From e158d0e1e8a846e6033789cf14f69c367171be0c Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Fri, 7 Aug 2026 12:49:38 +0200 Subject: [PATCH 1/2] ripe-atlas: keep the direct libopenssl dependency This reverts commit bf43fb1082145b0935c70aed02a6e0c59a252a11. The Atlas busybox links OpenSSL itself, it does not merely inherit it from the ssh tools: $ readelf -d usr/lib/ripe-atlas/measurement/busybox | grep NEEDED 0x00000001 (NEEDED) Shared library: [libcrypto.so.3] 0x00000001 (NEEDED) Shared library: [libssl.so.3] 0x00000001 (NEEDED) Shared library: [libc.so] openssh-client and openssh-keygen do pull libopenssl in today, which is why CheckDependencies stays quiet: .provides is accumulated over the whole dependency closure, so a transitively reachable libcrypto.so.3 satisfies the check just as well as a direct one. That makes the build agree with the drop, but it does not make the package correct - it now links a library it does not depend on, and the day openssh stops needing libopenssl ripe-atlas-common breaks at runtime instead of at build time. Signed-off-by: Josef Schlehofer --- net/ripe-atlas/Makefile | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ripe-atlas/Makefile b/net/ripe-atlas/Makefile index a8abef4942c01..1f89e3d4e07d8 100644 --- a/net/ripe-atlas/Makefile +++ b/net/ripe-atlas/Makefile @@ -65,6 +65,7 @@ define Package/ripe-atlas-common +jsonfilter \ +openssh-client \ +openssh-keygen \ + +libopenssl \ +@OPENSSL_WITH_DEPRECATED \ +@BUSYBOX_CONFIG_KILL \ +@BUSYBOX_CONFIG_KILLALL \ From ceb2b10d1769c3ebe4afe62748fcf60bca23e359 Mon Sep 17 00:00:00 2001 From: Josef Schlehofer Date: Fri, 7 Aug 2026 13:00:39 +0200 Subject: [PATCH 2/2] ripe-atlas: migrate probe key and config from atlas-sw-probe ripe-atlas-probe provides atlas-sw-probe and ripe-atlas-common provides atlas-probe, so a router running the packages this one replaces resolves onto ripe-atlas on the next update. Provides only settles the dependency though, it does not carry any state across, and the two packages share nothing: atlas-sw-probe ripe-atlas-common /etc/atlas/probe_key /etc/ripe-atlas/probe_key /etc/atlas/probe_key.pub /etc/ripe-atlas/probe_key.pub /etc/config/atlas /etc/config/ripe-atlas user atlas (444) user ripe-atlas (445) A probe is identified by its ssh key. generic-ATLAS.sh generates a fresh one whenever $ATLAS_SYSCONFDIR/probe_key is missing, so as it stands every upgraded probe silently re-registers as a new one and drops its probe ID, its measurement history and its credits. There is no way back from that: the old ID stays bound to a key the probe no longer presents. Copy the key over on first start, tightening the private key to 0600 on the way - atlas-sw-probe kept it at 0644. An existing key is never overwritten, so this cannot disturb a probe that already registered. The old init script is stopped and disabled if it is still around. OpenWrt has no Replaces:, and the paths do not overlap, so nothing forces atlas-sw-probe out on a plain opkg upgrade; leaving it enabled would have two probes presenting the same key to the registration servers. Carry the uci settings across as well. Only the spelling of rxtxrpt changed; username has no counterpart and is dropped. Signed-off-by: Josef Schlehofer --- net/ripe-atlas/Makefile | 4 ++ net/ripe-atlas/files/ripe-atlas.defaults | 63 ++++++++++++++++++++++++ 2 files changed, 67 insertions(+) create mode 100644 net/ripe-atlas/files/ripe-atlas.defaults diff --git a/net/ripe-atlas/Makefile b/net/ripe-atlas/Makefile index 1f89e3d4e07d8..72d670fabe6f0 100644 --- a/net/ripe-atlas/Makefile +++ b/net/ripe-atlas/Makefile @@ -100,6 +100,10 @@ define Package/ripe-atlas-common/install $(INSTALL_DIR) $(1)/etc/config $(INSTALL_CONF) ./files/ripe-atlas.conf $(1)/etc/config/ripe-atlas + $(INSTALL_DIR) $(1)/etc/uci-defaults + $(INSTALL_BIN) ./files/ripe-atlas.defaults \ + $(1)/etc/uci-defaults/80-ripe-atlas + $(INSTALL_DIR) $(1)/etc/ripe-atlas $(INSTALL_DIR) $(1)/usr/lib/ripe-atlas/measurement diff --git a/net/ripe-atlas/files/ripe-atlas.defaults b/net/ripe-atlas/files/ripe-atlas.defaults new file mode 100644 index 0000000000000..754d5c15b2998 --- /dev/null +++ b/net/ripe-atlas/files/ripe-atlas.defaults @@ -0,0 +1,63 @@ +#!/bin/sh + +# Take over the state left behind by atlas-sw-probe, the package this one +# provides. A probe is identified by its ssh key, so without this an upgraded +# router registers itself as a brand new probe and loses its probe ID, its +# measurement history and its credits. + +OLD_CONF=/etc/config/atlas +OLD_ETC=/etc/atlas +OLD_INIT=/etc/init.d/atlas +NEW_ETC=/etc/ripe-atlas + +migrate_key() +{ + [ -f "${OLD_ETC}/probe_key" ] || return 0 + + # Never clobber a key this package already registered with. + [ -f "${NEW_ETC}/probe_key" ] && return 0 + + cp "${OLD_ETC}/probe_key" "${NEW_ETC}/probe_key" || return 0 + [ -f "${OLD_ETC}/probe_key.pub" ] && + cp "${OLD_ETC}/probe_key.pub" "${NEW_ETC}/probe_key.pub" + + # atlas-sw-probe left the private key world readable; ssh-keygen would + # have created it as 0600, so settle on that. + chmod 0600 "${NEW_ETC}/probe_key" + [ -f "${NEW_ETC}/probe_key.pub" ] && chmod 0644 "${NEW_ETC}/probe_key.pub" + + # What generic-ATLAS.sh does after generating the key by itself. + chown -R ripe-atlas:ripe-atlas "${NEW_ETC}" + + # Both probes would now present the same key to the registration + # servers, so leave only the new one running. + if [ -x "${OLD_INIT}" ]; then + "${OLD_INIT}" stop + "${OLD_INIT}" disable + fi +} + +migrate_config() +{ + local option + local value + + [ -f "${OLD_CONF}" ] || return 0 + uci -q get ripe-atlas.@ripe-atlas[0] >/dev/null || return 0 + + for option in log_stdout log_stderr; do + value="$(uci -q get "atlas.common.${option}")" && + uci -q set "ripe-atlas.@ripe-atlas[0].${option}=${value}" + done + + # atlas-sw-probe spelled this one without the underscore. + value="$(uci -q get atlas.common.rxtxrpt)" && + uci -q set "ripe-atlas.@ripe-atlas[0].rxtx_report=${value}" + + uci -q commit ripe-atlas +} + +migrate_key +migrate_config + +exit 0