Repository navigation
opengnb: add opengnb 1.6.8 to openwrt - #29879
charleschan2006-alias wants to merge 1 commit into
Conversation
There was a problem hiding this comment.
Pull request overview
Adds the opengnb package to the OpenWrt packages feed at version 1.6.5, enabling users to build/install OpenGNB (P2P decentralized virtual network/VPN) from the feed.
Changes:
- Introduces
net/opengnb/Makefiledefining the new package metadata, source fetch, and build/install steps. - Builds OpenGNB using the upstream
Makefile.openwrtand installsgnb,gnb_crypto, andgnb_ctlinto/usr/sbin.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This comment was marked as low quality.
This comment was marked as low quality.
This comment was marked as low quality.
This comment was marked as low quality.
|
These test errors are all occurring within Docker, mentioning: |
cab7043 to
013be9b
Compare
2aa84a9 to
d726341
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 2 new commits. CI (FormalityCheck) passes on the head commit; the earlier natpmpc test failures were resolved by dropping the miniupnpc/libnatpmp dependencies in the 1.6.6 update. Commit messages match their diffs. Two minor nits inline (file mode, series hygiene); no blocking issues found.
Generated by Claude Code
d726341 to
a72ccc9
Compare
charleschan2006-alias
changed the title
5808f51 to
b171fdf
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit; no new issues found. The two prior nits are resolved: the Makefile is now committed with mode 100644, and history was squashed into a single opengnb: add version 1.6.6 commit with the PR title/description updated to match PKG_VERSION. FormalityCheck CI passes on the head commit.
Generated by Claude Code
|
Hi all, I have fixed the license identifiers according to the guidelines and double-checked the package via local compilation. The CI is passing and it is ready for review. Could someone take a look when available? Thanks! |
Is there anything else that needs to be done? |
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.
Suppressed comments (1)
net/opengnb/Makefile:45
- Build/Compile overrides
CFLAGSbut drops$(TARGET_CPPFLAGS)and hard-codes staging include/library paths. In this tree, manual-make packages typically pass bothCFLAGSandCPPFLAGS(e.g.net/pixiewps/MakefilesetsCFLAGSandCPPFLAGSseparately) so target sysroot include paths and hardening defines are preserved. Recommend moving-I.../-D...intoCPPFLAGS, include$(TARGET_CPPFLAGS), and avoid explicit-I$(STAGING_DIR)/usr/include/-L$(STAGING_DIR)/usr/libunless strictly required.
define Build/Compile
$(MAKE) -C $(PKG_BUILD_DIR) \
$(TARGET_CONFIGURE_OPTS) \
CFLAGS="$(TARGET_CFLAGS) -I. -I./src -I./libs -I$(STAGING_DIR)/usr/include -DWITHOUT_MINIUPNPC -D_GNU_SOURCE -DNO_GZIP=1 -DGNB_OPENWRT_BUILD=1" \
LDFLAGS="$(TARGET_LDFLAGS) -L$(STAGING_DIR)/usr/lib -lz -pthread" \
b171fdf to
889395f
Compare
charleschan2006-alias
changed the title
889395f to
59bbd6b
Compare
59bbd6b to
385836d
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit (385836d), which replaces the previously reviewed 1.6.6 state with 1.6.7.
What I verified as correct:
PKG_HASHmatches the upstreamopengnb-1.6.7.tar.gzrelease asset (c2e4aa17…f0443), andPKG_RELEASE:=1is right for a version bump.- The
Build/Compilesimplification holds up. 1.6.7'sMakefile.openwrtnow setsGNB_CFLAGS=$(CFLAGS) -I./src -I./libs -D_GNU_SOURCE -DNO_GZIP=1 -DWITHOUT_MINIUPNPC -DGNB_OPENWRT_BUILD=1itself, so dropping those flags here is not a behaviour change, and-DWITHOUT_MINIUPNPCis still applied — the missing miniupnpc/libnatpmp dependencies stay correct. - Dropping the explicit
allgoal is safe:allis the first target inMakefile.openwrtand the includedMakefile.openwrt.incdefines only variables, no rules, soallremains the default goal. - Removing
-I$(STAGING_DIR)/usr/include/-L$(STAGING_DIR)/usr/libis fine —$(TARGET_CPPFLAGS)and$(TARGET_LDFLAGS)already carry them. Dropping-lz -pthreadfromLDFLAGSis also fine: upstream adds them on thegnbandgnb_eslink lines, andgnb_ctl/gnb_cryptopull in neither zlib nor pthread. This addresses the earlier Copilot remark on the flag handling. - The commit message matches its diff.
Two substantive findings inline: gnb_es is linked without $(TARGET_LDFLAGS) because upstream shadows it with GNB_ES_LDFLAGS, so that binary ships without OpenWrt's hardening/linker flags; and all four binaries embed __DATE__/__TIME__, which upstream lets you switch off with a single define. I'd call the gnb_es link the one worth fixing before merge; the timestamp one is a reproducibility improvement rather than a blocker. The other two comments are optional nits.
On CI: only FormalityCheck has reported on this head commit and all three of its checks are green. The multi-arch test build has not posted a result yet, so there is nothing to read into it either way.
Generated by Claude Code
| $(MAKE) -C $(PKG_BUILD_DIR) \ | ||
| $(TARGET_CONFIGURE_OPTS) \ | ||
| CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \ | ||
| LDFLAGS="$(TARGET_LDFLAGS)" \ |
There was a problem hiding this comment.
$(TARGET_LDFLAGS) never reaches the gnb_es link. Upstream's Makefile.openwrt links that one binary with GNB_ES_LDFLAGS, which is a fresh assignment that does not reference $(LDFLAGS):
GNB_ES_LDFLAGS=-Wl,--gc-sections
...
$(GNB_ES): $(GNB_ES_OBJS) $(CRYPTO_OBJS)
$(CC) -o $(GNB_ES) $(GNB_ES_OBJS) $(CRYPTO_OBJS) $(GNB_ES_LDFLAGS) -pthreadgnb, gnb_ctl and gnb_crypto all link through GNB_LDFLAGS=$(LDFLAGS) and are fine, so of the four binaries installed below, gnb_es is the only one built without the flags OpenWrt puts in TARGET_LDFLAGS: -zrelro / -znow and the PIE specs from hardening.mk, plus -fuse-ld=$(TARGET_LINKER), -zmax-page-size, the toolchain -L paths and the LTO linker plugin when CONFIG_USE_LTO is set.
A variable set on the $(MAKE) command line overrides the makefile's own assignment, so passing it here is enough (-Wl,--gc-sections is kept explicitly because TARGET_LDFLAGS only picks it up when CONFIG_USE_GC_SECTIONS is enabled):
| LDFLAGS="$(TARGET_LDFLAGS)" \ | |
| LDFLAGS="$(TARGET_LDFLAGS)" \ | |
| GNB_ES_LDFLAGS="$(TARGET_LDFLAGS) -Wl,--gc-sections" \ |
Generated by Claude Code
There was a problem hiding this comment.
| define Build/Compile | ||
| $(MAKE) -C $(PKG_BUILD_DIR) \ | ||
| $(TARGET_CONFIGURE_OPTS) \ | ||
| CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \ |
There was a problem hiding this comment.
All four installed binaries embed a compile timestamp, which makes the package non-reproducible — the same source built twice yields different binaries. src/gnb_version.h in the 1.6.7 tarball has:
#ifndef GNB_SKIP_BUILD_TIME
#define GNB_BUILD_STRING "Build Time ["__DATE__","__TIME__"]"
#else
#define GNB_BUILD_STRING "Build Time [Hidden]"
#endifand GNB_BUILD_STRING is referenced from src/cli/gnb.c, gnb_ctl.c, gnb_crypto.c and gnb_es.c, so every one of them is affected. Upstream already provides the opt-out, so defining it here is the whole fix. Feed packages handle build stamps the same way — see net/ratched/Makefile:17 (-DBUILD_TIMESTAMP_UTC="\"unknown\"") and net/socat/Makefile:83 (BUILD_DATE=$(SOURCE_DATE_EPOCH)).
| CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS)" \ | |
| CFLAGS="$(TARGET_CFLAGS) $(TARGET_CPPFLAGS) -DGNB_SKIP_BUILD_TIME" \ |
Generated by Claude Code
There was a problem hiding this comment.
Fixed upstream in 1.6.8, which adds -DGNB_SKIP_BUILD_TIME=1 to GNB_CFLAGS. Thanks.
Generated by Claude Code
| endef | ||
|
|
||
| define Package/opengnb/install | ||
| $(INSTALL_DIR) $(1)/usr/sbin |
There was a problem hiding this comment.
nit / question: gnb is a long-running daemon, but the package installs only the four binaries — there is no /etc/init.d/opengnb and no /etc/config/opengnb, so nothing starts the VPN at boot and there is no UCI surface to configure it. The feed's convention for daemons is a procd init script (#!/bin/sh /etc/rc.common, USE_PROCD=1, start_service()), with any shipped config registered in define Package/opengnb/conffiles.
I can't tell from the diff whether this is deliberate. Worth noting the 1.6.7 tarball ships only a systemd unit (scripts/opengnb@.service) and a examples/node_config_example tree, so there is nothing to install verbatim — an init script would have to be written for this package. Is that planned as a follow-up, or is manual invocation the intent for the initial submission?
Generated by Claude Code
385836d to
6d18701
Compare
charleschan2006-alias
changed the title
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit (6d18701), which replaces the previously reviewed 1.6.7 state with 1.6.8. Nothing blocking; one optional cosmetic nit inline.
What I verified:
PKG_HASH:=4c6a6030…f829matches the upstreamopengnb-1.6.8.tar.gzrelease asset (downloaded and hashed independently), andPKG_RELEASE:=1is correct for a version bump.- Both substantive findings from my 1.6.7 review are fixed upstream in 1.6.8, so no change is needed in this Makefile for either.
Makefile.openwrtnow readsGNB_ES_LDFLAGS=$(LDFLAGS)(was-Wl,--gc-sections), sognb_esfinally links with$(TARGET_LDFLAGS)like the other three binaries; andGNB_CFLAGSgained-DGNB_SKIP_BUILD_TIME=1, so none of the four binaries embeds__DATE__/__TIME__any more (src/gnb_version.hnow resolvesGNB_BUILD_STRINGto"Build Time [Hidden]"). The two corresponding inline threads from the last review are stale and can be resolved. - The full 1.6.7 → 1.6.8 upstream diff is confined to the per-platform
Makefile.*,src/gnb_version.handversion— no new sources and no new library usage — soDEPENDS:=+kmod-tun +libpthread +zlibis still accurate:gnbstill links-lz -pthread, and-DWITHOUT_MINIUPNPCis still set, so the miniupnpc/libnatpmp dependencies stay correctly absent. - Omitting an explicit make goal is still safe:
allremains the first target inMakefile.openwrt, andMakefile.openwrt.incstill defines only object-list variables, no rules. - The commit message matches its diff, carries a
Signed-off-by, and the file is committed with mode100644.
CI: the three FormalityCheck jobs are green on the head commit. The multi-arch test build has not reported on this commit yet, so there is nothing to read into it either way.
Still open from the previous round: the question about whether a procd init script (/etc/init.d/opengnb) and a UCI config are planned, since gnb is a long-running daemon and the package currently installs binaries only. That thread has not been answered.
Generated by Claude Code
04fb620 to
403d211
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Reviewed 1 new commit (403d211); no new issues found.
The only change since the previously reviewed state is the cosmetic alignment nit from my last round: the LDFLAGS="$(TARGET_LDFLAGS)" continuation line now pads with a single space like the three lines around it, so the whole Build/Compile block is consistent. Nothing else in net/opengnb/Makefile moved — PKG_VERSION/PKG_RELEASE/PKG_HASH, DEPENDS, the recipe body and the install block are byte-identical to what I verified at 1.6.8, the file is still committed with mode 100644, and the commit subject matches its diff.
Housekeeping on the older inline threads, so the list reflects reality:
- The
gnb_es/$(TARGET_LDFLAGS)thread and the__DATE__/__TIME__reproducibility thread are both stale — 1.6.8 fixes each upstream (GNB_ES_LDFLAGS=$(LDFLAGS)and-DGNB_SKIP_BUILD_TIME=1inMakefile.openwrt), so no change is needed here. They can be resolved. - Still unanswered from two rounds ago: whether a procd init script (
/etc/init.d/opengnb) and a UCI config are planned.gnbis a long-running daemon and the package currently installs binaries only, so nothing starts it at boot. Not a blocker for an initial submission if that is the intent — it would just be good to say so on the record.
Generated by Claude Code
OpenGNB does not require a configuration file; the daemon process can be started directly via a command in the terminal window. |
403d211 to
0bac353
Compare
openwrt-ai
left a comment
openwrt-ai
left a comment
There was a problem hiding this comment.
Commit checks
0bac353"opengnb: add version 1.6.8" — optional, does not block a merge: the new body is accurate and matches the diff, but the subject still reads like a version bump of an already-packaged program, while the diff createsnet/opengnb/from scratch. The in-tree convention for a first submission is<pkg>: add new package(recent examples in this repo:nodogsplash: add new package,bird3: add new package,librespeed-cli-rust: add new package). Worth a reword if you touch the branch again; not worth a force-push on its own.
Reviewed 1 new commit (0bac353), which replaces 403d211.
The tree did not change. git diff 403d211..0bac353 is empty — net/opengnb/Makefile is byte-identical to the state I verified at 1.6.8: same PKG_VERSION/PKG_RELEASE/PKG_HASH, same DEPENDS, same Build/Compile and install block, still committed with mode 100644. The only difference is that the commit gained a message body. So all the substance I checked in the previous rounds still stands and I found nothing new.
Re-verified on this head anyway:
PKG_HASH:=4c6a6030…f829matches the upstreamopengnb-1.6.8.tar.gzrelease asset (downloaded and hashed independently), andPKG_RELEASE:=1is correct.- Omitting an explicit make goal is still safe —
allis the first target inMakefile.openwrtandMakefile.openwrt.incdefines only object-list variables, no rules. All four binaries are linked in the source root, which is where the install block picks them up. - No
test-version.shis needed:gnbhandles-v/--version(src/gnb_argv.c→show_description()insrc/cli/gnb.c) and printsGNB version Dev 1.6.8 protocol version 1.6.0, which containsPKG_VERSION, so the CI generic version check has an executable to satisfy it. (gnb_cryptois the one binary whose usage text omits the version string, but the check is evaluated per package, not per executable.)
Housekeeping on the older inline threads:
- The
gnb_es/$(TARGET_LDFLAGS)thread and the__DATE__/__TIME__reproducibility thread remain stale — 1.6.8 fixes both upstream (GNB_ES_LDFLAGS=$(LDFLAGS)and-DGNB_SKIP_BUILD_TIME=1inMakefile.openwrt, both confirmed again in the 1.6.8 tarball). They can be resolved. - The init-script question is now answered: @gnbdev explained that OpenGNB needs no config file for the basic mode and that key material has to be generated by hand, so no
/etc/init.d/opengnbis shipped. That is a reasonable position for an initial submission and it is now on the record — closing that thread from my side. - Still unanswered, and probably the actual thing holding this up: @BKPepe asked on 2026-07-01 why this PR was opened instead of continuing #29797 / #28956. A short reply there would help a maintainer pick this up.
CI: the three FormalityCheck jobs are green on 0bac353. The multi-arch test build has not reported on this commit, so there is nothing to read into it either way.
Generated by Claude Code
The previous PRs were closed because the upstream releases had bugs and were replaced by newer versions with different version numbers. At the time, I mistakenly thought that a closed PR targeting an older upstream version could not be continued, so I opened a new PR for each replacement release. I now understand that I could have updated the existing branch and reopened or continued the same PR instead. Sorry for creating the duplicate PRs. I will reuse the existing PR in the future. Thank you for pointing this out. |
|
@BKPepe Hi, this PR adds new package opengnb 1.6.8. All previously raised issues have been resolved:
CI checks are all green. I've built & tested ipk on x86_64 and aarch64 OpenWrt snapshot, binary runs fine. Could you please take a look and give a review when you have time? Thanks. |
|
This OpenWrt gnb package is a feature I've been waiting for for a long time. With it, I can connect to |
0bac353 to
3664332
Compare
| # This is free software, licensed under the GNU General Public License v3.0-or-later | ||
| # See /LICENSE for more information. |
There was a problem hiding this comment.
| # This is free software, licensed under the GNU General Public License v3.0-or-later | |
| # See /LICENSE for more information. | |
| # SPDX-License-Identifier: GPL-3.0-or-later |
|
|
||
| define Package/opengnb/install | ||
| $(INSTALL_DIR) $(1)/usr/sbin | ||
| $(INSTALL_BIN) $(PKG_BUILD_DIR)/gnb $(1)/usr/sbin/ |
There was a problem hiding this comment.
nit: the PR description says the package "Includes procd init script and UCI configuration", but this install block ships only the four binaries, with no /etc/init.d/ or /etc/config/ file. That also contradicts the earlier reply saying no init script is included. Please drop that line from the description, and also its opening sentence "Update opengnb package", since this is a new package.
Generated by Claude Code
3664332 to
79a57b7
Compare
| PKG_HASH:=4c6a603080efa79457b889e43e87c1a3a070e7cf7cd7621d1a106a06a161f829 | ||
|
|
||
| PKG_MAINTAINER:=Charles Chan <hollidgelongsun157@gmail.com> | ||
| PKG_LICENSE:=GPL-3.0-only |
There was a problem hiding this comment.
Upstream is GPL-3.0-or-later, not GPL-3.0-only: the 1.6.8 tarball's src/ headers (e.g. src/gnb_keys.c:6-7) say "either version 3 of the License, or (at your option) any later version". This change also no longer matches the file header at line 4 or the PR body.
| PKG_LICENSE:=GPL-3.0-only | |
| PKG_LICENSE:=GPL-3.0-or-later |
Generated by Claude Code
There was a problem hiding this comment.
Add the OpenGNB package so the P2P decentralized virtual network can be built and installed on OpenWrt. Use the target compiler and linker flags, then install the OpenGNB command-line utilities. Signed-off-by: charles chan <hollidgelongsun157@gmail.com>
9a66e73 to
71630c3
Compare
Update opengnb package to the latest version 1.6.8.
📦 Package Details
PKG_MAINTAINER:= Charles Chan hollidgelongsun157@gmail.com
opengnb: add version 1.6.8 to openwrt
Description:
OpenGNB securely connects remote OpenWrt routers and their local networks
directly together over the internet, even when all endpoints are behind
carrier-grade NAT (CGNAT) or firewalls with no public IP and no port forwarding.
Why it is valuable for OpenWrt users:
Transparent Site-to-Site LAN bridging: Connects remote subnets (e.g. Home
192.168.1.0/24 and Office 192.168.2.0/24) directly at the router level.
All PCs, NAS units, and devices can communicate across locations without
installing any software on client devices.
Built for resource-constrained hardware: Written entirely in pure C99 with
no heavy runtime dependencies. Total stripped binary size is only ~350KB,
and runtime memory consumption is under 8MB. Runs comfortably on legacy
and budget routers with as little as 32MB RAM and 8MB Flash.
Direct P2P speed without server bottlenecks: Automatically establishes
direct UDP tunnels between routers using STUN-like index beacons, UPnP,
and multi-socket hole-punching. Traffic flows at full broadband speed.
End-to-end security: Mutual authentication via Ed25519 digital signatures
and encrypted payload stream with time-synchronized key rotation.
Features:
Category: Network / VPN
Dependencies: +kmod-tun +libpthread +zlib
Binaries provided:
Service integration: Includes procd init script and UCI configuration.
License: GPL-3.0-or-later
Upstream: https://github.com/opengnb/opengnb
🧪 Run Testing Details
**OpenWrt Version:OpenWrt SNAPSHOT, r35007-9f385a71a7
**OpenWrt Target/Subtarget:x86/x86_64
**OpenWrt Device:intel NUC 11
Signed-off-by: Charles Chan hollidgelongsun157@gmail.com
✅ Formalities