OpenWrt: preserve SDK selections and cover the mount helper

Apply the configuration seed after feed installation so defconfig keeps
runtime package selections.

Require Bash to be absent and exercise mount.veracrypt in the QEMU smoke
test. Scope installer errexit so subsequent failures report their status.

src/Build/Packaging/openwrt/README.md

@@ -87,7 +87,8 @@ The test script downloads and verifies the matching OpenWrt x86/64 ext4 image,
 boots it with QEMU user networking, waits for OpenWrt network init to settle,
 gets a DHCP lease on `br-lan` or `eth0`, resolves the needed dependency closure
 from local SDK `.ipk` control metadata plus the official OpenWrt kmod feed,
-serves those packages to the guest, and installs them with `opkg`. It then runs:
+serves those packages to the guest, and installs them with `opkg`. It verifies
+that Bash is unavailable, then runs:
 
 ```sh
 veracrypt --text --version
@@ -96,8 +97,10 @@ veracrypt --text --test
 
 By default it also creates a 16 MiB AES/SHA-512 test container, opens it with
 `--filesystem=none`, verifies it appears in `veracrypt --text --list`, and
-unmounts it. Use `--skip-container` to run only the package install, version,
-and algorithm self-test path.
+unmounts it. It repeats the mount/list/unmount check through `mount.veracrypt`.
+The test password must not contain commas because the helper uses comma-separated
+options. Use `--skip-container` to run only the package install, Bash absence,
+version, and algorithm self-test path.
 
 If QEMU was extracted locally instead of installed system-wide, pass the binary
 and firmware directory explicitly:

src/Build/build_veracrypt_openwrt.sh

@@ -302,7 +302,6 @@ render_package_makefile() {
 configure_sdk() {
 	[ -f "$OPENWRT_CONFIG" ] || die "Missing OpenWrt config seed: $OPENWRT_CONFIG"
 
-	cp "$OPENWRT_CONFIG" "$SDK_DIR/.config"
 	(
 		cd "$SDK_DIR"
 		if ! PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base; then
@@ -311,6 +310,8 @@ configure_sdk() {
 			PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base
 		fi
 		PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds install fuse3 lvm2 util-linux pcsc-lite
+		# Feed updates run defconfig before feed package symbols are available.
+		cp "$OPENWRT_CONFIG" "$SDK_DIR/.config"
 		PATH="$HOST_TOOLS/bin:$PATH" make defconfig
 	)
 }

src/Build/test_veracrypt_openwrt_qemu.py

@@ -701,7 +701,9 @@ def run_guest_tests(args, console, http_port, packages):
         timeout=120,
     )
 
-    console.run(package_download_command(packages, http_port), timeout=900)
+    # Keep the installer's set -e local so later failures report their status.
+    console.run(f"(\n{package_download_command(packages, http_port)}\n)", timeout=900)
+    console.run("! command -v bash", timeout=60)
 
     version_output = console.run("veracrypt --text --version", timeout=120)
     if "VeraCrypt " not in version_output:
@@ -714,6 +716,9 @@ def run_guest_tests(args, console, http_port, packages):
     if not args.skip_container:
         quoted_container_size = sh_quote(args.container_size)
         quoted_password = sh_quote(args.password)
+        quoted_helper_options = sh_quote(
+            f"password={args.password},pim=0,keyfiles=,protect-hidden=no,fs=none"
+        )
         console.run("dd if=/dev/urandom of=/tmp/vc-random.bin bs=1M count=1", timeout=120)
         console.run(
             "veracrypt --text --create /tmp/openwrt-test.hc "
@@ -725,16 +730,18 @@ def run_guest_tests(args, console, http_port, packages):
             timeout=360,
         )
         console.run("mkdir -p /mnt/veracrypt-test", timeout=60)
-        console.run(
+        for mount_command in (
             "veracrypt --text --mount /tmp/openwrt-test.hc /mnt/veracrypt-test "
             f"--password={quoted_password} "
             "--pim=0 --keyfiles='' --protect-hidden=no --filesystem=none --non-interactive",
-            timeout=240,
-        )
-        list_output = console.run("veracrypt --text --list", timeout=120)
-        if "/dev/mapper/veracrypt" not in list_output:
-            raise TestError("container did not appear in veracrypt --list output")
-        console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180)
+            "/sbin/mount.veracrypt /tmp/openwrt-test.hc /mnt/veracrypt-test "
+            f"-o {quoted_helper_options}",
+        ):
+            console.run(mount_command, timeout=240)
+            list_output = console.run("veracrypt --text --list", timeout=120)
+            if "/dev/mapper/veracrypt" not in list_output:
+                raise TestError("container did not appear in veracrypt --list output")
+            console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180)
 
 
 def parse_args():
@@ -786,6 +793,8 @@ def parse_args():
 
 def main():
     args = parse_args()
+    if not args.skip_container and "," in args.password:
+        raise TestError("--password cannot contain commas: mount.veracrypt uses comma-separated options")
     args.ipk = args.ipk.resolve()
     if not args.ipk.exists():
         raise TestError(f"Package does not exist: {args.ipk}")