| Age | Commit message (Collapse) | Author |
|---|
|
Kernel: T9197: package iwlwifi firmware the 6.18 driver actually loads
|
|
Firmware was selected by exact match against the names a driver declares.
On 6.18 iwlwifi declares only its highest API version, while at runtime it
falls back to lower versions, and for Wi-Fi 6/6E parts it caps the API at
the MAC family limit. linux-firmware ships none of the declared names, so
BE200, AX201, AX210, AX211 and AX411 were left without firmware.
For each declared iwlwifi name, the newest available ucode at or below the
declared version (core 99 falls back to API 101) is now packaged, together
with its PNVM file. Names with no loadable firmware emit a build warning.
|
|
includes security fix follow-up hardening and message-authenticator support for Blast-RADIUS mitigation
|
|
smoketest: T9402: stop navigating the installed system's GRUB menu
|
|
Testsuite: T861: boot VyOS CA signed images as-is in Secure Boot test
|
|
Kernel: T9385: Update Linux Kernel to 6.18.55
|
|
The Secure Boot test always disabled Secure Boot in the UEFI and enrolled a
Machine Owner Key. That only applies to images signed with a custom
certificate - an image signed by the VyOS CA is already trusted and must boot
without any firmware changes.
If the custom signing key pair is present in the build tree, the MOK workflow
is used as before. Otherwise the image boots with Secure Boot enabled from the
start, and the Kernel signature is verified against the VyOS CA issuer and
signer via "show secure-boot detail", which requires a matching vyos-1x.
The make target is renamed from testsb to test-secure-boot.
|
|
The QEMU smoketest selected the serial console on the installed system by
sending timed arrow keys and Enter through the GRUB menus. Under host load
those keys raced the five second auto-boot countdown or got lost, so tests
failed at random.
Earlier fixes only treated symptoms. T8147 doubled the menu timeout. T9099
added checks after each submenu to fail fast. T9214 first sent the first key
earlier and then ignored a lost race on the top menu.
The installer already makes the serial console the default, and raw images
take it from the build flavor, so the default entry boots the right console.
The harness now only waits for GRUB and lets it boot. The existing console
checks still verify the setting. Live ISO menus are unchanged.
|
|
After the last installer question the QEMU smoketest waits for the
operational mode prompt with the default timeout of 60 seconds. Installing
GRUB and unmounting the target, which flushes the copied image to disk, can
take longer on large images, slow storage or loaded CI hosts. A working
install was then reported as failed. Raise this wait to 300 seconds.
|
|
|
|
Adds to cleanup kernel intermediate objects and create source tarball
|
|
|
|
Added in commit 21c7e661 ("Kernel: T5641: enable module compression to save
disk space"), the flag is removed again as there is no need for it.
|
|
The README still described the pre-T8506 flow, where a single
x86_64_vyos_defconfig was copied into arch/x86/configs of the Kernel source
tree. That file and that flow no longer exist, and the text also claimed
the Kernel was 6.6 and that only amd64 was built.
Describe what actually happens: a per architecture base config selected from
dpkg --print-architecture, the config/*.config snippets merged on top in
file name order, and the module signing snippet generated at build time.
|
|
Smoketest test_kernel_options.py::test_hypervisor_virtio fails on arm64.
The test is not architecture gated and checks fifteen virtio options, of
which VIRTIO_IOMMU was the only one not enabled on arm64 - amd64 has it
as a module already.
The driver is available here, it is "depends on VIRTIO && (ARM64 || X86)",
and it is what QEMU virt machines use, so build it as a module to match
amd64.
ACPI_VIOT comes along because VIRTIO_IOMMU selects it.
|
|
The arm64 base config was still the dump of a 6.6.15 configuration. It had
only ever been hand edited per feature, never regenerated, so building
6.18.x produced 91 warnings from merge_config.sh:
Value requested for CONFIG_AS_HAS_LSE_ATOMICS not in final .config
Requested value: CONFIG_AS_HAS_LSE_ATOMICS=y
Actual value:
|
|
The config/*.config snippets are merged on every architecture, so an option
that only exists on one of them is reported as a mismatch on the others:
Value requested for CONFIG_NETLABEL not in final .config
Requested value: # CONFIG_NETLABEL is not set
Actual value:
Three options are only available on amd64 and were sitting in the shared
snippets. Move them to the amd64 base config, each next to the symbol that
gates it:
* XFRM_USER_COMPAT needs COMPAT_FOR_U64_ALIGNMENT
* HUGETLB_PAGE_OPTIMIZE_VMEMMAP_DEFAULT_ON needs
ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP
* NETLABEL depends on SECURITY, which arm64 does not enable
|
|
T8938 consolidated the WWAN build time options into config/12-wwan.config
and requested the USB WWAN drivers as built-in. That only ever took effect
on amd64. On arm64 all of them silently ended up as modules, because a
tristate can never exceed the value of what it depends on and the arm64
base config had USB_USBNET=m and USB_SERIAL=m, while amd64 had both =y.
Pull the two parents into the snippet so the requested =y is reachable on
every architecture - this is a no-op on amd64 where they were already =y.
|
|
|
|
|
|
|
|
2.7.7 carries CVE-2026-84732: two fixes in the reliability layer, an
unbounded reliable TLS timeout and acks being honoured for packets that
cannot be outstanding. Debian skipped 2.7.6, so debian/2.7.7-1 is the
next packaging tag after the debian/2.7.5-1 this was pinned to.
The carried gerrit 1734 patch stays: 2.7.7 still has no
net_iface_ovpn_mode(), so pre-created DCO interfaces are not yet handled
upstream. It applies to the new tree with line offsets only, and no
Debian patch touches the files it edits.
|
|
The ISA "tpm-tis" device only exists on x86 machines. The arm64 "virt"
machine exposes the TPM via MMIO and a device-tree node, which QEMU models
as "tpm-tis-device" instead.
|
|
Update accel-ppp-ng to the 306fff8 version includes multiple
upstream fixes
|
|
openvpn: T8264: build 2.7.5 backport for the in-tree ovpn module
|
|
T9277: image: further reduced installed and ISO image size
|
|
The installer writes the GRUB defaults to the persistence partition, and on
a running image the /boot of the booted image is not that partition, so the
check never found the file and declared the image unusable.
Resolve the persistence directory the way vyos.system.grub does instead of
assuming "/".
|
|
Testsuite: T7575: strip terminal escapes when parsing console output
|
|
T9294: strongswan: add security patches
|
|
Commit c7eef9dd ("Testsuite: T8375: verify proper serial console settings")
read console_type/console_num/console_speed from flavor.json by taking the
last non-empty line of the raw pexpect buffer, then interpolated those values
unescaped into c.expect() patterns.
That stayed harmless until commit 0505dc09 ("vbash: T7575: vyatta-bash 5.2.37
using build system") rebased vyatta-bash onto Debian bash 5.2.37, where
readline enables bracketed-paste mode by default. The shell now emits
\x1b[?2004h around every prompt, that sequence got parsed as console_type,
and its "[" opened an unterminated character class:
re.error: unterminated character set at position 27
Add a get_cmd_output() helper that strips terminal control sequences and the
echoed command before returning the last output line, hoist the ANSI regex to
module scope for reuse, validate the parsed values, and re.escape() everything
interpolated into a regular expression.
|
|
Add security patches from
https://www.strongswan.org/blog/2026/09/07/strongswan-6.1.0-released.html
|
|
vbash: T7575: vyatta-bash 5.2.37 using build system
|
|
VyOS creates the "ovpn" device whenever the daemon cannot - a client whose
server is not reachable yet never opens its tun - so OpenVPN has to adopt a
device it did not make. It takes the device but not its ifindex today, so
dco_new_peer() fails, the daemon exits and deletes the interface on its way
out. systemd starts it again and the second attempt creates a device of its
own, which hides the whole thing behind a tunnel that does come up.
Carry Ralf's fix until it is released: it resolves the ifindex on the
-EEXIST path, refuses a device whose operating mode does not match, and
leaves a pre-existing interface alone on close.
https://gerrit.openvpn.net/c/openvpn/+/1734 (patchset 2)
|
|
Kernel: T9298: make linux-firmware package architecture aware
|
|
Currently when the Kernel is build and creates the vyos-linux-firmware package,
the Kernel modules are inspected and the firmware file string is extracted.
This is the case for years. Now with ARM64 on the doorstep, we would assemble
the vyos-linux-firmware package twice, once for x86_64 and once for amd64.
The generated package is for CPU architecture all - as the package is build
twice, the longer running build will win -> perfect race condition.
|
|
T9245: podman: add libsystemd-dev to enable automatic health checks
|
|
The in-tree "ovpn" module requires OpenVPN 2.7 or later, while bookworm
ships 2.6.14 which speaks only ovpn-dco-v2. DCO stays inert until
userspace is upgraded.
systemd-dev does not exist in bookworm, so it is stripped before
mk-build-deps reads debian/control. The package is also added to the
rebuild trigger, without which it would never reach the mirror.
|
|
VyOS carried a fork of Debian's live-boot, based on release 1:20151213, purely
to add a handful of VyOS specific behaviours. The fork is retired here in
favour of Debian's own live-boot plus a drop-in component.
live-boot's frontend sources every /lib/live/boot/????-* file in glob order,
so 9991-vyos.sh is read after all upstream components and can both translate
the vyos-union= kernel parameter and redefine three helpers. An initramfs-tools
hook copies the multiarch klibc libraries that upstream's non-multiarch glob
never matches, and a live-top shim runs mdadm, which boot=live otherwise skips
entirely, leaving RAID arrays unassembled.
|
|
T9269: add OCI container image test
|
|
Add scripts/check-oci-container, a container adapted counterpart to
check-qemu-install. It imports the OCI tarball produced by scripts/iso-to-oci,
verifies the containerlab healthcheck survives the import, boots the image with
systemd as PID 1 and then drives the VyOS CLI to run basic operational and
configuration mode tests plus assertions on the rootfs modifications done by
iso-to-oci (locale, banner, /config symlink, removed podman runtime and removed
container CLI nodes).
Wire it up as "make test-oci", which picks up the newest tarball matching the
host architecture.
The boot wait polls for the vyos user in addition to vyos-router, as the unit
reports itself active before the default configuration has been committed.
|
|
The vyos-1x-smoketest maintainer script now queries the image flavor to implant
the correct serial console device and speed into the configuration test data.
This requires /usr/share/vyos/flavor.json to be present in the chroot before
the Debian packages get installed, but config/includes.chroot is only copied
into the chroot after package installation.
Write flavor.json to config/includes.chroot_before_packages instead, which
live-build copies into the chroot prior to installing packages. version.json
and the activation hints are unaffected and remain in config/includes.chroot.
Companion change to vyos-1x commit 2f9fe3e74 ("smoketest: T9014: make
configtest serial console image flavor agnostic").
|
|
Update accel-ppp-ng to the 8cb6287 version, which includes multiple
security fixes, merged in the https://github.com/accel-ppp/accel-ppp-ng/pull/40
|
|
Kernel: T9283: run Accel-PPP depmod for the target Kernel version
|
|
oci: T9269: mask systemd services for container startup and add healthcheck
|
|
Unpacking the squashfs and compressing the rootfs keep the script silent for
minutes - it looks hung. Animate a spinner, but only when stdout is a terminal
so CI runs and piped logs keep their single "I: ..." line per step.
|
|
Running containers inside the VyOS container is not supported and the
container CLI nodes are stripped from the image anyway, so podman(8) and
its helpers are dead weight - about 110 MiB of the uncompressed rootfs
(podman 43 MiB, podman-remote 32 MiB, netavark and aardvark-dns 21 MiB,
runc 8 MiB), which is roughly 32 MiB of the compressed tarball.
Remove the binaries along with everything that would otherwise dangle:
the podman and netavark systemd units - podman.service is enabled via a
"WantedBy" symlink and would fail on boot - the quadlet generators, the
tmpfiles.d snippet and the configuration shipped by containers-common.
The container operational mode templates are removed as well, they would
only greet the user with a traceback now that podman is gone.
|
|
containerlab uses the image healthcheck to determine when a VyOS node is
ready, see https://containerlab.dev/manual/kinds/vyosnetworks_vyos/
A rootfs tarball carries no OCI image configuration, so this can only be
attached when the tarball is imported.
|
|
Adjust systemd units for containerized operation - this is what the containerlab
documentation asks users to do in their Dockerfile, but as we ship a ready made
rootfs there is no build stage where "systemctl" could be run.
Masking and disabling is nothing but symlink handling below /etc/systemd, so we
can do it offline (and cross-architecture) right here.
|
|
The Accel-PPP maintainer scripts call depmod without a Kernel version, so it
uses the version reported by uname of the build host instead of the VyOS Kernel
the ipoe and vlan_mon modules were compiled for.
The ISO build therefore logs:
depmod: ERROR: could not open directory /lib/modules/6.1.0-52-amd64
depmod: FATAL: could not search modules
Add a patch that generates the maintainer scripts from a template so the module
directory version known to the build is substituted and handed to depmod
explicitly. The same version is already passed to the build via MODULES_KDIR,
and the uname fallback for standalone builds stays untouched.
|
|
|
