From 3801cc4847cc3b3ef58ecf6cfddaf6ea162f5f89 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Tue, 7 Jul 2026 13:13:31 +0200 Subject: [PATCH 1/8] global-functions: $ScriptInstallUpdate: skip checksums if not rsc.eworm.de The file is not in git repository, but generated when deploying to my server only. --- global-functions.rsc | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index 5cadb24f..c45aa97e 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1318,12 +1318,14 @@ :local DeviceMode [ /system/device-mode/get ]; :local CheckSums ({}); - :do { - :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); - $LogPrint debug $0 ("Fetching checksums from url: " . $Url); - :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ - http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; - } on-error={ } + :if ([ :pick $ScriptUpdatesBaseUrl 0 21 ] = "https://rsc.eworm.de/") do={ + :do { + :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); + $LogPrint debug $0 ("Fetching checksums from url: " . $Url); + :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ + http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; + } on-error={ } + } :foreach Script in=[ /system/script/find where source~"^#!rsc by RouterOS\r?\n" ] do={ :local ScriptVal [ /system/script/get $Script ]; From 55eef9c69222d9cd718999e67ff685b3e2c26d57 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Tue, 7 Jul 2026 13:18:34 +0200 Subject: [PATCH 2/8] global-functions: $ScriptInstallUpdate: log and print error It is no longer expected to fail... So let's complain. --- global-functions.rsc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index c45aa97e..61408bec 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1319,12 +1319,14 @@ :local CheckSums ({}); :if ([ :pick $ScriptUpdatesBaseUrl 0 21 ] = "https://rsc.eworm.de/") do={ - :do { + :onerror Err { :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); $LogPrint debug $0 ("Fetching checksums from url: " . $Url); :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; - } on-error={ } + } do={ + $LogPrint warning $0 ("Failed downloading checksums: " . $Err); + } } :foreach Script in=[ /system/script/find where source~"^#!rsc by RouterOS\r?\n" ] do={ From aa14c26488e2518b87f03121b472b639dfc06342 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Tue, 7 Jul 2026 13:13:31 +0200 Subject: [PATCH 3/8] global-functions: $ScriptInstallUpdate: skip checksums if not rsc.eworm.de The file is not in git repository, but generated when deploying to my server only. --- global-functions.rsc | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index 5cadb24f..c45aa97e 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1318,12 +1318,14 @@ :local DeviceMode [ /system/device-mode/get ]; :local CheckSums ({}); - :do { - :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); - $LogPrint debug $0 ("Fetching checksums from url: " . $Url); - :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ - http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; - } on-error={ } + :if ([ :pick $ScriptUpdatesBaseUrl 0 21 ] = "https://rsc.eworm.de/") do={ + :do { + :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); + $LogPrint debug $0 ("Fetching checksums from url: " . $Url); + :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ + http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; + } on-error={ } + } :foreach Script in=[ /system/script/find where source~"^#!rsc by RouterOS\r?\n" ] do={ :local ScriptVal [ /system/script/get $Script ]; From b960a9d2fbf3bcc49af9445dc4ca6f005a8c6c82 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Tue, 7 Jul 2026 13:18:34 +0200 Subject: [PATCH 4/8] global-functions: $ScriptInstallUpdate: log and print error It is no longer expected to fail... So let's complain. --- global-functions.rsc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/global-functions.rsc b/global-functions.rsc index c45aa97e..61408bec 100644 --- a/global-functions.rsc +++ b/global-functions.rsc @@ -1319,12 +1319,14 @@ :local CheckSums ({}); :if ([ :pick $ScriptUpdatesBaseUrl 0 21 ] = "https://rsc.eworm.de/") do={ - :do { + :onerror Err { :local Url ($ScriptUpdatesBaseUrl . "checksums.json" . $ScriptUpdatesUrlSuffix); $LogPrint debug $0 ("Fetching checksums from url: " . $Url); :set CheckSums [ :deserialize from=json ([ /tool/fetch check-certificate=yes-without-crl \ http-header-field=({ [ $FetchUserAgentStr $0 ] }) $Url output=user as-value ]->"data") ]; - } on-error={ } + } do={ + $LogPrint warning $0 ("Failed downloading checksums: " . $Err); + } } :foreach Script in=[ /system/script/find where source~"^#!rsc by RouterOS\r?\n" ] do={ From 0c69d49480a4811af447f18b11fce02cbc781362 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 8 Jul 2026 15:08:11 +0200 Subject: [PATCH 5/8] certs: add 'Sectigo Public Server Authentication Root R46'... ... to use with gitlab.com for mirror. curl -d '["Sectigo Public Server Authentication Root R46"]' https://mkcert.org/generate/ | grep -v '^$' > certs/Sectigo-Public-Server-Authentication-Root-R46.pem --- certs/Makefile | 2 +- ...-Public-Server-Authentication-Root-R46.pem | 39 +++++++++++++++++++ 2 files changed, 40 insertions(+), 1 deletion(-) create mode 100644 certs/Sectigo-Public-Server-Authentication-Root-R46.pem diff --git a/certs/Makefile b/certs/Makefile index c9a33798..48de17c2 100644 --- a/certs/Makefile +++ b/certs/Makefile @@ -13,7 +13,7 @@ DOMAINS_DUAL = \ dns.google/GTS-Root-RX \ dns.quad9.net/DigiCert-Global-Root-G3 \ git.eworm.de/Root-YE \ - gitlab.com/USERTrust-RSA-Certification-Authority \ + gitlab.com/Sectigo-Public-Server-Authentication-Root-R46 \ lists.blocklist.de/GTS-Root-R4 \ matrix.org/GTS-Root-R4 \ raw.githubusercontent.com/ISRG-Root-X1 \ diff --git a/certs/Sectigo-Public-Server-Authentication-Root-R46.pem b/certs/Sectigo-Public-Server-Authentication-Root-R46.pem new file mode 100644 index 00000000..72f2f82b --- /dev/null +++ b/certs/Sectigo-Public-Server-Authentication-Root-R46.pem @@ -0,0 +1,39 @@ +# Issuer: CN=Sectigo Public Server Authentication Root R46 O=Sectigo Limited +# Subject: CN=Sectigo Public Server Authentication Root R46 O=Sectigo Limited +# Label: "Sectigo Public Server Authentication Root R46" +# Serial: 156256931880233212765902055439220583700 +# MD5 Fingerprint: 32:10:09:52:00:d5:7e:6c:43:df:15:c0:b1:16:93:e5 +# SHA1 Fingerprint: ad:98:f9:f3:e4:7d:75:3b:65:d4:82:b3:a4:52:17:bb:6e:f5:e4:38 +# SHA256 Fingerprint: 7b:b6:47:a6:2a:ee:ac:88:bf:25:7a:a5:22:d0:1f:fe:a3:95:e0:ab:45:c7:3f:93:f6:56:54:ec:38:f2:5a:06 +-----BEGIN CERTIFICATE----- +MIIFijCCA3KgAwIBAgIQdY39i658BwD6qSWn4cetFDANBgkqhkiG9w0BAQwFADBf +MQswCQYDVQQGEwJHQjEYMBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQD +Ey1TZWN0aWdvIFB1YmxpYyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYw +HhcNMjEwMzIyMDAwMDAwWhcNNDYwMzIxMjM1OTU5WjBfMQswCQYDVQQGEwJHQjEY +MBYGA1UEChMPU2VjdGlnbyBMaW1pdGVkMTYwNAYDVQQDEy1TZWN0aWdvIFB1Ymxp +YyBTZXJ2ZXIgQXV0aGVudGljYXRpb24gUm9vdCBSNDYwggIiMA0GCSqGSIb3DQEB +AQUAA4ICDwAwggIKAoICAQCTvtU2UnXYASOgHEdCSe5jtrch/cSV1UgrJnwUUxDa +ef0rty2k1Cz66jLdScK5vQ9IPXtamFSvnl0xdE8H/FAh3aTPaE8bEmNtJZlMKpnz +SDBh+oF8HqcIStw+KxwfGExxqjWMrfhu6DtK2eWUAtaJhBOqbchPM8xQljeSM9xf +iOefVNlI8JhD1mb9nxc4Q8UBUQvX4yMPFF1bFOdLvt30yNoDN9HWOaEhUTCDsG3X +ME6WW5HwcCSrv0WBZEMNvSE6Lzzpng3LILVCJ8zab5vuZDCQOc2TZYEhMbUjUDM3 +IuM47fgxMMxF/mL50V0yeUKH32rMVhlATc6qu/m1dkmU8Sf4kaWD5QazYw6A3OAS +VYCmO2a0OYctyPDQ0RTp5A1NDvZdV3LFOxxHVp3i1fuBYYzMTYCQNFu31xR13NgE +SJ/AwSiItOkcyqex8Va3e0lMWeUgFaiEAin6OJRpmkkGj80feRQXEgyDet4fsZfu ++Zd4KKTIRJLpfSYFplhym3kT2BFfrsU4YjRosoYwjviQYZ4ybPUHNs2iTG7sijbt +8uaZFURww3y8nDnAtOFr94MlI1fZEoDlSfB1D++N6xybVCi0ITz8fAr/73trdf+L +HaAZBav6+CuBQug4urv7qv094PPK306Xlynt8xhW6aWWrL3DkJiy4Pmi1KZHQ3xt +zwIDAQABo0IwQDAdBgNVHQ4EFgQUVnNYZJX5khqwEioEYnmhQBWIIUkwDgYDVR0P +AQH/BAQDAgGGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQEMBQADggIBAC9c +mTz8Bl6MlC5w6tIyMY208FHVvArzZJ8HXtXBc2hkeqK5Duj5XYUtqDdFqij0lgVQ +YKlJfp/imTYpE0RHap1VIDzYm/EDMrraQKFz6oOht0SmDpkBm+S8f74TlH7Kph52 +gDY9hAaLMyZlbcp+nv4fjFg4exqDsQ+8FxG75gbMY/qB8oFM2gsQa6H61SilzwZA +Fv97fRheORKkU55+MkIQpiGRqRxOF3yEvJ+M0ejf5lG5Nkc/kLnHvALcWxxPDkjB +JYOcCj+esQMzEhonrPcibCTRAUH4WAP+JWgiH5paPHxsnnVI84HxZmduTILA7rpX +DhjvLpr3Etiga+kFpaHpaPi8TD8SHkXoUsCjvxInebnMMTzD9joiFgOgyY9mpFui +TdaBJQbpdqQACj7LzTWb4OE4y2BThihCQRxEV+ioratF4yUQvNs+ZUH7G6aXD+u5 +dHn5HrwdVw1Hr8Mvn4dGp+smWg9WY7ViYG4A++MnESLn/pmPNPW56MORcr3Ywx65 +LvKRRFHQV80MNNVIIb/bE/FmJUNS0nAiNs2fxBx1IK1jcmMGDw4nztJqDby1ORrp +0XZ60Vzk50lJLVU3aPAaOpg+VBeHVOmmJ1CJeyAvP/+/oYtKR5j/K3tJPsMpRmAY +QqszKbrAKbkTidOIijlBO8n9pu0f9GBj39ItVQGL +-----END CERTIFICATE----- From 5f32948f20e0a0723602de000b0720c6c7e71692 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 8 Jul 2026 15:09:54 +0200 Subject: [PATCH 6/8] INITIAL-COMMANDS: give option to install from mirrors --- INITIAL-COMMANDS.md | 26 ++++++++++++++++++++++++++ 1 file changed, 26 insertions(+) diff --git a/INITIAL-COMMANDS.md b/INITIAL-COMMANDS.md index 31c58555..88b38fa3 100644 --- a/INITIAL-COMMANDS.md +++ b/INITIAL-COMMANDS.md @@ -55,6 +55,32 @@ Then continue setup with [scheduled automatic updates](README.md#scheduled-automatic-updates) or [editing configuration](README.md#editing-configuration). +## Install from mirror + +In case you have issues with my default source using a mirror may help. +Just replace the first lines for updated variables. + +### Install from git.eworm.de + + :local BaseUrl "https://git.eworm.de/cgit/routeros-scripts/plain/"; + :local CertCommonName "Root YE"; + :local CertFileName "Root-YE.pem"; + :local CertFingerprint "e14ffcad5b0025731006caa43a121a22d8e9700f4fb9cf852f02a708aa5d5666"; + +### Install from Github + + :local BaseUrl "https://raw.githubusercontent.com/eworm-de/routeros-scripts/main/"; + :local CertCommonName "Root YR"; + :local CertFileName "Root-YR.pem"; + :local CertFingerprint "e57b7e6f150c419102e8d5c055729ff967b9d1a829bf00cec89ca604ebf4a86f"; + +### Install from Gitlab + + :local BaseUrl "https://gitlab.com/eworm-de/routeros-scripts/raw/main/"; + :local CertCommonName "Sectigo Public Server Authentication Root R46"; + :local CertFileName "Sectigo-Public-Server-Authentication-Root-R46.pem"; + :local CertFingerprint "7bb647a62aeeac88bf257aa522d01ffea395e0ab45c73f93f65654ec38f25a06"; + ## Fix existing installation The [initial commands](#initial-commands) above allow to fix an existing From e906deda041c83a971cf09e83cee06f3e8b39eb4 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 8 Jul 2026 15:16:48 +0200 Subject: [PATCH 7/8] INITIAL-COMMANDS: give hint on url in global configuration overlay --- INITIAL-COMMANDS.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/INITIAL-COMMANDS.md b/INITIAL-COMMANDS.md index 88b38fa3..325b222c 100644 --- a/INITIAL-COMMANDS.md +++ b/INITIAL-COMMANDS.md @@ -60,6 +60,9 @@ Then continue setup with In case you have issues with my default source using a mirror may help. Just replace the first lines for updated variables. +> 💡️ **Hint**: You may want to set the same *url* with `ScriptUpdatesBaseUrl` +> in `global-config-overlay`. + ### Install from git.eworm.de :local BaseUrl "https://git.eworm.de/cgit/routeros-scripts/plain/"; From 4480282079dc94ed742ebe2fc776e5de9cd87d32 Mon Sep 17 00:00:00 2001 From: Christian Hesse Date: Wed, 8 Jul 2026 15:20:01 +0200 Subject: [PATCH 8/8] INITIAL-COMMANDS: warn on missing checksums --- INITIAL-COMMANDS.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/INITIAL-COMMANDS.md b/INITIAL-COMMANDS.md index 325b222c..4ec68668 100644 --- a/INITIAL-COMMANDS.md +++ b/INITIAL-COMMANDS.md @@ -63,6 +63,10 @@ Just replace the first lines for updated variables. > 💡️ **Hint**: You may want to set the same *url* with `ScriptUpdatesBaseUrl` > in `global-config-overlay`. +> ⚠️ **Warning**: The mirrors do not provide checksums. Each invocation of +> `$ScriptInstallUpdate` takes longer and generates more traffic, as every +> script needs to be downloaded for local check! + ### Install from git.eworm.de :local BaseUrl "https://git.eworm.de/cgit/routeros-scripts/plain/";