HOWTO: Switch OpenWrt from using wolfssl to mbedtls manually (22.03 to 23.05)

gistfile1.txt

#!/bin/sh
#
# from https://forum.openwrt.org/t/openwrt-23-05-0-rc1-first-release-candidate/162544/27
#
# auc will not work as-is to upgrade from 22.03 to 23.05 due to the mbedtls switch
# therefore, we need to first switch from wolfssl to mbedtls while on 22.03 before using auc
#

cd /root || exit
opkg update

# Do 'opkg list-installed | grep wolfssl' and verify that the 'remove' list
# is correct and complete.
echo ''
echo 'Installed:'
opkg list-installed | grep wolfssl
echo ''

# remove=$(opkg list-installed | grep wolfssl | awk -F" -" '{print $1}' | awk '{printf("%s ",$0)} END { printf "\n" }')
remove='libustream-wolfssl20201210 libwolfssl5.5.4.ee39414e px5g-wolfssl wpad-basic-wolfssl'
for pkg in $remove ; do
    echo "Checking package: $pkg"
    if ! opkg list-installed | grep -q "^\b${pkg}\b" ; then
        echo "Couldn't find $pkg"
        exit 1
    fi
    opkg whatdepends "$pkg"  # I only see 'luci-ssl' as the top-level dependency for these.
    echo ''
done
exit 0  # Danger checkpoint 1

# Make absolutely sure that all of these 'add' packages exist in the release you
# are updating.

add='libustream-mbedtls20201210 libmbedtls12 px5g-mbedtls wpad-basic-mbedtls'
for pkg in $add ; do
    if ! opkg list | grep -q "^\b${pkg}\b" ; then
        echo "There is no such package as $pkg in the current release"
        exit 1
    fi
done
exit 0  # Danger checkpoint 2, after this, you are on your own!

# Note that the 'opkg remove' will kill tls, and opkg fetches will stop working!
# That's why we must download everything BEFORE we do the remove.

opkg download "$add"
opkg remove luci-ssl  # You can't remove the underlying ssl libraries while this depends on them.
opkg remove "$remove"
opkg install --offline-root / ~/*.ipk
opkg install luci-ssl # Put it back after we have new ssl in place.

This is still WIP for now.

I managed to lock myself out by not realizing I needed to use " --offline-root /" when installing. In the process I did notice that you can download the needed *.ipk files with http: instead of https: That should get you out of the case where you can't download a needed file.