OPNsense aarch64 firmware repository

[Maurice]

Hello all,

After testing OPNsense on ARM64 (aarch64) virtual machines for some time, I've decided to make my firmware repository public. It can be used for installing updates and plugins on existing OPNsense aarch64 systems as well as for quickly building aarch64 images. Updates typically get published within 24 hours of the official amd64 updates.

https://opnsense-update.walker.earth

Configure OPNsense to use the repository for downloading updates and plugins

• Add the fingerprint to OPNsense:
  

  fetch -o /usr/local/etc/pkg/fingerprints/OPNsense/trusted https://opnsense-update.walker.earth/FreeBSD:14:aarch64/25.1/opnsense-update.walker.earth.20241220

  
  
• Change the firmware mirror:
  'System: Firmware: Settings'
  Mirror    (custom)
                  https://opnsense-update.walker.earth

Build aarch64 images

• Follow the instructions on https://github.com/opnsense/tools
• Before invoking make arm or make vm, prefetch the sets:
  

  make prefetch-base,kernel,packages MIRRORS=https://opnsense-update.walker.earth

  
  
  

For building VM images, my fork of the OPNsense tools allows configuring the default console. Sample VM images are available in the releases section.


None of this is supported by Deciso or the OPNsense core team! Use at your own risk.


Thanks to everyone who contributed to OPNsense-aarch64. I only use the tools others have created.

Cheers
Maurice

GitHub Sponsors is available as an option if you'd like to support these efforts.

The public key for my 25.1-aarch64 packages and sets is:

Code Select Expand

-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAvjmZd/4LGgOwvsOW35iH
novsNd+39Y1dWFhLFnYDLQ7Jp+xYeYmFwhLSxxR6mJcHCRQpzL1vX1aCB+6OZNgd
2wfQW44CEW//9hhoAJK/6QUwLmpB7OfFMy8/dnVacAdzLhmdqBjowBMoiRxQ8L7Q
tPGiztsBOK6UsytMquVKmAloo7NxNVK3pDcJpjoN48mS/78NmcW/xoFsP6j55n77
WOpkm2ExklTrpENymFocD/RzKApmTyZMkoeeH3PfdPEj8rd8ZGgposGra1Da0wUb
6moiP1yqnuyS9Wdt91IQ01cWW+DRi/OIZhSJxPrsNvMQQrcS46LviCIJ5nbjPRVq
QAnMXONUbTSR5x4BdUUELTWOCDNonIe3vglpfOB6QYnAZMCi+StY+NVv4hjp92UT
hLCy3hB846ubriIq4LLBVrmMufFuR/1cIPcd2zwyAbjOOsjGSKlL6szjsodBkFnp
Ha+BYY1JtBVe6tCkTF5RRpktK16fml8nYe8fxELDsq3ffayQDi6Uo49gNwGddDC2
VeLskIgweTecMFbwT1Nw2DNNi45RT9w/X5Li+kqgPfUbPWBrQNroH1HfDAmS8/RX
fg70S7WW1czb29tPXk9OR0gaA4hPc3iAlexB5AN+dJ/VsJwzhcVxC7dcSbA069bd
g1TGwGknb36h4NhTiiI0+XkCAwEAAQ==
-----END PUBLIC KEY-----


[franco]

Nice. Thanks for your work!

Only for reference: what's your update strategy? Providing snapshots (time frame?) or follow stable releases?


Cheers,
Franco

[Maurice]

The plan is to follow stable releases. So far I've released packages and sets matching the 23.7, 23.7.1, 23.7.2 and 23.7.3 tags. When you release an official update, I fire up my build system and set the VERSION accordingly.

Not entirely sure how to deal with hotfixes yet. My 23.7.3 packages do include the hotfixed os-wireguard 2.0_2, but the 23.7.1 packages do not include opnsense 23.7.1_3.

Cheers
Maurice

[franco]

Hotfixes are tricky indeed as they leave the basic formula of building what is tagged.

I wouldn't worry too much about these if you don't happen to be able to pick them up right away (build delay). Following releases sounds like a working strategy for everyone using this. :)

Snapshots are handy too, but too many surprises on updates.

I also see you don't publish development packages (EXTRABRANCH=master). The feature formerly known as "rewind" doesn't like this anyway. It's almost like snapshot releases inside the stable releases so not needed as well.


Cheers,
Franco

[Monviech (Cedrik)]

Did you get any experience with the performance of a Raspberry Pi 4?

I'm kinda curious since I have a few CM4 with waveshare boards, some with pcie nvme or with pcie 2 Nics. But if you already made some tests yourself it would be nice to know what to expect.

I'll definitely try to build it and implement your firmware repo for tests, thank you.

[Maurice]

I'm currently using this on Ampere Altra based Cloud VMs exclusively (which works flawlessly). Don't own a Raspberry Pi.

yrzr.tk offers images for RPI and well-written docs. They've contributed a lot to OPNsense-aarch64. 👍🎉

[Maurice]

OPNsense 23.7.4 aarch64 packages and sets released.

Cheers
Maurice

[Maurice]

OPNsense 23.7.5 aarch64 packages and sets released.

[Maurice]

OPNsense 23.7.6 aarch64 packages and sets released.

[hushcoden]

Why don't you make this a sticky post?

[franco]

Waited for someone to ask about it ;)

[Abbott]

I use the build of https://github.com/yrzr/opnsense-tools/releases
This repo worked for me.

Thank you very much.

[Maurice]

Yep, yrzr's work was the inspiration for my own repo. Their focus clearly is on images for various devices (RPI etc.), while mine is on virtualization and frequent updates.

Expect 23.7.7 by tomorrow.

Cheers
Maurice

[Maurice]

OPNsense 23.7.7 aarch64 packages and sets released. Includes hotfix 23.7.7_1.

[Update 2023-10-29]
Hotfix 23.7.7_3 released.

[Maurice]

OPNsense 23.7.8 aarch64 packages and sets released.

[Update 2023-11-13]
Hotfix 23.7.8_1 released.