Attended Sysupgrade OpenWrt 24.10.3 to 24.10.4 on GL-MT2500

[alramon]

root@OpenWrt:~# owut upgrade --verbose
owut - OpenWrt Upgrade Tool 2025.09.27~f049043e-r1 (/usr/bin/owut)
ASU-Server     https://sysupgrade.openwrt.org
Upstream       https://downloads.openwrt.org
Target         mediatek/filogic
Profile        glinet_gl-mt2500
Package-arch   aarch64_cortex-a53
Root-FS-type   squashfs
Sys-type       sysupgrade
Version-from   24.10.3 r28872-daca7c049b (kernel 6.6.104)
Version-to     24.10.4 r28959-29397011cc (kernel 6.6.110)
Build-commit   https://git.openwrt.org/?p=openwrt/openwrt.git;a=shortlog;h=29397011cc
Build-FS-type  squashfs
Build-at       2025-10-19T16:37:45Z (~3 days ago)
Image-prefix   openwrt-24.10.4-mediatek-filogic-glinet_gl-mt2500
Image-URL      https://downloads.openwrt.org/releases/24.10.4/targets/mediatek/filogic
Image-file     openwrt-24.10.4-mediatek-filogic-glinet_gl-mt2500-squashfs-sysupgrade.bin
Installed      168 packages
Top-level       52 packages
Default         35 packages
User-installed  23 packages (top-level only)

Package version changes:
  base-files                          1662~daca7c049b                             1665~29397011cc
  kmod-crypto-acompress               6.6.104-r1                                  6.6.110-r1
  kmod-crypto-aead                    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-authenc                 6.6.104-r1                                  6.6.110-r1
  kmod-crypto-crc32c                  6.6.104-r1                                  6.6.110-r1
  kmod-crypto-des                     6.6.104-r1                                  6.6.110-r1
  kmod-crypto-hash                    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-hmac                    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-hw-safexcel             6.6.104-r1                                  6.6.110-r1
  kmod-crypto-kpp                     6.6.104-r1                                  6.6.110-r1
  kmod-crypto-lib-chacha20            6.6.104-r1                                  6.6.110-r1
  kmod-crypto-lib-chacha20poly1305    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-lib-curve25519          6.6.104-r1                                  6.6.110-r1
  kmod-crypto-lib-poly1305            6.6.104-r1                                  6.6.110-r1
  kmod-crypto-manager                 6.6.104-r1                                  6.6.110-r1
  kmod-crypto-md5                     6.6.104-r1                                  6.6.110-r1
  kmod-crypto-null                    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-sha1                    6.6.104-r1                                  6.6.110-r1
  kmod-crypto-sha256                  6.6.104-r1                                  6.6.110-r1
  kmod-crypto-sha512                  6.6.104-r1                                  6.6.110-r1
  kmod-gpio-button-hotplug            6.6.104-r5                                  6.6.110-r5
  kmod-hwmon-core                     6.6.104-r1                                  6.6.110-r1
  kmod-leds-gpio                      6.6.104-r1                                  6.6.110-r1
  kmod-lib-crc-ccitt                  6.6.104-r1                                  6.6.110-r1
  kmod-lib-crc32c                     6.6.104-r1                                  6.6.110-r1
  kmod-lib-lzo                        6.6.104-r1                                  6.6.110-r1
  kmod-libphy                         6.6.104-r1                                  6.6.110-r1
  kmod-nf-conntrack                   6.6.104-r1                                  6.6.110-r1
  kmod-nf-conntrack6                  6.6.104-r1                                  6.6.110-r1
  kmod-nf-flow                        6.6.104-r1                                  6.6.110-r1
  kmod-nf-log                         6.6.104-r1                                  6.6.110-r1
  kmod-nf-log6                        6.6.104-r1                                  6.6.110-r1
  kmod-nf-nat                         6.6.104-r1                                  6.6.110-r1
  kmod-nf-reject                      6.6.104-r1                                  6.6.110-r1
  kmod-nf-reject6                     6.6.104-r1                                  6.6.110-r1
  kmod-nfnetlink                      6.6.104-r1                                  6.6.110-r1
  kmod-nft-core                       6.6.104-r1                                  6.6.110-r1
  kmod-nft-fib                        6.6.104-r1                                  6.6.110-r1
  kmod-nft-nat                        6.6.104-r1                                  6.6.110-r1
  kmod-nft-offload                    6.6.104-r1                                  6.6.110-r1
  kmod-nls-base                       6.6.104-r1                                  6.6.110-r1
  kmod-phy-aquantia                   6.6.104-r1                                  6.6.110-r1
  kmod-ppp                            6.6.104-r1                                  6.6.110-r1
  kmod-pppoe                          6.6.104-r1                                  6.6.110-r1
  kmod-pppox                          6.6.104-r1                                  6.6.110-r1
  kmod-slhc                           6.6.104-r1                                  6.6.110-r1
  kmod-udptunnel4                     6.6.104-r1                                  6.6.110-r1
  kmod-udptunnel6                     6.6.104-r1                                  6.6.110-r1
  kmod-usb-core                       6.6.104-r1                                  6.6.110-r1
  kmod-usb-xhci-hcd                   6.6.104-r1                                  6.6.110-r1
  kmod-usb-xhci-mtk                   6.6.104-r1                                  6.6.110-r1
  kmod-usb3                           6.6.104-r1                                  6.6.110-r1
  kmod-wireguard                      6.6.104-r1                                  6.6.110-r1
  libmbedtls                          3.6.4-r1                                    3.6.5-r1
  libubus                             2025.07.02~5952b48e-r1                      2025.10.17~60e04048-r1
  luci                                25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-app-attendedsysupgrade         25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-app-firewall                   25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-app-package-manager            25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-app-wol                        25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-base                           25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-lib-uqr                        25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-light                          25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-mod-admin-full                 25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-mod-network                    25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-mod-status                     25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-mod-system                     25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-proto-ipv6                     25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-proto-ppp                      25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-proto-wireguard                25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-ssl                            25.264.71301~3974d8a                        25.292.66247~75e41cb
  luci-theme-bootstrap                25.264.71301~3974d8a                        25.292.66247~75e41cb
  odhcpd-ipv6only                     2024.05.08~a2988231-r1                      2025.10.02~b14cf98c-r1
  ubus                                2025.07.02~5952b48e-r1                      2025.10.17~60e04048-r1
  ubusd                               2025.07.02~5952b48e-r1                      2025.10.17~60e04048-r1
75 packages are out-of-date

Default package analysis:
  Default                             Provided-by
  nftables                            nftables-json

There are currently package build failures for 24.10.4 aarch64_cortex-a53:
  Feed: packages
    syslog-ng                         Tue Oct 21 11:49:32 2025 - not installed
  Feed: telephony
    dahdi-linux                       Tue Oct 21 10:48:17 2025 - not installed
    dahdi-tools                       Tue Oct 21 11:14:38 2025 - not installed
    libpri                            Tue Oct 21 11:22:04 2025 - not installed
Failures don't affect this device, details at
  https://downloads.openwrt.org/releases/faillogs-24.10/aarch64_cortex-a53/

Request:
  Version 24.10.4 r28959-29397011cc (kernel 6.6.110)
Request hash:
  9b7fb9341158f293924d28980edfadd87ba6332d482bed10d2362c117818f2a9
--
Status:   done
Progress:   0s total =   0s in queue +   0s in build

Build succeeded in   0s total =   0s in queue +   0s to build:
  version_number = 24.10.4
  version_code   = r28959-29397011cc (requested r28959-29397011cc)
  kernel_version = 6.6.110
  rootfs_size_mb = default
  init-script    = no-init-script

Image source: https://sysupgrade.openwrt.org/store/a29ba1c034a0c1515f2ba2f8ed7ba4770ca282f2d20fd0f228298bc9a6d6c9a5/openwrt-24.10.4-16084cf42d80-mediatek-filogic-glinet_gl-mt2500-airoha-squashfs-sysupgrade.bin
Image saved : /tmp/firmware.bin
Manifest    : /tmp/firmware-manifest.json
Verifying   : /tmp/firmware.bin (8203146 bytes) against /tmp/firmware.sha256sums
  Saved sha256 matches
ERROR: sysupgrade validation failed:
stderr =
invalid sysupgrade file
Image check failed.

[efahl]

Could you run owut download, then do some checks on the result? After the download, show me the output from:

ls -la /tmp/firmware*
sysupgrade --test /tmp/firmware.bin
cat /tmp/sysupgrade.meta

[alramon]

Could you run owut download, then do some checks on the result? After the download, show me the output from:

ls -la /tmp/firmware*
sysupgrade --test /tmp/firmware.bin
cat /tmp/sysupgrade.meta

This is the output of these commands:

root@OpenWrt:~# owut download
ASU-Server     https://sysupgrade.openwrt.org
Upstream       https://downloads.openwrt.org
Target         mediatek/filogic
Profile        glinet_gl-mt2500
Package-arch   aarch64_cortex-a53
Version-from   24.10.3 r28872-daca7c049b (kernel 6.6.104)
Version-to     24.10.4 r28959-29397011cc (kernel 6.6.110)
75 packages are out-of-date
Request hash:
  8b885e3f83ea10a2f6ece0c3b566f26d21fac2edd56428260bd6bb9c1059eb23
--
Status:   done
Progress:   0s total =   0s in queue +   0s in build

Build succeeded in   0s total =   0s in queue +   0s to build:
Image saved : /tmp/firmware.bin
ERROR: sysupgrade validation failed:
stderr =
invalid sysupgrade file
Image check failed.
root@OpenWrt:~# ls -la /tmp/firmware*
-rw-r--r--    1 root     root         49385 Oct 25 19:02 /tmp/firmware-manifest.json
-rw-r--r--    1 root     root            84 Oct 25 19:02 /tmp/firmware.sha256sums
root@OpenWrt:~# sysupgrade --test /tmp/firmware.bin
Sat Oct 25 19:04:32 CEST 2025 upgrade: Image metadata not present
Sat Oct 25 19:04:32 CEST 2025 upgrade: Use sysupgrade -F to override this check when downgrading or flashing to vendor firmware
invalid sysupgrade file
Image check failed.
root@OpenWrt:~# cat /tmp/sysupgrade.meta
root@OpenWrt:~#

I have also tried to repeat the owut upgrade command and see if I get a non empty sysupgrade.meta file, which has been the case:

root@OpenWrt:/tmp# cat sysupgrade.meta
{  "metadata_version": "1.1", "compat_version": "1.0",   "supported_devices":["glinet,gl-mt2500-airoha","glinet,mt2500-emmc","glinet,gl-mt2500"], "version": { "release": "24.10.4", "date": "20251026010026", "dist": "OpenWrt", "version": "24.10.4", "revision": "r28959-29397011cc", "target": "mediatek/filogic", "board": "glinet_gl-mt2500-airoha" } }

Although still no signs of the firmware.bin file, despite the filesystem having enough space left:

root@OpenWrt:/tmp# df -h | grep /tmp
tmpfs                   493.8M      1.3M    492.4M   0% /tmp

[efahl]

... "supported_devices":["glinet,gl-mt2500-airoha", ...

It's an upstream error for that device, see openwrt/openwrt#20566

[alramon]

Thank you for the heads up

[map-b]

openwrt/openwrt#18799 (comment)

This is what I see:
These are the entries we get from supported_devices

asu/asu/util.py

Lines 563 to 567 in 0328704

	app.profiles[version][target] = {
	name.replace(",", "_"): profile
	for profile, data in response.json()["profiles"].items()
	for name in data.get("supported_devices", []) + [profile]
	}

{
gl-mt2500: gl-mt2500,
gl-mt2500-emmc: gl-mt2500,
gl-mt2500-airoha: gl-mt2500,
gl-mt2500: gl-mt2500,
gl-mt2500-airoha: gl-mt2500-airoha,
gl-mt2500-emmc: gl-mt2500-airoha,
gl-mt2500: gl-mt2500-airoha,
gl-mt2500-airoha: gl-mt2500-airoha
}
Which ends up creating mappings like this: (that is why we have issues)
(in this case always selecting the airoha profile)
{
gl-mt2500-emmc: gl-mt2500-airoha,
gl-mt2500: gl-mt2500-airoha,
gl-mt2500-airoha: gl-mt2500-airoha
}
Proposed change:
{
gl-mt2500: gl-mt2500,
gl-mt2500: gl-mt2500-emmc,
gl-mt2500: gl-mt2500-airoha,
gl-mt2500: gl-mt2500,
gl-mt2500-airoha: gl-mt2500-airoha,
gl-mt2500-aihora: gl-mt2500-emmc,
gl-mt2500-airoha: gl-mt2500,
gl-mt2500-airoha: gl-mt2500-airoha
}
Which would end up creating mappings like this:
{
gl-mt2500: [gl-mt2500, gl-mt2500-emmc, gl-mt2500-airoha, gl-mt2500],
gl-mt2500-airoha: [gl-mt2500-airoha, gl-mt2500-emmc, gl-mt2500, gl-mt2500-airoha]
}

This was before to try to test the alternative and find out that the prefix with "," or "_" (which I omitted when thinking about this) really matter so I have to rethink this.
openwrt/openwrt#20632 (comment)

[efahl]

gl-mt2500: gl-mt2500-airoha,

That's the only problematic one of those that you show for the current state, and it is resolved by the pending PR.

[map-b]

Excuse me for my confuse comment, this is what I mean:

Right now we got this when generating the app.profiles[version][target]
{
'glinet_gl-mt2500': 'glinet_gl-mt2500',
'glinet_gl-mt2500-emmc': 'glinet_gl-mt2500',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500',
'glinet_gl-mt2500': 'glinet_gl-mt2500',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500-emmc': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500-airoha'
}
which ends up like this: (not working)
{
'glinet_gl-mt2500': 'glinet_gl-mt2500-airoha',
'glinet_mt2500-emmc': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500-airoha'
}
Before commit "sanitize profile" 1579236
{
'glinet,gl-mt2500': 'glinet_gl-mt2500',
'glinet,gl-mt2500-emmc': 'glinet_gl-mt2500',
'glinet,gl-mt2500-airoha': 'glinet_gl-mt2500',
'glinet_gl-mt2500': 'glinet_gl-mt2500',
'glinet,gl-mt2500-airoha': 'glinet_gl-mt2500-airoha',
'glinet,gl-mt2500-emmc': 'glinet_gl-mt2500-airoha',
'glinet,gl-mt2500': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500-airoha'
}
which ends up like this: (working only works firmware-selector which use the profile directly, no DTS compatible)
{
'glinet,gl-mt2500': 'glinet_gl-mt2500-airoha',
'glinet,mt2500-emmc': 'glinet_gl-mt2500-airoha',
'glinet,gl-mt2500-airoha': 'glinet_gl-mt2500-airoha',
'glinet_gl-mt2500': 'glinet_gl-mt2500',
'glinet_gl-mt2500-airoha': 'glinet_gl-mt2500-airoha'
}

In both cases we are losing information but if we "sanitize" before creating this Dict is too much.

[efahl]

This is not a bug in ASU, its root cause is the SUPPORTED_DEVICES for these two specific devices, which also manifests as an issue when using sysupgrade. Don't waste your time trying to work around an upstream bug.

[map-b]

First of all, thanks for all your work on these topics and in general.

Following the discussion about adding those "same" SUPPORTED_DEVICES seem legit openwrt/openwrt#18799 (comment).

sysupgrade is not working? The user in the other issue claims in the description that it worked before, and again that building from sources was working so I think the only thing is not working correctly is ASU and this was working until the recent changes in ASU.

Revert the two commits "sanitizing" and fix the bananapi-m2-berry case by adding the comma name to supported_devices? Or maybe modify your commits to check with the profile with comma like the provided by old Luci ASU and check also with the sanitized one ("virtual" un-sanitization only for the check). Can we confirm that old Luci ASU passing no-sanitized profile is a general problem?

Can you give more details of what was happening before the second commit 1579236?

[efahl]

sysupgrade is not working?

Correct. You can at present install either the mt2500 or -airoha image variant on either device. sysupgrade does not give the expected "Device X not supported by this image" error. Subsequently, if you installed the wrong image, the device has no WAN.

[map-b]

But that is expected if there is no way of distinguish between the two variants. This should only be the case for the first installation so not that bad, and this is the point of the initial idea of be able to try both versions.

diff --git a/asu/util.py b/asu/util.py
index 0c17239..9104663 100644
--- a/asu/util.py
+++ b/asu/util.py
@@ -561,9 +561,9 @@ def reload_profiles(app: FastAPI, version: str, target: str) -> bool:
     )
 
     app.profiles[version][target] = {
-        name.replace(",", "_"): profile
+        name: profile
         for profile, data in response.json()["profiles"].items()
-        for name in data.get("supported_devices", []) + [profile]
+        for name in data.get("supported_devices", []) + [profile] + [profile.replace("_", ",")]
     }
 
     return True

This would cover the case for old Luci ASU clients sending the un-sanitized profile.

EDIT: It is not an un-sanitized profile is the DTS compatible string which all ASU's clients are suppose to send except the smarter which try to translate to profile before send the build request (Owut?) and firmware-selector which only knows profiles.json and send the profile directly.