This repository builds device-specific upgrade images with the unified Skyglide package preinstalled. Device credentials are added locally after installation; they are never included in public images.

The initial target is the Beryl 7, board glinet,gl-mt3600be, using OpenWrt 25.12.6 and profile glinet_gl-mt3600be. Other boards, releases and OEM builds are refused by the preservation tools. A successful build is not evidence that a new hardware revision or vendor configuration is supported.

The public image contains full Wi-Fi authentication support, WireGuard, the native captive gateway, and the isolated skyglide_config onboarding interface supplied by Skyglide. Roles and policy come from the cloud console. It contains no account or Wi-Fi uplink configuration.

The current candidate bundle is in images/beryl7/25.12.6-r7/. Its signed release.json records the exact image, source, package and qualification facts. The image has been inspected, not flashed as a new image on physical hardware.

Build and verify

Run on Linux with Python 3, make, tar/zstd, OpenWrt SDK host tools and the prerequisites used by skyglide.com/openwrt. First build the package at the exact source revisions in the device manifest. Keep the existing SDK signing key: it is separate from the image release key.

python3 scripts/device.py build --device beryl7 \
  --openwrt-tree ../openwrt \
  --package-dir ../openwrt/.nogit/packages/r7/25.12.6-mediatek-filogic \
  --signing-key .nogit/signing/release.sec
python3 scripts/device.py verify dist/beryl7/release.json

The builder authenticates official release checksums, checks the hardware profile and ImageBuilder digest, verifies the signed Skyglide package repository and payloads, uses a fresh isolated ImageBuilder, and inspects the resulting filesystem. Local ImageBuilder keys are excluded from the installed trust store. Output contains the image, package manifest/SBOM, input receipts, exact hashes, and a detached Skyglide release signature.

keys/openwrt-25.12.usign.pub pins the official key that verifies the selected release's checksum signature (upstream keyring path usign/b5043e70f9a75cde, last changed at e24fe0d44a4d1c3ad94c005a98cd90d0ca18789b). keys/skyglide-devicesupport.pub independently verifies Skyglide release manifests. Obtain these repository keys through a trusted channel; a key downloaded beside an image does not establish trust by itself.

On a fresh installation, the credential-free hardware preset enables only the 2GHz radio at channel 1; the 5GHz radio is disabled. There are no preconfigured AP or station sections. The enabled supervisor creates its owned configuration AP when appropriate, without a global Wi-Fi reload. The image's first-boot check only reads state. A private native restore replaces this preset with the saved wireless file unchanged. Bootstrap requires a safe available radio: it uses an empty 2GHz radio or a qualified existing channel/beacon interval, and refuses unknown or incompatible active-radio state. Image inspection does not replace a first-boot test on hardware.

Preserve a qualified native uplink

For a Beryl 7 already running the exact supported native release, run scripts/capture-device.sh on the device. It makes a private backup and source-facts receipt without changing networking. Copy that private directory to a protected location you control.

python3 scripts/device.py prepare-restore --device beryl7 \
  --capture .private/device-capture --release dist/beryl7/release.json \
  --output .private/beryl7-restore.tar.gz

This preserves native UCI configuration and Skyglide state, including the Wi-Fi uplink, without replacing them with firmware defaults. It does not migrate vendor network/firewall/DHCP sections, install additional software from a backup, or flash anything. Keep the original complete backup and a known working image outside the router.

Verify the release with the independently obtained repository trust key, then run the device's read-only scripts/upgrade-check.sh with the image and private archive. It checks the source board/release, signatures, image digest and sysupgrade -T, and prints the final command for review. Do not bypass a refusal. A firmware upgrade reboots the device; preservation means restoring the connection after reboot, not uninterrupted connectivity during flashing.

Recovery and qualification

Have local Ethernet access and the original backup available. A fresh image retains the native platform's Ethernet recovery address; a qualified restore retains the existing LAN configuration. No tool here changes the bootloader or repartitions flash. Use the hardware vendor's documented recovery procedure if the native upgrade does not boot.

The initial OEM backup did not include immutable source board/build metadata. The earlier one-device selective migration is useful research, but does not qualify arbitrary OEM builds. OEM-to-native upgrade preservation is therefore explicitly unsupported in this first pipeline; no complete vendor UCI files are copied into a native image.

Run python3 -m unittest discover -s tests -v for archive/refusal tests. Release receipts distinguish package signature and VM installation evidence from filesystem inspection and physical image tests.