diff options
Diffstat (limited to 'scripts')
3 files changed, 55 insertions, 6 deletions
diff --git a/scripts/check-qemu-install b/scripts/check-qemu-install index 49cd3d54..373587e4 100755 --- a/scripts/check-qemu-install +++ b/scripts/check-qemu-install @@ -112,8 +112,11 @@ mok_password = '1234' # If present, the image was signed with a custom CA and the MOK must be enrolled. # If absent, the image is expected to be signed by the VyOS CA and boots as-is. SB_CERT_DIR = os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'data', 'certificates') -SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.key') -SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, 'vyos-dev-2025-linux.pem') +SB_DEV_YEAR = time.strftime('%Y') +SB_CUSTOM_KEY = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.key') +SB_CUSTOM_CERT = os.path.join(SB_CERT_DIR, f'vyos-dev-{SB_DEV_YEAR}-linux.pem') +# Development shim root certificate, placed in the image by build-vyos-image +SB_MOK_DER = f'/var/lib/shim-signed/mok/vyos-dev-{SB_DEV_YEAR}-shim.der' # Expected Linux Kernel signature certificate of a VyOS CA signed image SB_VYOS_ISSUER = '/CN=VyOS Networks Secure Boot CA' SB_VYOS_SUBJECT = '/CN=VyOS Networks Secure Boot Signer 2025 - linux' @@ -554,7 +557,10 @@ def toggleUEFISecureBoot(c): c.send(KEY_F2) time.sleep(0.250) - time.sleep(10) + # Wait for the firmware to start the setup application - the time this + # takes differs between hosts, a fixed delay would lose the key presses + c.expect(r'BdsDxe: starting Boot0000 "UiApp"', timeout=120) + time.sleep(5) # Device Manager UEFIKeyPress(c, KEY_DOWN) @@ -1105,7 +1111,7 @@ try: c.expect(op_mode_prompt, timeout=300) if sb_custom_ca: - c.sendline('install mok') + c.sendline(f'sudo mokutil --ignore-keyring --import {SB_MOK_DER}') c.expect('input password:.*') c.sendline(mok_password) c.expect('input password again:.*') diff --git a/scripts/package-build/linux-kernel/patches/ipt-netflow/0005-Fix-build-with-sockaddr_unsized-bind-callbacks.patch b/scripts/package-build/linux-kernel/patches/ipt-netflow/0005-Fix-build-with-sockaddr_unsized-bind-callbacks.patch new file mode 100644 index 00000000..61f18372 --- /dev/null +++ b/scripts/package-build/linux-kernel/patches/ipt-netflow/0005-Fix-build-with-sockaddr_unsized-bind-callbacks.patch @@ -0,0 +1,37 @@ +From: Christian Breunig <christian@vyos.io> +Subject: [PATCH] Fix build with sockaddr_unsized proto_ops bind() + +Kernel commit 0e50474fa514 ("net: Convert proto_ops bind() callbacks to +use sockaddr_unsized") changed the bind() callback to take a +struct sockaddr_unsized pointer. It was backported to 6.18.y stable, so +detect it with a compile test instead of a version check. +--- +diff --git a/gen_compat_def b/gen_compat_def +index d267b5a..134df99 100755 +--- a/gen_compat_def ++++ b/gen_compat_def +@@ -152,6 +152,8 @@ kbuild_test_ref totalram_pages linux/mm.h + kbuild_test_member nf_ct_event_notifier.ct_event net/netfilter/nf_conntrack_ecache.h + # 6.4: 0199849acd07 ("sysctl: remove register_sysctl_paths()") + kbuild_test_symbol register_sysctl_paths linux/sysctl.h ++# 0e50474fa514 ("net: Convert proto_ops bind() callbacks to use sockaddr_unsized") ++kbuild_test_struct sockaddr_unsized linux/socket.h + + echo "// End of compat_def.h" + +diff --git a/ipt_NETFLOW.c b/ipt_NETFLOW.c +index 7ed9fe6..69f5c40 100644 +--- a/ipt_NETFLOW.c ++++ b/ipt_NETFLOW.c +@@ -1936,7 +1936,11 @@ static struct socket *usock_open_sock(struct ipt_netflow_sock *usock) + salen = sizeof(struct sockaddr_in); + else if (usock->saddr.ss_family == AF_INET6) + salen = sizeof(struct sockaddr_in6); ++#ifdef HAVE_SOCKADDR_UNSIZED ++ if ((error = sock->ops->bind(sock, (struct sockaddr_unsized *)&usock->saddr, salen)) < 0) { ++#else + if ((error = sock->ops->bind(sock, (struct sockaddr *)&usock->saddr, salen)) < 0) { ++#endif + printk(KERN_ERR "ipt_NETFLOW: error binding socket %d\n", -error); + goto err_free_sock; + } diff --git a/scripts/package-build/podman/package.toml b/scripts/package-build/podman/package.toml index 83a235cb..d70faeda 100644 --- a/scripts/package-build/podman/package.toml +++ b/scripts/package-build/podman/package.toml @@ -171,13 +171,19 @@ sudo ln -sf "$HOME/.cargo/bin/rustup" /usr/local/bin/rustup [[packages]] name = "podman" -commit_id = "v5.8.4" +commit_id = "v5.8.8" scm_url = "https://github.com/containers/podman" #build_cmd = "cd ..; ./build.sh" build_cmd = """ make install.tools -make PREFIX=/usr podman-release +# podman-release installs into the tarball with PREFIX=/usr but compiles with +# the default PREFIX=/usr/local, which ends up hardcoded in the binaries - e.g. +# quadlet generating ExecStart=/usr/local/bin/podman in systemd units (T9129) +# Remove a release tarball left over from a previous build in a re-used source +# tree, make would consider it up-to-date and skip the rebuild +rm -rf podman-release-*.tar.gz podman-v*/ +make podman-release PREFIX=/usr tar xf podman-release-$(dpkg --print-architecture).tar.gz VERSION=$(ls -d podman-v* | cut -c9-) |