Update w1700k cherrypicks

README.md

@@ -13,9 +13,9 @@ Build and deploy OpenWRT images using shell-style device profiles, via source co
 --release,-r,--version,-v RELEASE ("snapshot", "22.03.3")
 --buildroot,-b PATH (Default: script directory)
 --source
-  Build image from source code, not from Image Builder
+  Build image from source code, not from Image Builder.
-  Allows make config options to be passed in profile
+  Allows make config options to be passed in profile.
-  Uses git worktree for multi-profile deduplication
+  Uses git worktree for multi-profile deduplication.
 --ssh-upgrade HOST
   Example: root@192.168.1.1
 --ssh-backup SSH_PATH

openwrtbuilder

@@ -1,10 +1,11 @@
 #!/usr/bin/env bash
-# Build and deploy OpenWRT images using shell-style device profiles, via source code or the official Image Builder.# Copyright 2022-25 Bryan C. Roessler
+# Build and deploy OpenWRT images using shell-style device profiles, via source code or the official Image Builder.
+# Copyright 2022-25 Bryan C. Roessler
 # Apache 2.0 License
-# See README and profiles for device configuration
+# See README and ./profiles for device configuration
 
 # Set default release
-: "${RELEASE:="24.10.2"}"
+: "${RELEASE:="24.10.5"}"
 
 # @internal
 print_help() {
@@ -21,18 +22,16 @@ print_help() {
 	  --release,-r,--version,-v RELEASE ("snapshot", "22.03.5") 
 	  --buildroot,-b PATH
 	    Default: location of openwrtbuilder script
-	  --source
+	  --source[=CLEAN]
 	    Build image from source, not from Image Builder
-	    Allows make config options to be passed in profile
+	    Optional CLEAN runs the given clean mode before building
-	    Uses git worktree for multi-profile deduplication
+	      (clean|targetclean|dirclean|distclean)
 	  --ssh-upgrade HOST
 	    Examples: root@192.168.1.1, root@router.lan
 	  --ssh-backup SSH_PATH
 	    Enabled by default for --ssh-upgrade
 	  --flash,-f DEVICE
 	    Example: /dev/sdX
-	  --reset
-	    Cleanup all source and output files
 	  --depends
 	    Force dependency installation
 	  --yes,-y
@@ -57,7 +56,7 @@ init() {
 
   # Save the script directory
   # https://stackoverflow.com/a/4774063
-  SCRIPT_DIR="$(cd -- "$(dirname "$0")" >/dev/null 2>&1 || exit $? ; pwd -P)"
+  SCRIPT_DIR=$(readlink -f "$(dirname "${BASH_SOURCE[0]}")")
 
   if [[ -e "/etc/os-release" ]]; then
     source "/etc/os-release"
@@ -126,8 +125,8 @@ parse_input() {
   debug "${FUNCNAME[0]}" "$*"
   declare -ga PROFILES
   declare -gi RESET=0 FROM_SOURCE=0 YES=0 DEBUG=0 FORCE_DEPENDS=0
-  declare -g USER_RELEASE SSH_UPGRADE_PATH SSH_BACKUP_PATH FLASH_DEV
+  declare -g USER_RELEASE SSH_UPGRADE_PATH SSH_BACKUP_PATH FLASH_DEV SOURCE_CLEAN 
-  local long_opts='release:,version:,profile:,buildroot:,source,'
+  local long_opts='release:,version:,profile:,buildroot:,source::,'
   long_opts+='ssh-upgrade:,ssh-backup:,flash:,reset,depends,yes,debug,help'
 
   if _input=$(getopt -o +r:v:p:b:sf:ydh -l $long_opts -- "$@"); then
@@ -137,7 +136,12 @@ parse_input() {
         --release|-r|--version|-v) shift; USER_RELEASE="$1" ;;
         --profile|-p) shift; PROFILES+=("$1") ;;
         --buildroot|-b) shift; BUILD_ROOT="$1" ;;
-        --source|-s) FROM_SOURCE=1 ;;
+        --source|-s) FROM_SOURCE=1
+          case "$1" in
+            -*|"") ;; # if empty
+            *) SOURCE_CLEAN="$1"; shift ;;
+          esac
+          ;;
         --ssh-upgrade) shift; SSH_UPGRADE_PATH="$1" ;;
         --ssh-backup) shift; SSH_BACKUP_PATH="$1" ;;
         --flash|-f) shift; FLASH_DEV="$1" ;;
@@ -171,7 +175,7 @@ install_dependencies() {
     lock_file="$BUILD_ROOT/.dependencies_ib.lock"
   fi
 
-  [[ -f $lock_file ]] && debug "$lock_file lock file exists" && return 0
+  [[ -f $lock_file ]] && debug "$lock_file lock file exists but skipping for --debug" && return 0
 
   if [[ "$mode" == "source" ]]; then
     # For building from source code see:
@@ -185,6 +189,7 @@ install_dependencies() {
           gcc
           gcc-c++
           git
+          golang
           llvm15-libs # for qosify
           make
           ncurses-devel
@@ -203,6 +208,7 @@ install_dependencies() {
           python3-devel
           python3-pyelftools
           python3-setuptools
+          quilt
           rsync
           swig
           tar
@@ -221,10 +227,12 @@ install_dependencies() {
           gcc-multilib
           gettext
           git
+          golang
           liblzma-dev
           libncurses5-dev
           libssl-dev
           python3-distutils
+          quilt
           rsync
           patch
           unzip
@@ -249,6 +257,7 @@ install_dependencies() {
           gcc
           gettext
           git
+          golang
           grep
           groff
           gzip
@@ -263,6 +272,7 @@ install_dependencies() {
           patch
           pkgconf
           python
+          quilt
           rsync
           sed
           texinfo
@@ -507,11 +517,29 @@ from_source() {
   local seed_file="$BUILD_DIR/.config"
   local worktree_meta="$SRC_DIR/.git/worktrees/source-$ref"
   local pkg config commit seed_file description
-  local -a make_opts config_opts
+  local -a make_opts
+  local -a config_opts=(
+    "CONFIG_TARGET_${TARGET%%/*}=y"
+    "CONFIG_TARGET_${TARGET//\//_}=y"
+    "CONFIG_TARGET_PROFILE=DEVICE_$DEVICE"
+    "CONFIG_TARGET_${TARGET//\//_}_DEVICE_$DEVICE=y"
+    "CONFIG_TARGET_ROOTFS_${FILESYSTEM^^}=y"
+    "CONFIG_TARGET_MULTI_PROFILE=n"
+    "CONFIG_BUILDBOT=n"
+    "CONFIG_ALL_KMODS=n" 
+    "CONFIG_ALL_NONSHARED=n"
+    "CONFIG_DEVEL=n"
+    "CONFIG_COLLECT_KERNEL_DEBUG=n"
+    "CONFIG_SDK=n"
+    "CONFIG_SDK_LLVM_BPF=n"
+    "CONFIG_IB=n"
+    "CONFIG_MAKE_TOOLCHAIN=n"
+    "CONFIG_TARGET_PER_DEVICE_ROOTFS=n"
+  )
 
   echo "Building from source is under development"
 
-  # Remove all build directories and worktrees
+  # Remove all build directories and worktrees if --reset
   if ((RESET)); then
     if [[ -d "$BUILD_DIR" || -d "$worktree_meta" ]]; then
       execute git -C "$SRC_DIR" worktree remove --force --force "$BUILD_DIR"
@@ -521,24 +549,63 @@ from_source() {
     [[ -d "$BUILD_DIR" ]] && execute rm -rf "$BUILD_DIR"
   fi
 
-  # Pull or clone source repo
+  # Fetch or clone source repo (no local merges)
   if [[ -d "$SRC_DIR" ]]; then
-    execute git -C "$SRC_DIR" pull
+    execute git -C "$SRC_DIR" fetch origin --tags --prune
   else
     execute mkdir -p "$SRC_DIR"
     execute git clone "$src_url" "$SRC_DIR"
   fi
 
-  # Remove existing build dir and add new worktree
+  # Reuse worktree if present; otherwise create it (support branches and tags)
-  if [[ -d "$BUILD_DIR" ]]; then
+  if git -C "$BUILD_DIR" rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    execute rm -rf "$BUILD_DIR"
+    execute git -C "$BUILD_DIR" fetch origin --tags --prune
-  fi
+    execute git -C "$BUILD_DIR" reset --hard "origin/$ref" || \
+      execute git -C "$BUILD_DIR" reset --hard "$ref" || \
+      execute git -C "$BUILD_DIR" checkout --detach "$ref"
+  else
     execute git -C "$SRC_DIR" worktree prune --verbose
-  execute git -C "$SRC_DIR" worktree add --detach "$BUILD_DIR" "$ref"
+    # Prefer local tag/branch if present, otherwise use remote-tracking branch
+    if ! execute git -C "$SRC_DIR" worktree add --detach "$BUILD_DIR" "$ref"; then
+      execute git -C "$SRC_DIR" worktree add --detach "$BUILD_DIR" "origin/$ref"
+    fi
+  fi
+
+  # Add cherrypicks
+  for entry in ${P_ARR[cherrypicks]}; do
+    url_branch="${entry%%:*}"
+    commit="${entry##*:}"
+
+    branch=""
+    url="$url_branch"
+    if [[ "$url_branch" == *"@"* ]]; then
+      url="${url_branch%@*}"
+      branch="${url_branch#*@}"
+    fi
+
+    remote="${url%.git}"
+    remote="${remote##*/}"
+    remote=${remote//[^A-Za-z0-9._-]/_}
+    [[ -z $remote ]] && remote="cherry"
+
+    if ! git -C "$BUILD_DIR" remote | grep -q "^$remote$"; then
+      execute git -C "$BUILD_DIR" remote add "$remote" "$url"
+    else
+      execute git -C "$BUILD_DIR" remote set-url "$remote" "$url"
+    fi
+
+    if [[ -n $branch ]]; then
+      execute git -C "$BUILD_DIR" fetch "$remote" "$branch"
+    else
+      execute git -C "$BUILD_DIR" fetch "$remote"
+    fi
+    execute git -C "$BUILD_DIR" merge-base --is-ancestor "$commit" HEAD ||
+      execute git -C "$BUILD_DIR" cherry-pick "$commit"
+  done
   
   # Print commit info
   commit=$(git -C "$BUILD_DIR" rev-parse HEAD)
-  description=$(git -C "$BUILD_DIR" describe)
+  description=$(git -C "$BUILD_DIR" describe --always --dirty)
   echo "Current commit hash: $commit"
   echo "Git worktree description: $description"
 
@@ -550,29 +617,24 @@ from_source() {
   # Begin OpenWRT build process
   ((DEBUG)) && make_opts+=("V=sc")
   
-  # Cleanup build environment
+  # Cleanup build environment: heavy clean only when --reset was used earlier
-  execute make "${make_opts[@]}" "-j1" distclean
   # make clean # compiled output
   # make targetclean # compiled output, toolchain
   # make dirclean # compiled output, toolchain, build tools
   # make distclean # compiled output, toolchain, build tools, .config, feeds, .ccache
+  if [[ -n $SOURCE_CLEAN ]]; then
+    execute make "${make_opts[@]}" "-j1" "$SOURCE_CLEAN"
+  else
+    debug "Skipping cleanup step"
+  fi
   
   # Use a custom (faster) mirror
-  # execute sed -i -E 's;git.openwrt.org/(feed|project);github.com/openwrt;' feeds.conf.default
+  execute sed -i -E 's;git.openwrt.org/(feed|project);github.com/openwrt;' feeds.conf.default
 
   # Update package feed
   ./scripts/feeds update -a -f &&
   ./scripts/feeds install -a -f
 
-  # Grab the release seed config
-  if ! execute "$DL_TOOL" "-o" "$seed_file" "$seed_url"; then
-    echo "Could not obtain $seed_file from $seed_url"
-    return 1
-  fi
-
-  # Set compilation output dir
-  config_opts+=("CONFIG_BINARY_FOLDER=\"$BIN_DIR\"")
-
   # Add custom packages
   for pkg in $PACKAGES; do
     if [[ $pkg == -* ]]; then
@@ -582,54 +644,37 @@ from_source() {
     fi
   done
 
-  # Add config options from profile
+  # Add profile config options
   for config in ${P_ARR[config]}; do
     config_opts+=("$config")
   done
 
-  # Only compile selected fs
+  # Reset and write options to config seed file
-  execute sed -i '/CONFIG_TARGET_ROOTFS_/d' "$seed_file"
+  [[ -f $seed_file ]] && execute rm -f "$seed_file"
-  config_opts+=("CONFIG_TARGET_PER_DEVICE_ROOTFS=n")
-  if [[ $FILESYSTEM == "squashfs" ]]; then
-    config_opts+=("CONFIG_TARGET_ROOTFS_EXT4FS=n")
-    config_opts+=("CONFIG_TARGET_ROOTFS_SQUASHFS=y")
-  elif [[ $FILESYSTEM == "ext4" ]]; then
-    config_opts+=("CONFIG_TARGET_ROOTFS_SQUASHFS=n")
-    config_opts+=("CONFIG_TARGET_ROOTFS_EXT4FS=y")
-  fi
-
-  # Only compile selected target image
-  execute sed -i '/CONFIG_TARGET_DEVICE_/d' "$seed_file"
-  config_opts+=("CONFIG_TARGET_MULTI_PROFILE=n")
-  config_opts+=("CONFIG_TARGET_PROFILE=DEVICE_$DEVICE")
-  config_opts+=("CONFIG_TARGET_${TARGET//\//_}_DEVICE_$DEVICE=y")
-  config_opts+=("CONFIG_SDK=n")
-  config_opts+=("CONFIG_SDK_LLVM_BPF=n")
-  config_opts+=("CONFIG_IB=n")
-  config_opts+=("CONFIG_MAKE_TOOLCHAIN=n")
-  
-  # Write options to config seed file
   for config in "${config_opts[@]}"; do
     debug "Writing $config to $seed_file"
     echo "$config" >> "$seed_file"
   done
 
-  # Serial make prep is more reliable
+  # Expand seed into full config
   execute make "${make_opts[@]}" "-j1" defconfig
+
+  # Run serial make download for better reliability
   execute make "${make_opts[@]}" "-j1" download
 
-  # make_opts+=("-j$(($(nproc)-1))")
+  # (Optional) Disable multicore make world
-  ((DEBUG)) && make_opts+=("-j1") || make_opts+=("-j$(($(nproc)-1))")
+  # ((DEBUG)) && make_opts+=("-j1") || make_opts+=("-j$(($(nproc)-2))")
+  make_opts+=("-j$(($(nproc)-2))")
 
   # Make image
-  if ! execute ionice -c 3 chrt --idle 0 nice -n19 make "${make_opts[@]}" world; then
+  if ! execute ionice -c2 -n7 nice -n19 make "${make_opts[@]}" BIN_DIR="$BIN_DIR" world; then
     echo "Error: make failed"
     return 1
   fi
 
   execute popd || return 1
 
-  # Symlink output images to root of BIN_DIR (match Image Builder)
+  # Symlink output images to root of BIN_DIR (match Image Builder behavior)
   shopt -s nullglob
   for image in "$BIN_DIR/targets/${TARGET}/"*.{img,img.gz,ubi}; do
     execute ln -fs "$image" "$BIN_DIR/${image##*/}"
@@ -753,7 +798,7 @@ main() {
 
     # Store profile in P_ARR nameref
     local -n P_ARR="$profile"
-    local mode="${P_ARR[mode]:="imagebuilder"}"
+    local mode="${P_ARR[mode]:-"imagebuilder"}"
     ((FROM_SOURCE)) && mode="source" # allow cli override
     install_dependencies "$mode"
     local repo="${P_ARR[repo]:-}"
@@ -769,8 +814,8 @@ main() {
     read -r release ref < <(normalize_and_ref "$raw_release" "$mode")
 
     declare -g SRC_DIR="$BUILD_ROOT/src/.openwrt"
-    declare -g BUILD_DIR="$BUILD_ROOT/src/$profile/$mode-$ref"
+    declare -g BUILD_DIR="$BUILD_ROOT/src/$profile/$ref-$mode"
-    declare -g BIN_DIR="$BUILD_ROOT/bin/$profile/$mode-$ref"
+    declare -g BIN_DIR="$BUILD_ROOT/bin/$profile/$ref-$mode"
 
     if [[ "$release" == "snapshot" ]]; then
       local url_prefix="https://downloads.openwrt.org/snapshots/targets/$TARGET"
@@ -794,7 +839,7 @@ main() {
       declare -g SYSUPGRADEIMGGZ="$BUILD_DIR/$img_fname-sysupgrade.img.gz"
     fi
 
-    backup "$SYSUPGRADEIMGGZ" "$BACKUP_DIR/$profile/$mode-$ref"
+    backup "$SYSUPGRADEIMGGZ" "$BACKUP_DIR/$profile/$ref-$mode"
 
     if [[ "$mode" == "source" ]]; then
       from_source "$seed_url" "$profile" "$ref" || return $?
@@ -828,5 +873,9 @@ main() {
   done
 }
 
+# Roughly turn debugging on for pre-init
+# Reset and reparse in parse_input() with getopt
+[[ " $* " =~ ( --debug | -d ) ]] && DEBUG=1
+
 main "$@"
 exit

profiles

@@ -1,12 +1,16 @@
 #!/usr/bin/env bash
-# shellcheck disable=SC2034
 # Device profiles for openwrtbuilder
+# shellcheck disable=SC2034
 
-# Default packages
+# Default (but optional) packages (precede with "-" to exclude)
-default_packages="luci luci-ssl luci-proto-wireguard luci-app-statistics \
+default_packages=(nano htop diffutils tar iperf3 zsh rsync curl tcpdump
-  collectd-mod-sensors collectd-mod-thermal collectd-mod-conntrack \
+  openssh-sftp-server luci luci-ssl luci-proto-wireguard luci-app-statistics
-  collectd-mod-cpu nano htop diffutils tar iperf3 zsh rsync \
+  collectd-mod-sensors collectd-mod-thermal collectd-mod-conntrack collectd-mod-cpu
-  openssh-sftp-server"
+)
+
+# Default (but optional) kernel configs
+default_configs=(
+)
 
 # Current devices
 declare -Ag r4s=(
@@ -14,14 +18,19 @@ declare -Ag r4s=(
   [device]="friendlyarm_nanopi-r4s"
   [target]="rockchip/armv8"
   [filesystem]="ext4"
-  [packages]="$default_packages luci-app-ddns luci-app-sqm irqbalance \
+  [packages]="${default_packages[*]} \
+    luci-app-ddns luci-app-sqm \
+    adblock luci-app-adblock \
     collectd-mod-df usbutils kmod-usb-storage kmod-usb-storage-uas \
     kmod-fs-btrfs btrfs-progs block-mount smcroute avahi-daemon \
-    curl ethtool ca-bundle tailscale"
+    ethtool ca-bundle tailscale"
-  [config]="CONFIG_KERNEL_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_PROGS_ZSTD=y \
+  [config]="${default_configs[*]} \
-    CONFIG_TARGET_ROOTFS_PARTSIZE=512 CONFIG_TARGET_KERNEL_PARTSIZE=32 \
+    CONFIG_KERNEL_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_PROGS_ZSTD=y \
-    CONFIG_BUILDBOT=n"
+    CONFIG_TARGET_ROOTFS_PARTSIZE=512 CONFIG_TARGET_KERNEL_PARTSIZE=32"
   [files]="/mnt/backup"
+  # For 24.10 branch (Linux 6.6)
+  # [cherrypicks]="https://github.com/wurzerj/openwrt.git:59d6e31 \
+  # https://github.com/wurzerj/openwrt.git:bb251b8" # fix inconsistent reboot
 )
 
 declare -Ag ax6000=(
@@ -30,7 +39,8 @@ declare -Ag ax6000=(
   [target]="mediatek/filogic"
   [release]="snapshot"
   [filesystem]="squashfs"
-  [packages]="$default_packages -dnsmasq -odhcpd-ipv6only -nftables -firewall4 tailscale"
+  [packages]="${default_packages[*]} \
+    -dnsmasq -odhcpd-ipv6only -nftables -firewall4 tailscale"
 )
 
 declare -Ag ax6000_uboot=(
@@ -39,29 +49,61 @@ declare -Ag ax6000_uboot=(
   [target]="mediatek/filogic"
   [release]="snapshot"
   [filesystem]="squashfs"
-  [packages]="$default_packages -dnsmasq -odhcpd-ipv6only -nftables -firewall4"
+  [packages]="${default_packages[*]} \
+    -dnsmasq -odhcpd-ipv6only -nftables -firewall4"
 )
 
 declare -Ag n5100=(
   [device]="generic"
   [target]="x86/64"
   [filesystem]="squashfs"
-  [packages]="$default_packages luci-app-ddns irqbalance collectd-mod-df \
+  [packages]="${default_packages[*]} \
+    luci-app-ddns irqbalance collectd-mod-df \
     usbutils kmod-usb-storage kmod-usb-storage-uas kmod-fs-btrfs \
     btrfs-progs block-mount cryptsetup kmod-crypto-xts smcroute \
-    avahi-daemon curl ethtool ca-bundle smartmontools intel-microcode \
+    avahi-daemon ethtool ca-bundle smartmontools intel-microcode \
     lm-sensors samba4-server luci-app-samba4 tailscale shadow-useradd"
-  [config]="CONFIG_KERNEL_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_PROGS_ZSTD=y \
+  [config]="${default_configs[*]} \
+    CONFIG_KERNEL_BTRFS_FS_POSIX_ACL=y CONFIG_BTRFS_PROGS_ZSTD=y \
     CONFIG_TARGET_ROOTFS_PARTSIZE=512 CONFIG_TARGET_KERNEL_PARTSIZE=32"
   # [files]="/mnt/backup"
 )
 
+declare -Ag w1700k=(
+  [mode]="source"
+  [device]="gemtek_w1700k"
+  [target]="airoha/an7581"
+  [filesystem]="squashfs"
+  [release]="snapshot"
+  [packages]="${default_packages[*]} \
+    luci-app-ddns luci-app-sqm \
+    adblock luci-app-adblock \
+    smcroute avahi-daemon \
+    lm-sensors samba4-server luci-app-samba4 tailscale shadow-useradd \
+    ethtool ca-bundle tailscale"
+  [cherrypicks]="\
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:4cfd50f648 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:59bb20c522 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:1d58331f5c \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:c2712ff093 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:dc3dd61835 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:32caca6a76 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:cf66b89f84 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:ef002d6422 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:af3e569610 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:66b0757616 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:26398bc2c6 \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:16be0246ca \
+    https://github.com/OpenWRT-fanboy/OpenW1700k.git@lumos:3cdf63b0ec"
+)
+
 declare -Ag rpi4=(
   [device]="rpi-4"
   [target]="bcm27xx/bcm2711"
   [filesystem]="ext4"
-  [packages]="$default_packages kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8152 \
+  [packages]="${default_packages[*]} \
-    luci-app-upnp luci-app-pbr -dnsmasq dnsmasq-full luci-app-ddns luci-app-sqm"
+    luci-app-upnp luci-app-pbr -dnsmasq dnsmasq-full luci-app-ddns luci-app-sqm \
+    kmod-usb-net-asix-ax88179 kmod-usb-net-rtl8152"
 )
 
 declare -Ag r4s_stock=(
@@ -75,7 +117,8 @@ declare -Ag totolink=(
   [device]="totolink_x5000r"
   [target]="ramips/mt7621"
   [filesystem]="squashfs"
-  [packages]="$default_packages -dnsmasq -odhcpd-ipv6only -nftables -firewall4 \
+  [packages]="${default_packages[*]} \
+    -dnsmasq -odhcpd-ipv6only -nftables -firewall4 \
     -kmod-nft-offload collectd-mod-iwinfo"
 )
 
@@ -83,7 +126,7 @@ declare -Ag archer=(
   [device]="tplink_archer-c7-v2"
   [target]="ath79/generic"
   [filesystem]="squashfs"
-  [packages]="$default_packages -dnsmasq -odhcpd -iptables \
+  [packages]="${default_packages[*]} -dnsmasq -odhcpd -iptables \
     -ath10k-firmware-qca988x-ct ath10k-firmware-qca988x-ct-full-htt"
 )
 
@@ -91,14 +134,16 @@ declare -Ag linksys=(
   [device]="linksys_ea8300"
   [target]="ipq40xx/generic"
   [filesystem]="squashfs"
-  [packages]="$default_packages -dnsmasq -odhcpd -iptables"
+  [packages]="${default_packages[*]} \
+    -dnsmasq -odhcpd -iptables"
 )
 
 declare -Ag r2s=(
   [device]="friendlyarm_nanopi-r2s"
   [target]="rockchip/armv8"
   [filesystem]="ext4"
-  [packages]="$default_packages luci-app-upnp luci-app-pbr -dnsmasq dnsmasq-full \
+  [packages]="${default_packages[*]} \
+    luci-app-upnp luci-app-pbr -dnsmasq dnsmasq-full \
     luci-app-ddns luci-app-sqm luci-app-statistics collectd-mod-sensors \
     collectd-mod-thermal collectd-mod-conntrack smcroute curl ethtool"
 )
@@ -107,7 +152,8 @@ declare -Ag r2s_tr=(
   [device]="friendlyarm_nanopi-r2s"
   [target]="rockchip/armv8"
   [filesystem]="ext4"
-  [packages]="$default_packages luci-app-upnp luci-app-pbr luci-app-ddns \
+  [packages]="${default_packages[*]} \
+    luci-app-upnp luci-app-pbr luci-app-ddns \
     luci-app-statistics collectd-mod-sensors collectd-mod-thermal \
     collectd-mod-conntrack curl ethtool travelmate"
 )