From 13bd6297330709eb3b64722958b64d382734fc8f Mon Sep 17 00:00:00 2001 From: Mounir IDRASSI Date: Thu, 22 Oct 2026 09:53:32 +0900 Subject: [PATCH] OpenWrt: preserve SDK selections and cover the mount helper Apply the configuration seed after feed installation so defconfig keeps runtime package selections. Require Bash to be absent and exercise mount.veracrypt in the QEMU smoke test. Scope installer errexit so subsequent failures report their status. --- src/Build/Packaging/openwrt/README.md | 9 ++++++--- src/Build/build_veracrypt_openwrt.sh | 3 ++- src/Build/test_veracrypt_openwrt_qemu.py | 25 ++++++++++++++++-------- 3 files changed, 25 insertions(+), 12 deletions(-) diff --git a/src/Build/Packaging/openwrt/README.md b/src/Build/Packaging/openwrt/README.md index 6a9c2581..09d0b750 100644 --- a/src/Build/Packaging/openwrt/README.md +++ b/src/Build/Packaging/openwrt/README.md @@ -87,7 +87,8 @@ The test script downloads and verifies the matching OpenWrt x86/64 ext4 image, boots it with QEMU user networking, waits for OpenWrt network init to settle, gets a DHCP lease on `br-lan` or `eth0`, resolves the needed dependency closure from local SDK `.ipk` control metadata plus the official OpenWrt kmod feed, -serves those packages to the guest, and installs them with `opkg`. It then runs: +serves those packages to the guest, and installs them with `opkg`. It verifies +that Bash is unavailable, then runs: ```sh veracrypt --text --version @@ -96,8 +97,10 @@ veracrypt --text --test By default it also creates a 16 MiB AES/SHA-512 test container, opens it with `--filesystem=none`, verifies it appears in `veracrypt --text --list`, and -unmounts it. Use `--skip-container` to run only the package install, version, -and algorithm self-test path. +unmounts it. It repeats the mount/list/unmount check through `mount.veracrypt`. +The test password must not contain commas because the helper uses comma-separated +options. Use `--skip-container` to run only the package install, Bash absence, +version, and algorithm self-test path. If QEMU was extracted locally instead of installed system-wide, pass the binary and firmware directory explicitly: diff --git a/src/Build/build_veracrypt_openwrt.sh b/src/Build/build_veracrypt_openwrt.sh index de8c1a77..566b88a7 100755 --- a/src/Build/build_veracrypt_openwrt.sh +++ b/src/Build/build_veracrypt_openwrt.sh @@ -302,7 +302,6 @@ render_package_makefile() { configure_sdk() { [ -f "$OPENWRT_CONFIG" ] || die "Missing OpenWrt config seed: $OPENWRT_CONFIG" - cp "$OPENWRT_CONFIG" "$SDK_DIR/.config" ( cd "$SDK_DIR" if ! PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base; then @@ -311,6 +310,8 @@ configure_sdk() { PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds update packages base fi PATH="$HOST_TOOLS/bin:$PATH" ./scripts/feeds install fuse3 lvm2 util-linux pcsc-lite + # Feed updates run defconfig before feed package symbols are available. + cp "$OPENWRT_CONFIG" "$SDK_DIR/.config" PATH="$HOST_TOOLS/bin:$PATH" make defconfig ) } diff --git a/src/Build/test_veracrypt_openwrt_qemu.py b/src/Build/test_veracrypt_openwrt_qemu.py index 11ec0eba..096f2a66 100755 --- a/src/Build/test_veracrypt_openwrt_qemu.py +++ b/src/Build/test_veracrypt_openwrt_qemu.py @@ -701,7 +701,9 @@ def run_guest_tests(args, console, http_port, packages): timeout=120, ) - console.run(package_download_command(packages, http_port), timeout=900) + # Keep the installer's set -e local so later failures report their status. + console.run(f"(\n{package_download_command(packages, http_port)}\n)", timeout=900) + console.run("! command -v bash", timeout=60) version_output = console.run("veracrypt --text --version", timeout=120) if "VeraCrypt " not in version_output: @@ -714,6 +716,9 @@ def run_guest_tests(args, console, http_port, packages): if not args.skip_container: quoted_container_size = sh_quote(args.container_size) quoted_password = sh_quote(args.password) + quoted_helper_options = sh_quote( + f"password={args.password},pim=0,keyfiles=,protect-hidden=no,fs=none" + ) console.run("dd if=/dev/urandom of=/tmp/vc-random.bin bs=1M count=1", timeout=120) console.run( "veracrypt --text --create /tmp/openwrt-test.hc " @@ -725,16 +730,18 @@ def run_guest_tests(args, console, http_port, packages): timeout=360, ) console.run("mkdir -p /mnt/veracrypt-test", timeout=60) - console.run( + for mount_command in ( "veracrypt --text --mount /tmp/openwrt-test.hc /mnt/veracrypt-test " f"--password={quoted_password} " "--pim=0 --keyfiles='' --protect-hidden=no --filesystem=none --non-interactive", - timeout=240, - ) - list_output = console.run("veracrypt --text --list", timeout=120) - if "/dev/mapper/veracrypt" not in list_output: - raise TestError("container did not appear in veracrypt --list output") - console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180) + "/sbin/mount.veracrypt /tmp/openwrt-test.hc /mnt/veracrypt-test " + f"-o {quoted_helper_options}", + ): + console.run(mount_command, timeout=240) + list_output = console.run("veracrypt --text --list", timeout=120) + if "/dev/mapper/veracrypt" not in list_output: + raise TestError("container did not appear in veracrypt --list output") + console.run("veracrypt --text --unmount /tmp/openwrt-test.hc", timeout=180) def parse_args(): @@ -786,6 +793,8 @@ def parse_args(): def main(): args = parse_args() + if not args.skip_container and "," in args.password: + raise TestError("--password cannot contain commas: mount.veracrypt uses comma-separated options") args.ipk = args.ipk.resolve() if not args.ipk.exists(): raise TestError(f"Package does not exist: {args.ipk}")