vyos-1x.git/src/op_mode, branch rolling

Merge pull request #5388 from c-po/remove-acme-autocert

2026-08-11T18:02:14+00:00

pki: T9135: derive ACME certificate chains from disk

Merge pull request #5365 from l0crian1/last-used

2026-08-11T15:53:51+00:00

firewall: T8221: Add last-used option to firewall rules

pki: T9135: add "show pki ca/certificate text" command

2026-08-10T19:34:19+00:00

"show pki ca/certificate " only ever offered PEM output, which isn't practical for a human to actually read. Add a "text" form that runs the certificate through OpenSSL's own "-text" formatter, the same human-readable breakdown "openssl x509 -text" produces.

pki: T9135: correctly resolve a file:// URL when importing a CA certificate

2026-08-10T19:06:48+00:00

The local-file branch of CA certificate import recognized a file:// URL by scheme but never actually decoded it - os.path.exists()/open() still received the full "file://..." string rather than the path component, so an explicit file:// URL always failed with "File not found" even when it pointed at a real, readable file.

pki: T9135: preserve every certificate in an ACME chain, not just the first

2026-08-10T19:05:13+00:00

certbot's chain.pem commonly holds more than one certificate - e.g. the immediate intermediate plus its own issuing root - but the synthetic CA entry built from it only ever kept the first, silently dropping the rest before find_chain() ever saw them. This left a shorter chain than certbot itself actually has, e.g. requiring a root to also be configured manually to reach the same result certbot's own data already provides. Parse every certificate block in chain.pem and emit one synthetic entry per certificate, numbering entries after the first so each is still its own addressable, non-redundant, non-settable object exactly like before.

pki: T9135: don't crash on an ACME certificate not yet issued

2026-08-10T19:04:10+00:00

Both the with_pki=True chain injection and "show pki ca" unconditionally read a certificate's own content to check whether an explicit CA already covers its chain. For an ACME certificate with no cert.pem yet (pending its first issuance, or after a failed request), that content is never populated and the lookup raised KeyError - crashing every with_pki=True consumer and "show pki" alike.

pki: T9135: derive ACME certificate chains from disk

2026-08-10T19:04:07+00:00

An ACME-issued certificate's intermediate CA was previously imported into the running configuration as a synthetic object, purely so consumers building a full certificate chain (HAProxy, HTTPS, IPsec, stunnel, EAPOL, ...) could find it. This leaked certbot's internal state into the CLI as a real, deletable object that never needed to exist there: the intermediate is available on disk the moment the certificate is issued, same as the leaf certificate and its key. Read it live from disk instead, purely in memory, wherever a full chain is resolved or displayed - never as a settable or deletable configuration object. An already-configured CA that completes the chain on its own takes precedence and nothing synthetic is added. Adding, changing, or removing a CA now reloads only the services whose resolved chain is actually affected, with no side effect on certificates whose own content did not change.

op-mode: T9135: allow importing a CA certificate from a remote URL

2026-08-10T19:04:07+00:00

The path argument to the CA import command now also accepts a remote URL (http, https, ftp, sftp, scp, tftp, ...), detected by scheme, in addition to a local file path. Makes it convenient to pull a well-known public intermediate directly by URL instead of downloading and pasting PEM content by hand.

container: T7736: give container veths a deterministic host_interface_name

2026-08-04T18:36:28+00:00

Podman's default "vethN" auto-naming for a container's host-side veth can collide with VyOS's own "virtual-ethernet vethN" interfaces. Bump the minimum Podman dependency to 5.8 (which supports "host_interface_name" network connect option) and use it to name every non-macvlan container network attachment "veth-" instead, eliminating the collision by construction. Container names too long to fit are shortened to a recognizable prefix plus a short hash of the full name; verify() rejects the rare case where two containers still generate the same interface name. Add "show container interface" to display the resulting name-to-container mapping.

T8221: Add last-used option to firewall rules

2026-08-01T16:08:15+00:00

- Add last-used option to firewall rules - Updated output of show firewall to include last-used - Added smoketest for last-used option