VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=rolling 2026-10-06T15:47:56+00:00 2026-10-06T15:47:56+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-10-06T15:47:56+00:00 urn:sha1:de6463c2c7ea77e89a44658d5c53612ef273c813 smoketest: T9402: stop navigating the installed system's GRUB menu 2026-10-05T21:06:19+00:00 Christian Breunig christian@breunig.cc 2026-10-05T21:06:19+00:00 urn:sha1:4b5d6c035bf808fc4689f7db958c3ce15e534d73 The Secure Boot test always disabled Secure Boot in the UEFI and enrolled a Machine Owner Key. That only applies to images signed with a custom certificate - an image signed by the VyOS CA is already trusted and must boot without any firmware changes. If the custom signing key pair is present in the build tree, the MOK workflow is used as before. Otherwise the image boots with Secure Boot enabled from the start, and the Kernel signature is verified against the VyOS CA issuer and signer via "show secure-boot detail", which requires a matching vyos-1x. The make target is renamed from testsb to test-secure-boot. 2026-10-05T18:50:14+00:00 Christian Breunig christian@breunig.cc 2026-10-05T18:50:14+00:00 urn:sha1:1abdc8757e997bb2487b463fc3964267c1bc3de0 The QEMU smoketest selected the serial console on the installed system by sending timed arrow keys and Enter through the GRUB menus. Under host load those keys raced the five second auto-boot countdown or got lost, so tests failed at random. Earlier fixes only treated symptoms. T8147 doubled the menu timeout. T9099 added checks after each submenu to fail fast. T9214 first sent the first key earlier and then ignored a lost race on the top menu. The installer already makes the serial console the default, and raw images take it from the build flavor, so the default entry boots the right console. The harness now only waits for GRUB and lets it boot. The existing console checks still verify the setting. Live ISO menus are unchanged. 2026-10-05T18:50:09+00:00 Christian Breunig christian@breunig.cc 2026-10-05T18:50:09+00:00 urn:sha1:c3becfea464e18a49912eb70f2923ef310d21fa6 After the last installer question the QEMU smoketest waits for the operational mode prompt with the default timeout of 60 seconds. Installing GRUB and unmounting the target, which flushes the copied image to disk, can take longer on large images, slow storage or loaded CI hosts. A working install was then reported as failed. Raise this wait to 300 seconds. 2026-09-16T18:30:25+00:00 Christian Breunig christian@breunig.cc 2026-09-16T18:30:25+00:00 urn:sha1:4571978c8542a1f996af8a4913c787eecfb0b15d The ISA "tpm-tis" device only exists on x86 machines. The arm64 "virt" machine exposes the TPM via MMIO and a device-tree node, which QEMU models as "tpm-tis-device" instead. 2026-09-12T20:52:33+00:00 Antonio Quartulli antonio@mandelbit.com 2026-09-11T12:13:02+00:00 urn:sha1:df46ba4cf9f95014eef26afa5324197d30d77dd1 The installer writes the GRUB defaults to the persistence partition, and on a running image the /boot of the booted image is not that partition, so the check never found the file and declared the image unusable. Resolve the persistence directory the way vyos.system.grub does instead of assuming "/". 2026-09-12T06:47:41+00:00 Christian Breunig christian@breunig.cc 2026-09-12T06:38:53+00:00 urn:sha1:13a1662bfab2f23bd8c093ad8e55b60752874d6f Commit c7eef9dd ("Testsuite: T8375: verify proper serial console settings") read console_type/console_num/console_speed from flavor.json by taking the last non-empty line of the raw pexpect buffer, then interpolated those values unescaped into c.expect() patterns. That stayed harmless until commit 0505dc09 ("vbash: T7575: vyatta-bash 5.2.37 using build system") rebased vyatta-bash onto Debian bash 5.2.37, where readline enables bracketed-paste mode by default. The shell now emits \x1b[?2004h around every prompt, that sequence got parsed as console_type, and its "[" opened an unterminated character class: re.error: unterminated character set at position 27 Add a get_cmd_output() helper that strips terminal control sequences and the echoed command before returning the last output line, hoist the ANSI regex to module scope for reuse, validate the parsed values, and re.escape() everything interpolated into a regular expression. 2026-09-07T18:43:35+00:00 Christian Breunig christian@breunig.cc 2026-09-04T08:21:06+00:00 urn:sha1:c598316aa436d682999a710446edb4ef504a6e56 VyOS carried a fork of Debian's live-boot, based on release 1:20151213, purely to add a handful of VyOS specific behaviours. The fork is retired here in favour of Debian's own live-boot plus a drop-in component. live-boot's frontend sources every /lib/live/boot/????-* file in glob order, so 9991-vyos.sh is read after all upstream components and can both translate the vyos-union= kernel parameter and redefine three helpers. An initramfs-tools hook copies the multiarch klibc libraries that upstream's non-multiarch glob never matches, and a live-top shim runs mdadm, which boot=live otherwise skips entirely, leaving RAID arrays unassembled. 2026-09-04T08:57:50+00:00 Christian Breunig christian@breunig.cc 2026-09-04T08:57:50+00:00 urn:sha1:db3d3258649c9bf1d1758d681eec062278497c62 Re-partitioning a disk and adding it back to the array can take significantly longer then the default pexpect timeout of 30 seconds. 2026-08-17T19:03:57+00:00 Christian Breunig christian@breunig.cc 2026-08-17T18:44:56+00:00 urn:sha1:01ea1f76641603e6dc0845ce2bc59c1eab2e8a3f QEMU_CONFIG only defines profiles for amd64 and arm64, and arm64 guests only boot via UEFI, so fail fast with a clear message instead of running into an unsupported-architecture error deep into the install.