TheUnboundDeveloper/AM-Reaper v3.1.0-GT-BE98_PRO

Reaper v3.1.0 — GT-BE98_PRO

on GitHub

v3.1.0 — OpenSSL 3.5, second attempt: the library every TLS path stands on (built RT-BE96U)

• The firmware moves from OpenSSL 1.1.1w (end of life since September 2023) to OpenSSL 3.5.8.
  Every source-built consumer — hostapd and wpa_supplicant, httpd, curl and wget, OpenVPN, strongSwan,
  inadyn, Tor, vsftpd, lighttpd, net-snmp, the Reaper Advisor daemon and 110 more — now links the
  real 3.5 library directly. The closed ASUS binaries that cannot be rebuilt (AiMesh's cfg_server and
  friends, the Let's Encrypt helper, the lighttpd modules) keep their OpenSSL 1.1 ABI through a small
  forwarding shim that hands every call to 3.5. The port is Asuswrt-Merlin upstream work by RSDNTWK
  (the shim and the 3.5 integration) and Eric "Merlin" Sauvageau (the parallel-compile fix),
  carried as cherry-picks with their authorship intact; the Reaper Advisor daemon links 3.5 alone.
• Why the first attempt (v3.0.3) broke Wi-Fi and this one does not. hostapd had been compiled in
  the wireless SDK tree all along; its link rule never sees a library change, so the September 1 image
  shipped a hostapd still bound to the 1.1 name — which now resolved to the shim, which does not carry
  the elliptic-curve functions WPA3-SAE needs. This rung purges every object compiled against the old
  headers before the swap — including the ones git ignores, which the first purge could not see — and
  adds a release gate (check 22) that names the only binaries allowed to depend on the 1.1 name in a
  3.5 image and fails on any other. hostapd is required by that gate to link libcrypto.so.3
  outright, verified with readelf, not inferred from a green build.
• Proven on the RT-BE96U before it was written up: 31 minutes on the test image with hostapd
  never restarting, five stations through WPA3-SAE on 6 GHz at 320 MHz, HTTPS UI and outbound TLS
  working, the router's certificate unchanged across the flash. A pre-flash kit now exists that
  loader-traces every consumer of the new image on the running router from /tmp before anything
  is flashed.
• Licensing. OpenSSL 3.x is Apache-2.0; its text is added under LICENSES/, and the notices no
  longer misdescribe OpenSSL as BSD/MIT. The move resolves a conflict rather than creating one:
  1.1.1's OpenSSL/SSLeay advertising clause was never GPL-compatible.
• First boot is one box. The security banner's Wi-Fi step used to open the stock Wireless page,
  which shows the primary radios' settings; on this build those become the hidden AiMesh backhaul and
  the network people join lives on the fronthaul VIFs the mesh daemon rebuilds afterwards. A factory box
  now gets one Reaper page: network name, Wi-Fi password, router login password. It writes what the
  stock apply writes on every band (one name, WPA2/WPA3 on 2.4 and 5 GHz, WPA3 on 6 GHz, Smart Connect
  on) and fires the same restart, so the mesh daemon's split is unchanged; the login change follows the
  same committed path as the password page. Keys under 8 characters are refused in the page and in the
  router, the rule that saved v2.9.1. The stock Wireless page is untouched for engineers, and a new
  release check locks the whole chain - page, gate, banner target, 25 language packs - so it cannot
  quietly regress. The security banner that points at it is down to one row and one button: while
  both the login and the Wi-Fi are factory it says so once and offers "Set up this router"; only the
  half that remains gets its own button after that.
• Packaging. The 3.5 source (5,767 files) is too large to publish as a patch; it ships as the
  hash-pinned overlays/openssl-3.5-source.tar.gz, unpacked by the public build after the patch
  series, with only the integration diff and the shim in patches/. The reproduce recipe in the
  docs gains that one step.
• Factory reset takes the short road, and the page says how to get back. Three waits came out of
  the reset chain, none of them doing work: the web server no longer waits up to two minutes for a
  USB application to stop when none is mounted; the reset request is handed to the service manager
  in the form that waits for it rather than the one that gives up after 15 seconds; and the reset
  routine takes the reboot lock first, the way a plain reboot does, so the shutdown can never spin
  half a minute on a lock left by a daemon that died mid-write. The router logs a timestamp at each
  step so the next report carries numbers. The Backup page changed too: the veil now says that the
  router comes back on its open factory network with its default address, and links to it, instead
  of polling in silence; it no longer mistakes the few seconds the web server is busy for the reboot
  and bounces to a login page that is about to vanish; and if the router has not gone down within
  three minutes it says so and hands the page back. A new release check pins all three files.
• AiMesh backhaul parking stays in sync with wireless restarts. Any apply that restarts the
  radios, from the Network or Wireless page or from the mesh daemon itself, re-creates the parked
  carriers, and the parking service kept believing they were down. It now checks the live state on
  every pass, logs that the carrier came back, and parks it again within five seconds.
• Phones get the full width. Below 680px the shell collapses its rail into a sticky icon strip
  under the header, the way the dashboard already did, and the page takes the whole screen; stock
  pages framed in the shell pan sideways until each is replaced by a native one. Two small labels
  with it: the Connections page no longer calls a weighted class "WRR" (every port has run strict
  priority since v2.5.4), and the Advisor's client-pin hint no longer clips inside its box.
• The update check learns a beta channel. A Beta Channel switch on the Firmware page (off by
  default) lets the check also read the Dev branch's beta line in the update manifest. The rule is
  the owner's: a beta is offered only to a router that already runs the newest stable release, and
  only when the beta's number is higher than that stable's; when the stable release carries the same
  number, only the stable one is offered. A beta offer is labelled as one on the page and on the
  dashboard badge, its release note opens with the beta warning, and the previous firmware stays in
  the standby partition as always. On the publishing side a Dev-branch publish now writes a separate
  MODEL#VARIANT-beta# line into the manifest and leaves the stable line untouched; firmware older
  than v3.1.0 cannot match that line and keeps seeing stable releases only. A release check pins the
  chain (check script, note script, the nvram key, the page, 25 language packs).
• The QoS page stops explaining Weighted classes. The hint under the class list, and the "Priority
  vs Weighted" explainer below it, described a scheduler mode that was removed in v2.5.4 and cannot be
  selected; the hint now says only that classes are served strictly top to bottom, in all 25 language
  packs, and the explainer is gone.

Images & checksums (GT-BE98_PRO)

Two flashable images: + AI Advisor (default) and Standard (noMCP, all AI components compiled out entirely). Flash the *_nand_squashfs.pkgtb via Administration > Firmware Upgrade.

Verify a download against the attached SHA256SUMS-GT-BE98_PRO-Reaper_v3.1.0.txt.

Corresponding source & reproducibility

The GT-BE98_PRO image for v3.1.0 is built from this repository at tag v3.1.0-GT-BE98_PRO: the pinned Asuswrt-Merlin base (3006.102.8-beta2, a7ebfa133a) plus the complete patch series. The tag freezes the exact source that produced it.

• Patches: patches/ (0001-0620)
• Provenance record: provenance/manifest.json
• Source tree hash (release/src/router): 8d05e4ceb4af57b7955e44c053022ab6f3b15120 -- reproduce by git am --keep-cr of the patches onto the base, then git rev-parse HEAD:release/src/router.
• How to verify: docs/REPRODUCIBILITY.md and docs/SOURCE-AVAILABILITY.md

The auto-attached Source code (zip/tar.gz) asset below is this repository at tag v3.1.0-GT-BE98_PRO (patches + docs).