jackos1998
8248f82ebb
Pinned OpenWrt feed hashes for realtek/rtl930x on snapshot and 25.12.5, generated with nix-openwrt-imagebuilder's release2nix. Expanding the feeds locally (rather than relying on upstream's index-level hashes) keeps every package a plain pinned fetchurl, and removes the import-from-derivation that would otherwise make evaluation depend on the OpenWrt download server.
80 lines
3.2 KiB
Markdown
80 lines
3.2 KiB
Markdown
# openwrt-feeds
|
|
|
|
Pinned OpenWrt package feed hashes for use with
|
|
[`astro/nix-openwrt-imagebuilder`](https://github.com/astro/nix-openwrt-imagebuilder).
|
|
|
|
Take this repo as a flake input and pass one of its `cachePaths` to that project's `cachePath`, and
|
|
image builds resolve their packages from these pins instead of from whatever the download server is
|
|
serving today:
|
|
|
|
```nix
|
|
openwrt-imagebuilder.lib.build {
|
|
inherit pkgs;
|
|
release = "snapshot";
|
|
cachePath = openwrt-feeds.cachePaths.snapshot;
|
|
target = "realtek";
|
|
variant = "rtl930x";
|
|
profile = "xikestor_sks8300-8x";
|
|
packages = [ "luci" ];
|
|
}
|
|
```
|
|
|
|
`cachePaths` has one entry per pinned release. A flake's source is copied to the store, so each is
|
|
an importable store path.
|
|
|
|
Everything under `cache/` is generated. Nothing here is hand-written.
|
|
|
|
## Why this exists
|
|
|
|
`nix-openwrt-imagebuilder` ships hashes for the OpenWrt download server, but only at the level of
|
|
each feed's *index* (`packages.adb`), not the packages inside it. When an index hash no longer
|
|
matches, two things happen:
|
|
|
|
- The build fails outright with `hash mismatch in fixed-output derivation`.
|
|
- Resolving the package list falls back to import-from-derivation, so *evaluation* needs the
|
|
network and can fail for reasons unrelated to what is being evaluated. In a flake that also
|
|
describes other systems, that turns an OpenWrt feed rebuild into an evaluation failure for
|
|
everything else in the flake.
|
|
|
|
Those indexes move constantly. Snapshot is rebuilt daily, and release feeds are no better:
|
|
`releases/<version>/packages/` is a symlink to the rolling `packages-<major>` feed shared by every
|
|
point release, so it changes whenever any package in it is rebuilt. Upstream refreshes its hashes
|
|
once a day and routinely loses that race.
|
|
|
|
Regenerating locally writes the *expanded* per-package files (`cache/<release>/packages/<arch>/`),
|
|
which `nix-openwrt-imagebuilder` imports directly. That removes the import-from-derivation, leaves
|
|
every `.apk` as a plain pinned `fetchurl`, and makes the pin something to move deliberately rather
|
|
than something upstream moves daily.
|
|
|
|
The generated files are large — a few MB per release, rewritten wholesale each time — which is why
|
|
they are kept in a repository of their own rather than in the history of whatever consumes them.
|
|
|
|
## Regenerating
|
|
|
|
From a checkout:
|
|
|
|
```sh
|
|
nix run .#update
|
|
```
|
|
|
|
This rewrites `cache/` for every entry in `pins` in `flake.nix`. Review and commit the result, then
|
|
update the pin in the consuming flake.
|
|
|
|
Adding a release or target means adding it to `pins` and re-running. Note that
|
|
`cache/<release>/default.nix` lists every target in the release, but only the ones generated here
|
|
exist on disk; the others are referenced lazily and are never evaluated.
|
|
|
|
## Layout
|
|
|
|
| Path | Contents |
|
|
|---|---|
|
|
| `cache/<release>/default.nix` | Per-target entry points for the release |
|
|
| `cache/<release>/targets/<target>/<variant>/` | ImageBuilder hash, `profiles.json` extract, kmod and target package feeds |
|
|
| `cache/<release>/packages/<arch>.nix` | Feed index hashes for the target's architecture |
|
|
| `cache/<release>/packages/<arch>/<feed>.nix` | Expanded per-package versions, dependencies and hashes |
|
|
|
|
## Mirroring
|
|
|
|
`git.nul.ie/dev/openwrt-feeds` is canonical; it is push-mirrored to
|
|
`github.com/devplayer0/openwrt-feeds`.
|