For router owners

Install a package from a feed

Trust the feed's key, add the repository, install by name. One command does all three on any release; the manual steps are below it, because 25.12 and later use apk and 24.10 and earlier use opkg, and the two share nothing here.

Read this before you paste anything. Installing a feed's key tells your router to trust it for every package name, not only the one you want. A feed whose key leaks can offer a higher version of dropbear and win. apk has no revocation. Install a key because you trust who publishes it, not because a page told you to.

One line, either release

wget -qO- https://repo.owfeed.org/subscribe.sh | sh

It looks at your router, not at you: apk or opkg, which architecture, which release line. Then it installs the key, adds the repository and makes both survive a firmware upgrade. Run it twice and nothing doubles. If your release is one this feed does not publish for, it says so and stops rather than adding a URL that 404s.

It installs no packages. Afterwards: apk add luci-theme-footstrap, or opkg install on 24.10.

You are handing a downloaded script to root. That is worth one extra step, here and anywhere else:

wget -O subscribe.sh https://repo.owfeed.org/subscribe.sh
less subscribe.sh          # ~65 lines, half of them comments
sh subscribe.sh

The script is generated by owfeed index from the same config that laid out the feed, so it cannot describe a layout the feed does not have — which is the failure the manual steps below have had at other feeds. It is not a substitute for reading it.

Or by hand: 25.12 and later (apk)

The same thing, if you would rather do it yourself.

# HTTPS needs these. Stock 25.12 images have them; a custom build may not.
apk add ca-bundle libustream-mbedtls

# 1. Trust the key
wget https://repo.owfeed.org/owfeed-packages.pem \
  -O /etc/apk/keys/owfeed-packages.pem

# 2. Add the repository — this is the URL of the index file itself
echo "https://repo.owfeed.org/releases/25.12/$(cat /etc/apk/arch)/packages.adb" \
  > /etc/apk/repositories.d/owfeed-packages.list

# 3. Keep both across a firmware upgrade
mkdir -p /lib/upgrade/keep.d
printf '%s\n' /etc/apk/keys/owfeed-packages.pem \
  /etc/apk/repositories.d/owfeed-packages.list > /lib/upgrade/keep.d/owfeed-packages

apk update && apk add luci-theme-footstrap

Step 3 is not optional. Neither file survives sysupgrade on its own, and a missing key is the most common cause of UNTRUSTED signature after a firmware upgrade.

Or by hand: 24.10 and earlier (opkg)

# 1. Trust the key. The FILE NAME must be the key id — opkg looks it up by that.
wget https://repo.owfeed.org/9040356b214084da \
  -O /etc/opkg/keys/9040356b214084da

# 2. Add the repository — here it is the URL of the DIRECTORY
echo "src/gz owfeed-packages https://repo.owfeed.org/releases/24.10/$(. /etc/openwrt_release; echo $DISTRIB_ARCH)" \
  >> /etc/opkg/customfeeds.conf

opkg update && opkg install luci-theme-footstrap

Three things that will bite you

Do not	Why
`apk add ./package.apk`	Installing the file directly writes a pin on its content hash into `/etc/apk/world`. That file survives sysupgrade, and the package then never upgrades from the feed again. Add the repository and install by name.
Expect Attended Sysupgrade to carry packages over	`owut` forwards no custom repositories, and the sysupgrade server's `repository_allow_list` is empty by default, which denies everything. Re-add the feed after the upgrade.
Use a feed URL that redirects	apk does not follow 30x responses (openwrt#17180). If the feed moved, use the new URL directly.

What the signature does and does not mean

A feed signs its own index, and the index is where trust comes from: apk verifies the index against the key you installed, then checks each package against the hash the index recorded.

What that says is these bytes are the ones this feed published, and nothing more. It is not a statement that the software is safe, that it works, that it is lawful where you are, or that anyone looked at what it does. A well-run feed verifies each author's own signature against a pinned key before adding its own and says exactly what it checks — owfeed-packages does. Read that page for any feed before you trust it.

Responsibility for what is inside a package is the author's, not the feed's.

Whether a package carries a signature of its own is up to the feed. apk signature blocks are additive, so a package can hold the author's and the feed's at once — and a feed may equally decline to add its own, leaving the author's file exactly as it was built. Neither changes how installing by name works: the signed index is what your router checks.

owfeed-packages signs the index and nothing else, so what you install is the author's own file.

Removing a feed

# apk
rm /etc/apk/repositories.d/owfeed-packages.list
rm /etc/apk/keys/owfeed-packages.pem
rm -f /lib/upgrade/keep.d/owfeed-packages
apk update

# opkg — remove the src/gz line, then
rm /etc/opkg/keys/9040356b214084da
opkg update

Packages already installed stay. They stop receiving upgrades.

Packages are other people's software, used at your own risk. A feed verifies where a package came from and that it installs. It does not review the code, assess its security, or judge whether it is lawful where you are — responsibility for what is inside a package rests with its author, whom apk info <name> will name. The full statement is here.