From 5fbd1e913a4c3f068a673690c145b8394614e345 Mon Sep 17 00:00:00 2001 From: ExtremeFiretop Date: Mon, 7 Sep 2026 19:41:22 -0400 Subject: [PATCH 1/5] Update the official source for online fallbacks Update the official source for online fallbacks --- .github/workflows/update-merlin-sha256.yml | 121 --------------------- MerlinAU.sh | 12 +- 2 files changed, 6 insertions(+), 127 deletions(-) delete mode 100644 .github/workflows/update-merlin-sha256.yml diff --git a/.github/workflows/update-merlin-sha256.yml b/.github/workflows/update-merlin-sha256.yml deleted file mode 100644 index 7bf939be..00000000 --- a/.github/workflows/update-merlin-sha256.yml +++ /dev/null @@ -1,121 +0,0 @@ -name: Update Merlin SHA256 Checksums - -on: - schedule: - # Every 15 minutes, offset from the top of the hour to reduce scheduler congestion. - - cron: '7,22,37,52 * * * *' - workflow_dispatch: - -permissions: - contents: write - -concurrency: - group: update-merlin-sha256 - cancel-in-progress: false - -jobs: - scrape-and-commit: - runs-on: ubuntu-latest - timeout-minutes: 5 - - steps: - - name: Checkout repository - uses: actions/checkout@v7 - with: - ssh-key: ${{ secrets.DEPLOY_KEY }} - - - name: Fetch, parse, and validate SHA256 signatures - shell: bash - run: | - set -euo pipefail - - readonly SOURCE_URL='https://www.asuswrt-merlin.net/download' - readonly TARGET_FILE='merlin-sha256.txt' - readonly MIN_EXPECTED_ENTRIES=5 - - page_file="$(mktemp)" - candidate_file="$(mktemp)" - trap 'rm -f "$page_file" "$candidate_file"' EXIT - - echo "Fetching SHA256 signatures from ${SOURCE_URL}..." - curl --fail --location --silent --show-error \ - --retry 4 --retry-delay 5 --retry-connrefused \ - --connect-timeout 15 --max-time 60 \ - --user-agent 'MerlinAutoUpdate checksum mirror (+https://github.com/ExtremeFiretop/MerlinAutoUpdate-Router)' \ - --output "$page_file" \ - "$SOURCE_URL" - - # Keep the same source section MerlinAU consumes today, but write to a - # temporary candidate so a scrape/parser failure cannot destroy the - # last-known-good mirror in the repository. - sed -n '/<.*>SHA256 signatures:<\/.*>/,/<\/pre>/p' "$page_file" | \ - sed -n '/]*>/,/<\/pre>/p' | \ - sed -e 's/^.*]*>//' \ - -e 's/<[^>]*>//g' \ - -e 's/^[[:space:]]*//' \ - -e 's/[[:space:]]*$//' | \ - tr -d '\r' | \ - sed '/^[[:space:]]*$/d' > "$candidate_file" - - echo "Validating candidate checksum list..." - awk -v min_entries="$MIN_EXPECTED_ENTRIES" ' - BEGIN { - valid = 1 - count = 0 - } - { - count++ - - if (NF != 2) { - printf "Invalid field count on line %d: %s\n", NR, $0 > "/dev/stderr" - valid = 0 - next - } - - if (length($1) != 64 || $1 ~ /[^0-9A-Fa-f]/) { - printf "Invalid SHA256 on line %d: %s\n", NR, $1 > "/dev/stderr" - valid = 0 - } - - if (seen[$2]++) { - printf "Duplicate firmware filename on line %d: %s\n", NR, $2 > "/dev/stderr" - valid = 0 - } - } - END { - if (count < min_entries) { - printf "Only %d checksum entries were parsed; expected at least %d.\n", count, min_entries > "/dev/stderr" - valid = 0 - } - - if (!valid) - exit 1 - } - ' "$candidate_file" - - echo "Validated $(wc -l < "$candidate_file") checksum entries." - echo "Candidate preview:" - head -n 5 "$candidate_file" - - # Replace the working-tree copy only after the candidate has passed - # every validation check. A failed run therefore leaves the repository - # and its last-known-good checksum mirror unchanged. - mv -f "$candidate_file" "$TARGET_FILE" - - - name: Commit and push changes - shell: bash - run: | - set -euo pipefail - - git config user.name 'github-actions[bot]' - git config user.email '41898282+github-actions[bot]@users.noreply.github.com' - - git add merlin-sha256.txt - - if git diff --cached --quiet; then - echo 'No checksum changes detected. Nothing to commit.' - exit 0 - fi - - git commit -m 'Automated update: refresh Merlin SHA256 checksums' - git push diff --git a/MerlinAU.sh b/MerlinAU.sh index 08ccce56..7dcfa397 100644 --- a/MerlinAU.sh +++ b/MerlinAU.sh @@ -19,11 +19,11 @@ set -u ## Set version for each Production Release ## -readonly SCRIPT_VERSION=1.6.7 -readonly SCRIPT_VERSTAG="26090309" +readonly SCRIPT_VERSION=1.6.8 +readonly SCRIPT_VERSTAG="26090718" readonly SCRIPT_NAME="MerlinAU" ## Set to "master" for Production Releases ## -SCRIPT_BRANCH="master" +SCRIPT_BRANCH="dev" ##----------------------------------------## ## Modified by Martinski W. [2024-Jul-03] ## @@ -38,7 +38,7 @@ readonly FW_SFURL_RELEASE_SUFFIX="Release" readonly FW_GITURL_RELEASE="https://api.github.com/repos/gnuton/asuswrt-merlin.ng/releases/latest" readonly FW_SHA256_URL="https://www.asuswrt-merlin.net/download" # The scheduled checksum mirror is maintained on the repository's default branch # -readonly FW_SHA256_MIRROR_URL="${SCRIPT_URL_BASE}/main/merlin-sha256.txt" +readonly FW_SHA256_MIRROR_URL="https://fwupdate.asuswrt-merlin.net/sha256sums-ng.txt" ##----------------------------------------## ## Modified by Martinski W. [2024-May-31] ## @@ -6141,8 +6141,8 @@ _CheckOnlineFirmwareSHA256_() return 1 fi - checksumSource="MerlinAU GitHub repository mirror" - Say "${MGNTct}*WARNING*${NOct}: Using the MerlinAU GitHub checksum mirror for verification (15-MINUTE Update Intervals!)" + checksumSource="FwUpdate VPS mirror" + Say "${MGNTct}*WARNING*${NOct}: Using the FwUpdate VPS checksum mirror for verification." fi #--------------------------------------------------------------------------# From 3841a6a554b69b27e4fa6e4b544feab16f648fe5 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 7 Sep 2026 23:42:47 +0000 Subject: [PATCH 2/5] Bump softprops/action-gh-release in the all-actions group Bumps the all-actions group with 1 update: [softprops/action-gh-release](https://github.com/softprops/action-gh-release). Updates `softprops/action-gh-release` from 3.0.2 to 3.0.3 - [Release notes](https://github.com/softprops/action-gh-release/releases) - [Changelog](https://github.com/softprops/action-gh-release/blob/master/CHANGELOG.md) - [Commits](https://github.com/softprops/action-gh-release/compare/v3.0.2...v3.0.3) --- updated-dependencies: - dependency-name: softprops/action-gh-release dependency-version: 3.0.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: all-actions ... Signed-off-by: dependabot[bot] --- .github/workflows/Create-NewReleases.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/Create-NewReleases.yml b/.github/workflows/Create-NewReleases.yml index 68663afa..5059e092 100644 --- a/.github/workflows/Create-NewReleases.yml +++ b/.github/workflows/Create-NewReleases.yml @@ -85,7 +85,7 @@ jobs: git push origin ${{ steps.nextver.outputs.tag }} - name: Create Release with Automated Release Notes - uses: softprops/action-gh-release@v3.0.2 + uses: softprops/action-gh-release@v3.0.3 with: token: ${{ secrets.GITHUB_TOKEN }} tag_name: ${{ steps.nextver.outputs.tag }} From 14bca294e6a2bee633f4f6dd96667a3eb095d062 Mon Sep 17 00:00:00 2001 From: ExtremeFiretop Date: Mon, 7 Sep 2026 19:43:12 -0400 Subject: [PATCH 3/5] Update Wording Update Wording --- MerlinAU.sh | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/MerlinAU.sh b/MerlinAU.sh index 7dcfa397..7ad425c4 100644 --- a/MerlinAU.sh +++ b/MerlinAU.sh @@ -37,7 +37,6 @@ readonly FW_SFURL_BASE="https://sourceforge.net/projects/asuswrt-merlin/files" readonly FW_SFURL_RELEASE_SUFFIX="Release" readonly FW_GITURL_RELEASE="https://api.github.com/repos/gnuton/asuswrt-merlin.ng/releases/latest" readonly FW_SHA256_URL="https://www.asuswrt-merlin.net/download" -# The scheduled checksum mirror is maintained on the repository's default branch # readonly FW_SHA256_MIRROR_URL="https://fwupdate.asuswrt-merlin.net/sha256sums-ng.txt" ##----------------------------------------## @@ -6119,7 +6118,7 @@ _CheckOnlineFirmwareSHA256_() Say "${MGNTct}*WARNING*${NOct}: Independently published checksum signature could NOT be retrieved from the ASUSWRT-Merlin website." #-----------------------------------------------------------------------# - # SECONDARY SOURCE: Use the repository mirror ONLY when the official + # SECONDARY SOURCE: Use the official mirror ONLY when the Merlin Website # source did NOT yield a usable checksum. Never use a checksum bundled # with the firmware image in the ZIP archive for an online F/W update. #-----------------------------------------------------------------------# From 0121756c59f0bee68f3d0ce5f19c918fd7372de8 Mon Sep 17 00:00:00 2001 From: Joel Samson Date: Mon, 7 Sep 2026 19:55:04 -0400 Subject: [PATCH 4/5] Bump version from 1.6.7 to 1.6.8 --- version.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/version.txt b/version.txt index 400084b1..d8c5e721 100644 --- a/version.txt +++ b/version.txt @@ -1 +1 @@ -1.6.7 +1.6.8 From 4453b855197d3267c3fb70292c24272639d93f72 Mon Sep 17 00:00:00 2001 From: Joel Samson Date: Mon, 7 Sep 2026 19:55:28 -0400 Subject: [PATCH 5/5] Update version to v1.6.8 and release date --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1492a294..814a3d5b 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # MerlinAU - AsusWRT-Merlin Firmware Auto Updater -## v1.6.7 -## 2026-Sep-03 +## v1.6.8 +## 2026-Sep-07 ## WebUI: image