rf 'cache/${release}'
+                mv "$generated/${release}" 'cache/${release}'
+              fi
+            '')
+            pins)}
+
+          if [ "$matched" != true ]; then
+            echo "Unknown release: $release_filter" >&2
+            exit 1
+          fi
         '';
       };
     in