Skip to content

Reaper v2.7.3 — RT-BE86U

Choose a tag to compare

View all tags
@github-actions github-actions released this 23 Aug 16:17
· 16 commits to main since this release
v2.7.3-RT-BE86U
ee7dc87

v2.7.3 — polish pass + Gatekeeper learns AiMesh exists (in progress, not yet built)

Firmware-update manifest signing — built, and shelved inert for now (owner decision). The
full machinery exists: the manifest can be signed (RSA-4096/SHA-256) with a key that exists only
offline — deliberately not in the repository and not in CI — and the router can verify the
signature against a public key baked into the firmware before honouring a single field, refusing a
missing or invalid signature outright. For this release the enforcement ships disabled: the
verify code, embedded public key, signing tooling and CI checks are all present but inert behind
two explicit switches (REAPER_SIG_ENFORCE in the check script — a rebuild, deliberately — and
build-scripts/signing.conf for the tooling/CI side), so it can be turned on end-to-end later
without rework.
(Key note: the shipped OpenSSL 1.1.1 CLI has no one-shot Ed25519, so RSA via dgst is the
primitive; if the tree later moves to Merlin's OpenSSL 3.x-with-shim arrangement, the documented
rotation path can move the key to Ed25519.)

A refused signature explains itself: instead of the generic "check failed", the Firmware page
says the update list failed authentication, that this is briefly expected right after a release is
published, and that a persistent failure can mean a compromised source. Beside it, an explicit
Override exists for the operator who knows what they are doing: a danger dialog whose confirm
button only unlocks after typing OVERRIDE, arming a one-shot flag the next check consumes — the
overridden offer then stays visibly branded UNVERIFIED, and the override is loudly logged. It can
never happen by accident, and it never persists.

rwatch's self-heals now run under the firewall lock. The policy-routing and Warden chain
re-asserts used to run the (idempotent) apply scripts outside rc's firewall lock — at worst a
transient inconsistency, but shell flock can't take rc's POSIX fcntl lock, so a small rc applet
now takes the real lock and runs the (allow-listed) heal script; a heal that races a firewall
rebuild serializes behind it.

AiMesh onboarding and mesh nodes are now exempt from Gatekeeper. A full review of the
add-node/search path (prompted by contradictory field reports) proved the search/add chain itself
is byte-for-byte stock — but no Reaper enforcement layer knew AiMesh existed: with Gatekeeper in
default-deny mode, a joining node got its DHCP lease and then every packet to the router's mesh
controller was dropped, so adding a node stalled right after association — and enabling
default-deny on an existing mesh silently cut the nodes' control traffic. Now the mesh's own
pairing registry exempts node MACs from every Gatekeeper surface (ahead of per-device rules, so a
mis-filed entry can never sever a live backhaul), the exemptions refresh automatically when a node
joins or leaves, and while an add is actually in progress the quarantine gate is held open for
router-bound traffic only — time-boxed, and closed within seconds of the add finishing. The
diagnostic's Gatekeeper section now shows the registry and window state.

  • Full-backup card alignment: the new card on the Administration page now sits flush with the
    stock table under it instead of floating centered.
  • USB format confirmation (and Safely Remove) now use a Reaper-themed dialog instead of the
    browser's stock popup. Formatting requires a deliberate click — Enter does not confirm it. The
    themed dialog is a shared helper other pages will adopt over time.
  • The owner's guide is one click away everywhere: a ? in the shell and dashboard topbars opens
    docs/REAPER-GUIDE.md; the Firewall, Gatekeeper, Warden, Storage and USB pages deep-link their own
    guide sections beside the page title; the About page carries an "Owner's Guide" button; the
    first-boot page mentions it. External links only — the router never fetches anything.
  • Flash page "Cancel leaves the buttons dead": a harness executing the page's real script shows
    every Cancel path in current firmware leaves the page fully usable — the report matches the
    pre-v2.3.4 polling bug that was fixed then. One residual wedge (an error thrown between arming
    and the overlay painting) is now cleared automatically. If it recurs on v2.7.x, exact steps
    would pin it.

Images & checksums (RT-BE86U)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Variant File SHA-256
+ AI Advisor RT-BE86U_3006_102.8_Reaper_v2.7.3_nand_squashfs.pkgtb b00073665f6c766abf49f4b0cd0f249f273744231b7ad2241de9271512becf9c
Standard RT-BE86U_3006_102.8_Reaper_v2.7.3_noMCP_nand_squashfs.pkgtb 77476841a65fb4877433c7553ebfcdc916a110808bd40ae357043ed8a09a54f4

Verify a download against the attached SHA256SUMS-RT-BE86U-Reaper_v2.7.3.txt.

Corresponding source & reproducibility

The RT-BE86U image for v2.7.3 is built from this repository at tag v2.7.3-RT-BE86U: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v2.7.3-RT-BE86U (patches + docs).

Assets 5
Loading