| Age | Commit message (Collapse) | Author |
|---|
|
|
|
T9400: Fix APT repository key for Debian Trixie release
|
|
|
|
|
|
|
|
|
|
T5498: Add script to run e2fsck -p to initramfs-tools
|
|
Because boot=live is set on the kernel's command
line, the standard fsck does not work.
Adds a hacked script that looks for a partition labeled
persistence and runs an `e2fsck -p`, as it would happen
normally during the standard boot time.
Added logging to kmsg, as suggested by @jestabro.
|
|
Use a proper systemd journald override configuration file for this feature
which is tracked in vyos-1x repo.
|
|
T9277: image: further reduced installed and ISO image size
|
|
Kernel: T9298: make linux-firmware package architecture aware
|
|
Currently when the Kernel is build and creates the vyos-linux-firmware package,
the Kernel modules are inspected and the firmware file string is extracted.
This is the case for years. Now with ARM64 on the doorstep, we would assemble
the vyos-linux-firmware package twice, once for x86_64 and once for amd64.
The generated package is for CPU architecture all - as the package is build
twice, the longer running build will win -> perfect race condition.
|
|
VyOS carried a fork of Debian's live-boot, based on release 1:20151213, purely
to add a handful of VyOS specific behaviours. The fork is retired here in
favour of Debian's own live-boot plus a drop-in component.
live-boot's frontend sources every /lib/live/boot/????-* file in glob order,
so 9991-vyos.sh is read after all upstream components and can both translate
the vyos-union= kernel parameter and redefine three helpers. An initramfs-tools
hook copies the multiarch klibc libraries that upstream's non-multiarch glob
never matches, and a live-top shim runs mdadm, which boot=live otherwise skips
entirely, leaving RAID arrays unassembled.
|
|
Linux 6.18 Series
* 6.18.49 https://lwn.net/Articles/1092156/
* 6.18.50 https://lwn.net/Articles/1092986/
|
|
Only two actions were left in this hook and neither is needed.
- /etc/pam_radius_auth.conf is created empty at image build time, but vyos-1x
renders the file from its own Jinja2 template and the router init script
removes it on every boot when restoring PAM to its virgin state.
- kernel.printk was patched into /etc/sysctl.conf. The setting now ships in
vyos-1x as part of /etc/sysctl.d/30-vyos-router.conf, next to the other
kernel defaults.
|
|
/opt/vyatta/etc/default_ssh has not been shipped by any VyOS package
for years, so the copy failed on every ISO build:
cp: cannot stat '/opt/vyatta/etc/default_ssh': No such file or directory
/etc/default/ssh is left at its Debian default, and ssh.service is
disabled in the image anyway - the SSH daemon is started from the CLI
configuration.
|
|
Disabling ipsec.service and strongswan-starter.service failed during
every ISO build:
Failed to disable unit, unit ipsec.service does not exist.
Failed to disable unit, unit strongswan-starter.service does not exist.
Since the strongSwan 6.0 update only strongswan.service unit is shipped.
|
|
There is neither a compiler nor DKMS on the running system.
|
|
Linux 6.18 Series (rolling)
* 6.18.45 https://lwn.net/Articles/1089546/
* 6.18.46 https://lwn.net/Articles/1090101/
* 6.18.47 https://lwn.net/Articles/1090944/
* 6.18.48 https://lwn.net/Articles/1091122/
|
|
Upgrade rolling release Kernel version.
This is not a routine bump: 6.18.39 through 6.18.41 are unbootable on Intel
Denverton (DNV), Ice Lake Xeon D (ICX-D/CDF) and Snowridge (SNR) platforms,
which covers a large part of the small-form-factor hardware VyOS is deployed
on. We moved to 6.18.41 in 97c2a87c0 (T9067).
Upstream b1b4efea05a5 ("serial: 8250_mid: Disable DMA for selected platforms",
in stable since v6.18.39) set dnv_board.setup and dnv_board.exit to
PTR_IF(false, ...) to work around a DMA errata, but left the three call sites
in mid8250_probe() and mid8250_remove() dereferencing them unguarded. Since
CONFIG_SERIAL_8250_MID=y in our defconfig, the driver is built in and the
resulting NULL function pointer call happens during early PCI probe, killing
the probing kworker with interrupts disabled and wedging the boot:
CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 6.18.41-vyos #1
Hardware name: Supermicro SYS-510D-10C-FN6P/X12SDV-10C-SP6F, BIOS 2.2a
Workqueue: events work_for_cpu_fn
RIP: 0010:0x0
Call Trace:
mid8250_probe.part.0+0x10c/0x230
local_pci_probe+0x41/0x90
work_for_cpu_fn+0x16/0x20
note: kworker/0:1[11] exited with irqs disabled
The missing NULL checks were added by 7fb13fd7e9a5 ("serial: 8250_mid: Fix
NULL function pointer dereference on DNV/ICX-D/SNR platforms"), which is in
stable as of v6.18.42, so any release from .42 onwards resolves this. Taking
.44 as the current 6.18.y tip.
All five patches under patches/kernel/ still apply: of the files they touch,
only net/ipv6/route.c saw upstream changes in this range (1db34097998c, in
__ip6_del_rt_siblings() around line 4011), which does not overlap the
rt6_link_filter()/rt6_score_route() hunks of 0001 around line 717.
Changelogs:
* 6.18.44 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.44
* 6.18.43 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.43
* 6.18.42 https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.42
|
|
T8329: Make the Azure VF-naming helper script 'vyos_vf_name' available in initramfs
|
|
Upgrade rolling release Kernel version.
Changelogs:
* 6.18.41 https://lwn.net/Articles/1086227/
* 6.18.40 https://lwn.net/Articles/1084923/
* 6.18.39 https://lwn.net/Articles/1083464/
|
|
|
|
initramfs so that VFs with add events appearing in early stage can be renamed using this script
|
|
|
|
`icon_heigh` is a typo of the GRUB2 boot_menu property `icon_height`. Icons are
already disabled in this menu via `icon_width = 0` + `item_icon_space = 0`, so
correcting the property name is behaviour-neutral. Clears the lone typos-check
hit on this repo ahead of the T8490 ruleset pilot active flip.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
|
|
T8099: Update strongswan to 6.0.6
|
|
geoip: T5746: Download ASN database
|
|
|
|
* Upgrade to 6.0.6
* Update 30-strongswan-configs.chroot to not change
/etc/strongswan.d/charon.conf as the file is part of package
strongswan-charon that should not be installed
* Rebase all patches
* Enable ML-KEM for Post Quantum
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
|
|
|
|
|
|
* T8947: migrate remaining current→rolling residuals on rolling branch
Post-1c the default branch is `rolling`, but several build-config values
on this branch still referenced the old `current` repo path / codename /
train identity. These are not cosmetic — they break the rolling ISO build:
- docker/vyos-dev.list: apt source baked into vyos/vyos-build:rolling still
pointed at repositories/current (Hit/Err on package builds). Now
repositories/rolling + codename `rolling` (verified against live repo:
Suite/Codename `rolling`, Components `main`).
- data/defaults.toml: vyos_mirror → repositories/rolling; vyos_branch →
rolling (build-vyos-image checks out vyos-1x at this branch — `current`
no longer exists post-1c); release_train → rolling (apt pin codename +
os-release identity).
- data/live-build-config/archives/vyos-dev.pref.chroot: Pin codename
n=rolling to match the repo.
- data/versions: key current→rolling. build-vyos-image looks up
version_mapping[git_branch]; git_branch is `rolling`, so the `current`
key KeyErrored and the version fell back to 999.<timestamp>.
- .github/config/smoketest-branches.json: rolling-train entry key
current→rolling (looked up by branch name; was already 404ing on
rolling) + mirror + container_image to rolling.
os-release impact (intended): rolling images now report
VERSION_CODENAME=rolling and "(rolling)" in PRETTY_NAME/VERSION. The
-rolling version suffix is hardcoded and unaffected.
Companion to Rollout 1c (T8943). Ref IS-504.
đŸ¤– Generated by [robots](https://vyos.io)
* T8947: finish current→rolling residuals in docs/Dockerfile examples
Address adversarial-review findings (Codex) — stale current refs on the
rolling branch outside build config:
- .github/PULL_REQUEST_TEMPLATE.md: CONTRIBUTING link vyos-1x/blob/current
→ blob/rolling (was a broken link — vyos-1x renamed current→rolling in 1c).
- README.md: "Development Branches" section described the default branch as
`current`; updated to `rolling` (dropped the obsolete "may switch to main"
note — the rename already happened, to rolling).
- docker/Dockerfile: build-example comments vyos-build:current* →
vyos-build:rolling*.
Ref IS-504, companion to T8943.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
|
|
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
|
|
serial: T8844: fix default config injection leading to invalid boot console
|
|
With all the latest serial interface changes - and the resulting patching of
the default configuration based on the build flavor - the serial console
was always injected by a helper named write-config-file-value.py, even if the
console_type was set to tty instead of ttyS or ttyAMA.
This was a pending issue in the rolling tests for the PROXMOX flavor. It is
applicable to every other flavor using tty as default console.
|
|
Kernel: T6847: update Intel Out-Of-Tree drivers for IGB, IXGBE, I40e, ICE and IAVF
|
|
Stable kernels with Hyunwoo Kim's patch [1] for the second vulnerability
CVE-2026-43500 reported with Dirty Frag and Copy Fail 2.
1: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel ice driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel i40e driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
These kernels contain a partial fix for the Dirty Frag [1] and
Copy Fail 2 [2] security flaws.
1: https://github.com/V4bel/dirtyfrag#dirty-frag-universal-linux-lpe
2: https://www.openwall.com/lists/oss-security/2026/05/07/12
|
|
* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream
|
|
|
|
Kernel: T861: add custom VyOS CA to Kernel builds for later module signing
|
|
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
|
