[VERY BETA] Community test builds — Gargoyle on OpenWrt 25.12 (ath79 / mediatek / ipq40xx / x86)

[ispyisail]

Warning

VERY BETA SOFTWARE. These are unofficial, experimental test builds. They have had automated testing but only limited real-hardware time. Flashing beta firmware can brick your router. Do not flash a device you cannot recover (TFTP / serial / vendor recovery), and do not use these on a router you depend on.

Note

Michael (lantis) is working on the proper official release — these builds are not it, and are not a preview of it. This is a community test of a development snapshot, mainly to shake out bugs early and to exercise the new build/signing/hosting pipeline. When the official release arrives, use that.

What this is

Test builds of the Gargoyle development tree on a new OpenWrt 25.12.5 base (kernel 6.12), built, signed, and published by the new automated pipeline. Four targets are included:

Target	Covers
ath79	most older Atheros routers — Archer C7, WNDR3800, …
mediatek	filogic boards incl. GL.iNet GL-MT6000 / Flint 2
ipq40xx	IPQ40xx boards
x86	PC / VM images

Notable changes in this snapshot

(This is beta6, replacing the earlier test builds. Main addition since beta4: a real, working signed OTA firmware-update client — see below — plus three real bugs found and fixed via actual hardware testing on a GL-MT6000, not just simulator runs.)

• OTA firmware-update client is live (System → Update → Check for Updates): fetches a usign-signed manifest, verifies it against the key baked into the firmware, checks your board is listed and meets the hardware floor (RAM/flash), then offers a signed, checksum-verified download and a fail-closed apply path (re-verifies everything fresh immediately before flashing — never trusts an earlier check). An opt-in autocheck cron is available too.
  • Nothing to actually download yet — the manifest-publishing side isn't populated with real device entries yet, so Check for Updates will currently report "not applicable for your board" on every device. This release proves the client works end-to-end (including two real bugs found via hardware testing — see below), not that there's a live update channel to use yet.
• apk-tools now ships on every build profile, not just the internal test profile — found because the very first real-hardware test of the apk-backed package manager (a groundwork feature landing over the last few snapshots) turned up apk: not found on a real GL-MT6000, despite everything else being correctly configured. Fixed and reflashed-verified.
• Two real bugs found via hardware testing, both fixed:
  • OTA's anti-replay protection could get permanently stuck: if a manifest ever regressed to an older timestamp (a legitimate publisher revert, not an attack — it's already signature-verified), every future check failed forever, including checks against genuinely newer manifests. Now it flags the regression and keeps working; the actual rollback protection moved to the download/apply step, where it matters.
  • Removing a plugin that was baked into the image at build time (the normal case for anything in the default package set) could silently report success while leaving the files untouched on disk — confirmed live, gpkg list-installed said a plugin was gone while its actual files were still there. Fixed: a failed removal now correctly stays reported as installed.
• New simulator test coverage added for both bugs above, verified failing pre-fix and passing post-fix before merge.

(Everything from beta4 — new OpenWrt 25.12 base, signed plugin feed, VLAN Manager, port-forwarding WAN-VLAN zone selector, captive portal, multi-tab save-corruption fixes, WireGuard peer preservation, first-boot fixes, the Basic-page Router-IP CIDR fix, DHCP alternative-gateway rework, QoS/DDNS fixes, weburl security hardening — is still in this build too.)

Download

Firmware Finder (search by model name or alias): https://ispyisail.github.io/gargoyle-firmware/

Tip

Not sure exactly which hardware revision you have? Drag your existing Gargoyle backup file (System → Backup → backup.tar.gz) onto the Finder page — it identifies candidate boards from the backup, entirely in your browser (nothing is uploaded).

Direct release page (all files): https://github.com/ispyisail/gargoyle-firmware/releases/tag/v2026.07.19-beta6

Every image has a .sha256 file next to it — check your download with sha256sum <file> and compare. Sysupgrade images also carry a .sig (usign signature) — this is what the new OTA client (above) verifies against automatically; for manual flashing you can check it too, or ignore it.

How to flash

New install (coming from stock vendor firmware): use the -factory image for your exact model, via the vendor's firmware-upgrade page or recovery method (model-specific — check the OpenWrt wiki page for your device).

Already on Gargoyle/OpenWrt: use the -sysupgrade image via System → Update.

Important

This snapshot is on a newer OpenWrt base than any official Gargoyle release. Do not "keep settings" when upgrading from an older Gargoyle — config formats changed between bases and stale settings cause weird breakage. Back up your settings first, flash clean, and reconfigure. (Automatic settings migration across base jumps is being worked on separately — #97 — but it is not in this build.) If you're already on a beta4/beta5 test build, upgrading to beta6 via sysupgrade without keep-settings is the same story.

x86: use the -squashfs-combined (BIOS) or -squashfs-combined-efi (UEFI) .img.gz — gunzip and write to disk:

gunzip -c openwrt-x86-64-generic-squashfs-combined-efi.img.gz | dd of=/dev/sdX

Installing plugins

The Plugins page (System → Plugins) is connected to a signed online feed for these builds. The captive portal, adblock, DoH, email notifications and the rest of the plugin set can be installed from there. Before installing, the router downloads the feed's package list and its usign signature and verifies it against a key baked into the firmware — an unsigned or wrong-key feed is refused rather than installed. This needs working internet access on the router.

Known issues in this snapshot

• Plugin installation needs the router to reach GitHub (the feed is hosted on GitHub Releases). On a router with no upstream internet it will report that it cannot fetch the package list.
• OTA Check for Updates works but has nothing to offer yet (see above) — this is expected right now, not a bug to report.

What is NOT in this build

• 4/32 devices (e.g. TL-WR841) are not supported on this base — the hardware cannot fit modern releases.

Feedback

That is the whole point of this test. If something breaks, reply here or open an issue with: your exact model + hardware revision, the image filename you flashed, what you did, and what happened. "Works fine on <model>" reports are just as valuable as bug reports.

[ispyisail]

Follow-up on your review — thank you

Thanks so much for taking the time to go through the build and for the kind words — and for being clear with everyone that this is a fork and not a preview of the official direction. That framing is exactly right, and the encouragement to note which pieces might be worth proposing for mainline is genuinely appreciated.

Wanted to follow up on the three technical points with what we've found so far. All three are fair, and a couple line up with things we'd already run into.

Patch 022 / apk package naming

Good catch — you're right to flag it. patches-generic/022-kernel_module_packages_include_kernel_checksum_in_version.patch appends -$(LINUX_VERMAGIC) to each kernel module's VERSION, which produces version strings apk isn't happy with. Looking more closely, the kernel-ABI pin is already carried by the EXTRA_DEPENDS := kernel (=$(LINUX_VERSION)~$(LINUX_VERMAGIC)-r$(LINUX_RELEASE)) line right above it, so the extra suffix on VERSION looks redundant on top of being apk-unfriendly.

Our plan is to verify a kmod install/remove through apk on real hardware and, assuming that confirms it, drop the patch (and re-check that a kernel change still triggers a kmod refresh, which is the property it was protecting). Nothing has shipped on this yet — thanks for catching it early.

First-boot timezone / country list

Thanks for flagging this, and for the nudge to check the build environment. We dug into it and traced the freeze to how the timezone/country <script> block gets generated: the page builds those JS arrays by shelling out to awk with a gsub() that backslash-escapes quotes, and busybox awk (what the image ships) treats the replacement string differently from GNU awk, so the quotes come through unescaped, the inline script dies with a SyntaxError, and the dropdown ends up empty with the Save handler wedged.

Because it's the on-device busybox awk rather than anything at build time, it only really shows if you walk the first-boot page on the flashed image — which probably explains why it slipped past. We've switched the escaping to sed (busybox-safe) on our side and have a clean repro (empty dropdown + the console SyntaxError) if that's useful. Since the generation approach is shared lineage, we'd be glad to put the fix up as a small PR for you to look over — entirely your call whether it's relevant to your tree.

WireGuard peer handling

This is a fair point and we take it. The plugin is meant to own the config, and preserving hand-added peers does cut against that. We'd like to follow your lead here: rather than keeping unmanaged peers, the better path is to expand what the plugin can natively express, so there's no need to hand-edit in the first place — then let it manage the full set as designed.

If you have a moment, the most helpful thing would be knowing which peer configurations you'd want Gargoyle to import/represent natively — we're happy to build toward that. (One small thing — the email you mentioned doesn't seem to have reached us, so we may have missed some of your detail on this; happy to pick it up here, or wherever's easiest for you.)

---

Thanks again for the review and the time — really appreciated. We'll keep track of which pieces might be worth proposing upstream, and we're glad to send any of the above over as PRs whenever it's useful to you.