luci-app-attendedsysupgrade and owut by default?

[Hauke Mehrtens]

On 9/27/25 19:40, Daniel Golle wrote:
> On Sat, Sep 27, 2025 at 07:16:33PM +0200, Hauke Mehrtens wrote:
>> I think we would get some negative feedback from users when we remove apk
>> from the default images. We could offer an option in the ASU web interface
>> to remove APK.
>> If we have a button to generate a default image without apk in the firmware
>> selector UI it would be sufficient:
>> https://firmware-selector.openwrt.org/?version=24.10.3&target=mediatek%2Fmt7622&id=linksys_e8450
>> Removing it manually from the list is a bit complicated for the novice user.
> 
> On many devices the only possible outcome of trying to use the package
> manager is a brick because rootfs_overlay got only 1 or 2 JFFS2 blocks
> total. So even **deleting** a package would result in a brick as the
> list of installed packages would be copied to the rootfs_overlay as a
> consequence of *any* change...
> 
> Apart from just not installing the package manager, I believe we should
> also not install 'ca-bundle' on SMALL_FLASH devices, and also select
> CONFIG_CLEAN_IPKG=y by default. Together with an easy to use way to
> generate and install custom ASU-generated images for such a devices the
> outcome would be something much more intuitive and user-friendly than
> an anyway broken package manager (opkg or apk are equally affected by
> this problem, obviously).
> 
>>>> Do we have to install luci-app-attendedsysupgrade and owut for this or is it
>>>> possible with less?
>>>
>>> Either of the two packages is sufficient, we don't need both of them.
>>>
>>>>
>>>> Should we add luci-app-attendedsysupgrade as a dependency to
>>>> luci/collections/luci/Makefile ?
>>>
>>> I'd say yes, but that's just my opinion.
>>
>> I think this is a good option.
>>
>>>> Should we move utils/attendedsysupgrade-common from the package feed to the
>>>> main repository?
>>>
>>> I suggest to merge the content of the utils/attendedsysuprade-common
>>> package into base-files, as the packaging overhead is bigger than the
>>> actual content (a single UCI configuration file).
>>
>> I agree with you.
>>
>> Maybe we should handle the ASU signing key a bit special.
>> This key is not as good protected as the other keys.
>> Maybe store it in /etc/opkg/asu-key/ and use this key for signature checks
>> initialized by the tools using ASU intentionally only.
> 
> +1 makes a lot of sense!
> 
>> So to summarize:
>>   * Add luci-app-attendedsysupgrade as a dependency to the LuCI default
>> collections for all builds with use LuCI.
>>   * Add OWUT for !SMALL_FLASH
>>   * The automatic checks for updates should be opt in, we can keep it like it
>> is for now and improve later.
> 
> +1
> 
> 
>>
>> I would keep apk for now, but make it easy for users to generate images
>> without apk in the firmware selector UI.
> 
> Ok, but lets somehow expose CONFIG_CLEAN_IPKG as an option to the IB and
> ASU as well. That, together with dropping libuclient, ca-bundle and
> owut can be a good option for SMALL_FLASH devices which are then still
> suitable for running LuCI and offer a good overall UIX.
> 
I am scared that the media will simplify this to the following headline:
 > OpenWrt replaces local package manager with cloud service.
This headline will get a lot of clicks. ;-)

Maybe we should remove apk for some boards only where we know that they 
are unusable with it anyway.

I would prefer to have something like profiles in the firmware selector 
interface where users can easily select an image without apk or without 
LuCI support. The text filed is not very intuitive to use.

We should at least mark the images which are too small to provide a full 
package manager so that users are aware.

Hauke