diff --git a/.github/workflows/mikrotik_patch_6.yml b/.github/workflows/mikrotik_patch_6.yml new file mode 100644 index 0000000..674a1dc --- /dev/null +++ b/.github/workflows/mikrotik_patch_6.yml @@ -0,0 +1,254 @@ +name: Patch Mikrotik RouterOS 6.x + +on: + # push: + # branches: [ "main" ] + schedule: + - cron: "0 0 * * *" + workflow_dispatch: + +permissions: + contents: write + +jobs: + Patch_RouterOS: + runs-on: ubuntu-22.04 + strategy: + matrix: + channel: [long-term,stable] + env: + TZ: 'Asia/Shanghai' + LATEST_VERSION: "" + BUILD_TIME: "0" + CUSTOM_LICENSE_PRIVATE_KEY: ${{ secrets.CUSTOM_LICENSE_PRIVATE_KEY }} + CUSTOM_LICENSE_PUBLIC_KEY: ${{ secrets.CUSTOM_LICENSE_PUBLIC_KEY }} + CUSTOM_NPK_SIGN_PRIVATE_KEY: ${{ secrets.CUSTOM_NPK_SIGN_PRIVATE_KEY }} + CUSTOM_NPK_SIGN_PUBLIC_KEY: ${{ secrets.CUSTOM_NPK_SIGN_PUBLIC_KEY }} + MIKRO_LICENSE_PUBLIC_KEY: ${{ secrets.MIKRO_LICENSE_PUBLIC_KEY }} + MIKRO_NPK_SIGN_PUBLIC_LKEY: ${{ secrets.MIKRO_NPK_SIGN_PUBLIC_LKEY }} + MIKRO_LICENCE_URL: ${{ secrets.MIKRO_LICENCE_URL }} + CUSTOM_LICENCE_URL: ${{ secrets.CUSTOM_LICENCE_URL }} + MIKRO_UPGRADE_URL: ${{ secrets.MIKRO_UPGRADE_URL }} + CUSTOM_UPGRADE_URL: ${{ secrets.CUSTOM_UPGRADE_URL }} + MIKRO_RENEW_URL: ${{ secrets.MIKRO_RENEW_URL }} + CUSTOM_RENEW_URL: ${{ secrets.CUSTOM_RENEW_URL }} + steps: + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Set up Python + uses: actions/setup-python@v5 + with: + python-version: '3.11' + + - name: Get latest routeros version + id: get_latest + run: | + echo $(uname -a) + if [ "${{ matrix.channel }}" == "long-term" ]; then + LATEST="LATEST.6fix" + elif [ "${{ matrix.channel }}" == "stable" ]; then + LATEST="LATEST.6" + fi + LATEST_VERSION=$(wget -nv -O - https://upgrade.mikrotik.com/routeros/$LATEST | cut -d ' ' -f1) + echo Latest Version:$LATEST_VERSION + if [ "${{ github.event_name }}" == "schedule" ]; then + _LATEST_VERSION=$(wget -nv -O - https://${{ env.CUSTOM_UPGRADE_URL }}/routeros/$LATEST | cut -d ' ' -f1) + if [ "$_LATEST_VERSION" == "$LATEST_VERSION" ]; then + echo "No new version found" + echo "has_new_version=false" >> $GITHUB_OUTPUT + exit 0 + fi + fi + echo "has_new_version=true" >> $GITHUB_OUTPUT + BUILD_TIME=$(date +"%s") + echo Build Time:$BUILD_TIME + wget -nv -O CHANGELOG https://${{ env.MIKRO_UPGRADE_URL }}/routeros/$LATEST_VERSION/CHANGELOG + cat CHANGELOG + echo "LATEST_VERSION=${LATEST_VERSION}" >> $GITHUB_ENV + echo "BUILD_TIME=${BUILD_TIME}" >> $GITHUB_ENV + + + - name: Cache mikrotik-${{ env.LATEST_VERSION }}.iso + if: steps.get_latest.outputs.has_new_version == 'true' + id: cache-mikrotik + uses: actions/cache@v4 + with: + path: | + mikrotik.iso + key: mikrotik-${{ env.LATEST_VERSION }} + + - name: Get mikrotik-${{ env.LATEST_VERSION }}.iso + if: steps.get_latest.outputs.has_new_version == 'true' && steps.cache-mikrotik.outputs.cache-hit != 'true' + run: | + sudo wget -nv -O mikrotik.iso https://download.mikrotik.com/routeros/$LATEST_VERSION/mikrotik-$LATEST_VERSION.iso + + + - name: Patch mikrotik-${{ env.LATEST_VERSION }}.iso + if: steps.get_latest.outputs.has_new_version == 'true' + run: | + sudo apt-get install -y mkisofs xorriso > /dev/null + sudo mkdir ./iso + sudo mount -o loop,ro mikrotik.iso ./iso + sudo mkdir ./new_iso + sudo cp -r ./iso/* ./new_iso/ + sudo rsync -a ./iso/ ./new_iso/ + sudo umount ./iso + sudo rm -rf ./iso + sudo mv ./new_iso/system-$LATEST_VERSION.npk ./ + sudo -E python3 patch.py npk system-$LATEST_VERSION.npk + NPK_FILES=$(find ./new_iso/*.npk) + for file in $NPK_FILES; do + sudo -E python3 npk.py sign $file $file + done + sudo cp system-$LATEST_VERSION.npk ./new_iso/ + sudo -E python3 patch.py kernel ./isolinux/initrd.rgz + sudo mkisofs -o mikrotik-$LATEST_VERSION.iso \ + -V "MikroTik $LATEST_VERSION" \ + -sysid "" -preparer "MiKroTiK" \ + -publisher "" -A "MiKroTiK RouterOS" \ + -input-charset utf-8 \ + -b isolinux/isolinux.bin \ + -c isolinux/boot.cat \ + -no-emul-boot \ + -boot-load-size 4 \ + -boot-info-table \ + -R -J \ + ./new_iso + + sudo mkdir ./all_packages + sudo cp ./new_iso/*.npk ./all_packages/ + sudo rm -rf ./new_iso + cd ./all_packages + sudo zip ../all_packages-x86-$LATEST_VERSION.zip *.npk + cd .. + + + - name: Create install-image-${{ env.LATEST_VERSION }}.img + if: steps.get_latest.outputs.has_new_version == 'true' + run: | + sudo modprobe nbd + sudo apt-get install -y qemu-utils extlinux > /dev/null + truncate --size 64M install-image-$LATEST_VERSION.img + sudo qemu-nbd -c /dev/nbd0 -f raw install-image-$LATEST_VERSION.img + sudo mkfs.vfat -n "Install" /dev/nbd0 + sudo mkdir ./install + sudo mount /dev/nbd0 ./install + sudo ./extlinux --install -H 64 -S 32 ./install/ + sudo echo -e 'default system\nLABEL system\n\tKERNEL linux\n\tAPPEND load_ramdisk=1 initrd=initrd.rgz -hdd-install' \ + > ./install/syslinux.cfg + NPK_FILES=($(find ./all_packages/*.npk)) + for ((i=1; i<=${#NPK_FILES[@]}; i++)) + do + echo "${NPK_FILES[$i-1]}=>$i.npk" + sudo cp ${NPK_FILES[$i-1]} ./install/$i.npk + done + sudo touch ./install/CHOOSE + sudo touch ./install/autorun.scr + sudo umount /dev/nbd0 + sudo qemu-nbd -d /dev/nbd0 + sudo rm -rf ./install + sudo zip install-image-$LATEST_VERSION.zip ./install-image-$LATEST_VERSION.img + sudo rm ./install-image-$LATEST_VERSION.img + + - name: Cache chr-${{ env.LATEST_VERSION }}.img.zip + if: steps.get_latest.outputs.has_new_version == 'true' + id: cache-chr-img + uses: actions/cache@v4 + with: + path: | + chr.img + key: chr-${{ env.LATEST_VERSION }}.img + + - name: Get chr-${{ env.LATEST_VERSION }}.img + if: steps.get_latest.outputs.has_new_version == 'true' && steps.cache-chr-img.outputs.cache-hit != 'true' + run: | + sudo wget -nv -O chr.img.zip https://download.mikrotik.com/routeros/$LATEST_VERSION/chr-$LATEST_VERSION.img.zip + sudo unzip chr.img.zip + sudo rm chr.img.zip + sudo mv chr-$LATEST_VERSION.img chr.img + + - name: Create chr-${{ env.LATEST_VERSION }}.img + if: steps.get_latest.outputs.has_new_version == 'true' + run: | + sudo mkdir ./chr + sudo cp chr.img chr-$LATEST_VERSION.img + sudo mount -o loop,rw chr-$LATEST_VERSION.img ./chr + sudo -E python3 patch.py kernel ./chr/boot/initrd.rgz + sudo cp ./all_packages/ipv6-$LATEST_VERSION.npk ./chr/var/pdb/ipv6/image + sudo cp ./all_packages/dude-$LATEST_VERSION.npk ./chr/var/pdb/dude/image + sudo cp ./all_packages/system-$LATEST_VERSION.npk ./chr/var/pdb/routeros-x86/image + sudo umount ./chr + sudo rm -rf ./chr + + sudo qemu-img convert -f raw -O qcow2 chr-$LATEST_VERSION.img chr-$LATEST_VERSION.qcow2 + sudo qemu-img convert -f raw -O vmdk chr-$LATEST_VERSION.img chr-$LATEST_VERSION.vmdk + sudo qemu-img convert -f raw -O vpc chr-$LATEST_VERSION.img chr-$LATEST_VERSION.vhd + sudo qemu-img convert -f raw -O vhdx chr-$LATEST_VERSION.img chr-$LATEST_VERSION.vhdx + sudo qemu-img convert -f raw -O vdi chr-$LATEST_VERSION.img chr-$LATEST_VERSION.vdi + + sudo zip chr-$LATEST_VERSION.qcow2.zip chr-$LATEST_VERSION.qcow2 + sudo zip chr-$LATEST_VERSION.vmdk.zip chr-$LATEST_VERSION.vmdk + sudo zip chr-$LATEST_VERSION.vhd.zip chr-$LATEST_VERSION.vhd + sudo zip chr-$LATEST_VERSION.vhdx.zip chr-$LATEST_VERSION.vhdx + sudo zip chr-$LATEST_VERSION.vdi.zip chr-$LATEST_VERSION.vdi + sudo zip chr-$LATEST_VERSION.img.zip chr-$LATEST_VERSION.img + + sudo rm chr-$LATEST_VERSION$ARCH.qcow2 + sudo rm chr-$LATEST_VERSION$ARCH.vmdk + sudo rm chr-$LATEST_VERSION$ARCH.vhd + sudo rm chr-$LATEST_VERSION$ARCH.vhdx + sudo rm chr-$LATEST_VERSION$ARCH.vdi + sudo rm chr-$LATEST_VERSION$ARCH.img + + + - name: Upload Files + if: steps.get_latest.outputs.has_new_version == 'true' + run: | + mkdir -p ./publish/$LATEST_VERSION + if [ "${{ matrix.channel }}" == "long-term" ]; then + LATEST="LATEST.6fix" + elif [ "${{ matrix.channel }}" == "stable" ]; then + LATEST="LATEST.6" + fi + echo $LATEST_VERSION $BUILD_TIME > ./publish/$LATEST + cp CHANGELOG ./publish/$LATEST_VERSION/ + cp ./all_packages/*.npk ./publish/$LATEST_VERSION/ + sudo apt-get install -y lftp > /dev/null 2>&1 + sudo -E lftp -u ${{ secrets.SSH_USERNAME }},'${{ secrets.SSH_PASSWORD }}' sftp://${{ secrets.SSH_SERVER }}:${{ secrets.SSH_PORT }} <> $GITHUB_ENV echo "BUILD_TIME=${BUILD_TIME}" >> $GITHUB_ENV - if [ "${{ matrix.arch }}" == "x86_64" ]; then + if [ "${{ matrix.arch }}" == "x86" ]; then ARCH='' echo "ARCH=$ARCH" >> $GITHUB_ENV elif [ "${{ matrix.arch }}" == "arm64" ]; then @@ -83,24 +85,24 @@ jobs: if: steps.get_latest.outputs.has_new_version == 'true' && steps.cache-squashfs.outputs.cache-hit != 'true' run: | sudo mkdir -p ./option-root/bin/ - if [ "${{ matrix.arch }}" == "x86_64" ]; then - sudo cp busybox/busybox_x86_64 ./option-root/bin/busybox + if [ "${{ matrix.arch }}" == "x86" ]; then + sudo cp busybox/busybox_x86 ./option-root/bin/busybox sudo chmod +x ./option-root/bin/busybox elif [ "${{ matrix.arch }}" == "arm64" ]; then sudo cp busybox/busybox_aarch64 ./option-root/bin/busybox sudo chmod +x ./option-root/bin/busybox fi - sudo chmod +x ./busybox/busybox_x86_64 - COMMANDS=$(./busybox/busybox_x86_64 --list) + sudo chmod +x ./busybox/busybox_x86 + COMMANDS=$(./busybox/busybox_x86 --list) for cmd in $COMMANDS; do sudo ln -sf /pckg/option/bin/busybox ./option-root/bin/$cmd done sudo mksquashfs option-root option.sfs -quiet -comp xz -no-xattrs -b 256k sudo rm -rf option-root - if [ "${{ matrix.arch }}" == "x86_64" ]; then - sudo wget -O cpython-3.11.9.tar.gz -nv https://github.com/indygreg/python-build-standalone/releases/download/20240415/cpython-3.11.9+20240415-x86_64-unknown-linux-gnu-install_only.tar.gz + if [ "${{ matrix.arch }}" == "x86" ]; then + sudo wget -O cpython-3.11.9.tar.gz -nv https://github.com/indygreg/python-build-standalone/releases/download/20240415/cpython-3.11.9+20240713-x86_64-unknown-linux-gnu-install_only.tar.gz elif [ "${{ matrix.arch }}" == "arm64" ]; then - sudo wget -O cpython-3.11.9.tar.gz -nv https://github.com/indygreg/python-build-standalone/releases/download/20240415/cpython-3.11.9+20240415-aarch64-unknown-linux-gnu-install_only.tar.gz + sudo wget -O cpython-3.11.9.tar.gz -nv https://github.com/indygreg/python-build-standalone/releases/download/20240415/cpython-3.11.9+20240713-aarch64-unknown-linux-gnu-install_only.tar.gz fi sudo tar -xf cpython-3.11.9.tar.gz sudo rm cpython-3.11.9.tar.gz @@ -110,7 +112,7 @@ jobs: sudo rm -rf ./python - name: Cache NetInstall ${{ env.LATEST_VERSION }} - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' id: cache-netinstall uses: actions/cache@v4 with: @@ -120,13 +122,13 @@ jobs: key: netinstall-${{ env.LATEST_VERSION }} - name: Get netinstall ${{ env.LATEST_VERSION }} - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' && steps.cache-netinstall.outputs.cache-hit != 'true' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' && steps.cache-netinstall.outputs.cache-hit != 'true' run: | sudo wget -nv -O netinstall.zip https://download.mikrotik.com/routeros/$LATEST_VERSION/netinstall-$LATEST_VERSION.zip sudo wget -nv -O netinstall.tar.gz https://download.mikrotik.com/routeros/$LATEST_VERSION/netinstall-$LATEST_VERSION.tar.gz - name: Patch netinstall ${{ env.LATEST_VERSION }} - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' run: | sudo unzip netinstall.zip sudo -E python3 patch.py netinstall netinstall.exe @@ -174,7 +176,7 @@ jobs: sudo cp python3-$LATEST_VERSION$ARCH.npk ./new_iso/ sudo mkdir ./efiboot sudo mount -o loop ./new_iso/efiboot.img ./efiboot - if [ "${{ matrix.arch }}" == "x86_64" ]; then + if [ "${{ matrix.arch }}" == "x86" ]; then sudo -E python3 patch.py kernel ./efiboot/linux.x86_64 sudo cp ./efiboot/linux.x86_64 ./BOOTX64.EFI sudo cp ./BOOTX64.EFI ./new_iso/isolinux/linux @@ -212,15 +214,11 @@ jobs: sudo cp ./new_iso/*.npk ./all_packages/ sudo rm -rf ./new_iso cd ./all_packages - if [ "${{ matrix.arch }}" == "x86_64" ]; then - sudo zip ../all_packages-x86-$LATEST_VERSION.zip *.npk - elif [ "${{ matrix.arch }}" == "arm64" ]; then - sudo zip ../all_packages-arm64-$LATEST_VERSION.zip *.npk - fi + sudo zip ../all_packages-${{ matrix.arch }}-$LATEST_VERSION.zip *.npk cd .. - name: Cache refind - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' id: cache-refind uses: actions/cache@v4 with: @@ -228,11 +226,11 @@ jobs: key: refind - name: Get refind - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' && steps.cache-refind.outputs.cache-hit != 'true' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' && steps.cache-refind.outputs.cache-hit != 'true' run: sudo wget -nv -O refind-bin-0.14.2.zip https://nchc.dl.sourceforge.net/project/refind/0.14.2/refind-bin-0.14.2.zip - name: Create install-image-${{ env.LATEST_VERSION }}.img - if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86_64' + if: steps.get_latest.outputs.has_new_version == 'true' && matrix.arch == 'x86' run: | sudo modprobe nbd sudo apt-get install -y qemu-utils extlinux > /dev/null @@ -321,7 +319,7 @@ jobs: sudo mkfs.ext4 -F -L "RouterOS" -m 0 /dev/nbd0p2 sudo mkdir -p ./img/{boot,routeros} sudo mount /dev/nbd0p1 ./img/boot/ - if [ "${{ matrix.arch }}" == "x86_64" ]; then + if [ "${{ matrix.arch }}" == "x86" ]; then sudo mkdir -p ./img/boot/{BOOT,EFI/BOOT} sudo cp BOOTX64.EFI ./img/boot/EFI/BOOT/BOOTX64.EFI sudo ./extlinux --install -H 64 -S 32 ./img/boot/BOOT @@ -418,7 +416,7 @@ jobs: name: "RouterOS ${{ env.LATEST_VERSION }} ${{ matrix.arch }}" body_path: "CHANGELOG" tag_name: ${{ env.LATEST_VERSION }}${{ env.ARCH }} - make_latest: ${{ matrix.channel == 'stable'}} && ${{ matrix.arch == 'x86_64'}} + make_latest: ${{ matrix.channel == 'stable'}} && ${{ matrix.arch == 'x86'}} prerelease: ${{ matrix.channel == 'testing' }} files: | mikrotik-${{ env.LATEST_VERSION }}${{ env.ARCH }}.iso diff --git a/README.md b/README.md index 4fb5a40..eec3df6 100644 --- a/README.md +++ b/README.md @@ -29,8 +29,6 @@ Sign,Verify,Create, Extract npk file. ### patch.py Patch public key and sign NPK files -### netinstall.py - Patch netinstall to enable network installation of NPK files that have been resigned in ISO ## all patches are applied automatically with [Github Action](https://github.com/elseif/MikroTikPatch/blob/main/.github/workflows/mikrotik_patch.yml). diff --git a/README_CN.md b/README_CN.md index dc4eebe..9d23d3b 100644 --- a/README_CN.md +++ b/README_CN.md @@ -30,8 +30,7 @@ 对npk文件进行解包,修改,创建,签名和验证 ### patch.py 替换公钥并签名 -### netinstall.py - 替换 netinstall 中的 bootloader 的公钥,使通过网络安装时可以安装ISO文件内的npk文件 + ## 所有的修补操作都自动运行在[Github Action](https://github.com/elseif/MikroTikPatch/blob/main/.github/workflows/mikrotik_patch.yml)。 diff --git a/busybox/busybox_x86 b/busybox/busybox_x86 new file mode 100644 index 0000000..e6ed29d Binary files /dev/null and b/busybox/busybox_x86 differ diff --git a/busybox/busybox_x86_64 b/busybox/busybox_x86_64 deleted file mode 100644 index f72ded6..0000000 Binary files a/busybox/busybox_x86_64 and /dev/null differ diff --git a/keygen/keygen_x86_64 b/keygen/keygen_x86 similarity index 50% rename from keygen/keygen_x86_64 rename to keygen/keygen_x86 index 1e66f11..d23bc8e 100644 Binary files a/keygen/keygen_x86_64 and b/keygen/keygen_x86 differ diff --git a/patch.py b/patch.py index 3dec651..d3767b0 100644 --- a/patch.py +++ b/patch.py @@ -220,6 +220,16 @@ def patch_squashfs(path,key_dict): print(f'{file} url patched {old_url.decode()[:7]}...') data = data.replace(old_url,new_url) open(file,'wb').write(data) + if os.path.split(file)[1] == 'licupgr': + url_dict = { + os.environ['MIKRO_RENEW_URL'].encode():os.environ['CUSTOM_RENEW_URL'].encode(), + } + for old_url,new_url in url_dict.items(): + if old_url in data: + print(f'{file} url patched {old_url.decode()[:7]}...') + data = data.replace(old_url,new_url) + open(file,'wb').write(data) + def run_shell_command(command): process = subprocess.run(command, shell=True, check=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) @@ -252,7 +262,7 @@ def patch_npk_file(key_dict,kcdsa_private_key,eddsa_private_key,input_file,outpu patch_squashfs(extract_dir,key_dict) keygen = os.path.join(extract_dir,'bin/keygen') if os.environ['ARCH'] =='': - run_shell_command(f"sudo cp keygen/keygen_x86_64 {keygen}") + run_shell_command(f"sudo cp keygen/keygen_x86 {keygen}") run_shell_command(f"sudo chmod a+x {keygen}") elif os.environ['ARCH'] == '-arm64': run_shell_command(f"sudo cp keygen/keygen_aarch64 {keygen}")