vyos-1x.git/src/op_mode, branch fix/T8955-http-api-verify-tls

http-api-client: T8955: enable TLS verification by default

2026-06-02T14:49:20+00:00

ApiClientConfig.verify_tls defaulted to False and ApiClient unconditionally silenced urllib3's InsecureRequestWarning, so TLS peer verification was off by default. The sole consumer, src/op_mode/config_sync.py, builds the client without passing verify_tls and therefore connected to a *remote* secondary VyOS node over HTTPS without verifying the certificate -- a MITM exposure on the channel that carries the API key and the full configuration. - ApiClientConfig.verify_tls now defaults to True and accepts Union[bool, str]; a string is forwarded to requests as a CA bundle path (verify=). - InsecureRequestWarning is suppressed only when verification is explicitly disabled (verify_tls is False), not when a CA path or True is set. - config_sync reads an optional verify_tls from the secondary runtime settings, defaulting to False to preserve current behaviour for self-signed secondaries. The insecurity is now explicit at the call site instead of hidden in the library default. A first-class CLI knob (set service config-sync secondary verify-tls / ca-certificate, with XML + migration) is the follow-up. 🤖 Generated by [robots](https://vyos.io)

Merge pull request #5202 from indrajitr/T8877-pki-private-key

2026-05-26T11:44:59+00:00

pki: T8877: Add ability to show private key in pem format

conntrack: T8909: Remove connection id column from output table

2026-05-25T14:15:13+00:00

This cleanup enhances readability and aligns the output with the actual data being displayed.

pki: T8877: Add ability to show private key in pem format

2026-05-19T04:33:51+00:00

Add op-mode command having ability to show private key in pem format as part of PKI configuration. This is needed for users who want to render the certificate and its private key.

traceroute: T8539: fix invalid hostname

2026-04-22T05:33:44+00:00

traceroute: T8539: fix source-address AF lookup

2026-04-21T15:32:43+00:00

traceroute: T8539: fix IPv6 hostname resolution

2026-04-21T07:12:13+00:00

Merge pull request #5096 from jestabro/extend-activation-system

2026-04-20T20:48:43+00:00

T8445: T8335: Extend config activation system

Merge pull request #5122 from c-po/op-mode-sensors

2026-04-17T10:00:45+00:00

op-mode: T8483: fix /show_sensors.py: No such file or directory

op-mode: T8483: remove hypervisor checks from sensors detection

2026-04-16T15:17:31+00:00

Maintainers agreed to remove the CPU-flag-based hypervisor check, as it is arbitrary and can produce incorrect behavior. Sensors can be passed through to virtual machines, so running in a VM should not be treated differently. If no sensors are detected - whether on a hypervisor VM or on bare metal - the command now reports: "No sensors found".