Add WireGuard VPN

[cfernande1470]

Adds WireGuard VPN for rooted LG webOS TVs.

The app uses wireguard-go in userspace because stock LG webOS kernels usually do not include the WireGuard kernel module.

Release assets:

• org.wireguard_1.0.0_all.ipk
• org.wireguard.manifest.json

Source:
https://github.com/cfernande1470/webos-wireguard

[github-actions]

Check Results for org.wireguard.yml:

Package Metadata

• ⚠️ No licence found in https://github.com/cfernande1470/webos-wireguard. pool: main declares the app as open source, so its source repository should carry a licence. Add a LICENSE file, or set pool: non-free.

Compatibility Check

App org.webosbrew.wireguard

Web app — Plain HTML/JS; webOSTV.js; requires ES2015

	5.3.1	6.4.0	7.4.0	8.3.0	9.2.0	10.2.0	11.2.0
Web engine	Chromium 68	Chromium 79	Chromium 87	Chromium 94	Chromium 108	Chromium 120	Chromium 132
ES2015 support	🆗	🆗	🆗	🆗	🆗	🆗	🆗
Runtime APIs	🆗	🆗	🆗	🆗	🆗	🆗	🆗

Web app

• Framework: Plain HTML/JS
• Language features used: let/const
• Runtime APIs (up to ES2017, may need polyfills): Object.getOwnPropertyDescriptors, Object.getOwnPropertySymbols

[cfernande1470]

Hi!

Any news?

[mariotaku]

Hi, can you change package name as it is not from webosbrew organization?

[cfernande1470]

Done

[mariotaku]

Hi, can you also update the file in this PR?

[cfernande1470]

done

[cfernande1470]

Hi, is this progressing?

[mariotaku]

I have updated the pipeline but I think you need to update manifest content again. Without the pipeline going green, the app couldn't be downloaded by homebrew channel.

[cfernande1470]

Can you re-run the checks? I think it is fixed now

[mariotaku]

It is checking against your latest release. The json is pointing to org.webosbrew.wireguard while your new package is org.wireguard

[cfernande1470]

fixed

[mariotaku]

Since its not likely to run on webOS 4, is marking it for webOS 5+ sounds good to you?

[cfernande1470]

Yes!

[mariotaku]

I've pushed requirements.webosRelease: '>=5.0' to this branch (a499c1a) as we discussed — checks are green now.

One thing needs you to address (not a blocker): the repository has no licence. pool: main declares the app as open source, so please add one. Since the app bundles wireguard-go, which is MIT, an MIT or GPL-2.0 licence would both be compatible choices — https://choosealicense.com/ is a good starting point if you're unsure.

[mariotaku]

Sorry for the back-and-forth — I reverted this in #223 after spotting two problems that the checks didn't catch at the time. Here's everything needed for a resubmission, so it can go in one go.

1. The IPK still installs as org.webosbrew.wireguard

The rename we discussed in May reached the package file and the manifest, but not the package itself:

$ ar p org.wireguard_1.0.0_all.ipk control.tar.gz | tar xzO ./control
Package: org.webosbrew.wireguard

$ appinfo.json
{ "id": "org.webosbrew.wireguard", "vendor": "webOSBrew", ... }

So the repo listed org.wireguard while TVs installed org.webosbrew.wireguard. Beyond the naming, Homebrew Channel matches installs by id — with the two disagreeing, the app would never register as installed and would never be offered updates.

Also note org.webosbrew.* is now rejected outright for packages outside github.com/webosbrew, so the new id can't be in that namespace. I'd suggest com.github.cfernande1470.wireguard — org.wireguard isn't great either, since that's upstream WireGuard's own namespace and it's a trademark of Jason Donenfeld.

The id needs changing in all of: appinfo.json, the ipk control (Package:), the installed paths under usr/palm/, the manifest, and the package file name here. A new check now verifies the manifest against the id inside the IPK, so a partial rename will fail rather than slip through.

2. The bundled binaries need to be 32-bit

payload/wireguard/bin/wg            ELF 64-bit LSB executable, ARM aarch64
payload/wireguard/bin/wireguard-go  ELF 64-bit LSB executable, ARM aarch64
payload/wireguard/bin/wg-upload     ELF 64-bit LSB executable, ARM aarch64

The standard for webOS homebrew is to always ship 32-bit ARM binaries. A single armv7 build runs on every LG TV, including the 64-bit models, which is what makes the Architecture: all in your control file true. 64-bit binaries only run on a subset, so please rebuild for 32-bit — for the Go parts that's GOARCH=arm GOARM=7, and wg needs an arm (not aarch64) toolchain.

The requirements list in the package description mentions "linux/arm64 / aarch64 for the bundled binaries", which can go once they're 32-bit.

3. The repository still has no licence

As mentioned above — pool: main declares the app open source. Since it bundles wireguard-go (MIT), MIT or GPL-2.0 would both work.

Happy to re-review as soon as you have a new release ready.

[cfernande1470]

No worries, I am learning a lot. I will fix the issues.

[cfernande1470]

All requested changes are now complete and a new release is ready:

• The application/package ID is consistently com.github.cfernande1470.wireguard in appinfo.json, the IPK control file, packageinfo.json, installed paths, manifest, and asset filenames.
• All three bundled executables (wg, wireguard-go, and wg-upload) have been rebuilt as 32-bit ARMv7 ELF binaries.
• An MIT LICENSE has been added to the source repository.
• Reproducible build/package verification scripts were added to prevent stale IDs or non-ARM32 binaries from being released again.

Release: https://github.com/cfernande1470/webos-wireguard/releases/tag/v1.0.1

Manifest: https://github.com/cfernande1470/webos-wireguard/releases/download/v1.0.1/com.github.cfernande1470.wireguard.manifest.json

I also tested the release on a 64-bit ARM LG webOS TV: clean IPK installation, payload installation, native execution of the ARMv7 binaries, upload-server health check, and WireGuard tunnel startup all succeeded.

Everything should now be ready for resubmission. Thank you for the detailed review.