| Age | Commit message (Collapse) | Author |
|---|
|
T7142: Update HAProxy version to 3.0.29
|
|
T9454: Upgrade FRR to 10.7.1
|
|
|
|
Kernel: T9197: package iwlwifi firmware the 6.18 driver actually loads
|
|
Firmware was selected by exact match against the names a driver declares.
On 6.18 iwlwifi declares only its highest API version, while at runtime it
falls back to lower versions, and for Wi-Fi 6/6E parts it caps the API at
the MAC family limit. linux-firmware ships none of the declared names, so
BE200, AX201, AX210, AX211 and AX411 were left without firmware.
For each declared iwlwifi name, the newest available ucode at or below the
declared version (core 99 falls back to API 101) is now packaged, together
with its PNVM file. Names with no loadable firmware emit a build warning.
|
|
Exactly it will be per Git describe: frr-10.7.1-60-g45b345f38f
|
|
includes security fix follow-up hardening and message-authenticator support for Blast-RADIUS mitigation
|
|
Kernel: T9385: Update Linux Kernel to 6.18.55
|
|
|
|
Adds to cleanup kernel intermediate objects and create source tarball
|
|
|
|
Added in commit 21c7e661 ("Kernel: T5641: enable module compression to save
disk space"), the flag is removed again as there is no need for it.
|
|
The README still described the pre-T8506 flow, where a single
x86_64_vyos_defconfig was copied into arch/x86/configs of the Kernel source
tree. That file and that flow no longer exist, and the text also claimed
the Kernel was 6.6 and that only amd64 was built.
Describe what actually happens: a per architecture base config selected from
dpkg --print-architecture, the config/*.config snippets merged on top in
file name order, and the module signing snippet generated at build time.
|
|
Smoketest test_kernel_options.py::test_hypervisor_virtio fails on arm64.
The test is not architecture gated and checks fifteen virtio options, of
which VIRTIO_IOMMU was the only one not enabled on arm64 - amd64 has it
as a module already.
The driver is available here, it is "depends on VIRTIO && (ARM64 || X86)",
and it is what QEMU virt machines use, so build it as a module to match
amd64.
ACPI_VIOT comes along because VIRTIO_IOMMU selects it.
|
|
The arm64 base config was still the dump of a 6.6.15 configuration. It had
only ever been hand edited per feature, never regenerated, so building
6.18.x produced 91 warnings from merge_config.sh:
Value requested for CONFIG_AS_HAS_LSE_ATOMICS not in final .config
Requested value: CONFIG_AS_HAS_LSE_ATOMICS=y
Actual value:
|
|
The config/*.config snippets are merged on every architecture, so an option
that only exists on one of them is reported as a mismatch on the others:
Value requested for CONFIG_NETLABEL not in final .config
Requested value: # CONFIG_NETLABEL is not set
Actual value:
Three options are only available on amd64 and were sitting in the shared
snippets. Move them to the amd64 base config, each next to the symbol that
gates it:
* XFRM_USER_COMPAT needs COMPAT_FOR_U64_ALIGNMENT
* HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON needs
ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
* NETLABEL depends on SECURITY, which arm64 does not enable
|
|
T8938 consolidated the WWAN build time options into config/12-wwan.config
and requested the USB WWAN drivers as built-in. That only ever took effect
on amd64. On arm64 all of them silently ended up as modules, because a
tristate can never exceed the value of what it depends on and the arm64
base config had USB_USBNET=m and USB_SERIAL=m, while amd64 had both =y.
Pull the two parents into the snippet so the requested =y is reachable on
every architecture - this is a no-op on amd64 where they were already =y.
|
|
|
|
|
|
2.7.7 carries CVE-2026-84732: two fixes in the reliability layer, an
unbounded reliable TLS timeout and acks being honoured for packets that
cannot be outstanding. Debian skipped 2.7.6, so debian/2.7.7-1 is the
next packaging tag after the debian/2.7.5-1 this was pinned to.
The carried gerrit 1734 patch stays: 2.7.7 still has no
net_iface_ovpn_mode(), so pre-created DCO interfaces are not yet handled
upstream. It applies to the new tree with line offsets only, and no
Debian patch touches the files it edits.
|
|
Update accel-ppp-ng to the 306fff8 version includes multiple
upstream fixes
|
|
openvpn: T8264: build 2.7.5 backport for the in-tree ovpn module
|
|
T9277: image: further reduced installed and ISO image size
|
|
T9294: strongswan: add security patches
|
|
Add security patches from
https://www.strongswan.org/blog/2026/09/07/strongswan-6.1.0-released.html
|
|
vbash: T7575: vyatta-bash 5.2.37 using build system
|
|
VyOS creates the "ovpn" device whenever the daemon cannot - a client whose
server is not reachable yet never opens its tun - so OpenVPN has to adopt a
device it did not make. It takes the device but not its ifindex today, so
dco_new_peer() fails, the daemon exits and deletes the interface on its way
out. systemd starts it again and the second attempt creates a device of its
own, which hides the whole thing behind a tunnel that does come up.
Carry Ralf's fix until it is released: it resolves the ifindex on the
-EEXIST path, refuses a device whose operating mode does not match, and
leaves a pre-existing interface alone on close.
https://gerrit.openvpn.net/c/openvpn/+/1734 (patchset 2)
|
|
Kernel: T9298: make linux-firmware package architecture aware
|
|
Currently when the Kernel is build and creates the vyos-linux-firmware package,
the Kernel modules are inspected and the firmware file string is extracted.
This is the case for years. Now with ARM64 on the doorstep, we would assemble
the vyos-linux-firmware package twice, once for x86_64 and once for amd64.
The generated package is for CPU architecture all - as the package is build
twice, the longer running build will win -> perfect race condition.
|
|
T9245: podman: add libsystemd-dev to enable automatic health checks
|
|
The in-tree "ovpn" module requires OpenVPN 2.7 or later, while bookworm
ships 2.6.14 which speaks only ovpn-dco-v2. DCO stays inert until
userspace is upgraded.
systemd-dev does not exist in bookworm, so it is stripped before
mk-build-deps reads debian/control. The package is also added to the
rebuild trigger, without which it would never reach the mirror.
|
|
Update accel-ppp-ng to the 8cb6287 version, which includes multiple
security fixes, merged in the https://github.com/accel-ppp/accel-ppp-ng/pull/40
|
|
The Accel-PPP maintainer scripts call depmod without a Kernel version, so it
uses the version reported by uname of the build host instead of the VyOS Kernel
the ipoe and vlan_mon modules were compiled for.
The ISO build therefore logs:
depmod: ERROR: could not open directory /lib/modules/6.1.0-52-amd64
depmod: FATAL: could not search modules
Add a patch that generates the maintainer scripts from a template so the module
directory version known to the build is substituted and handed to depmod
explicitly. The same version is already passed to the build via MODULES_KDIR,
and the uname fallback for standalone builds stays untouched.
|
|
|
|
* ixgbe v6.4.4 -> v6.4.5
* ice v2.6.6 -> v2.6.7
|
|
|
|
|
|
|
|
Fixes accel-ppp: vlan-mon does not create dynamic VLAN interfaces
|
|
|
|
ddclient: T6981: Upgrade ddclient to v4.0.0
|
|
Kernel 6.18 moved Intel BE200/BE-series (Wi-Fi 7) devices to the new
iwlmld op-mode driver: their dev_info entries in iwlwifi's pcie/drv.c
are guarded by IS_ENABLED(CONFIG_IWLMLD). The VyOS kernel config enables
IWLWIFI/IWLDVM/IWLMVM but not IWLMLD, so BE-series support is compiled
out and probing fails with error -22 (no wlan interface is created).
Enable IWLMLD as a module on x86 and arm64, matching the existing
IWLDVM/IWLMVM op-modes. The firmware these devices need is already
shipped by the linux-firmware package.
|
|
Update the accel-ppp-ng version to 9654bb6
Includes fixes for T8391
(Bonding interface permission errors with custom ethernet MTU)
|
|
Convert build-nat-rtsp.sh, build-ipt-netflow.sh, build-intel-nic.sh,
build-intel-qat.sh and build-linux-firmware.sh from fpm to debmake +
debuild, matching the jool/realtek packaging style.
|
|
build-kernel.sh parsed kernel_flavor out of defaults.toml itself via a
brittle awk one-liner, even though build.py already has that value from
its own defaults.toml read.
Pass kernel_flavor down as an env var instead, so defaults.toml is read
in exactly one place (build.py's main) and everything downstream flows
through kernel-vars or explicit parameters.
|
|
Rewrite build-jool.py, build-realtek-r8126.py and build-realtek-r8152.py
as build-*.sh, matching the Bash convention already used by every other
sub-dependency script in this directory (kernel-vars sourcing, debmake +
debuild packaging).
|
|
Accel-PPP-ng only links against a few VPP libraries, but the build triggered
a full VPP package rebuild (make pkg-deb) on every run, with no caching.
Skip that step when the required VPP libraries already exist from a
previous run.
Delete them to force a rebuild.
|
|
Commit 21c7e661 ("Kernel: T5641: enable module compression to save disk
space") which enabled module compression using XZ missed that when we search
modules for firmware inclusion, the pattern was hardcoded to *.ko instead of
*.ko* - this has been fixed.
|
|
Package update required in lockstep mode to add support for renaming podman
macvlan interfaces.
|
|
T9147: Bump accel-ppp-ng version to 9874ea3
|
