| Age | Commit message (Collapse) | Author |
|---|
|
|
|
`icon_heigh` is a typo of the GRUB2 boot_menu property `icon_height`. Icons are
already disabled in this menu via `icon_width = 0` + `item_icon_space = 0`, so
correcting the property name is behaviour-neutral. Clears the lone typos-check
hit on this repo ahead of the T8490 ruleset pilot active flip.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
|
|
T8099: Update strongswan to 6.0.6
|
|
geoip: T5746: Download ASN database
|
|
|
|
* Upgrade to 6.0.6
* Update 30-strongswan-configs.chroot to not change
/etc/strongswan.d/charon.conf as the file is part of package
strongswan-charon that should not be installed
* Rebase all patches
* Enable ML-KEM for Post Quantum
|
|
As salt has been marked deprecated via T8056 and is thus deprecated in VyOS 1.5
and VyOS 1.4 it is time to remove it from the rolling release.
|
|
|
|
|
|
|
|
* T8947: migrate remaining current→rolling residuals on rolling branch
Post-1c the default branch is `rolling`, but several build-config values
on this branch still referenced the old `current` repo path / codename /
train identity. These are not cosmetic — they break the rolling ISO build:
- docker/vyos-dev.list: apt source baked into vyos/vyos-build:rolling still
pointed at repositories/current (Hit/Err on package builds). Now
repositories/rolling + codename `rolling` (verified against live repo:
Suite/Codename `rolling`, Components `main`).
- data/defaults.toml: vyos_mirror → repositories/rolling; vyos_branch →
rolling (build-vyos-image checks out vyos-1x at this branch — `current`
no longer exists post-1c); release_train → rolling (apt pin codename +
os-release identity).
- data/live-build-config/archives/vyos-dev.pref.chroot: Pin codename
n=rolling to match the repo.
- data/versions: key current→rolling. build-vyos-image looks up
version_mapping[git_branch]; git_branch is `rolling`, so the `current`
key KeyErrored and the version fell back to 999.<timestamp>.
- .github/config/smoketest-branches.json: rolling-train entry key
current→rolling (looked up by branch name; was already 404ing on
rolling) + mirror + container_image to rolling.
os-release impact (intended): rolling images now report
VERSION_CODENAME=rolling and "(rolling)" in PRETTY_NAME/VERSION. The
-rolling version suffix is hardcoded and unaffected.
Companion to Rollout 1c (T8943). Ref IS-504.
đŸ¤– Generated by [robots](https://vyos.io)
* T8947: finish current→rolling residuals in docs/Dockerfile examples
Address adversarial-review findings (Codex) — stale current refs on the
rolling branch outside build config:
- .github/PULL_REQUEST_TEMPLATE.md: CONTRIBUTING link vyos-1x/blob/current
→ blob/rolling (was a broken link — vyos-1x renamed current→rolling in 1c).
- README.md: "Development Branches" section described the default branch as
`current`; updated to `rolling` (dropped the obsolete "may switch to main"
note — the rename already happened, to rolling).
- docker/Dockerfile: build-example comments vyos-build:current* →
vyos-build:rolling*.
Ref IS-504, companion to T8943.
đŸ¤– Generated by [robots](https://vyos.io)
|
|
The Kernel 6.18.33 now has an upstream fix for the fragnesia vulnerability
|
|
This fixes the LPE https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn
|
|
serial: T8844: fix default config injection leading to invalid boot console
|
|
With all the latest serial interface changes - and the resulting patching of
the default configuration based on the build flavor - the serial console
was always injected by a helper named write-config-file-value.py, even if the
console_type was set to tty instead of ttyS or ttyAMA.
This was a pending issue in the rolling tests for the PROXMOX flavor. It is
applicable to every other flavor using tty as default console.
|
|
Kernel: T6847: update Intel Out-Of-Tree drivers for IGB, IXGBE, I40e, ICE and IAVF
|
|
Stable kernels with Hyunwoo Kim's patch [1] for the second vulnerability
CVE-2026-43500 reported with Dirty Frag and Copy Fail 2.
1: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
|
|
The Intel iavf driver (formerly i40evf) is the Linux virtual function driver
for modern Intel Ethernet adapters supporting SR-IOV, including the X700/E800
series.
Renamed to iavf to support future devices, it replaced i40evf entirely by 2019.
The driver facilitates high-performance networking in virtualized environments.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel ice driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
The current version of the Intel i40e driver does not compile with a recent
LTS Kernel due to missing internal Kernel API adjustments in the Intel driver.
This commit contains custom patches to make the driver build.
|
|
These kernels contain a partial fix for the Dirty Frag [1] and
Copy Fail 2 [2] security flaws.
1: https://github.com/V4bel/dirtyfrag#dirty-frag-universal-linux-lpe
2: https://www.openwall.com/lists/oss-security/2026/05/07/12
|
|
* Forwared port all out-of-tree driver patches
* Add Intel QAT patch to make it compile for LInux 6.18
* Remove out-of-tree OpenVPN DCO module - now available upstream
|
|
|
|
Kernel: T861: add custom VyOS CA to Kernel builds for later module signing
|
|
With this addition we can always sign a Kernel module later and ship it if
needed, without re-compiling the Kernel.
Kernel will report:
[ 1.223891] Loaded X.509 cert 'VyOS Networks Secure Boot Signer 2025 - linux: 6ca57e2add335babd08da69b48c70693edd2b037'
Issuer: CN = VyOS Networks Secure Boot CA
Validity
Not Before: Apr 26 09:07:06 2025 GMT
Not After : Apr 24 09:07:06 2035 GMT
Subject: CN = VyOS Networks Secure Boot Signer 2025 - linux
|
|
config.boot.default
We do have different default console configurations per flavor used. We will
set the serial console to the default configuration for the flavor once during
ISO image assembly.
|
|
image: T8375: honor already existing boot_settings
|
|
VyOS flavors might come with boot_settings which already provided additional
serial interface settings if required. Instead of using our own definitions,
re-use what's already existing.
scripts/image-build/build-vyos-image comes with an implicit default for
boot_settings like console number and speed, thus we do not need to redefine
the existing default - again.
|
|
* 6.6.135 https://lwn.net/Articles/1068477/
* 6.6.134 https://lwn.net/Articles/1067276/
|
|
|
|
flavor: T8375: add flavor.json during build into resulting image
|
|
T8047: replace netplugd with vyos-netlinkd
|
|
In order for amd64 or arm64 images to know their serial console settings, we
embed a new file named "flavor.json" under "/usr/share/vyos" into the resulting
image. The file holds configuration parameters unique to the build flavor.
Corresponding library functions are available via a Python vyos.flavor module.
|
|
T8410: Fix typos and mistakes in scripts and comments
|
|
Fix typos and mistakes in the comments
No functional changes
|
|
The custom patch "nft_ct: Added nfct_seqadj_ext_add() for DNAT'ed - conntrack."
is now available upstream in the Kernel tree.
|
|
|
|
|
|
found error
|
|
|
|
T8311: move to GNU coreutils when building GLIBC multiarch variable
|
|
T8330: ARM64: vyos-ipt-netflow package is missing in the build
|
|
Related to commit 39dc9c98c68 ("T8311: fix initramfs hook "dpkg-architecture:
command not found"). Drop dpkg-dev implementation in favour of GNU coreutils.
On x86_64 (aka amd64) both yield the same result:
$ echo $(uname -m)-linux-gnu
x86_64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
x86_64-linux-gnu
On aarch64 (aka arm64) both yield the same result:
$ echo $(uname -m)-linux-gnu
aarch64-linux-gnu
$ echo $(dpkg-architecture -qDEB_HOST_MULTIARCH)
aarch64-linux-gnu
|
|
T8120: add support for per CPU architecture serial interface name
|
|
Add vyos-ipt-netflow package to be installed on ARM64 platform by default.
|
|
This file is only needed to support upgrades from the legacy image management
tools. Example would be an upgrade from VyOS 1.3.8 -> 1.5 (which is officially
unsupported, but we always try our best). This is also the reason why we can
leave the ttyS0 console in this file - there was no ARM64 image for VyOS 1.3!
|
|
When building an ISO image the files which are probed for no longer exist.
This means it makes no sense to longer carry an unused hook.
|
|
|
|
x86_64 and arm64 both use a different serial interface during Linux Kernel
boot. Define either ttyS0 or ttyAMA0 per CPU architecture. This could be
further overwritten by individual flavors.
|
