VyOS image build scripts (mirror of https://github.com/vyos/vyos-build.git) https://git.amelek.net/vyos/vyos-build.git/atom?h=rolling 2026-10-20T16:23:08+00:00 2026-10-20T16:23:08+00:00 Christian Breunig christian@breunig.cc 2026-10-20T16:23:08+00:00 urn:sha1:a81e076d388ecb49a65fabf26c67eca22949d46f 5.8.5 * Fixed a bug where Podman Machine VMs on Mac using the libkrun provider could be regularly turned off by a port-scanning process on the host unintentionally commanding the VM to shut down. 5.8.6 * This release addressed CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained. 5.8.7 * This release addresses (CVE-2025-11395), where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host. * This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do not believe these CVEs are exploitable through the Podman command line. * Updated Buildah to v1.43.4 * Updated Common to v0.67.2 * Updated Image to v5.39.3 * Updated Storage to v1.62.1 5.8.8 * This release addresses CVE-2026-94603, where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created. 2026-10-17T13:42:15+00:00 Christian Breunig christian@breunig.cc 2026-10-17T13:42:15+00:00 urn:sha1:94192fd1290ed0146e824c4d009bc2b29d3d176e Testsuite: T861: enroll dev shim certificate using mokutil 2026-10-17T12:55:13+00:00 Christian Breunig christian@breunig.cc 2026-10-17T12:55:13+00:00 urn:sha1:b5155b113e7b624ca2b89ec6c6c2286624714cbe The install mok CLI command is gone, so the Secure Boot test now imports the development shim root certificate shipped in the image with plain mokutil. The development certificate names follow the current year instead of a hardcoded one. The production certificate is left untouched. 2026-10-17T10:55:26+00:00 Christian Breunig christian@breunig.cc 2026-10-16T17:25:14+00:00 urn:sha1:5b0aa8b2b3ab6b2a5898ff3d66d734042c75884a toggleUEFISecureBoot() slept a fixed 10 seconds after pressing F2 before sending the menu navigation keys. On hosts where OVMF needs longer to come up with SMM and Secure Boot enabled (about 16s here) the key presses were sent while the firmware still showed its logo and got lost, so Secure Boot stayed enabled and GRUB failed with 'prohibited by secure boot policy'. Wait for the firmware to start the setup application (UiApp) on the serial console instead. 2026-10-17T06:13:43+00:00 Christian Breunig christian@breunig.cc 2026-10-17T06:13:43+00:00 urn:sha1:ba40c9e76387fb84de6b10176e550978d9f172b5 2026-10-13T16:47:19+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-10-13T16:47:19+00:00 urn:sha1:9536a36e32f404b7ab637953ebab74b3fac6815f T7142: Update HAProxy version to 3.0.29 2026-10-13T15:45:59+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-10-13T15:45:59+00:00 urn:sha1:6a4a5da0a1a0af772cfe99c18c1cf936605d65dd T9454: Upgrade FRR to 10.7.1 2026-10-12T14:39:21+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-10-12T14:39:21+00:00 urn:sha1:350451d6b9e5f1c2bb3842d0f059db0f6fe15ec8 2026-10-12T13:38:00+00:00 Viacheslav Hletenko v.gletenko@vyos.io 2026-10-12T13:38:00+00:00 urn:sha1:1adb5ee01f95047decb037d16dc6d142c82a9919 Kernel: T9197: package iwlwifi firmware the 6.18 driver actually loads 2026-10-11T18:46:56+00:00 Christian Breunig christian@breunig.cc 2026-10-11T18:46:02+00:00 urn:sha1:78005f0e70ca1f410a4edfc613c36e8a8dc3d29d Firmware was selected by exact match against the names a driver declares. On 6.18 iwlwifi declares only its highest API version, while at runtime it falls back to lower versions, and for Wi-Fi 6/6E parts it caps the API at the MAC family limit. linux-firmware ships none of the declared names, so BE200, AX201, AX210, AX211 and AX411 were left without firmware. For each declared iwlwifi name, the newest available ucode at or below the declared version (core 99 falls back to API 101) is now packaged, together with its PNVM file. Names with no loadable firmware emit a build warning.