vyos-1x.git/src/migration-scripts, branch rolling

ci: T8490: fix typos in comments, strings, and local identifiers

2026-06-29T12:10:10+00:00

Reaches a clean typos baseline for the T8490 ruleset pilot. Categories: - Comments/docs: recursivly, taret, passsed, characted, arhive, AtrributeError; "ned" -> "new" (migration comments). - Messages/strings: writeable -> writable (x5); OCaml log "Commandis" -> "Command is". - Local variables (all refs in-function): commited, formating, presistent; inpt_range -> input_range; tz_datas -> tz_data_raw (avoids the tz_data collision). - Self-contained renames (definition + all references in-file): formated_stats, _get_formatted_output_conections -> ..._connections, expension_failure -> expansion_failure (ping + traceroute), snmpd_restart_reqired -> ..._required. False positives are allowlisted centrally (vyos/.github, separate PR), NOT changed here: mke2fs, Maya-calendar "Mak", RFC 4122 "IDentifier" (hostapd), and VPP's "U-Forwrd" bridge-domain column header (op_mode/vpp.py + the VPP smoketest assert the real upstream `vppctl` output). Verified: typos clean, py_compile of every edited .py, zero remaining old-identifier references. 🤖 Generated by [robots](https://vyos.io)

bgp: T8865: Reject `vni` sub-block in VRF l2vpn-evpn when `advertise-all-vni` is globally active

2026-06-26T07:28:05+00:00

When `advertise-all-vni` is configured in the global/default BGP instance, VyOS generated a `vni ` sub-block under each VRF BGP `address-family l2vpn evpn` context. This conflicts with advertise-all-vni: FRR already owns all kernel VNIs and returns `% Failed to create VNI` when frr-reload.py attempts to apply the VRF-level vni sub-block. FRR then performs an early exit from config processing, silently dropping the entire l2vpn evpn address-family for all subsequent VRF BGP instances.

Merge pull request #5231 from natali-rs1985/T8223

2026-06-17T12:36:46+00:00

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

T8923: normalize "can not" to "cannot"

2026-06-16T18:24:44+00:00

Replace two-word "can not" / "Can not" with "cannot" across comments, ConfigError messages, CLI help text, and op-mode output. Standard SNMP MIB files under mibs/ are left unchanged.

Merge pull request #5262 from c-po/remote-salt

2026-06-10T11:55:45+00:00

salt: T8973: remove feature

serial: T8974: invalid check during migration system 31 -> 32

2026-06-09T19:46:55+00:00

Commit 35db941bcf30 ("serial: T8375: add CLI option to explicitly set kernel console") added a migration script to alter the CLI for the kernel boot console. The migrations script early exist check does not work, as the statement never evaluates to true, thus the CLI Migration for Kernel console parameter is always called, even if undesired.

salt: T8973: remove feature

2026-06-09T19:44:03+00:00

As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5 and VyOS 1.4 it is time to remove it from the rolling release.

bgp: T8223: Prevent `advertise-all-vni` in multiple BGP VRF instances simultaneously

2026-06-09T15:41:56+00:00

FRR only allows one BGP instance to hold `advertise-all-vni` at a time (FRR issue #9405). When a default BGP instance is present it is always started before named VRF instances, so if a named VRF holds the flag FRR silently rejects it on every boot (regardless of default EVPN config), causing the running config to diverge from what is stored in VyOS. Enforce the following policy in verify(): - Default BGP instance may always hold `advertise-all-vni`. - A named VRF may hold it only when no default BGP instance exists. - Only one BGP instance (default or named VRF) may hold it at a time. The default BGP verify path additionally scans dependent VRFs so that adding or modifying the default BGP instance while a named VRF already holds the flag is caught even when the VRF node is not part of the current commit.

T8492: CRL generated by VyOS PKI lacks X.509 extensions required for strongSwan validation

2026-05-13T16:52:04+00:00

Previously generated CRLs were missing the Authority Key Identifier and CRL Number extensions required by strongSwan for certificate revocation validation. Without these extensions, strongSwan silently ignores the CRL, allowing revoked certificates to authenticate successfully. The migration regenerates existing CRLs for all CAs that have a private key available. CAs with passphrase-protected keys are skipped with a warning, as the passphrase cannot be provided non-interactively

migration: T8280: Fix auth file read for interfaces on first boot of new image

2026-04-28T07:40:59+00:00

During first boot after installing a new VyOS image, migrations are executed before the filesystem is fully initialized. At this point `/config` is not yet bind-mounted, causing auth files (certificates, keys, credentials) for OpenVPN, WireGuard and Ethernet EAPoL interfaces under `/config/auth` to be inaccessible even though they exist under the underlying `/opt/vyatta/etc/config/auth` path which is available at all boot stages. Add fallback logic to `read_auth_file()` to retry the file lookup under `/opt/vyatta/etc/config/auth` when the file is not found under `/config/auth`.