valnesfjord/tg-ws-proxy-rs v2.4.3

tg-ws-proxy-rs v2.4.3

on GitHub

The release binary now installs on Entware routers — Keenetic and other boxes
that run their userland at /opt — from the same one-liner the OpenWrt path
uses.

Why

install.sh was OpenWrt-only, and on an Entware box it failed before it could
say anything useful: cannot read OpenWrt DISTRIB_ARCH first, then
jsonfilter is required behind it. Entware has no jsonfilter, no
/etc/openwrt_release, no uci, no procd and no LuCI, and the --arch /
--package-manager overrides did not help, because the OpenWrt gate sits after
them.

That is a large part of this project's audience: a Keenetic already runs Entware
at /opt, and until now the only way to run this build there was to place the
binary by hand and write the init script yourself.

Added

• Entware support in install.sh. The platform is detected from its own
  markers rather than assumed: /etc/openwrt_release means OpenWrt,
  <root>/etc/opkg.conf means Entware (/opt unless TG_WS_PROXY_ROOT says
  otherwise). --platform openwrt|entware forces either.

  On Entware the installer:

  • reads the architecture from opkg print-architecture — the name Entware was
    installed from, aarch64-3.10, armv7-3.2, mips-3.4, mipsel-3.4,
    x64-3.2, with the Keenetic feeds' _kn suffix — and maps it onto the
    matching musl release binary. uname is deliberately not consulted: on MIPS
    it reports mips for both endians. A name with no release target is refused
    (ARMv5, 32-bit x86); the ARMv7 feeds are soft-float builds reported as
    armv7-3.2, so a core without VFP is caught by the run check.
  • verifies the archive against the release's SHA256SUMS, fetched from
    github.com even when GH_MIRROR serves the payload, and then runs it.
  • installs /opt/bin/tg-ws-proxy-rs and one init script,
    /opt/etc/init.d/S99tg-ws-proxy-rs, which rc.unslung sources at boot —
    the executable bit is the on/off switch. start, stop, restart and
    status are the same four verbs the OpenWrt integration offers, status
    printing the tg:// link read back from the log. Readiness is a bound
    listener rather than a log line, so LOG_LEVEL="quiet" — which writes
    nothing at all — starts and reports normally. The log is rotated at every
    start, and a run over 1 MiB is kept as its last 64 KiB rather than whole:
    the proxy holds the file open while it runs, and /opt is often a stick.
  • writes /opt/etc/tg-ws-proxy-rs/config.conf with the MTProto secret in
    secret.conf beside it, both 0600. An existing secret and port survive an
    upgrade; both files are read through a scratch copy with carriage returns
    stripped, so a config saved by an editor on Windows still starts the proxy.
  • sets LINK_IP from the bridge address it finds on br0/br-lan, rather
    than trusting the binary's own detection, which reports a tunnel address on
    a router that has one and produces a tg:// link no phone can dial.
  • stops another tg-ws-proxy (the Go port) when it holds the port
    and clears that init script's executable bit, leaving its files and
    configuration alone; a failed install puts the bit back. A proxy that cannot
    bind starts, logs a bind error and does nothing, which is worse than a
    failed installation — the same reasoning the OpenWrt path applies to the
    2.2.3 integration.
  • keeps the last three installs under /opt/var/tg-ws-proxy-backups/ and
    rolls all of it back if the service does not come up.

• --tag <TAG>, the only way to install a beta on Entware: naming a
  prerelease is a release-API call, and that API is what needs jsonfilter.
  Stable installs address releases/latest/download/<asset> directly.

• curl as a second downloader. One attempt now tries wget and then
  curl, because a box may carry either without the other, and BusyBox wget
  built without TLS answers not an http or ftp url for every https URL. The
  OpenWrt path gains the same fallback.

• Contract tests for all of the above in openwrt/tests/test-installer.sh:
  platform detection, arch mapping and its refusals, the release URLs --tag
  and latest produce, the manifest fetched through the downloader with no
  mirror branch, port preservation, bridge-address detection, and that the
  generated init script parses, carries no placeholder and passes
  shellcheck -s sh — rc.unslung runs it with BusyBox sh.

Changed

• --arch and --package-manager no longer name OpenWrt in the help text: they
  are the manual override for either platform.
• dl_url (one attempt at one URL, either downloader) is split out of dl
  (payload, may use GH_MIRROR) so the manifest can be fetched without mirror
  fallback.

Cost

The Entware path trades the API digest for the release's own SHA256SUMS: the
manifest then shares an origin with the payload, and only the run check stands
between a cached answer and an installed binary. A weaker anchor than OpenWrt's,
and the price of the platform having no jsonfilter; what OpenWrt verifies is
unchanged.

--channel beta on Entware needs --tag; --channel beta alone now fails with
that instruction instead of fetching a stable release and calling it a beta.