Integrate network-manager with openthread-br plus miscellaneous updates (#37)

* Add a git-with-metadata download method that can capture metadata from the git
repository and include it in the download archive for use at build time.

* Move overlay.{sh,mk} into include directory

* Use git-with-metadata for the gn build

* Update mDNSReponder package to 2881.0.25

* Update openthread-br to 07fc9adf and add a patch for an enhanced ubus interface

* Update network-manager app to 8f221d80

This change integrates the TBRM cluster with openthread-br using ubus.

* Move CI to OpenWrt 24.10.4

* Fix error handling in git-with-metadata hook

Author: ksperling-apple

.containers/matter-openwrt-build/Dockerfile

@@ -1,4 +1,4 @@
-ARG OPENWRT_VERSION=24.10.2
+ARG OPENWRT_VERSION=24.10.4
 FROM ghcr.io/openwrt/sdk:x86-generic-${OPENWRT_VERSION}
 LABEL org.opencontainers.image.description="Pre-warmed OpenWrt SDK"
 

.github/workflows/build-packages.yaml

@@ -17,7 +17,7 @@ jobs:
       - name: Build
         uses: addnab/docker-run-action@v3
         with:
-          image: ghcr.io/project-chip/matter-openwrt-build:24.10.2
+          image: ghcr.io/project-chip/matter-openwrt-build:24.10.4
           options: --volume ${{ github.workspace }}:/workspace
           shell: bash
           run: |

devel/gn/Makefile

@@ -16,18 +16,12 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=gn
 PKG_SOURCE_URL:=https://gn.googlesource.com/gn
-PKG_SOURCE_PROTO:=git
+PKG_SOURCE_PROTO:=git-with-metadata
 PKG_SOURCE_MIRROR:=0 # don't try OpenWrt mirror
 
-# GN versioning is based on the number of commits since the tag `initial-commit`,
-# and is exposed to build scripts via the `gn_version` variable. When updating
-# PKG_SOURCE_VERSION to a new commit hash, GN_VERSION needs to be obtained via
-#   git describe HEAD --match initial-commit | cut -f 3 -d -
-# and updated below.
 PKG_SOURCE_DATE:=2025-03-21
 PKG_SOURCE_VERSION:=6e8e0d6d4a151ab2ed9b4a35366e630c55888444
-PKG_MIRROR_HASH:=0767a5dffe09bbb779df2be610554b7b3c660fb7910f60136bd25c34faf33bab
-GN_VERSION:=2223
+PKG_MIRROR_HASH:=544da724e63e496be1f29df66259a6dd61bd6f4925b6310766185a5488d95681
 
 PKG_LICENSE:=BSD-3-Clause
 PKG_LICENSE_FILES:=LICENSE
@@ -37,6 +31,13 @@ HOST_BUILD_PARALLEL:=1
 
 include $(INCLUDE_DIR)/package.mk
 include $(INCLUDE_DIR)/host-build.mk
+include ../../include/git-with-metadata.mk
+
+define GitWithMetadata/gather
+desc="`git describe HEAD --abbrev=12 --match initial-commit`" && \
+echo -n "GN_VERSION=" && echo "$$$$desc" | cut -d - -f 3 && \
+echo -n "GN_COMMIT=" && echo "$$$$desc" | cut -d - -f 4 | cut -c 2-
+endef
 
 define Package/gn
   SECTION:=devel
@@ -51,10 +52,13 @@ endef
 
 define Host/Configure
 	cd $(HOST_BUILD_DIR) && $(HOST_CONFIGURE_VARS) \
-		$(STAGING_DIR_HOST)/bin/python build/gen.py --no-last-commit-position
-	echo "$$$$GN_LAST_COMMIT_HEADER" | \
-		VER_NUM=$(GN_VERSION) VER_STR="$(GN_VERSION) (`echo "$(PKG_SOURCE_VERSION)" | cut -c 1-12`)" \
-		perl -lpe 's/\$$$$(\w+)/$$$$ENV{$$$$1}/ge' >$(HOST_BUILD_DIR)/out/last_commit_position.h
+		$(STAGING_DIR_HOST)/bin/python build/gen.py --no-last-commit-position && \
+	{ . .git-metadata && \
+		echo "#ifndef OUT_LAST_COMMIT_POSITION_H_" && \
+		echo "#define OUT_LAST_COMMIT_POSITION_H_" && \
+		echo "#define LAST_COMMIT_POSITION_NUM $$$$GN_VERSION" && \
+		echo "#define LAST_COMMIT_POSITION \"$$$$GN_VERSION ($$$$GN_COMMIT)\"" && \
+		echo "#endif // OUT_LAST_COMMIT_POSITION_H_" ; } >$(HOST_BUILD_DIR)/out/last_commit_position.h
 endef
 
 define Host/Compile
@@ -66,14 +70,5 @@ define Host/Install
 	$(INSTALL_BIN) $(HOST_BUILD_DIR)/out/gn $(1)/bin
 endef
 
-define GN_LAST_COMMIT_HEADER
-#ifndef OUT_LAST_COMMIT_POSITION_H_
-#define OUT_LAST_COMMIT_POSITION_H_
-#define LAST_COMMIT_POSITION_NUM $$VER_NUM
-#define LAST_COMMIT_POSITION "$$VER_STR"
-#endif // OUT_LAST_COMMIT_POSITION_H_
-endef
-export GN_LAST_COMMIT_HEADER
-
 $(eval $(call BuildPackage,gn))
 $(eval $(call HostBuild))

include/git-with-metadata.mk

@@ -0,0 +1,41 @@
+# Copyright (c) 2025 Project CHIP Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+GWM_SH:=$(patsubst %.mk,%.sh,$(abspath $(lastword $(MAKEFILE_LIST))))
+
+# Hook function that gathers git metadata; it can be overridden by the
+# package Makefile. The output of this shell command (or commands) is
+# captured into a .git-metadata file located at the root of the source tree.
+define GitWithMetadata/gather
+git show -s --format="COMMIT_TIMESTAMP=%ct" HEAD
+endef
+
+# Expands into a shell expression that resolves a variable from
+# .git-metadata at build time, usually for passing as an argument
+# to configure or cmake.
+# Example: $(call GitWithMetadata/resolve,COMMIT_HASH)
+define GitWithMetadata/resolve
+"`. .git-metadata && echo "$$$$$(1)"`"
+endef
+
+ifndef DownloadMethod/default
+$(error git-with-metadata.mk must be included after package.mk)
+endif
+
+# Set up hooks and delegate to the 'git' download method.
+$(eval dl_tar_pack=true dl_tar_pack && $(value dl_tar_pack))
+define DownloadMethod/git-with-metadata
+	gwm_gather_$(if $(filter skip,$(SUBMODULES)),checkout,submodules)() { $(GitWithMetadata/gather) ; } && \
+	SUBDIR=$(SUBDIR) && . $(GWM_SH) && $(call DownloadMethod/git,$(1),$(2))
+endef

include/git-with-metadata.sh

@@ -0,0 +1,42 @@
+# Copyright (c) 2025 Project CHIP Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script is sourced at the start of a git download command sequence.
+# It intercepts `git` and `true` commands so additional work can be
+# performed at these injection points.
+
+GWM_IN_HOOK=
+GWM_META="$(mktemp -t gwm-meta.XXXXXX)"
+
+git() { command git "$@" && { [ -n "$GWM_IN_HOOK" ] || gwm_hook git "$@"; }; }
+true() { [ -n "$GWM_IN_HOOK" ] || gwm_hook true "$@"; }
+
+gwm_gather() {
+    local func="gwm_gather_$1"
+    if type "$func" >/dev/null; then
+        echo "Gathering meta-data..."
+        "$func" | tee "$GWM_META"
+    fi
+}
+
+gwm_hook() {
+    local GWM_IN_HOOK=1
+    if [ "$1 $2" = "git checkout" ]; then
+        gwm_gather checkout
+    elif [ "$1 $2 $3" = "git submodule update" ]; then
+        gwm_gather submodules
+    elif [ "$1 $2" = "true dl_tar_pack" ]; then
+        [ -s "$GWM_META" ] && mv "$GWM_META" "$SUBDIR/.git-metadata"
+    fi
+}

overlay/overlay.mk include/overlay.mkoverlay/overlay.mk renamed to include/overlay.mk

@@ -12,8 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-OVERLAY_MK:=$(abspath $(lastword $(MAKEFILE_LIST)))
-OVERLAY_SH:=$(dir $(OVERLAY_MK))overlay.sh
+OVERLAY_SH:=$(patsubst %.mk,%.sh,$(abspath $(lastword $(MAKEFILE_LIST))))
 
 define BuildPackageOverlay
   $(call BuildPackageOverlay/$(if $(DUMP),Dump,Build),$(notdir $(1)),$(call overlay_base,$(1)))

overlay/overlay.sh include/overlay.shoverlay/overlay.sh renamed to include/overlay.sh

@@ -12,5 +12,5 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-include ../overlay.mk
+include ../../include/overlay.mk
 $(eval $(call BuildPackageOverlay,network/services/hostapd))

overlay/hostapd/Makefile

@@ -26,9 +26,9 @@ PKG_SOURCE_SUBMODULES:=\
   third_party/nlio/repo
 
 # Hash can be regenerated with make package/matter-netman/check FIXUP=1
-PKG_SOURCE_DATE:=2025-07-08
-PKG_SOURCE_VERSION:=dda2252eb28440305c883d0204737dce5b3abe62
-PKG_MIRROR_HASH:=ad81137221dafc0302c70cb90a03ab2472a02ee3c03e8cef8edcba26fd34201d
+PKG_SOURCE_DATE:=2025-10-29
+PKG_SOURCE_VERSION:=8f221d80d3f78d63ff4ad3d2d363e702430b5df7
+PKG_MIRROR_HASH:=eb565be9381ce88369b063d5ba25855218b657e366b3258c74e4cc41956c08b2
 
 # Use local source dir for development
 # USE_SOURCE_DIR:=$(HOME)/workspace/connectedhomeip
@@ -50,7 +50,7 @@ define Package/matter-netman/default
   CATEGORY:=Network
   TITLE:=Matter Network Infrastructure Manager Daemon
   URL:=https://github.com/project-chip/connectedhomeip
-  DEPENDS:=+libstdcpp +libatomic
+  DEPENDS:=+libstdcpp +libatomic +libubus +libubox
   USERID:=matter:matter
 endef
 
@@ -90,10 +90,10 @@ endef
 
 # General options
 CONFIGURE_OPTIONS:=\
+	--enable-ubus \
+	--enable-detail-logging \
 	--enable-recommended=no \
 	--enable-access-restrictions=no \
-	--enable-wifi=no \
-	--enable-openthread=no \
 	--enable-network-layer-ble=no \
 	--enable-tracing-support=no
 
@@ -124,9 +124,10 @@ OS_VERSION:=$(if $(filter-out SNAPSHOT,$(VERSION_NUMBER)),$(VERSION_NUMBER)-)$(V
 TARGET_CFLAGS+=\
 	-DCHIP_DEVICE_CONFIG_ENABLE_TEST_SETUP_PARAMS=0 \
 	-DCHIP_DEVICE_CONFIG_DEVICE_SOFTWARE_VERSION_STRING=\"$(PKG_VERSION)@$(OS_VERSION)\" \
-	-DCHIP_DEVICE_CONFIG_DEFAULT_DEVICE_HARDWARE_VERSION_STRING=\"\" \
+	-DCHIP_DEVICE_CONFIG_DEFAULT_DEVICE_HARDWARE_VERSION_STRING=\"-\" \
 	-DCHIP_DEVICE_CONFIG_DEVICE_VENDOR_NAME=\"$(VERSION_DIST)\" \
-	-DCHIP_DEVICE_CONFIG_DEVICE_PRODUCT_NAME=\"\"
+	-DCHIP_DEVICE_CONFIG_DEVICE_PRODUCT_NAME=\"\" \
+	-DCHIP_DEVICE_CONFIG_TEST_SERIAL_NUMBER=\"\"
 
 # https://github.com/openwrt/openwrt/issues/13016
 TARGET_CFLAGS+= -Wno-format-nonliteral
@@ -149,9 +150,10 @@ define Build/Compile
 endef
 
 define Package/matter-netman/default/install
-	$(INSTALL_DIR) $(1)/usr/sbin $(1)/usr/share/matter $(1)/etc/init.d
+	$(INSTALL_DIR) $(1)/usr/sbin $(1)/usr/share/matter $(1)/etc/init.d $(1)/usr/share/acl.d
 	$(INSTALL_BIN) $(OUT_DIR)/matter-network-manager-app $(1)/usr/sbin
 	$(INSTALL_DATA) ./files/bootstrap.sh $(1)/usr/share/matter/
+	$(INSTALL_DATA) ./files/matter_acl.json $(1)/usr/share/acl.d
 	$(INSTALL_BIN) ./files/matter.init $(1)/etc/init.d/matter
 endef
 

service/matter-netman/Makefile

@@ -0,0 +1,10 @@
+{
+	"user": "matter",
+	"access": {
+		"otbr": {
+			"methods": ["*"]
+		}
+	},
+	"subscribe": [ "otbr" ],
+	"listen": [ "ubus.object.*" ]
+}