| Age | Commit message (Collapse) | Author |
|---|
|
Kernel: T9197: package iwlwifi firmware the 6.18 driver actually loads
|
|
Firmware was selected by exact match against the names a driver declares.
On 6.18 iwlwifi declares only its highest API version, while at runtime it
falls back to lower versions, and for Wi-Fi 6/6E parts it caps the API at
the MAC family limit. linux-firmware ships none of the declared names, so
BE200, AX201, AX210, AX211 and AX411 were left without firmware.
For each declared iwlwifi name, the newest available ucode at or below the
declared version (core 99 falls back to API 101) is now packaged, together
with its PNVM file. Names with no loadable firmware emit a build warning.
|
|
T9409: Bump accel-ppp-ng version to dd07b23
|
|
includes security fix follow-up hardening and message-authenticator support for Blast-RADIUS mitigation
|
|
T9400: Fix APT repository key for Debian Trixie release
|
|
agents: T9348: update content in AGENTS.md to improve AI generated changes
|
|
|
|
smoketest: T9402: stop navigating the installed system's GRUB menu
|
|
Testsuite: T861: boot VyOS CA signed images as-is in Secure Boot test
|
|
Kernel: T9385: Update Linux Kernel to 6.18.55
|
|
The Secure Boot test always disabled Secure Boot in the UEFI and enrolled a
Machine Owner Key. That only applies to images signed with a custom
certificate - an image signed by the VyOS CA is already trusted and must boot
without any firmware changes.
If the custom signing key pair is present in the build tree, the MOK workflow
is used as before. Otherwise the image boots with Secure Boot enabled from the
start, and the Kernel signature is verified against the VyOS CA issuer and
signer via "show secure-boot detail", which requires a matching vyos-1x.
The make target is renamed from testsb to test-secure-boot.
|
|
The QEMU smoketest selected the serial console on the installed system by
sending timed arrow keys and Enter through the GRUB menus. Under host load
those keys raced the five second auto-boot countdown or got lost, so tests
failed at random.
Earlier fixes only treated symptoms. T8147 doubled the menu timeout. T9099
added checks after each submenu to fail fast. T9214 first sent the first key
earlier and then ignored a lost race on the top menu.
The installer already makes the serial console the default, and raw images
take it from the build flavor, so the default entry boots the right console.
The harness now only waits for GRUB and lets it boot. The existing console
checks still verify the setting. Live ISO menus are unchanged.
|
|
After the last installer question the QEMU smoketest waits for the
operational mode prompt with the default timeout of 60 seconds. Installing
GRUB and unmounting the target, which flushes the copied image to disk, can
take longer on large images, slow storage or loaded CI hosts. A working
install was then reported as failed. Raise this wait to 300 seconds.
|
|
|
|
|
|
T9392: Keep kernel objects and don't create source tarball by default
|
|
Adds to cleanup kernel intermediate objects and create source tarball
|
|
Kernel: T9014: regenerate arm64 base config against Linux 6.18
|
|
|
|
Added in commit 21c7e661 ("Kernel: T5641: enable module compression to save
disk space"), the flag is removed again as there is no need for it.
|
|
The README still described the pre-T8506 flow, where a single
x86_64_vyos_defconfig was copied into arch/x86/configs of the Kernel source
tree. That file and that flow no longer exist, and the text also claimed
the Kernel was 6.6 and that only amd64 was built.
Describe what actually happens: a per architecture base config selected from
dpkg --print-architecture, the config/*.config snippets merged on top in
file name order, and the module signing snippet generated at build time.
|
|
Smoketest test_kernel_options.py::test_hypervisor_virtio fails on arm64.
The test is not architecture gated and checks fifteen virtio options, of
which VIRTIO_IOMMU was the only one not enabled on arm64 - amd64 has it
as a module already.
The driver is available here, it is "depends on VIRTIO && (ARM64 || X86)",
and it is what QEMU virt machines use, so build it as a module to match
amd64.
ACPI_VIOT comes along because VIRTIO_IOMMU selects it.
|
|
The arm64 base config was still the dump of a 6.6.15 configuration. It had
only ever been hand edited per feature, never regenerated, so building
6.18.x produced 91 warnings from merge_config.sh:
Value requested for CONFIG_AS_HAS_LSE_ATOMICS not in final .config
Requested value: CONFIG_AS_HAS_LSE_ATOMICS=y
Actual value:
|
|
The config/*.config snippets are merged on every architecture, so an option
that only exists on one of them is reported as a mismatch on the others:
Value requested for CONFIG_NETLABEL not in final .config
Requested value: # CONFIG_NETLABEL is not set
Actual value:
Three options are only available on amd64 and were sitting in the shared
snippets. Move them to the amd64 base config, each next to the symbol that
gates it:
* XFRM_USER_COMPAT needs COMPAT_FOR_U64_ALIGNMENT
* HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON needs
ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
* NETLABEL depends on SECURITY, which arm64 does not enable
|
|
T8938 consolidated the WWAN build time options into config/12-wwan.config
and requested the USB WWAN drivers as built-in. That only ever took effect
on amd64. On arm64 all of them silently ended up as modules, because a
tristate can never exceed the value of what it depends on and the arm64
base config had USB_USBNET=m and USB_SERIAL=m, while amd64 had both =y.
Pull the two parents into the snippet so the requested =y is reachable on
every architecture - this is a no-op on amd64 where they were already =y.
|
|
|
|
T861: Finalize VyOS kernel signing for UEFI Secure Boot
|
|
|
|
T5498: Add script to run e2fsck -p to initramfs-tools
|
|
Because boot=live is set on the kernel's command
line, the standard fsck does not work.
Adds a hacked script that looks for a partition labeled
persistence and runs an `e2fsck -p`, as it would happen
normally during the standard boot time.
Added logging to kmsg, as suggested by @jestabro.
|
|
journald: T9183: delete chroot include config file - use proper systemd override
|
|
Use a proper systemd journald override configuration file for this feature
which is tracked in vyos-1x repo.
|
|
vbash: T7575: Resolve completion on root-level op-mode
|
|
|
|
T9330: openvpn: bump to 2.7.7
|
|
2.7.7 carries CVE-2026-84732: two fixes in the reliability layer, an
unbounded reliable TLS timeout and acks being honoured for packets that
cannot be outstanding. Debian skipped 2.7.6, so debian/2.7.7-1 is the
next packaging tag after the debian/2.7.5-1 this was pinned to.
The carried gerrit 1734 patch stays: 2.7.7 still has no
net_iface_ovpn_mode(), so pre-created DCO interfaces are not yet handled
upstream. It applies to the new tree with line offsets only, and no
Debian patch touches the files it edits.
|
|
T9014: use tpm-tis-device for arm64 QEMU smoketests
|
|
The ISA "tpm-tis" device only exists on x86 machines. The arm64 "virt"
machine exposes the TPM via MMIO and a device-tree node, which QEMU models
as "tpm-tis-device" instead.
|
|
T9321: Update accel-ppp-ng to the 306fff8 version
|
|
Update accel-ppp-ng to the 306fff8 version includes multiple
upstream fixes
|
|
openvpn: T8264: build 2.7.5 backport for the in-tree ovpn module
|
|
T9277: image: further reduced installed and ISO image size
|
|
Testsuite: T9301: read the console type where GRUB keeps it
|
|
The installer writes the GRUB defaults to the persistence partition, and on
a running image the /boot of the booted image is not that partition, so the
check never found the file and declared the image unusable.
Resolve the persistence directory the way vyos.system.grub does instead of
assuming "/".
|
|
Testsuite: T7575: strip terminal escapes when parsing console output
|
|
T9294: strongswan: add security patches
|
|
Commit c7eef9dd ("Testsuite: T8375: verify proper serial console settings")
read console_type/console_num/console_speed from flavor.json by taking the
last non-empty line of the raw pexpect buffer, then interpolated those values
unescaped into c.expect() patterns.
That stayed harmless until commit 0505dc09 ("vbash: T7575: vyatta-bash 5.2.37
using build system") rebased vyatta-bash onto Debian bash 5.2.37, where
readline enables bracketed-paste mode by default. The shell now emits
\x1b[?2004h around every prompt, that sequence got parsed as console_type,
and its "[" opened an unterminated character class:
re.error: unterminated character set at position 27
Add a get_cmd_output() helper that strips terminal control sequences and the
echoed command before returning the last output line, hoist the ANSI regex to
module scope for reuse, validate the parsed values, and re.escape() everything
interpolated into a regular expression.
|
|
Add security patches from
https://www.strongswan.org/blog/2026/09/07/strongswan-6.1.0-released.html
|
|
vbash: T7575: vyatta-bash 5.2.37 using build system
|
|
VyOS creates the "ovpn" device whenever the daemon cannot - a client whose
server is not reachable yet never opens its tun - so OpenVPN has to adopt a
device it did not make. It takes the device but not its ifindex today, so
dco_new_peer() fails, the daemon exits and deletes the interface on its way
out. systemd starts it again and the second attempt creates a device of its
own, which hides the whole thing behind a tunnel that does come up.
Carry Ralf's fix until it is released: it resolves the ifindex on the
-EEXIST path, refuses a device whose operating mode does not match, and
leaves a pre-existing interface alone on close.
https://gerrit.openvpn.net/c/openvpn/+/1734 (patchset 2)
|
