Can't upgrade 24.10 -> 25.12

Installing and Using OpenWrt
1

When upgrading I am getting
Status: Error: Impossible package selection: hostapd not in manifest
I tried to upgrade to 25.12.4 but also 25.12.3, same error. During check it only said that
3 packages will be downgraded (procd, procd-seccomp, procd-ujail).
What do I do?

Full log 
ASU-Server     https://sysupgrade.openwrt.org
Upstream       https://downloads.openwrt.org
Target         x86/64
Profile        generic
Package-arch   x86_64
Version-from   24.10.6 r29141-81be8a8869 (kernel 6.6.127)
Version-to     25.12.3 r32912-6639b15f62 (kernel 6.12.85)
3 packages were downgraded
191 packages are out-of-date
There are 0 missing and 1 modified default packages
Request hash:
  c62e0dafbd36383701ccf68657926756910a3da019f370e5783a0e95b3e177d3
--
Status:   Error: Impossible package selection: hostapd not in manifest
Progress:   0s total =   0s in queue +   0s in build

Build failed in   0s total =   0s in queue +   0s to build:
ASU server stdout =
apk-mbedtls - 3.0.5-r3
attendedsysupgrade-common - 10
base-files - 1705~6639b15f62
bnx2-firmware - 20260221-r1
busybox - 1.37.0-r6
ca-bundle - 20260223-r1
cgi-io - 2025.12.11~658b14bd-r1
dnsmasq - 2.91-r3
dropbear - 2025.89-r1
e2fsprogs - 1.47.3-r1
firewall4 - 2025.03.17~b6e51575-r2
fstools - 2026.02.15~8d377aa6-r1
fwtool - 2025.10.03~04cd252e-r1
getrandom - 2025.10.30~6f78fa49-r1
grub2 - 2.12-r1
grub2-bios-setup - 2.12-r1
grub2-efi - 2.12-r1
hostapd-basic-mbedtls - 2025.08.26~ca266cc2-r1
hostapd-common - 2025.08.26~ca266cc2-r1
i915-firmware-dmc - 20260221-r1
iw - 6.17-r1
iwlwifi-firmware-ax200 - 20260221-r1
jansson - 2.14.1-r1
jshn - 2026.03.13~81563384-r2
jsonfilter - 2026.03.16~b9034210-r1
kernel - 6.12.85~d037e17efc2c7cd4972f63d6de88677f-r1
kmod-acpi-video - 6.12.85-r1
kmod-amazon-ena - 6.12.85-r1
kmod-amd-xgbe - 6.12.85-r1
kmod-backlight - 6.12.85-r1
kmod-bnx2 - 6.12.85-r1
kmod-button-hotplug - 6.12.85-r3
kmod-cfg80211 - 6.12.85.6.18.7-r1
kmod-crypto-acompress - 6.12.85-r1
kmod-crypto-aead - 6.12.85-r1
kmod-crypto-ccm - 6.12.85-r1
kmod-crypto-cmac - 6.12.85-r1
kmod-crypto-crc32c - 6.12.85-r1
kmod-crypto-ctr - 6.12.85-r1
kmod-crypto-gcm - 6.12.85-r1
kmod-crypto-geniv - 6.12.85-r1
kmod-crypto-gf128 - 6.12.85-r1
kmod-crypto-ghash - 6.12.85-r1
kmod-crypto-hash - 6.12.85-r1
kmod-crypto-hmac - 6.12.85-r1
kmod-crypto-manager - 6.12.85-r1
kmod-crypto-null - 6.12.85-r1
kmod-crypto-rng - 6.12.85-r1
kmod-crypto-seqiv - 6.12.85-r1
kmod-crypto-sha3 - 6.12.85-r1
kmod-crypto-sha512 - 6.12.85-r1
kmod-dma-buf - 6.12.85-r1
kmod-drm - 6.12.85-r1
kmod-drm-buddy - 6.12.85-r1
kmod-drm-display-helper - 6.12.85-r1
kmod-drm-exec - 6.12.85-r1
kmod-drm-i915 - 6.12.85-r1
kmod-drm-kms-helper - 6.12.85-r1
kmod-drm-suballoc-helper - 6.12.85-r1
kmod-drm-ttm - 6.12.85-r1
kmod-drm-ttm-helper - 6.12.85-r1
kmod-dwmac-intel - 6.12.85-r1
kmod-e1000 - 6.12.85-r1
kmod-e1000e - 6.12.85-r1
kmod-fb - 6.12.85-r1
kmod-fb-cfb-copyarea - 6.12.85-r1
kmod-fb-cfb-fillrect - 6.12.85-r1
kmod-fb-cfb-imgblt - 6.12.85-r1
kmod-fb-sys-fops - 6.12.85-r1
kmod-fb-sys-ram - 6.12.85-r1
kmod-forcedeth - 6.12.85-r1
kmod-fs-vfat - 6.12.85-r1
kmod-hwmon-core - 6.12.85-r1
kmod-i2c-algo-bit - 6.12.85-r1
kmod-i2c-core - 6.12.85-r1
kmod-igb - 6.12.85-r1
kmod-igc - 6.12.85-r1
kmod-input-core - 6.12.85-r1
kmod-iwlwifi - 6.12.85.6.18.7-r1
kmod-ixgbe - 6.12.85-r1
kmod-lib-crc-ccitt - 6.12.85-r1
kmod-lib-crc32c - 6.12.85-r1
kmod-lib-lzo - 6.12.85-r1
kmod-libphy - 6.12.85-r1
kmod-mac80211 - 6.12.85.6.18.7-r1
kmod-mdio - 6.12.85-r1
kmod-mdio-devres - 6.12.85-r1
kmod-mii - 6.12.85-r1
kmod-nf-conntrack - 6.12.85-r1
kmod-nf-conntrack6 - 6.12.85-r1
kmod-nf-flow - 6.12.85-r1
kmod-nf-log - 6.12.85-r1
kmod-nf-log6 - 6.12.85-r1
kmod-nf-nat - 6.12.85-r1
kmod-nf-nathelper - 6.12.85-r1
kmod-nf-reject - 6.12.85-r1
kmod-nf-reject6 - 6.12.85-r1
kmod-nfnetlink - 6.12.85-r1
kmod-nft-core - 6.12.85-r1
kmod-nft-fib - 6.12.85-r1
kmod-nft-nat - 6.12.85-r1
kmod-nft-offload - 6.12.85-r1
kmod-nls-base - 6.12.85-r1
kmod-nls-cp437 - 6.12.85-r1
kmod-nls-iso8859-1 - 6.12.85-r1
kmod-nls-utf8 - 6.12.85-r1
kmod-pcs-xpcs - 6.12.85-r1
kmod-phy-realtek - 6.12.85-r1
kmod-phylink - 6.12.85-r1
kmod-ppp - 6.12.85-r1
kmod-pppoe - 6.12.85-r1
kmod-pppox - 6.12.85-r1
kmod-pps - 6.12.85-r1
kmod-ptp - 6.12.85-r1
kmod-r8169 - 6.12.85-r1
kmod-slhc - 6.12.85-r1
kmod-stmmac-core - 6.12.85-r1
kmod-tg3 - 6.12.85-r1
libblkid - 2.41.3-r1
libblobmsg-json - 2026.03.13~81563384-r2
libc - 1.2.5-r5
libcomerr - 1.47.3-r1
libe2p - 1.47.3-r1
libext2fs - 1.47.3-r1
libf2fs - 1.16.0-r4
libgcc - 14.3.0-r5
libiwinfo - 2026.01.14~f5dd57a8-r1
libiwinfo-data - 2026.01.14~f5dd57a8-r1
libjson-c - 0.18-r1
libjson-script - 2026.03.13~81563384-r2
libkmod - 32-r1
liblucihttp - 2023.03.15~9b5b683f-r1
liblucihttp-ucode - 2023.03.15~9b5b683f-r1
libmbedtls - 3.6.6-r2
libmnl - 1.0.5-r1
libnftnl - 1.3.1-r1
libnl-tiny - 2025.12.02~40493a65-r1
libpci - 3.14.0-r1
libpthread - 1.2.5-r5
librt - 1.2.5-r5
libsmartcols - 2.41.3-r1
libss - 1.47.3-r1
libubox - 2026.03.13~81563384-r2
libubus - 2025.12.02~3cc98db1-r1
libuci - 2025.12.02~66127cd7-r1
libuclient - 2026.02.20~7a0aa2e4-r1
libucode - 2026.01.16~85922056-r1
libudebug - 2026.01.16~875e1a7a
libustream-mbedtls - 2026.03.01~99f1c0db-r1
libuuid - 2.41.3-r1
logd - 2025.10.30~6f78fa49-r1
luci - 26.134.75701~cd18b8e
luci-app-firewall - 26.134.75701~cd18b8e
luci-app-package-manager - 26.134.75701~cd18b8e
luci-base - 26.134.75701~cd18b8e
luci-lib-uqr - 26.134.75701~cd18b8e
luci-light - 26.134.75701~cd18b8e
luci-mod-admin-full - 26.134.75701~cd18b8e
luci-mod-network - 26.134.75701~cd18b8e
luci-mod-status - 26.134.75701~cd18b8e
luci-mod-system - 26.134.75701~cd18b8e
luci-proto-ipv6 - 26.134.75701~cd18b8e
luci-proto-ppp - 26.134.75701~cd18b8e
luci-ssl - 26.134.75701~cd18b8e
luci-theme-bootstrap - 26.134.75701~cd18b8e
macchanger - 1.7.0-r3
mkf2fs - 1.16.0-r4
mtd - 27
netifd - 2026.02.26~cbb83a18-r1
nftables-json - 1.1.6-r1
odhcp6c - 2026.01.25~ee2949e3-r1
odhcpd-ipv6only - 2026.03.16~edf2e523-r1
openwrt-keyring - 2025.12.10~f0670054-r1
owut - 2026.04.09~5d6760b5-r1
partx-utils - 2.41.3-r1
pciids - 0.387-r1
pciutils - 3.14.0-r1
ppp - 2.5.2-r3
ppp-mod-pppoe - 2.5.2-r3
procd - 2026.03.13~58eb263d-r1
procd-seccomp - 2026.03.13~58eb263d-r1
procd-ujail - 2026.03.13~58eb263d-r1
px5g-mbedtls - 11
r8169-firmware - 20260221-r1
rpcd - 2025.12.03~ffb9961c-r1
rpcd-mod-file - 2025.12.03~ffb9961c-r1
rpcd-mod-iwinfo - 2025.12.03~ffb9961c-r1
rpcd-mod-luci - 20240305-r1
rpcd-mod-rpcsys - 2025.12.03~ffb9961c-r1
rpcd-mod-rrdns - 20170710
rpcd-mod-ucode - 2025.12.03~ffb9961c-r1
ubox - 2025.10.30~6f78fa49-r1
ubus - 2025.12.02~3cc98db1-r1
ubusd - 2025.12.02~3cc98db1-r1
uci - 2025.12.02~66127cd7-r1
uclient-fetch - 2026.02.20~7a0aa2e4-r1
ucode - 2026.01.16~85922056-r1
ucode-mod-digest - 2026.01.16~85922056-r1
ucode-mod-fs - 2026.01.16~85922056-r1
ucode-mod-html - 1
ucode-mod-log - 2026.01.16~85922056-r1
ucode-mod-math - 2026.01.16~85922056-r1
ucode-mod-nl80211 - 2026.01.16~85922056-r1
ucode-mod-rtnl - 2026.01.16~85922056-r1
ucode-mod-ubus - 2026.01.16~85922056-r1
ucode-mod-uci - 2026.01.16~85922056-r1
ucode-mod-uclient - 2026.02.20~7a0aa2e4-r1
ucode-mod-uloop - 2026.01.16~85922056-r1
uhttpd - 2025.10.03~ebb92e6b-r1
uhttpd-mod-ubus - 2025.10.03~ebb92e6b-r1
urandom-seed - 3
urngd - 2025.10.03~f17e33d9-r1
usign - 2025.10.03~c4c72b1b-r1
wifi-scripts - 1.0-r1
wireless-regdb - 2026.03.18-r1
zlib - 1.3.1-r1

ASU server stderr =
Generate local signing keys...
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
WARNING: can't open config file: /builder/shared-workdir/build/staging_dir/host/etc/ssl/openssl.cnf
read EC key
writing EC key
WARNING: opening /builder/packages/packages.adb: No such file or directory
Package list missing or not up-to-date, generating it.

Building package index...

Traceback (most recent call last):
  File "/app/.venv/lib/python3.14/site-packages/rq/worker/base.py", line 1522, in perform_job
    return_value = job.perform()
  File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1342, in perform
    self._result = self._execute()
                   ~~~~~~~~~~~~~^^
  File "/app/.venv/lib/python3.14/site-packages/rq/job.py", line 1402, in _execute
    result = self.func(*self.args, **self.kwargs)
  File "/app/asu/build.py", line 494, in build
    result = _build(build_request, job)
  File "/app/asu/build.py", line 309, in _build
    report_error(job, err)
    ~~~~~~~~~~~~^^^^^^^^^^
  File "/app/asu/util.py", line 338, in report_error
    raise RuntimeError(msg)
RuntimeError: Impossible package selection: hostapd not in manifest

The above errors are often due to the upgrade server lagging behind the
build server, first suggestion is to wait a while and try again.
2

tried adding the package ?

3

It is currently installed:
image
Or you had something else in mind?

4

I would have expected the exact package name in the manifest, perhaps those two are the same in this case.

ping @efahl.

5

Basic mbedtls I currently do not have installed, just the hostapd and the common package:

image
image1432Ɨ663 124 KB

6

The error ifs happening up on the ASU server, which verifies that the requested packages all are included in the build manifest as one of its correctness checks. It appears that the manifest includes hostapd-basic-mbedtls instead of the requested hostapd variant of that package family, now we need to figure out why.

I just ran owut download -V 25.12 --add hostap --force on my 24.10 test x86 box and can reproduce, so this is a bug on the ASU server I need to figure out.

Early examination of the returned build manifest shows everything as expected, hostapd is selected and installed just fine, but then the validation at the end errors out...

$ jsonfilter -i /tmp/firmware-manifest.json  -e '$.stdout' | grep hostapd -C3
Checking 'which'... ok.
Checking 'ldconfig-stub'... ok.
Building images for x86 - Generic x86/64
Packages: base-files bind-dig btop conntrack coreutils-od curl diffutils dmidecode dnsmasq-full dropbear e2fsprogs ethtool fdisk file gawk grep grub2 grub2-bios-setup grub2-efi hostapd htop iperf3 iputils-tracepath jq kmod-amazon-ena kmod-amd-xgbe kmod-bnx2 kmod-button-hotplug kmod-e1000 kmod-e1000e kmod-forcedeth kmod-fs-vfat kmod-igb kmod-igc kmod-ixgbe kmod-lib-lzo kmod-nfnetlink-log kmod-nft-dup-inet kmod-nft-xfrm kmod-pcs-xpcs kmod-r8169 kmod-tg3 less logd lsblk lscpu luasocket luci luci-app-adblock luci-app-attendedsysupgrade luci-app-sqm luci-app-statistics luci-ssl-openssl luci-theme-openwrt-2020 mkf2fs mtd mtr-json ndptool ntpdate odhcp6c odhcpd-ipv6only openssh-sftp-server opkg owut partx-utils pciutils ppp ppp-mod-pppoe procd-ujail ss strace tcpdump uci ucode-mod-log ucode-mod-resolv urandom-seed urngd usbutils vim-fuller wget-ssl base-files dropbear e2fsprogs grub2-bios-setup kernel kmod-amazon-ena kmod-amd-xgbe kmod-bnx2 kmod-button-hotplug kmod-e1000 kmod-e1000e kmod-forcedeth kmod-fs-vfat kmod-igb kmod-igc kmod-ixgbe kmod-r8169 kmod-tg3 logd mkf2fs mtd odhcp6c odhcpd-ipv6only opkg partx-utils ppp ppp-mod-pppoe procd-ujail uci urandom-seed urngd


Installing packages...
--
Copying /builder/dl/grub2-bios-setup_2.12-r1_x86_64.ipk.
Installing grub2-efi (2.12-r1) to root...
Copying /builder/dl/grub2-efi_2.12-r1_x86_64.ipk.
Installing hostapd (2024.09.15~5ace39b0-r2) to root...
Copying /builder/dl/hostapd_2024.09.15~5ace39b0-r2_x86_64.ipk.
Installing hostapd-common (2024.09.15~5ace39b0-r2) to root...
Copying /builder/dl/hostapd-common_2024.09.15~5ace39b0-r2_x86_64.ipk.
Installing ucode-mod-nl80211 (2025.07.18~3f64c808-r1) to root...
Copying /builder/dl/ucode-mod-nl80211_2025.07.18~3f64c808-r1_x86_64.ipk.
Installing ucode-mod-rtnl (2025.07.18~3f64c808-r1) to root...
--
Configuring e2fsprogs.
Configuring dmidecode.
Configuring kmod-e1000.
Configuring hostapd-common.
Configuring ucode-mod-rtnl.
Configuring hostapd.
Configuring htop.
Configuring file.
Configuring libnetfilter-cttimeout1.

* For those that are curious, the hostapd (host-side wireless support), wpa-supplicant (client-side wireless support) and wpad (combined host- and client-side) variants are all defined in one big Makefile: https://github.com/openwrt/openwrt/blob/main/package/network/services/hostapd/Makefile#L176

7

Ok thank you for confirming it is a bug. I will wait then until you let me know I can try again. :blush: Thanks!

8

Ok, there's something broken in the hostapd* packages themselves, causing apk to select the default one when the minimal hostapd variant is requested.

The workaround is to use one of the variants, so if you can live with one of the cryptography-enabled ones, say hostapd-mbedtls, then that should get you past this issue while it's resolved upstream.

$ owut upgrade -V 25.12 --remove hostapd --add hostapd-mbedtls --force
...
9

Is it still valid when we speak about opkg? I am going from 24.10..
The workaround: what is the difference? Only that there is something extra enabled? But it doesn't matter if I don't use it?
Thanks

10

Yes, but if you are upgrading to 25.12, the imagebuilder producing the image is using apk. (If you were to stay on 24.10, then the imagebuilder would be using opkg.)

11

That's just the full hostapd package, but with the mbedTLS package linked in, thus enabling all the cryptographic functions using that library. There are any number of variants, depending on how big you want it and which crypto lib you use:

$ apk query --format yaml --fields name,description 'hostapd*'
# 11 items
- name: hostapd
  description: This package contains a full featured IEEE 802.1x/WPA/EAP/RADIUS Authenticator.
- name: hostapd-basic
  description: |
    This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
- name: hostapd-basic-mbedtls
  description: |
    This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
- name: hostapd-basic-openssl
  description: |
    This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
- name: hostapd-basic-wolfssl
  description: |
    This package contains a basic IEEE 802.1x/WPA Authenticator with WPA-PSK, 802.11r and 802.11w support.
- name: hostapd-common
  description: hostapd/wpa_supplicant common support files
- name: hostapd-mbedtls
  description: This package contains a full featured IEEE 802.1x/WPA/EAP/RADIUS Authenticator.
- name: hostapd-mini
  description: This package contains a minimal IEEE 802.1x/WPA Authenticator (WPA-PSK only).
- name: hostapd-openssl
  description: This package contains a full featured IEEE 802.1x/WPA/EAP/RADIUS Authenticator.
- name: hostapd-utils
  description: |
    This package contains a command line utility to control the IEEE 802.1x/WPA/EAP/RADIUS Authenticator.
- name: hostapd-wolfssl
  description: This package contains a full featured IEEE 802.1x/WPA/EAP/RADIUS Authenticator.
12

Sorry if I am being dense. If I install the hostapd mbedtls
A) my router will use some advanced features involving the cryptography
or
B) it will work the same unless I configure it to use the new cryptography features
Thanks

Edit: why I ask is that I don't want to upgrade with the workaround if I can then hit some issues with features that I don't even need or want.

13

It will work the same, as they are both the "full" hostapd package. The biggest difference is package size, and if you are concerned with space, but don't use any advanced features like 802.1x or WPA2-enterprise, maybe hostapd-basic, which strips down hostapd to its bones.

$ apk query --format yaml hostapd hostapd-mbedtls hostapd-basic --fields name,file-size
# 2 items
- name: hostapd
  file-size: 531615
- name: hostapd-mbedtls
  file-size: 610112
- name: hostapd-basic
  file-size: 363130
14

Okay, got it, thanks a lot!

Edit: the update was success, everything seems to be working well. Thanks again @efahl and @frollic :blush: