feat: add locked community package catalog

.github/workflows/pages.yml

@@ -6,11 +6,14 @@ on:
     paths:
       - 'site/**'
       - 'components/**'
+      - 'manifests/community-feeds.lock'
       - 'tests/test_pages_ui.js'
+      - 'tests/test_package_catalog.py'
       - 'tests/test_pages_policy.sh'
       - 'tests/test_component_catalog_staging.py'
       - 'devices/**'
       - 'scripts/device_metadata.py'
+      - 'scripts/generate-package-catalog.py'
       - 'scripts/generate-pages-data.py'
       - 'scripts/component_package_policy.py'
       - 'scripts/resolve-components.py'
@@ -94,6 +97,7 @@ jobs:
         run: |
           set -euo pipefail
           node tests/test_pages_ui.js
+          python3 tests/test_package_catalog.py
           python3 tests/test_component_catalog_staging.py
           bash tests/test_pages_policy.sh
       - name: Configure GitHub Pages

components/catalog.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "catalog_version": "2026.07.21",
+  "catalog_version": "2026.07.21.1",
   "max_selected_components": 32,
   "targets": [
     {
@@ -96,6 +96,12 @@
       "title": "视频与媒体",
       "description": "OpenWrt 官方 video feed 中的视频和媒体组件。",
       "order": 180
+    },
+    {
+      "id": "community-kiddin9",
+      "title": "社区候选库 / kiddin9（未审核）",
+      "description": "仅展示锁定元数据中的未审核候选；全部不可选，不进入构建请求，不克隆或执行社区 feed。",
+      "order": 190
     }
   ],
   "components": [

components/package-catalog.json

@@ -1 +1 @@
-{"catalog_version":"2026.07.21","openwrt_version":"25.12.5","schema_version":1,"shards":[{"flavor":"official","package_count":10947,"path":"components/packages/x86_64-official.json","selectable_count":10722,"sha256":"76957483a7e01e8e9e253babc7557e64bf5ef7780b7382445c8d56d18cd64e9f","sources":[{"feed":"target","sha256":"5b1f78e64094ac3c0338e3c8b1e731fd4cfe99ac41d2a84d1a2d90ea308ef9ca","url":"https://downloads.openwrt.org/releases/25.12.5/targets/x86/64/packages/packages.adb"},{"feed":"base","sha256":"c4fa582b1ffa68a3c1662047ef0c194d63873914dd876fb2149a58681373f4eb","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/base/packages.adb"},{"feed":"kmods","sha256":"396d8d908ed765664564a86df328ed55d5b7390ea5dfc00dac2931cc3bc3172d","url":"https://downloads.openwrt.org/releases/25.12.5/targets/x86/64/kmods/6.12.94-1-a7bc15f451f9652701ba04af9cfb0b95/packages.adb"},{"feed":"luci","sha256":"b2d26823521958fbb822971583d095d56cd81753b7af4ee4d15fe1e0833132f4","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/luci/packages.adb"},{"feed":"packages","sha256":"e035e0563f6756b1d715b62604db63a6530dba271d7af30076200dbd6845e5a2","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/packages/packages.adb"},{"feed":"routing","sha256":"b10fe8cc187eb33d4cf5b2fd082ccee7ff66ef6cef65e3d286432c74d479239b","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/routing/packages.adb"},{"feed":"telephony","sha256":"0fb0698f41ec500441894d0a7bef6b297ea1634673b7e508e4ebfab5c7cf384b","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/telephony/packages.adb"},{"feed":"video","sha256":"c1543970056375f056e0fac9bf1d2862673fe9910c6c6984293699b9eda39c87","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/video/packages.adb"}],"target":"x86_64"},{"flavor":"official","package_count":11154,"path":"components/packages/xiaomi_ax9000-official.json","selectable_count":10857,"sha256":"53dd20dd71e5636ee07831600935b8ffdbe8278485a23a9871425fdd49ef1cff","sources":[{"feed":"target","sha256":"b475666b9d7d56ee281cc99e10a66f513c98dd00a7f249af44f22b19376aee7c","url":"https://downloads.openwrt.org/releases/25.12.5/targets/qualcommax/ipq807x/packages/packages.adb"},{"feed":"base","sha256":"31a28b068dc5410f69c121ee94824884ee2f9c4fd0d271a571bb6fabb60ac6be","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/base/packages.adb"},{"feed":"kmods","sha256":"e1744c89c7516332beddb89c4229271d5c02df95cbd5deb0813a8650ec3bf854","url":"https://downloads.openwrt.org/releases/25.12.5/targets/qualcommax/ipq807x/kmods/6.12.94-1-dbd7ac5945a1d38dbc7f22bedd674e40/packages.adb"},{"feed":"luci","sha256":"289563e984e797396865e6d09142474853b03c20f33610dd54c2174a28cb11f7","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/luci/packages.adb"},{"feed":"packages","sha256":"28ae423e7d70b699491f132647b554da54e4dc4dff6236e97c5c957454e81f60","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/packages/packages.adb"},{"feed":"routing","sha256":"d16b73cae2145ce34aa17e3476a9ec94a8b408b8c9e2ed674b1d4271aeec4f79","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/routing/packages.adb"},{"feed":"telephony","sha256":"c61b70ad648b64baebeccccbdf8293929511233e9dcc13a1bdf7859e25cedf58","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/telephony/packages.adb"},{"feed":"video","sha256":"5717d11f3f2ce033caa4f2f595a010c2b53a84f6d510bf8c41420eb92a3840fc","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/video/packages.adb"}],"target":"xiaomi_ax9000"},{"flavor":"nss","package_count":3903,"path":"components/packages/xiaomi_ax9000-nss.json","selectable_count":3902,"sha256":"b1d6ef48d7a5f94f865429499de3140b9b2d180f1cc84ef0d41de3d4c4fb4ded","sources":[{"feed":"base","sha256":"31a28b068dc5410f69c121ee94824884ee2f9c4fd0d271a571bb6fabb60ac6be","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/base/packages.adb"},{"feed":"luci","sha256":"289563e984e797396865e6d09142474853b03c20f33610dd54c2174a28cb11f7","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/luci/packages.adb"},{"feed":"packages","sha256":"28ae423e7d70b699491f132647b554da54e4dc4dff6236e97c5c957454e81f60","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/packages/packages.adb"},{"feed":"routing","sha256":"d16b73cae2145ce34aa17e3476a9ec94a8b408b8c9e2ed674b1d4271aeec4f79","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/routing/packages.adb"},{"feed":"telephony","sha256":"c61b70ad648b64baebeccccbdf8293929511233e9dcc13a1bdf7859e25cedf58","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/telephony/packages.adb"},{"feed":"video","sha256":"5717d11f3f2ce033caa4f2f595a010c2b53a84f6d510bf8c41420eb92a3840fc","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/video/packages.adb"}],"target":"xiaomi_ax9000"}]}
+{"catalog_version":"2026.07.21.1","openwrt_version":"25.12.5","schema_version":2,"shards":[{"flavor":"official","package_count":10947,"path":"components/packages/x86_64-official.json","selectable_count":10721,"sha256":"b1af3f2601affd5678962cdab22bf5cfcf6061f08ed47f9f64eac15334e0ba75","sources":[{"feed":"target","sha256":"5b1f78e64094ac3c0338e3c8b1e731fd4cfe99ac41d2a84d1a2d90ea308ef9ca","url":"https://downloads.openwrt.org/releases/25.12.5/targets/x86/64/packages/packages.adb"},{"feed":"base","sha256":"c4fa582b1ffa68a3c1662047ef0c194d63873914dd876fb2149a58681373f4eb","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/base/packages.adb"},{"feed":"kmods","sha256":"396d8d908ed765664564a86df328ed55d5b7390ea5dfc00dac2931cc3bc3172d","url":"https://downloads.openwrt.org/releases/25.12.5/targets/x86/64/kmods/6.12.94-1-a7bc15f451f9652701ba04af9cfb0b95/packages.adb"},{"feed":"luci","sha256":"b2d26823521958fbb822971583d095d56cd81753b7af4ee4d15fe1e0833132f4","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/luci/packages.adb"},{"feed":"packages","sha256":"e035e0563f6756b1d715b62604db63a6530dba271d7af30076200dbd6845e5a2","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/packages/packages.adb"},{"feed":"routing","sha256":"b10fe8cc187eb33d4cf5b2fd082ccee7ff66ef6cef65e3d286432c74d479239b","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/routing/packages.adb"},{"feed":"telephony","sha256":"0fb0698f41ec500441894d0a7bef6b297ea1634673b7e508e4ebfab5c7cf384b","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/telephony/packages.adb"},{"feed":"video","sha256":"c1543970056375f056e0fac9bf1d2862673fe9910c6c6984293699b9eda39c87","url":"https://downloads.openwrt.org/releases/25.12.5/packages/x86_64/video/packages.adb"}],"target":"x86_64"},{"flavor":"official","package_count":12123,"path":"components/packages/xiaomi_ax9000-official.json","selectable_count":10856,"sha256":"0c2fee6c6331916c09a7c520aa466f3ec37d40048c2340a9c2cace865f0958bd","sources":[{"feed":"target","sha256":"b475666b9d7d56ee281cc99e10a66f513c98dd00a7f249af44f22b19376aee7c","url":"https://downloads.openwrt.org/releases/25.12.5/targets/qualcommax/ipq807x/packages/packages.adb"},{"feed":"base","sha256":"31a28b068dc5410f69c121ee94824884ee2f9c4fd0d271a571bb6fabb60ac6be","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/base/packages.adb"},{"feed":"kmods","sha256":"e1744c89c7516332beddb89c4229271d5c02df95cbd5deb0813a8650ec3bf854","url":"https://downloads.openwrt.org/releases/25.12.5/targets/qualcommax/ipq807x/kmods/6.12.94-1-dbd7ac5945a1d38dbc7f22bedd674e40/packages.adb"},{"feed":"luci","sha256":"289563e984e797396865e6d09142474853b03c20f33610dd54c2174a28cb11f7","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/luci/packages.adb"},{"feed":"packages","sha256":"28ae423e7d70b699491f132647b554da54e4dc4dff6236e97c5c957454e81f60","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/packages/packages.adb"},{"feed":"routing","sha256":"d16b73cae2145ce34aa17e3476a9ec94a8b408b8c9e2ed674b1d4271aeec4f79","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/routing/packages.adb"},{"feed":"telephony","sha256":"c61b70ad648b64baebeccccbdf8293929511233e9dcc13a1bdf7859e25cedf58","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/telephony/packages.adb"},{"feed":"video","sha256":"5717d11f3f2ce033caa4f2f595a010c2b53a84f6d510bf8c41420eb92a3840fc","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/video/packages.adb"},{"candidate_commit":"9f2092b4f204fc9948226d9a3f5166b69976af48","candidate_repository":"https://github.com/kiddin9/op-packages.git","catalog_sha256":"4b14b36b0c9839f81bb6a56ffc1ac94384603c7a9c93e7f63ac48ffc4c699292","feed":"kiddin9","metadata_format":"opkg-packages-gzip","metadata_signed":false,"sha256":"ce97a429f7fcd414a22b3ad701118d5299319a84add12c26d401216184c8bd04","url":"https://dl.openwrt.ai/releases/25.12/packages/aarch64_cortex-a53/kiddin9/Packages.gz"}],"target":"xiaomi_ax9000"},{"flavor":"nss","package_count":3903,"path":"components/packages/xiaomi_ax9000-nss.json","selectable_count":3902,"sha256":"0b12b7db49a3bb75e9075c45a0155b04492fa351cf845c923e3fe26a32adee93","sources":[{"feed":"base","sha256":"31a28b068dc5410f69c121ee94824884ee2f9c4fd0d271a571bb6fabb60ac6be","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/base/packages.adb"},{"feed":"luci","sha256":"289563e984e797396865e6d09142474853b03c20f33610dd54c2174a28cb11f7","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/luci/packages.adb"},{"feed":"packages","sha256":"28ae423e7d70b699491f132647b554da54e4dc4dff6236e97c5c957454e81f60","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/packages/packages.adb"},{"feed":"routing","sha256":"d16b73cae2145ce34aa17e3476a9ec94a8b408b8c9e2ed674b1d4271aeec4f79","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/routing/packages.adb"},{"feed":"telephony","sha256":"c61b70ad648b64baebeccccbdf8293929511233e9dcc13a1bdf7859e25cedf58","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/telephony/packages.adb"},{"feed":"video","sha256":"5717d11f3f2ce033caa4f2f595a010c2b53a84f6d510bf8c41420eb92a3840fc","url":"https://downloads.openwrt.org/releases/25.12.5/packages/aarch64_cortex-a53/video/packages.adb"}],"target":"xiaomi_ax9000"}]}

manifests/community-feeds.lock

@@ -0,0 +1,10 @@
+# shellcheck shell=sh
+# Metadata is intentionally marked unsigned and is used only to populate the UI catalog.
+# The Git commit below identifies the candidate source snapshot only; production builds do not clone or execute it, and never use dl.openwrt.ai IPK files.
+KIDDIN9_FEED="kiddin9"
+KIDDIN9_REPO="https://github.com/kiddin9/op-packages.git"
+KIDDIN9_COMMIT="9f2092b4f204fc9948226d9a3f5166b69976af48"
+KIDDIN9_PACKAGES_URL="https://dl.openwrt.ai/releases/25.12/packages/aarch64_cortex-a53/kiddin9/Packages.gz"
+KIDDIN9_PACKAGES_SHA256="ce97a429f7fcd414a22b3ad701118d5299319a84add12c26d401216184c8bd04"
+KIDDIN9_PACKAGES_SIGNED="0"
+KIDDIN9_CATALOG_SHA256="4b14b36b0c9839f81bb6a56ffc1ac94384603c7a9c93e7f63ac48ffc4c699292"

scripts/component_package_policy.py

@@ -12,6 +12,7 @@
         "fwtool",
         "kernel",
         "libc",
+        "luci-base",
         "mtd",
         "opkg",
         "procd",
@@ -55,6 +56,8 @@
     ("xiaomi_ax9000", "nss"): frozenset({"noarch"}),
 }
 
+PACKAGE_SOURCES = frozenset({"official", "kiddin9"})
+
 
 def blocked_reason_for(package: str) -> str:
     """Return the mandatory block reason, or an empty string when selectable."""
@@ -68,6 +71,22 @@ def blocked_reason_for(package: str) -> str:
     return ""
 
 
+def blocked_reason_for_record(
+    package: str, source: str, *, duplicates_official: bool = False
+) -> str:
+    """Return the source-aware block reason for one catalog record."""
+    reason = blocked_reason_for(package)
+    if reason:
+        return reason
+    if source == "kiddin9":
+        if duplicates_official:
+            return "社区候选库未审核且与 OpenWrt 官方包同名，不允许覆盖官方来源或进入生产构建。"
+        return "社区候选库未完成源码安全审核，不允许进入生产构建。"
+    if source not in PACKAGE_SOURCES:
+        return "包来源不在 NexaWrt 的允许列表中。"
+    return ""
+
+
 def risk_for(package: str, feed: str) -> str:
     """Return the mandatory risk label for a package/feed pair."""
     lower = package.lower()