I found serious bug in the Foris interface. It seems that updater uninstall packages not correctly. Here is an example:

1. Goto "Updater" tab in Foris.
2. If "NAS" is not set - set NAS and wait until everything is installed (message in the main tab), if it is checked already - goto step3.
3. SSH to the router. Check that samba is installed:
root@turris:~# opkg list-installed|grep ^samba
samba36-server - 3.6.25-1
root@turris:~# opkg files samba36-server
Package samba36-server (3.6.25-1) is installed on root and has the following files:
etc/samba/
etc/samba/valid.dat
usr/sbin/samba_multicall
<....>
4. Goto Updater tab again and unset "NAS" tab and wait for the message in the green tab about uninstalled packages, it will contain "• Odstraněn balík samba36-server" message.
5. All files are in place, but packages are unregistred:
root@turris:~# ls -l /usr/sbin/samba_multicall
-rwxr-xr-x    1 root     root       1862952 Mar 25 17:38 /usr/sbin/samba_multicall
root@turris:~# opkg list-installed|grep samba
root@turris:~#

If i am doing the same using opkg - everything works as expected:

root@turris:~# opkg install samba36-server
Installing samba36-server (3.6.25-1) to root...
Configuring samba36-server.
Reloading samba
root@turris:~# opkg remove samba36-server
Removing package samba36-server from root...
root@turris:~# ls -l /usr/sbin/samba_multicall
ls: /usr/sbin/samba_multicall: No such file or directory

I think it is a big issue, because space is not reclaimed and also, old binaries/services with security problems may still be active.

Update: Problem is on install stage, packages are installed with non-absolute path, e.g.

root@turris-vrt:/tmp# opkg files hd-idle
Package hd-idle (1.04-1) is installed on root and has the following files:
etc/config/hd-idle
usr/bin/hd-idle
etc/init.d/hd-idle

And it should be
/etc/config/hd-idle
etc.

Update2: it seems that problem is somewhere in shell escaping (my_opkg call?) in updater.sh. When i replaced line --offline-root / with --offline-root // in the /usr/bin/updater-worker.sh it starts to work correctly. Only problem is orphaned files which are already on the device. I created a small script to fix broken lists and find orphaned files. Thats what i found so far on normal production router: https://gist.github.com/samm-git/251bc758fa29806f8ebf