Merge pull request #1412 from kernelkit/initviz

Optimize boot time and consolidate confd into a single daemon                                                             

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>

.github/workflows/coverity.yml

@@ -55,7 +55,7 @@ jobs:
           sudo apt-get -y update
           sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                        libcrypt-dev libglib2.0-dev libpcre2-dev       \
-                       libuev-dev
+                       libuev-dev libavahi-client-dev
 
       - name: Build dependencies
         run: |

README.md

@@ -85,12 +85,12 @@ interfaces {
 admin@infix-12-34-56:/config/interface/eth0/> <b>leave</b>
 admin@infix-12-34-56:/> <b>show interfaces</b>
 <u>INTERFACE       PROTOCOL   STATE       DATA                                  </u>
-eth0            ethernet   UP          52:54:00:12:34:56
-                ipv4                   192.168.2.200/24 (static)
-                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 lo              ethernet   UP          00:00:00:00:00:00
                 ipv4                   127.0.0.1/8 (static)
                 ipv6                   ::1/128 (static)
+eth0            ethernet   UP          52:54:00:12:34:56
+                ipv4                   192.168.2.200/24 (static)
+                ipv6                   fe80::5054:ff:fe12:3456/64 (link-layer)
 admin@infix-12-34-56:/> <b>copy running startup</b>
 </code></pre>
 
@@ -114,6 +114,7 @@ containers for any custom functionality you need.
 - **x86_64** - Run in VMs or on mini PCs for development and testing
 - **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM64 platforms
 - **Microchip SparX-5i** - Enterprise switching capabilities
+- **Microchip SAMA7G54-EK** - ARM Cortex-A7
 - **NXP i.MX8MP EVK** - Highly capable ARM64 SoC
 - **StarFive VisionFive2** - RISC-V architecture support
 

board/aarch64/linux_defconfig

@@ -502,6 +502,7 @@ CONFIG_USB_OTG=y
 CONFIG_USB_XHCI_HCD=m
 CONFIG_USB_XHCI_MVEBU=m
 CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
 CONFIG_USB_EHCI_HCD_PLATFORM=m
 CONFIG_USB_OHCI_HCD=m
 CONFIG_USB_OHCI_HCD_PLATFORM=m

board/aarch64/raspberrypi-rpi64/Config.in

@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	bool "Raspberry Pi 64-bit (RPi3 and later)"
 	depends on BR2_aarch64
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of

board/arm/README.md

@@ -4,4 +4,5 @@ Arm 32-bit
 Board Specific Documentation
 ----------------------------
 
+- [Microchip SAMA7G54-EK (32-bit)](microchip-sama7g54-ek/)
 - [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)

board/arm/linux_defconfig

@@ -1,20 +1,19 @@
 CONFIG_SYSVIPC=y
 CONFIG_POSIX_MQUEUE=y
-CONFIG_AUDIT=y
 CONFIG_NO_HZ_IDLE=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_BPF_SYSCALL=y
 CONFIG_BPF_JIT=y
-CONFIG_PREEMPT=y
 CONFIG_BSD_PROCESS_ACCT=y
 CONFIG_BSD_PROCESS_ACCT_V3=y
 CONFIG_TASKSTATS=y
 CONFIG_TASK_DELAY_ACCT=y
 CONFIG_TASK_XACCT=y
 CONFIG_TASK_IO_ACCOUNTING=y
+# CONFIG_CPU_ISOLATION is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=18
+CONFIG_LOG_BUF_SHIFT=16
 CONFIG_MEMCG=y
 CONFIG_BLK_CGROUP=y
 CONFIG_CFS_BANDWIDTH=y
@@ -31,19 +30,15 @@ CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
-CONFIG_ARCH_MULTI_V6=y
+# CONFIG_ARM_ERRATA_643719 is not set
-CONFIG_ARCH_VIRT=y
-CONFIG_ARCH_BCM=y
-CONFIG_ARCH_BCM2835=y
 CONFIG_SMP=y
 CONFIG_CPU_FREQ=y
-CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
 CONFIG_CPU_FREQ_GOV_POWERSAVE=y
 CONFIG_CPU_FREQ_GOV_USERSPACE=y
 CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y
 CONFIG_CPUFREQ_DT=y
-CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
 CONFIG_VFP=y
 CONFIG_NEON=y
 CONFIG_KERNEL_MODE_NEON=y
@@ -55,7 +50,11 @@ CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
 CONFIG_PARTITION_ADVANCED=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+CONFIG_ZSWAP=y
+CONFIG_ZSWAP_DEFAULT_ON=y
+CONFIG_ZSWAP_SHRINKER_DEFAULT_ON=y
 # CONFIG_COMPAT_BRK is not set
+# CONFIG_BALLOON_COMPACTION is not set
 CONFIG_KSM=y
 CONFIG_CMA=y
 CONFIG_NET=y
@@ -259,7 +258,6 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 CONFIG_DEVTMPFS_MOUNT=y
 # CONFIG_STANDALONE is not set
-CONFIG_RASPBERRYPI_FIRMWARE=y
 CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_OF_OVERLAY=y
@@ -301,63 +299,29 @@ CONFIG_VETH=m
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
-CONFIG_BCMGENET=y
-CONFIG_SMSC911X=y
-CONFIG_USB_LAN78XX=y
 CONFIG_USB_USBNET=y
-CONFIG_USB_NET_SMSC95XX=y
-CONFIG_INPUT_MOUSEDEV=m
 CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_TOUCHSCREEN_EDT_FT5X06=m
 # CONFIG_LEGACY_PTYS is not set
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_8250_BCM2835AUX=y
-CONFIG_SERIAL_AMBA_PL011=y
-CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
 CONFIG_SERIAL_DEV_BUS=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_I2C_CHARDEV=y
-CONFIG_I2C_BCM2835=m
 CONFIG_SPI=y
-CONFIG_SPI_BCM2835=y
-CONFIG_SPI_BCM2835AUX=y
-CONFIG_SENSORS_RASPBERRYPI_HWMON=m
 CONFIG_THERMAL=y
-CONFIG_BCM2711_THERMAL=y
-CONFIG_BCM2835_THERMAL=m
 CONFIG_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
-CONFIG_BCM2835_WDT=y
 CONFIG_MFD_SYSCON=y
 CONFIG_REGULATOR=y
 CONFIG_REGULATOR_FIXED_VOLTAGE=y
-CONFIG_REGULATOR_GPIO=y
 CONFIG_MEDIA_SUPPORT=y
-CONFIG_DRM=y
-CONFIG_DRM_LOAD_EDID_FIRMWARE=y
-CONFIG_DRM_SIMPLEDRM=y
-CONFIG_DRM_PANEL_SIMPLE=m
-CONFIG_DRM_TOSHIBA_TC358762=m
-CONFIG_DRM_V3D=m
-CONFIG_DRM_VC4=m
-CONFIG_DRM_VC4_HDMI_CEC=y
-CONFIG_FB=y
-CONFIG_BACKLIGHT_CLASS_DEVICE=y
-CONFIG_SOUND=y
-CONFIG_SND=y
-CONFIG_SND_SOC=y
-CONFIG_SND_BCM2835_SOC_I2S=y
-CONFIG_HID_GENERIC=m
 CONFIG_USB=y
 CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
 CONFIG_USB_OTG=y
+CONFIG_USB_EHCI_HCD=m
+CONFIG_USB_EHCI_ROOT_HUB_TT=y
+CONFIG_USB_EHCI_HCD_PLATFORM=m
+CONFIG_USB_OHCI_HCD=m
+CONFIG_USB_OHCI_HCD_PLATFORM=m
 CONFIG_USB_STORAGE=y
-CONFIG_USB_DWC2=y
-CONFIG_NOP_USB_XCEIV=y
 CONFIG_USB_GADGET=y
 CONFIG_USB_ETH=m
 CONFIG_USB_ETH_EEM=y
@@ -365,8 +329,6 @@ CONFIG_USB_G_SERIAL=m
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
 CONFIG_MMC_SDHCI_PLTFM=y
-CONFIG_MMC_SDHCI_IPROC=y
-CONFIG_MMC_BCM2835=y
 CONFIG_NEW_LEDS=y
 CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_GPIO=y
@@ -380,20 +342,13 @@ CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
 CONFIG_LEDS_TRIGGER_TRANSIENT=y
 CONFIG_LEDS_TRIGGER_CAMERA=y
 CONFIG_DMADEVICES=y
-CONFIG_DMA_BCM2835=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
-CONFIG_STAGING=y
-CONFIG_SND_BCM2835=m
-CONFIG_CLK_RASPBERRYPI=y
 CONFIG_MAILBOX=y
-CONFIG_BCM2835_MBOX=y
 # CONFIG_IOMMU_SUPPORT is not set
-CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
-CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
@@ -426,18 +381,13 @@ CONFIG_DMA_CMA=y
 CONFIG_CMA_SIZE_MBYTES=32
 CONFIG_PRINTK_TIME=y
 CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
-CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC=y
 CONFIG_HARDLOCKUP_DETECTOR=y
 CONFIG_BOOTPARAM_HARDLOCKUP_PANIC=y
-CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
 CONFIG_WQ_WATCHDOG=y
-CONFIG_WQ_CPU_INTENSIVE_REPORT=y
 CONFIG_TEST_LOCKUP=m
-# CONFIG_RCU_TRACE is not set
 CONFIG_FUNCTION_TRACER=y
-CONFIG_MEMTEST=y
+# CONFIG_RUNTIME_TESTING_MENU is not set

board/arm/microchip-sama7g54-ek/dts/microchip/at91-sama7g5ek.dts

@@ -16,3 +16,28 @@
 &thermal_sensor {
 	status = "disabled";
 };
+
+/*
+ * Enable SDMMC high speed mode, please note that neither 'mmc-ddr-1_8v'
+ * or 'mmc-hs200-1_8v' work, even though [1] states they are supported,
+ * the errata [2] tells a different story: "Using mode SDR104, HS200 or
+ * HS400 may lead to tuning issues, data read errors or clock switching
+ * failures." — empirical testing has proved this on a rev 5 board.
+ *
+ * [1]: https://github.com/linux4sam/linux-at91/commit/5b35500
+ * [2]: https://ww1.microchip.com/downloads/en/DeviceDoc/SAMA7G5-Series-Silicon-Errata-and-Data-Sheet-Clarification-DS80001016A.pdf
+ */
+&sdmmc0 {
+	/delete-property/ sdhci-caps-mask;
+	cap-mmc-highspeed;
+	cap-mmc-hw-reset;
+};
+
+&sdmmc1 {
+	/delete-property/ no-1-8-v;
+	/delete-property/ sdhci-caps-mask;
+};
+
+&sdmmc2 {
+	/delete-property/ sdhci-caps-mask;
+};

board/arm/microchip-sama7g54-ek/rootfs/etc/rauc/system.conf

@@ -1,12 +0,0 @@
-[system]
-compatible=infix-sama7g54-ek
-bootloader=uboot
-statusfile=/mnt/aux/rauc.status
-
-[slot.rootfs.0]
-device=/dev/disk/by-partlabel/primary
-bootname=primary
-
-[slot.rootfs.1]
-device=/dev/disk/by-partlabel/secondary
-bootname=secondary

board/arm/microchip-sama7g54-ek/uboot/extras.config

@@ -1,6 +1,8 @@
 # Common U-Boot extras for SAMA7G54-EK
 CONFIG_EFI_PARTITION=y
 CONFIG_ENV_IMPORT_FDT=y
+# CONFIG_ENV_IS_IN_FAT is not set
+CONFIG_ENV_IS_NOWHERE=y
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_RSA=y

board/arm/raspberrypi-rpi2/Config.in

@@ -2,9 +2,6 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
 	depends on BR2_arm
 	select SDCARD_AUX
-	select BR2_PACKAGE_FEATURE_WIFI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
-	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.

board/arm/raspberrypi-rpi2/raspberrypi-rpi2.mk

@@ -1,13 +1,19 @@
 # Raspberry Pi 2 Model B specific kernel configuration
 define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835_SOC_I2S,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
 	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
 	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
 
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
@@ -15,46 +21,58 @@ define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_RASPBERRYPI_CPUFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_BCM2835)
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SPI_BCM2835AUX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_RASPBERRYPI_HWMON,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,y)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_SET_OPT,CONFIG_MMC_SDHCI_IPROC,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_AMBA_PL011_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,y)
 	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_USBNET)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_LAN78XX,y)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_SMSC95XX,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_SIMPLEDRM,y)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
-	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
-	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
 	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
 
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
-
-	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
-
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC2)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NOP_USB_XCEIV)
 endef
 
 $(eval $(ix-board))

board/arm/rootfs/etc/rauc/system.conf

@@ -0,0 +1,28 @@
+[system]
+compatible=infix-arm
+bootloader=uboot
+statusfile=/mnt/aux/rauc.status
+mountprefix=/var/lib/rauc/mnt
+bundle-formats=-plain
+max-bundle-download-size=1073741824
+
+[log.event-log]
+filename=/var/log/upgrade-json.log
+format=json-pretty
+max-size=1M
+max-files=5
+
+[keyring]
+directory=/etc/rauc/keys
+
+[slot.rootfs.0]
+device=/dev/disk/by-partlabel/primary
+bootname=primary
+
+[slot.rootfs.1]
+device=/dev/disk/by-partlabel/secondary
+bootname=secondary
+
+[slot.net.0]
+device=/dev/ram0
+bootname=net

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.1
+# Busybox version: 1.37.0
-# Sun Feb  9 12:25:37 2025
+# Mon Feb  9 07:51:08 2026
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -17,6 +17,7 @@ CONFIG_SHOW_USAGE=y
 CONFIG_FEATURE_VERBOSE_USAGE=y
 # CONFIG_FEATURE_COMPRESS_USAGE is not set
 CONFIG_LFS=y
+CONFIG_TIME64=y
 CONFIG_PAM=y
 CONFIG_FEATURE_DEVPTS=y
 CONFIG_FEATURE_UTMP=y
@@ -469,6 +470,7 @@ CONFIG_FEATURE_FIND_NEWER=y
 CONFIG_FEATURE_FIND_SAMEFILE=y
 CONFIG_FEATURE_FIND_EXEC=y
 CONFIG_FEATURE_FIND_EXEC_PLUS=y
+CONFIG_FEATURE_FIND_EXEC_OK=y
 CONFIG_FEATURE_FIND_USER=y
 CONFIG_FEATURE_FIND_GROUP=y
 CONFIG_FEATURE_FIND_NOT=y
@@ -795,6 +797,7 @@ CONFIG_FLASH_ERASEALL=y
 CONFIG_FLASH_LOCK=y
 CONFIG_FLASH_UNLOCK=y
 CONFIG_FLASHCP=y
+CONFIG_GETFATTR=y
 CONFIG_HDPARM=y
 CONFIG_FEATURE_HDPARM_GET_IDENTITY=y
 # CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
@@ -933,6 +936,7 @@ CONFIG_IPRULE=y
 CONFIG_IPNEIGH=y
 CONFIG_FEATURE_IP_ADDRESS=y
 CONFIG_FEATURE_IP_LINK=y
+CONFIG_FEATURE_IP_LINK_CAN=y
 CONFIG_FEATURE_IP_ROUTE=y
 CONFIG_FEATURE_IP_ROUTE_DIR="/etc/iproute2"
 CONFIG_FEATURE_IP_TUNNEL=y
@@ -1007,6 +1011,7 @@ CONFIG_FEATURE_WGET_HTTPS=y
 CONFIG_WHOIS=y
 CONFIG_ZCIP=y
 CONFIG_UDHCPD=y
+CONFIG_FEATURE_UDHCPD_BOOTP=y
 CONFIG_FEATURE_UDHCPD_BASE_IP_ON_MAC=y
 CONFIG_FEATURE_UDHCPD_WRITE_LEASES_EARLY=y
 CONFIG_DHCPD_LEASES_FILE="/var/lib/misc/udhcpd.leases"
@@ -1016,7 +1021,12 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
+CONFIG_UDHCPC6_DEFAULT_SCRIPT=""
 # CONFIG_UDHCPC6 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC3646 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4704 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC4833 is not set
+# CONFIG_FEATURE_UDHCPC6_RFC5970 is not set
 
 #
 # Common options for DHCP applets
@@ -1027,7 +1037,7 @@ CONFIG_UDHCP_DEBUG=0
 CONFIG_UDHCPC_SLACK_FOR_BUGGY_SERVERS=80
 CONFIG_FEATURE_UDHCP_RFC3397=y
 CONFIG_FEATURE_UDHCP_8021Q=y
-CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS="-b -R -n -O search"
+CONFIG_IFUPDOWN_UDHCPC_CMD_OPTIONS=""
 
 #
 # Print Utilities
@@ -1132,7 +1142,7 @@ CONFIG_SH_IS_ASH=y
 CONFIG_BASH_IS_NONE=y
 CONFIG_SHELL_ASH=y
 CONFIG_ASH=y
-CONFIG_ASH_OPTIMIZE_FOR_SIZE=y
+# CONFIG_ASH_OPTIMIZE_FOR_SIZE is not set
 CONFIG_ASH_INTERNAL_GLOB=y
 CONFIG_ASH_BASH_COMPAT=y
 # CONFIG_ASH_BASH_SOURCE_CURDIR is not set
@@ -1146,7 +1156,6 @@ CONFIG_ASH_IDLE_TIMEOUT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
-CONFIG_ASH_SLEEP=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
@@ -1197,7 +1206,7 @@ CONFIG_FEATURE_SH_MATH_64=y
 CONFIG_FEATURE_SH_MATH_BASE=y
 CONFIG_FEATURE_SH_EXTRA_QUIET=y
 # CONFIG_FEATURE_SH_STANDALONE is not set
-# CONFIG_FEATURE_SH_NOFORK is not set
+CONFIG_FEATURE_SH_NOFORK=y
 CONFIG_FEATURE_SH_READ_FRAC=y
 # CONFIG_FEATURE_SH_HISTFILESIZE is not set
 CONFIG_FEATURE_SH_EMBEDDED_SCRIPTS=y

board/common/post-build.sh

@@ -44,6 +44,10 @@ if [ -n "${ID_LIKE}" ]; then
     ID="${ID} ${ID_LIKE}"
 fi
 
+# Initialize default hostname for hostname.d pattern
+mkdir -p "$TARGET_DIR/etc/hostname.d"
+cp "$TARGET_DIR/etc/hostname" "$TARGET_DIR/etc/hostname.d/10-default"
+
 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
 ixmsg "Creating /etc/os-release"

board/common/rootfs/etc/finit.d/10-infix.conf

@@ -1,3 +1,3 @@
-task name:ixinit log:tag:ixinit [S] <pid/syslogd> \
+task name:ixinit [S] <pid/syslogd> \
 	/usr/libexec/finit/runparts -bp /usr/libexec/infix/init.d \
 	-- Probing system

board/common/rootfs/etc/finit.d/available/mkcert.conf

@@ -1 +0,0 @@
-task [S] <service/confd/ready> /usr/libexec/infix/mkcert -- Verifying self-signed https certificate

board/common/rootfs/etc/finit.d/available/netconf.conf

@@ -1,3 +1,3 @@
-service name:netopeer notify:none log env:/etc/default/confd \
+service name:netopeer notify:none log:null env:/etc/default/confd      \
-	[12345] <pid/confd> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
+	[12345] <pid/confd,usr/bootstrap> netopeer2-server -F -t $CONFD_TIMEOUT -v 1 \
 	-- NETCONF server

board/common/rootfs/etc/finit.d/available/restconf.conf

@@ -1,3 +1,3 @@
-service name:rousette notify:none log:null <pid/confd> env:/etc/default/confd \
+service <!pid/confd,usr/bootstrap> notify:none log:null env:/etc/default/confd \
-	[12345] rousette --syslog -t $CONFD_TIMEOUT \
+	[12345] rousette --syslog --log-level info -t $CONFD_TIMEOUT           \
 	-- RESTCONF server

board/common/rootfs/etc/finit.d/dbus.conf

@@ -1,5 +1,5 @@
 # Override Finit plugin
 service cgroup.system name:dbus notify:none pid:!/run/messagebus.pid \
-	[S123456789] <pid/syslogd> /usr/bin/dbus-daemon --nofork --system --syslog-only \
+	[S123456789] <usr/bootstrap> /usr/bin/dbus-daemon --nofork --system --syslog-only \
 	-- D-Bus message bus daemon
 

board/common/rootfs/etc/finit.d/enabled/mkcert.conf

@@ -1 +0,0 @@
-../available/mkcert.conf

board/common/rootfs/usr/libexec/infix/hostname

@@ -10,49 +10,43 @@
 
 HOSTNAME_D="/etc/hostname.d"
 
-# Ensure directory exists
+# Find highest priority file (reverse lexicographic)
-mkdir -p "$HOSTNAME_D"
+set -- "$HOSTNAME_D"/*
-
+if [ ! -e "$1" ]; then
-# Find the highest priority file (reverse sort, take first)
-hostname_file=$(ls -1 "$HOSTNAME_D" 2>/dev/null | sort -r | head -1)
-
-if [ -z "$hostname_file" ]; then
     logger -it confd "No hostname sources found in $HOSTNAME_D"
     exit 1
 fi
 
-# Read hostname from the file (first line only, strip whitespace)
+file=$(printf '%s\n' "$@" | sort -r | head -n1)
-new_hostname=$(cat "$HOSTNAME_D/$hostname_file" | head -1 | tr -d '\n\r\t ')
+IFS= read -r new < "$file"
-if [ -z "$new_hostname" ]; then
+new=$(printf '%s' "$new" | tr -d '\r\n\t ')
-    logger -it confd "Empty hostname in $hostname_file"
+if [ -z "$new" ]; then
+    logger -it confd "Empty hostname in $file"
     exit 1
 fi
 
-if [ ${#new_hostname} -gt 64 ]; then
+if [ ${#new} -gt 64 ]; then
-    logger -it confd "Hostname too long (${#new_hostname} > 64) in $hostname_file"
+    logger -it confd "Hostname too long (${#new} > 64) in $file"
     exit 1
 fi
 
 # Check if hostname has actually changed
-current_hostname=$(hostname)
+if [ "$new" = "$(hostname)" ]; then
-if [ "$new_hostname" = "$current_hostname" ]; then
     # No change needed, exit silently
     exit 0
 fi
 
 # Set the hostname
-logger -it confd "Setting hostname to '$new_hostname' from $hostname_file"
+if hostname "$new"; then
-hostname "$new_hostname"
+    echo "$new" > /etc/hostname
-
+fi
-# Update /etc/hostname (for persistence across reboots)
-echo "$new_hostname" > /etc/hostname
 
 # Update /etc/hosts (127.0.1.1 entry for proper name resolution)
 if grep -q "^127\.0\.1\.1" /etc/hosts; then
-    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new_hostname/" /etc/hosts
+    sed -i -E "s/^(127\.0\.1\.1\s+).*/\1$new/" /etc/hosts
 else
     # Add entry if it doesn't exist
-    echo "127.0.1.1	$new_hostname" >> /etc/hosts
+    echo "127.0.1.1	$new" >> /etc/hosts
 fi
 
 # Notify services of hostname change, skip while in bootstrap
@@ -63,7 +57,6 @@ fi
 
 initctl -bq status lldpd && lldpcli configure system hostname "$new_hostname" 2>/dev/null
 initctl -bq touch mdns-alias 2>/dev/null
-initctl -bq touch netbrowse  2>/dev/null
 
 # If called from dhcp script we need to reload to activate new name in syslogd
 # Otherwise we're called from confd, which does the reload when all is done.

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -521,6 +521,52 @@ def probe_dtsystem(out):
     return 0
 
 
+def probe_wifi_radios(out):
+    """Probe wifi radios via sysfs/iw and store in output dict."""
+    # feature-wifi is the only Buildroot package that enables CONFIG_MAC80211/
+    # CONFIG_CFG80211, so this directory exists iff WiFi support is built in.
+    # feature-wifi also selects BR2_PACKAGE_IW, so iw(8) is always available
+    # when this directory exists -- no separate iw check needed.
+    ieee80211 = "/sys/class/ieee80211"
+    if not os.path.exists(ieee80211):
+        return
+
+    radios = sorted(os.listdir(ieee80211))
+    if not radios:
+        return
+
+    out["wifi-radios"] = []
+    for phy in radios:
+        info = {"name": phy, "bands": []}
+        try:
+            result = subprocess.run(
+                ["iw", "phy", phy, "info"],
+                capture_output=True, text=True, timeout=5
+            )
+            if result.returncode != 0:
+                continue
+        except Exception:
+            continue
+
+        freqs = []
+        for line in result.stdout.splitlines():
+            stripped = line.strip()
+            if stripped.startswith("* ") and "MHz" in stripped:
+                try:
+                    freqs.append(int(float(stripped.split()[1])))
+                except (ValueError, IndexError):
+                    pass
+
+        if any(2400 <= f <= 2500 for f in freqs):
+            info["bands"].append({"name": "2.4GHz"})
+        if any(5150 <= f <= 5900 for f in freqs):
+            info["bands"].append({"name": "5GHz"})
+        if any(5955 <= f <= 7115 for f in freqs):
+            info["bands"].append({"name": "6GHz"})
+
+        out["wifi-radios"].append(info)
+
+
 def main():
     out = {
         "vendor": None,
@@ -546,6 +592,8 @@ def main():
     if err:
         return err
 
+    probe_wifi_radios(out)
+
     if not out["factory-password-hash"]:
         sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
                          "NO FACTORY PASSWORD FOUND\033[0m\n\n")

board/common/rootfs/usr/libexec/infix/init.d/05-hostname

@@ -1,18 +0,0 @@
-#!/bin/sh
-# Initialize default hostname for hostname.d pattern
-# This runs very early in boot to set up the default hostname entry
-
-HOSTNAME_D="/etc/hostname.d"
-
-# Ensure directory exists
-mkdir -p "$HOSTNAME_D"
-
-# If no default exists yet, create it from /etc/hostname (from squashfs)
-if [ ! -f "$HOSTNAME_D/10-default" ] && [ -f /etc/hostname ]; then
-    cp /etc/hostname "$HOSTNAME_D/10-default"
-fi
-
-# Apply hostname using the deterministic helper
-if [ -x /usr/libexec/infix/hostname ]; then
-    /usr/libexec/infix/hostname
-fi

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -1,20 +0,0 @@
-#!/bin/sh
-# Check if /cfg/startup-config.cfg needs to be migrated to new syntax.
-# Backup of the original is created in /cfg/backup/ for old versions,
-# the migrate tool inserts old version in name before .cfg extension.
-CONFIG_FILE="/cfg/startup-config.cfg"
-BACKUP_FILE="/cfg/backup/startup-config.cfg"
-BACKUP_DIR="$(dirname "$BACKUP_FILE")"
-
-mkdir -p         "$BACKUP_DIR"
-chown root:wheel "$BACKUP_DIR"
-chmod 0770       "$BACKUP_DIR"
-
-if [ ! -f "$CONFIG_FILE" ]; then
-    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
-    exit 0
-elif migrate -cq "$CONFIG_FILE"; then
-    exit 0
-fi
-
-migrate -i -b "$BACKUP_FILE" "$CONFIG_FILE"

board/common/rootfs/usr/libexec/infix/mkcert

@@ -1,7 +1,12 @@
 #!/bin/sh
+# Generate a self-signed TLS certificate.  Called from confd keystore
+# on first boot (or factory reset) when the gencert entry has empty
+# keys.  Output is written to a temporary directory that confd reads
+# and then removes after importing into the keystore.
 
-KEY=/cfg/ssl/private/self-signed.key
+TMPDIR=/tmp/ssl
-CRT=/cfg/ssl/certs/self-signed.crt
+KEY=$TMPDIR/self-signed.key
+CRT=$TMPDIR/self-signed.crt
 
 country=US
 state=California
@@ -20,23 +25,11 @@ if [ -z "$cn" ]; then
     fi
 fi
 
-generate()
+mkdir -p "$TMPDIR"
-{
+chmod 700 "$TMPDIR"
-    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
-    chmod 700 /cfg/ssl/private
 
-    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
-	    --organisation-unit "$unit" --common-name "$cn" \
+	--organisation-unit "$unit" --common-name "$cn" \
-	    --out-certificate $CRT --out-key $KEY
+	--out-certificate "$CRT" --out-key "$KEY"
-}
 
-CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
+exit $?
-if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
-    generate "$cn"
-fi
-
-cp "${KEY}" "/etc/ssl/private/"
-cp "${CRT}" "/etc/ssl/certs/"
-initctl cond set mkcert
-
-exit 0

configs/aarch64_defconfig

@@ -146,8 +146,11 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://www.kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_GPS=y
+BR2_PACKAGE_FEATURE_WIFI=y
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
+BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_NETD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y

configs/sama7g54_ek_emmc_boot_defconfig

@@ -20,9 +20,8 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5ekemmc_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/emmc-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y

configs/sama7g54_ek_sd_boot_defconfig

@@ -20,9 +20,8 @@ BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL=y
 BR2_TARGET_AT91BOOTSTRAP3_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,at91bootstrap,v4.0.9)/at91bootstrap-v4.0.9.tar.gz"
 BR2_TARGET_AT91BOOTSTRAP3_DEFCONFIG="sama7g5eksd_uboot"
 BR2_TARGET_UBOOT=y
-BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
-BR2_TARGET_UBOOT_CUSTOM_TARBALL=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
-BR2_TARGET_UBOOT_CUSTOM_TARBALL_LOCATION="$(call github,linux4sam,u-boot-at91,linux4microchip-2025.04)/u-boot-at91-linux4microchip-2025.04.tar.gz"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="sama7g5ek_mmc1"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/arm/microchip-sama7g54-ek/uboot/sd-extras.config"
 BR2_TARGET_UBOOT_NEEDS_DTC=y

doc/ChangeLog.md

@@ -31,11 +31,24 @@ All notable changes to the project are documented in this file.
   - `no ssh known-hosts <host>` — remove a stale or changed host key entry
 - Add OSPF point-to-multipoint (P2MP) and hybrid interface type support.  This
   also includes support for setting static neighbors, issue #1426
+- Add support for user-configurable HTTPS certificate: select any certificate
+  stored in the keystore via `services web certificate <name>`.  The default
+  auto-generated self-signed certificate is now stored in the keystore rather
+  than in `/cfg/ssl` and existing certificates are auto-migrated on upgrade
 
 ### Fixes
 
+- Fix #892: suppress rousette RESTCONF server warnings from syslog
+- Fix #1387: `infix.local` now resolves to exactly one device per LAN.  Previously
+  all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi
+  to append `#2`, `#3` suffixes to the shared alias on busy networks.  Assignment
+  is now first-come-first-served using standard mDNS conflict resolution
+- Fix #1416: `show firewall` command show an error when the firewall is disabled
+- Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
+  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
 - Fix #1438: default route from DHCP client not set at boot, regression
   introduced in v26.02.0
+- Fix #1446: suppress netopeer2-server NETCONF server warnings from syslog
 - Fix DHCP client not sending hostname to server (e.g. for `dnsmasq` lease
   registration).  All board factory configs had the hostname option without
   `value: auto`, so `udhcpc` only requested the option instead of sending it.
@@ -46,13 +59,6 @@ All notable changes to the project are documented in this file.
   options 3 (router) and 6 (dns-server) on every DHCP transaction.  Add
   `dhcp-authoritative` so clients with unexpired leases are not NAKed after
   a router crash or factory reset that clears the lease database
-- Fix #1387: `infix.local` now resolves to exactly one device per LAN.  Previously
-  all Infix devices claimed both `hostname.local` and `infix.local`, causing avahi
-  to append `#2`, `#3` suffixes to the shared alias on busy networks.  Assignment
-  is now first-come-first-served using standard mDNS conflict resolution
-- Fix #1416: `show firewall` command show an error when the firewall is disabled
-- Fix regression in MVEBU SafeXcel Crypto Engine for Marvell Armada SOCs (37xx,
-  7k, 8k, and CN913x series).  Firmware package lost in v26.01.0
 
 [BPI-R64]: https://docs.banana-pi.org/en/BPI-R64/BananaPi_BPI-R64
 [RPI-400]: https://www.raspberrypi.com/products/raspberry-pi-400/

doc/branding.md

@@ -59,6 +59,8 @@ them:
   XPath: `/ietf-system:system/authentication/user/password`
 - **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
   XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+- **Default HTTPS certificate:** `gencert` (self-signed, regenerated at factory reset)
+  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='gencert']`
 - **Hostname format specifiers:**  
   XPath: `/ietf-system:system/hostname`
    - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
@@ -219,8 +221,12 @@ Notice how both the public and private keys are left empty here, this
 cause them to be always automatically regenerated after each factory reset.
 Keeping the `factory-config` snippet like this means we can use the same
 file on multiple devices, without risking them sharing the same host
-keys.  Sometimes you may want the same host keys, but that is the easy
+keys or TLS certificates.  Sometimes you may want the same keys, but
-use-case and not documented here.
+that is the easy use-case and not documented here.
+
+The `genkey` entry is the default SSH host key, and `gencert` is the
+default self-signed HTTPS certificate used by the web server (nginx).
+Both are regenerated on factory reset when their keys are empty.
 
 ```json
   "ietf-keystore:keystore": {
@@ -233,6 +239,18 @@ use-case and not documented here.
           "private-key-format": "ietf-crypto-types:rsa-private-key-format",
           "cleartext-private-key": "",
           "certificates": {}
+        },
+        {
+          "name": "gencert",
+          "public-key-format": "infix-crypto-types:x509-public-key-format",
+          "public-key": "",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {
+            "certificate": [
+              { "name": "self-signed", "cert-data": "" }
+            ]
+          }
         }
       ]
     }
@@ -292,9 +310,22 @@ use-case and not documented here.
         "port": 22
       }
     ]
+  },
+  "infix-services:web": {
+    "certificate": "gencert",
+    "enabled": true,
+    "console": { "enabled": true },
+    "netbrowse": { "enabled": true },
+    "restconf": { "enabled": true }
   }
 ```
 
+The `certificate` leaf references an asymmetric key in the keystore
+that has an associated certificate.  The default `gencert` entry uses
+a self-signed certificate.  To use a custom (e.g., CA-signed)
+certificate, create a new keystore entry with
+`x509-public-key-format` and point the web `certificate` leaf to it.
+
 ## Integration
 
 When integrating your software stack with Infix there may be protocols

doc/cli/configure.md

@@ -40,16 +40,14 @@ admin@host:/config/interface/eth0/> up
 admin@host:/config/>
 ```
 
-----
+> **Note**
-
+>
-> **Note:** commands in configure context are automatically generated
+> Commands in configure context are automatically generated from the
-> from the system's YANG models, hence different products likely have a
+> system's YANG models, hence different products likely have a different
-> different set of commands.  However, both the `ietf-interfaces.yang`
+> set of commands.  However, both the `ietf-interfaces.yang` and
-> and `ietf-ip.yang` models, for instance, that provide the networking
+> `ietf-ip.yang` models, for instance, that provide the networking
 > support are common to all systems.
 
-----
-
 ## Set IP Address on an Interface
 
 ```
@@ -74,7 +72,6 @@ interfaces {
 }
 ```
 
-
 ## Saving Changes
 
 Apply the changes (from candidate to `running-config`):
@@ -85,12 +82,12 @@ admin@host:/> show running-config
 ...
 interfaces {
   interface eth0 {
-	type ethernetCsmacd;
+    type ethernetCsmacd;
-	ipv4 {
+    ipv4 {
-	  address 192.168.2.200 {
+      address 192.168.2.200 {
-		prefix-length 24;
+        prefix-length 24;
-	  }
+      }
-	}
+    }
   }
 ...
 ```
@@ -106,12 +103,10 @@ admin@host:/> copy running-config startup-config
 The `startup-config` can also be inspected with the `show` command to
 verify the changes are saved.
 
-----
+> **Important**
-
+>
-> **Note:** all commands need to be spelled out, no short forms are
+> All commands need to be spelled out, no short forms are allowed in the
-> allowed in the CLI.  Use the `TAB` key to make your life easier.
+> CLI.  Use the `TAB` key to make your life easier.
-
-----
 
 ## Changing Hostname
 
@@ -128,12 +123,10 @@ admin@example:/>
 Notice how the hostname in the prompt does not change until the change
 is committed.
 
-----
+> **Note**
-
+>
-> **Note:** critical services like syslog, mDNS, LLDP, and similar that
+> Critical services like syslog, mDNS, LLDP, and similar that advertise
-> advertise the hostname, are restarted when the hostname is changed.
+> the hostname, are restarted when the hostname is changed.
-
-----
 
 ## Changing Password
 
@@ -142,14 +135,14 @@ User management, including passwords, is also a part of `ietf-system`.
 ```
 admin@host:/config/> edit system authentication user admin
 admin@host:/config/system/authentication/user/admin/> change password
-New password: 
+New password:
-Retype password: 
+Retype password:
 admin@host:/config/system/authentication/user/admin/> leave
 ```
 
 The `change password` command starts an interactive dialogue that asks
 for the new password, with a confirmation, and then salts and encrypts
-the password with sha512crypt. 
+the password with sha512crypt.
 
 It is also possible to use the `set password ...` command.  This allows
 setting an already hashed password.  To manually hash a password, use
@@ -157,13 +150,11 @@ the `do password encrypt` command.  This launches the admin-exec command
 to hash, and optionally salt, your password.  This encrypted string can
 then be used with `set password ...`.
 
-----
+> **Tip**
-
+>
-> **Tip:** if you are having trouble thinking of a password, there is
+> If you are having trouble thinking of a password, there is also `do
-> also `do password generate`, which generates random but readable
+> password generate`, which generates random but readable strings using
-> strings using the UNIX command `pwgen`.
+> the UNIX command `pwgen`.
-
-----
 
 ## SSH Authorized Key
 
@@ -185,11 +176,11 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
 admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
 ```
 
-----
+> **Note**
-
+>
-> **Note:** the `ssh-keygen` program already base64 encodes the public
+> The `ssh-keygen` program already base64 encodes the public key data,
-> key data, so there is no need to use the `text-editor` command, `set`
+> so there is no need to use the `text-editor` command, `set` does the
-> does the job.
+> job.
 
 ----
 
@@ -229,13 +220,12 @@ admin@host:/config/> leave
 
 See the bridging example below for more.
 
-----
+> **Tip**
-
+>
-> **Note:** in the CLI you do not have to create the `veth0b` interface.
+> In the CLI you do not have to create the `veth0b` interface.  The
-> The system _infers_ this for you.  When setting up a VETH pair using
+> system _infers_ this for you.  This does not apply when setting up a
-> NETCONF, however, you must include the `veth0b` interface.
+> VETH pair using NETCONF or RESTCONF, then you must submit a complete
-
+> configuration.
-----
 
 ## Creating a Bridge
 
@@ -291,10 +281,8 @@ the VETH pair from the previous example) are now bridged.  Any traffic
 ingressing one port will egress the other.  Only reserved IEEE multicast
 is filtered, except LLDP frames as shown above.
 
-----
+> **Important**
-
+>
-> **Note:** the bridge can be named anything, provided the interface
+> The bridge can be named anything, provided the interface name is not
-> name is not already taken.  However, for any name outside the pattern
+> already taken.  However, for any name outside the pattern `br[0-9]+`,
-> `br[0-9]+`, you have to set the interface type manually to `bridge`.
+> you have to set the interface type manually to `bridge`.
-
-----

doc/cli/introduction.md

@@ -34,13 +34,11 @@ admin@host-12-34-56:/> show                   # Try: Tab or ?
 admin@host-12-34-56:/>                        # Try: Tab or ?
 ```
 
-----
+> **Tip**
-
+>
-> **Note:** even on an empty command line, you can tap the `Tab` or `?` keys.  
+> Even on an empty command line, you can tap the `Tab` or `?` keys.  
 > See [`help keybindings`](keybindings.md) for more tips!
 
-----
-
 ## Key Concepts
 
 The two modes in the CLI are the admin-exec and the configure context.
@@ -78,15 +76,15 @@ and *running* that can be managed and inspected using the `copy`,
 `show`, and `configure` commands.  The traditional names used in the CLI
 for these are listed below:
 
- - `factory-config` the default configuration from factory for the
+- `factory-config` the default configuration from factory for the
-   device, i.e., what the system returns to after a `factory-reset`
+  device, i.e., what the system returns to after a `factory-reset`
- - `startup-config` created from `factory-config` at first boot after
+- `startup-config` created from `factory-config` at first boot after
-   factory reset.  Loaded as the system configuration on each boot
+  factory reset.  Loaded as the system configuration on each boot
- - `running-config` what is actively running on the system.  If no
+- `running-config` what is actively running on the system.  If no
-   changes have been made since boot, it is the same as `startup-config`
+  changes have been made since boot, it is the same as `startup-config`
- - `candidate-config` is created from `running-config` when entering the
+- `candidate-config` is created from `running-config` when entering the
-   configure context.  Any changes made here can be discarded (`abort`,
+  configure context.  Any changes made here can be discarded (`abort`,
-   `rollback`) or committed (`commit`, `leave`) to `running-config`
+  `rollback`) or committed (`commit`, `leave`) to `running-config`
 
 Edit the *running* configuration using the `configure` command.  This
 copies *running* to *candidate*, a temporary datastore, where changes
@@ -131,16 +129,13 @@ In *configure context* the following commands are available:
 | `do command`      | Call admin-exec command: `do show log`                 |
 | `commit`          |                                                        |
 
-
 ## Example Session
 
-----
+> **Tip**
-
+>
 > Remember to use the `TAB` and `?` keys to speed up your navigation.  
 > See [`help keybindings`](keybindings.md) for more tips!
 
-----
-
 In this example we enter configure context to add an IPv4 address to
 interface `eth0`, then we apply the changes using the `leave` command.
 
@@ -151,8 +146,8 @@ save the changes for the next reboot.
 admin@host-12-34-56:/> configure
 admin@host-12-34-56:/config/> edit interface eth0
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
-      address     autoconf bind-ni-name      enabled
+      address     autoconf      bind-ni-name     dhcp 
-	  forwarding  mtu      neighbor
+      enabled     forwarding    mtu              neighbor
 admin@host-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@host-12-34-56:/config/interface/eth0/> show
 type ethernetCsmacd;
@@ -193,10 +188,12 @@ admin@host-12-34-56:/> copy startup-config running-config
 
 Or restart the device, for example if the change to the configuration
 caused you to lose contact with the system (it happens to the best of
-us).  The system will start up from the last "save gave".
+us).  The system will start up from the last "save game".
 
-> **Tip:** when restoring a backup of a configuration, or having manually
+> **Tip:** Restoring Backups
-> edited a config file, you can validate it using system's YANG models,
+>
-> it is *not* applied if validation is successful:
+> When restoring a backup of a configuration, or having manually edited
+> a config file, you can validate it using the system's YANG models, it
+> is *not* applied if validation is successful:
 >
 > `copy /media/backup/old.cfg running-config validate`

doc/cli/keybindings.md

@@ -33,7 +33,7 @@ CLI has several keybindings, most significant first:
 | Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
 | Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |
 
-## What is Meta?
+## What is Meta
 
 The Meta key is called Alt on most modern keyboards.  If you have
 neither, first tap the Esc key instead of holding down Alt/Meta.
@@ -53,4 +53,3 @@ See possible arguments, with brief help text, to a command:
     ...
 
 Type the command, then tap the `?` key.
-

doc/cli/netcalc.md

@@ -18,7 +18,6 @@ A subnet can be entered in two ways:
 An optional `split LEN` can be given as argument, the new length value
 must be bigger than the current prefix length.  See example below.
 
-
 ## Examples
 
 Its most commonly used features are to understand how many addresses an

doc/cli/quick.md

@@ -23,10 +23,8 @@ keybindings are really useful to learn!
 | `help text-editor`  | Help with the built-in text-editor command         |
 | `help keybindings`  | Lists available keybindings & other helpful tricks |
 
-----
+> **Tip:** Online Help
-
+>
-> In `configure` context the `help setting` command shows the YANG
+> In `configure` context the `help <setting>` command shows the YANG
 > description text for each node and container.  To reach the admin
 > exec help from configure context, e.g., `do help text-editor`
-
-----

doc/cli/upgrade.md

@@ -10,7 +10,7 @@ use the `upgrade` command and a URI to a ftp/tftp/sftp or http/https server
 that hosts the file:
 
 ```
-admin@host:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
+admin@example:/> upgrade tftp://192.168.122.1/firmware-x86_64-v23.11.pkg
 installing
   0% Installing
   0% Determining slot states
@@ -31,7 +31,7 @@ installing
  99% Updating slots done.
 100% Installing done.
 Installing `tftp://192.168.122.1/firmware-x86_64-v23.11.pkg` succeeded
-admin@host:/>
+admin@example:/>
 ```
 
 The secondary partition (`rootfs.1`) has now been upgraded and will be used as

doc/keystore.md

@@ -11,6 +11,7 @@ The keystore supports two types of cryptographic keys:
 
 1. **Asymmetric Keys** — public/private key pairs used for:
     - SSH host authentication (RSA keys)
+    - HTTPS/TLS certificates (X.509 keys)
     - WireGuard VPN tunnels (X25519 keys)
 
 2. **Symmetric Keys** — shared secrets used for:
@@ -22,10 +23,11 @@ managed via CLI, NETCONF, or RESTCONF.
 
 ### Supported Formats
 
-| **Asymmetric Key Format**                                | **Use Case**  | **Key Type** |
+| **Asymmetric Key Format**                                | **Use Case**       | **Key Type** |
-|----------------------------------------------------------|---------------|--------------|
+|----------------------------------------------------------|--------------------|--------------|
-| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys | RSA          |
+| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys      | RSA          |
-| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519   |
+| `rsa-private-key-format` / `x509-public-key-format`      | TLS certificates   | RSA + X.509  |
+| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN      | Curve25519   |
 
 | **Symmetric Key Format**        | **Use Case**                          |
 |-----------------------------|-----------------------------------|
@@ -46,6 +48,53 @@ keystore with the name `genkey`.
 See [SSH Management](management.md) for details on generating and importing
 custom SSH host keys.
 
+### TLS Certificates
+
+TLS certificates are used by the web server (nginx) for HTTPS connections.
+The default certificate is a self-signed certificate automatically generated
+on first boot and stored in the keystore with the name `gencert`.  Like SSH
+host keys, the certificate is regenerated on factory reset when its keys are
+empty.
+
+The web server's `certificate` leaf references which keystore entry to use:
+
+```json
+"infix-services:web": {
+    "certificate": "gencert",
+    "enabled": true
+}
+```
+
+To use a custom (e.g., CA-signed) certificate, create a new asymmetric key
+entry with `x509-public-key-format`, populate it with your certificate and
+private key, then point the web `certificate` leaf to it:
+
+```json
+"ietf-keystore:keystore": {
+    "asymmetric-keys": {
+        "asymmetric-key": [
+            {
+                "name": "my-cert",
+                "public-key-format": "infix-crypto-types:x509-public-key-format",
+                "public-key": "<base64-encoded-cert>",
+                "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                "cleartext-private-key": "<base64-encoded-key>",
+                "certificates": {
+                    "certificate": [
+                        { "name": "ca-signed", "cert-data": "<base64-encoded-cert>" }
+                    ]
+                }
+            }
+        ]
+    }
+}
+```
+
+> [!NOTE]
+> The `public-key` and `cert-data` fields contain base64-encoded PEM data
+> with the `-----BEGIN/END-----` markers stripped.  The system reconstructs
+> the PEM files when writing them to disk for nginx.
+
 ### WireGuard Keys
 
 WireGuard uses X25519 elliptic curve cryptography for key exchange.  Each
@@ -116,6 +165,7 @@ wg-psk                       octet-string  zYr83O4Ykj9i1gN+/aaosJxQx...
 <span class="title">Asymmetric Keys</span>
 <span class="header">NAME                         TYPE    PUBLIC KEY                         </span>
 genkey                       rsa     MIIBCgKCAQEAnj0YinjhYDgYbEGuh7...
+gencert                      x509    MIIDXTCCAkWgAwIBAgIJAJC1HiIAZA...
 wg-tunnel                    x25519  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1...
 </code></pre>
 

doc/management.md

@@ -136,6 +136,7 @@ the unit's neighbors, collected via mDNS (see
 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit web</b>
 admin@example:/config/web/> <b>help</b>
+  certificate                       Reference to asymmetric key in central keystore.
   enabled                           Enable or disable on all web services.
   console                           Web console interface.
   netbrowse                         mDNS Network Browser.
@@ -191,6 +192,23 @@ admin@example:/config/web/restconf/> <b>no enabled</b>
 admin@example:/config/web/restconf/>
 </code></pre>
 
+### HTTPS Certificate
+
+The Web server uses a TLS certificate from the central
+[keystore](keystore.md).  By default it uses `gencert`, a self-signed
+certificate that is automatically generated on first boot.
+
+To use a different certificate, e.g., one signed by a CA, first add
+it to the keystore as an asymmetric key with `x509-public-key-format`,
+then point the web `certificate` leaf to it:
+
+<pre class="cli"><code>admin@example:/config/web/> <b>set certificate my-cert</b>
+admin@example:/config/web/>
+</code></pre>
+
+See [Keystore](keystore.md#tls-certificates) for details on managing
+TLS certificates.
+
 ## System Upgrade
 
 See [Upgrade & Boot Order](upgrade.md) for information on upgrading.

doc/test-arch.md

@@ -243,20 +243,59 @@ spanning tree matches the expected one.
 
 Integration to Infix
 --------------------
-When the test environment is started with Qeneth, it doesn't use the 
-base image directly. Instead, it creates a copy and inserts a `test-mode`
-flag into it. During the bootstrap phase, the system checks for the 
-presence of the test-mode flag (file).
 
-If the flag exists, a 'test-config.cfg' file is generated. In the 
+### Test Mode
-following step, the system loads the 'test-config' instead of the
-standard `startup-config` (or `factory-config`). This configuration
-is simple and safe, equivalent to the one used in 'Secure Mode' 
-(also known as 'failure-config').
 
-Additionally, the configuration enables extra RPCs related to system 
+Infix supports a *test mode* that makes devices safe and predictable to
-restart and configuration overrides, allowing tests to be run even on 
+test against.  When active, each boot starts from a known-good
-systems where the factory configuration may potentially create L2 loops. 
+`test-config` (equivalent to the failure/secure config) instead of the
+stored startup or factory configuration.  This prevents any persistent
+configuration from interfering with tests and avoids L2 loops that a
+factory config might create.  It also enables two extra RPCs used by
+Infamy:
+
+- `infix-test:test/reset` — reload the `test-config` into the running
+  datastore (called by `env.attach()` at the start of each test)
+- `infix-test:test/override-startup` — boot from the startup datastore
+  once, instead of the `test-config` (used by tests that verify
+  save-and-reboot behaviour)
+
+Test mode is activated by the presence of an empty file named
+`test-mode` on the device's `aux` partition (`/mnt/aux/test-mode`).
+
+### Test Mode on Virtual Devices
+
+When the test environment is started with Qeneth, the `inject-test-mode`
+script (`test/inject-test-mode`) is run automatically.  It copies the
+base disk image and writes the `test-mode` marker into the `aux`
+partition of that copy, which is then used as the Qeneth backing image.
+
+### Test Mode on Physical Devices
+
+For a physical device, log in as `root` (or `admin`) and create the
+marker file on the `aux` partition, then reboot:
+
+```
+# touch /mnt/aux/test-mode
+# reboot
+```
+
+Alternatively, if you want to prepare the disk image before flashing,
+use the `inject-test-mode` script:
+
+```
+$ test/inject-test-mode -b infix-<board>.img -o infix-<board>-test.img
+```
+
+Flash `infix-<board>-test.img` to the device instead of the plain
+image.  The device will boot into test mode on first power-on.
+
+> [!NOTE]
+> Test mode persists across reboots until the marker file is removed
+> (`rm /mnt/aux/test-mode`).  A device in test mode always starts from
+> the `test-config`, so any configuration changes are lost on reboot
+> unless `startup_override()` is called first (or the marker is removed
+> and a normal startup config is saved).
 
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth

doc/testing.md

@@ -37,7 +37,7 @@ $ make TEST_MODE=host test
 ...
 ```
 
-This typically used when testing on physical hardware. By default the
+This is typically used when testing on physical hardware. By default the
 topology will be sourced from `/etc/infamy.dot`, but this can be
 overwritten by setting the `TOPOLOGY` variable:
 
@@ -46,6 +46,12 @@ $ make TEST_MODE=host TOPOLOGY=~/my-topology.dot test
 ...
 ```
 
+> [!IMPORTANT]
+> Physical devices must be put into *test mode* before running tests.
+> See [Test Mode](test-arch.md#test-mode) in the architecture document
+> for details.  The short version: log in to the device and run
+> `touch /mnt/aux/test-mode && reboot`.
+
 ### `make run` Devices
 
 Some tests only require a single DUT.  These can therefore be run

package/Config.in

@@ -20,6 +20,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/firewall/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/greenpak-programmer/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/ifupdown-ng/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/iito/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/initviz/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/k8s-logger/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/keyack/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/klish-plugin-infix/Config.in"

package/confd/confd.conf

@@ -1,27 +1,11 @@
 #set DEBUG=1
 
-run name:bootstrap log:prio:user.notice norestart <usr/ixinit> \
+# Single daemon handles gen-config, datastore init, config load, and plugins
-	[S] /usr/libexec/confd/bootstrap \
+#  log:prio:daemon.err
-	-- Bootstrapping YANG datastore
+service log:console env:/etc/default/confd           \
-
+	[S12345] <usr/ixinit> confd -f -v warning \
-run name:error :1 log:console norestart if:<run/bootstrap/failure> \
+		-F /etc/factory-config.cfg \
-	[S] /usr/libexec/confd/error --
+		-S /cfg/startup-config.cfg \
-
+		-E /etc/failure-config.cfg \
-service name:confd log:prio:daemon.err <run/bootstrap/success> \
+		-t $CONFD_TIMEOUT \
-	[S12345] sysrepo-plugind -f -p /run/confd.pid -n -v warning \
 	-- Configuration daemon
-
-# Bootstrap system with startup-config
-run name:startup log:prio:user.notice norestart <pid/confd> env:/etc/default/confd \
-	[S] /usr/libexec/confd/load -t $CONFD_TIMEOUT startup-config \
-	-- Loading startup-config
-
-# Run if loading startup-config fails for some reason
-run	name:failure log:prio:user.crit norestart env:/etc/default/confd \
-	if:<run/startup/failure> \
-	[S] <pid/confd> /usr/libexec/confd/load -t $CONFD_TIMEOUT failure-config \
-	-- Loading failure-config
-
-run	name:error :2 log:console norestart \
-	if:<run/failure/failure> \
-	[S] /usr/libexec/confd/error --

package/confd/confd.mk

@@ -4,13 +4,13 @@
 #
 ################################################################################
 
-CONFD_VERSION = 1.7
+CONFD_VERSION = 1.8
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause
 CONFD_LICENSE_FILES = LICENSE
 CONFD_REDISTRIBUTE = NO
-CONFD_DEPENDENCIES = host-sysrepo sysrepo rousette netopeer2 jansson libite sysrepo libsrx libglib2
+CONFD_DEPENDENCIES = host-sysrepo sysrepo rousette netopeer2 jansson libite sysrepo libsrx libglib2 libev
 CONFD_AUTORECONF = YES
 CONFD_CONF_OPTS += --disable-silent-rules --with-crypt=$(BR2_PACKAGE_CONFD_DEFAULT_CRYPT)
 CONFD_SYSREPO_SHM_PREFIX = sr_buildroot$(subst /,_,$(CONFIG_DIR))_confd
@@ -42,7 +42,7 @@ define CONFD_INSTALL_EXTRA
 	done
 	cp $(CONFD_PKGDIR)/tmpfiles.conf $(TARGET_DIR)/etc/tmpfiles.d/confd.conf
 	mkdir -p $(TARGET_DIR)/etc/avahi/services
-	cp $(CONFD_PKGDIR)/avahi.service $(TARGET_DIR)/etc/avahi/services/netconf.service
+	cp $(CONFD_PKGDIR)/netconf.service $(TARGET_DIR)/etc/avahi/services/
 endef
 
 NETOPEER2_SEARCHPATH=$(TARGET_DIR)/usr/share/yang/modules/netopeer2/

package/confd/resolvconf.conf

@@ -1,3 +1,2 @@
-# Create initial /etc/resolv.conf after successful bootstrap, regardless
+# Update /etc/resolv.conf after successful bootstrap and reconf.
-# of startup-config or failure-config.  Condition set by confd.
+task [S12345] <usr/bootstrap,pid/dnsmasq> resolvconf -u --
-task [S12345] <usr/bootstrap> resolvconf -u -- Update DNS configuration

package/finit/0001-Remove-redundant-global-path-var-and-fix-memory-corr.patch

@@ -0,0 +1,54 @@
+From 184c079c08387d1b0f74de25b63c56304d2156d0 Mon Sep 17 00:00:00 2001
+From: bazub <github@zubko.cc>
+Date: Tue, 3 Mar 2026 20:31:33 +0000
+Subject: [PATCH 1/3] Remove redundant global path var and fix memory
+ corruption
+Organization: Wires
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/conf.c | 13 ++-----------
+ 1 file changed, 2 insertions(+), 11 deletions(-)
+
+diff --git a/src/conf.c b/src/conf.c
+index d0abb61d..6e8ec834 100644
+--- a/src/conf.c
++++ b/src/conf.c
+@@ -121,9 +121,6 @@ static uev_t etcw;
+ 
+ static TAILQ_HEAD(, conf_change) conf_change_list = TAILQ_HEAD_INITIALIZER(conf_change_list);
+ 
+-static char *path;
+-static char *shell;
+-
+ static int  parse_conf(char *file, int is_rcsd);
+ static void drop_changes(void);
+ 
+@@ -377,8 +374,6 @@ void conf_parse_cmdline(int argc, char *argv[])
+ 		fstab = strdup(ptr);
+ 	finit_conf = strdup(FINIT_CONF);
+ 	finit_rcsd = strdup(FINIT_RCSD);
+-	path       = getenv("PATH");
+-	shell      = getenv("SHELL");
+ 
+ 	for (int i = 1; i < argc; i++)
+ 		parse_arg(argv[i]);
+@@ -404,13 +399,9 @@ void conf_reset_env(void)
+ 		free(node);
+ 	}
+ 
+-	if (path)
+-		setenv("PATH", path, 1);
+-	else
++	if (!getenv("PATH"))
+ 		setenv("PATH", _PATH_STDPATH, 1);
+-	if (shell)
+-		setenv("SHELL", shell, 1);
+-	else
++	if (!getenv("SHELL"))
+ 		setenv("SHELL", _PATH_BSHELL, 1);
+ 	setenv("LOGNAME", "root", 1);
+ 	setenv("USER", "root", 1);
+-- 
+2.43.0
+

package/finit/0002-Use-explicit-plugin-names-to-prevent-subtle-macro-pr.patch

@@ -0,0 +1,318 @@
+From 662293e194811213b9b387163dfe8499e3300ccf Mon Sep 17 00:00:00 2001
+From: bazub <github@zubko.cc>
+Date: Fri, 6 Mar 2026 20:36:23 +0000
+Subject: [PATCH 2/3] Use explicit plugin names to prevent subtle macro
+ processing bugs
+Organization: Wires
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ plugins/alsa-utils.c   | 6 +++---
+ plugins/bootmisc.c     | 2 +-
+ plugins/dbus.c         | 4 ++--
+ plugins/hook-scripts.c | 2 +-
+ plugins/modprobe.c     | 2 +-
+ plugins/modules-load.c | 2 +-
+ plugins/netlink.c      | 2 +-
+ plugins/pidfile.c      | 2 +-
+ plugins/procps.c       | 4 ++--
+ plugins/resolvconf.c   | 2 +-
+ plugins/rtc.c          | 6 +++---
+ plugins/sys.c          | 2 +-
+ plugins/tty.c          | 1 +
+ plugins/urandom.c      | 6 +++---
+ plugins/usr.c          | 2 +-
+ plugins/x11-common.c   | 4 ++--
+ 16 files changed, 25 insertions(+), 24 deletions(-)
+
+diff --git a/plugins/alsa-utils.c b/plugins/alsa-utils.c
+index 6b2c3603..a8a967b0 100644
+--- a/plugins/alsa-utils.c
++++ b/plugins/alsa-utils.c
+@@ -38,7 +38,7 @@
+ static void save(void *arg)
+ {
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "alsa-utils");
+ 		return;
+ 	}
+ 
+@@ -51,7 +51,7 @@ static void save(void *arg)
+ static void restore(void *arg)
+ {
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "alsa-utils");
+ 		return;
+ 	}
+ 
+@@ -62,7 +62,7 @@ static void restore(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "alsa-utils",
+ 	.hook[HOOK_BASEFS_UP] = { .cb  = restore },
+ 	.hook[HOOK_SHUTDOWN]  = { .cb  = save    }
+ };
+diff --git a/plugins/bootmisc.c b/plugins/bootmisc.c
+index 701f73f0..a8ba3808 100644
+--- a/plugins/bootmisc.c
++++ b/plugins/bootmisc.c
+@@ -172,7 +172,7 @@ static void setup(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "bootmisc",
+ 	.hook[HOOK_MOUNT_POST] = { .cb = clean },
+ 	.hook[HOOK_BASEFS_UP]  = { .cb = setup },
+ 	.depends = { "pidfile" },
+diff --git a/plugins/dbus.c b/plugins/dbus.c
+index bbf55bc2..a8a155a1 100644
+--- a/plugins/dbus.c
++++ b/plugins/dbus.c
+@@ -106,7 +106,7 @@ static void setup(void *arg)
+ 	char *cmd;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "dbus");
+ 		return;
+ 	}
+ 
+@@ -164,7 +164,7 @@ static void setup(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name                  = __FILE__,
++	.name = "dbus",
+ 	.hook[HOOK_SVC_PLUGIN] = { .cb  = setup },
+ };
+ 
+diff --git a/plugins/hook-scripts.c b/plugins/hook-scripts.c
+index 9aa78173..e75808c5 100644
+--- a/plugins/hook-scripts.c
++++ b/plugins/hook-scripts.c
+@@ -79,7 +79,7 @@ static void hscript_shutdown(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "hook-scripts",
+ 	.hook[HOOK_BANNER]      = { .cb  = hscript_banner      },
+ 	.hook[HOOK_ROOTFS_UP]   = { .cb  = hscript_rootfs_up   },
+ 	.hook[HOOK_MOUNT_ERROR] = { .cb  = hscript_mount_error },
+diff --git a/plugins/modprobe.c b/plugins/modprobe.c
+index b6b7e7bb..e52bf228 100644
+--- a/plugins/modprobe.c
++++ b/plugins/modprobe.c
+@@ -228,7 +228,7 @@ static void coldplug(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "modprobe",
+ 	.hook[HOOK_BASEFS_UP] = { .cb  = coldplug },
+ 	.depends = { "bootmisc", }
+ };
+diff --git a/plugins/modules-load.c b/plugins/modules-load.c
+index 53aef82f..e2e45c72 100644
+--- a/plugins/modules-load.c
++++ b/plugins/modules-load.c
+@@ -213,7 +213,7 @@ static void load(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name                  = __FILE__,
++	.name = "modules-load",
+ 	.hook[HOOK_SVC_PLUGIN] = { .cb  = load },
+ };
+ 
+diff --git a/plugins/netlink.c b/plugins/netlink.c
+index a70b01e8..625cbd1b 100644
+--- a/plugins/netlink.c
++++ b/plugins/netlink.c
+@@ -426,7 +426,7 @@ static void nl_enumerate(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "netlink",
+ 	.hook[HOOK_SVC_RECONF]  = { .cb = nl_reconf },
+ 	.hook[HOOK_SVC_PLUGIN]  = { .cb = nl_enumerate },
+ 	.io = {
+diff --git a/plugins/pidfile.c b/plugins/pidfile.c
+index ae0fdeea..f1232ab6 100644
+--- a/plugins/pidfile.c
++++ b/plugins/pidfile.c
+@@ -335,7 +335,7 @@ static void pidfile_init(void *arg)
+  * SIGSTP:ed (in state PAUSED) waiting for <net/iface/lo>.
+  */
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "pidfile",
+ 	.hook[HOOK_BASEFS_UP]  = { .cb = pidfile_init   },
+ 	.hook[HOOK_SVC_RECONF] = { .cb = pidfile_reconf },
+ 	.depends = { "netlink" }, /* bootmisc depends on us */
+diff --git a/plugins/procps.c b/plugins/procps.c
+index 826e38ad..5a178d75 100644
+--- a/plugins/procps.c
++++ b/plugins/procps.c
+@@ -43,7 +43,7 @@ static void setup(void *arg)
+ 	glob_t gl;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "procps");
+ 		return;
+ 	}
+ 
+@@ -69,7 +69,7 @@ static void setup(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "procps",
+ 	.hook[HOOK_BASEFS_UP] = {
+ 		.cb  = setup
+ 	},
+diff --git a/plugins/resolvconf.c b/plugins/resolvconf.c
+index 1ac29dae..b98e9214 100644
+--- a/plugins/resolvconf.c
++++ b/plugins/resolvconf.c
+@@ -51,7 +51,7 @@ static void setup(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "resolvconf",
+ 	.hook[HOOK_BASEFS_UP] = {
+ 		.cb  = setup
+ 	},
+diff --git a/plugins/rtc.c b/plugins/rtc.c
+index faf69415..cf734763 100644
+--- a/plugins/rtc.c
++++ b/plugins/rtc.c
+@@ -236,7 +236,7 @@ static void rtc_save(void *arg)
+ 	int fd, rc = 0;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "rtc");
+ 		return;
+ 	}
+ 
+@@ -266,7 +266,7 @@ static void rtc_restore(void *arg)
+ 	int fd, rc = 0;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "rtc");
+ 		return;
+ 	}
+ 
+@@ -321,7 +321,7 @@ static void update(uev_t *w, void *arg, int events)
+ 
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "rtc",
+ 	.hook[HOOK_BASEFS_UP] = {
+ 		.cb  = rtc_restore
+ 	},
+diff --git a/plugins/sys.c b/plugins/sys.c
+index 438fdfd5..484adc05 100644
+--- a/plugins/sys.c
++++ b/plugins/sys.c
+@@ -180,7 +180,7 @@ static void sys_init(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "sys",
+ 	.hook[HOOK_BASEFS_UP]  = { .cb = sys_init },
+ 	.depends = { "bootmisc", },
+ };
+diff --git a/plugins/tty.c b/plugins/tty.c
+index b3255f9f..c6a750b0 100644
+--- a/plugins/tty.c
++++ b/plugins/tty.c
+@@ -43,6 +43,7 @@
+ static void tty_watcher(void *arg, int fd, int events);
+ 
+ static plugin_t plugin = {
++	.name = "tty",
+ 	.io = {
+ 		.cb    = tty_watcher,
+ 		.flags = PLUGIN_IO_READ,
+diff --git a/plugins/urandom.c b/plugins/urandom.c
+index 410d0660..9bb6252b 100644
+--- a/plugins/urandom.c
++++ b/plugins/urandom.c
+@@ -87,7 +87,7 @@ static void setup(void *arg)
+ 	int fd, err;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "urandom");
+ 		return;
+ 	}
+ 
+@@ -188,7 +188,7 @@ static void save(void *arg)
+ 	mode_t prev;
+ 
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "urandom");
+ 		return;
+ 	}
+ 
+@@ -202,7 +202,7 @@ static void save(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "urandom",
+ 	.hook[HOOK_BASEFS_UP] = { .cb  = setup },
+ 	.hook[HOOK_SHUTDOWN]  = { .cb  = save  },
+ 	.depends = { "bootmisc", }
+diff --git a/plugins/usr.c b/plugins/usr.c
+index d30d9440..496facc2 100644
+--- a/plugins/usr.c
++++ b/plugins/usr.c
+@@ -104,7 +104,7 @@ static void usr_init(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "usr",
+ 	.hook[HOOK_BASEFS_UP]  = { .cb = usr_init },
+ 	.depends = { "bootmisc", },
+ };
+diff --git a/plugins/x11-common.c b/plugins/x11-common.c
+index f65331a0..75825a36 100644
+--- a/plugins/x11-common.c
++++ b/plugins/x11-common.c
+@@ -39,7 +39,7 @@
+ static void setup(void *arg)
+ {
+ 	if (rescue) {
+-		dbg("Skipping %s plugin in rescue mode.", __FILE__);
++		dbg("Skipping %s plugin in rescue mode.", "x11-common");
+ 		return;
+ 	}
+ 
+@@ -48,7 +48,7 @@ static void setup(void *arg)
+ }
+ 
+ static plugin_t plugin = {
+-	.name = __FILE__,
++	.name = "x11-common",
+ 	.hook[HOOK_SVC_PLUGIN] = { .cb  = setup },
+ };
+ 
+-- 
+2.43.0
+

package/finit/0003-service-clear-condition-before-stopping-rdeps-on-rel.patch

@@ -0,0 +1,66 @@
+From c01faef99b7e4ff9c39f29ad5648db61a4742539 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 19 Mar 2026 06:37:50 +0100
+Subject: [PATCH 3/3] service: clear condition before stopping rdeps on reload
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Organization: Wires
+
+When a service without SIGHUP reload support (noreload) is touched and
+'initctl reload' is called, service_update_rdeps() correctly identifies
+its reverse dependencies but only marks them dirty.  It does not clear
+the service's condition, so when service_step_all() runs:
+
+ - rdeps supporting SIGHUP hit the sm_in_reload() guard and break early,
+   left running while their dependency is being killed.
+ - rdeps without SIGHUP support may receive SIGTERM too late, after the
+   dependency has already died and broken their connection, causing them
+   to exit from RUNNING state and have their restart counter incremented.
+
+Fix by calling cond_clear() on the service's condition immediately in
+service_update_rdeps(), before service_step_all() runs.  cond_clear()
+calls cond_update() which calls service_step() inline on all affected
+services, which see COND_OFF and transition to STOPPING_STATE — all
+before SIGTERM is ever sent to the dependency itself.
+
+This mirrors the pattern already used in api.c:do_reload() for direct
+'initctl reload <svc>' calls.
+
+Fixes: avahi/mdns stop causing mdns-alias restart counter increment
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/service.c | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/src/service.c b/src/service.c
+index b2c6c15b..016b5d2f 100644
+--- a/src/service.c
++++ b/src/service.c
+@@ -2418,7 +2418,21 @@ void service_update_rdeps(void)
+ 		if (!svc_is_noreload(svc))
+ 			continue; /* Yup, no need to stop start rdeps */
+ 
+-		svc_mark_affected(mkcond(svc, cond, sizeof(cond)));
++		/*
++		 * Clear the condition immediately, before service_step_all()
++		 * runs.  cond_clear() calls cond_update() which calls
++		 * service_step() on all affected services right now.  Those
++		 * services see COND_OFF and get service_stop() called,
++		 * transitioning to STOPPING_STATE before we ever send SIGTERM
++		 * to this service.  Without this, the condition is only cleared
++		 * after the service dies, by which time reverse-dependencies
++		 * may have already crashed due to the lost connection.
++		 * See also: api.c do_reload() which does the same for direct
++		 * 'initctl reload <svc>' calls.
++		 */
++		mkcond(svc, cond, sizeof(cond));
++		cond_clear(cond);
++		svc_mark_affected(cond);
+ 	}
+ }
+ 
+-- 
+2.43.0
+

package/initviz/Config.in

@@ -0,0 +1,22 @@
+config BR2_PACKAGE_INITVIZ
+	bool "initviz"
+	depends on BR2_USE_MMU # fork()
+	help
+	  InitViz is a performance analysis and visualization tool for the
+	  boot process and system services.  It consists of the bootchartd
+	  data collection daemon (bootchartd) that runs during boot to
+	  capture system activity, and InitViz the host visualization tool.
+
+	  InitViz is a reimplementation and successor to the bootchart2
+	  project, offering a more feature-rich solution compared to the
+	  bootchartd subset available as a BusyBox applet.
+
+	  To profile the boot process, append the following to the kernel
+	  command line:
+
+	      init=/sbin/bootchartd initcall_debug printk.time=y quiet
+
+	  The collected data can be visualized using the host-initviz
+	  tool, initviz.py, which is currently not built here.
+
+	  https://github.com/finit-project/InitViz

package/initviz/initviz.hash

@@ -0,0 +1,3 @@
+# Locally calculated
+sha256  28a059ca6d3cbc5f65809a18167d089fd0dc2be13cd6c640c56ddae47be01849  initviz-1.0.0-rc1.tar.gz
+sha256  54e1afa760fa3649fa47c7838ac937771e74af695d4cf7d907bc61c107c83dc9  COPYING

package/initviz/initviz.mk

@@ -0,0 +1,26 @@
+################################################################################
+#
+# initviz
+#
+################################################################################
+
+INITVIZ_VERSION = 1.0.0-rc1
+INITVIZ_SITE = https://github.com/finit-project/InitViz/releases/download/$(INITVIZ_VERSION)
+INITVIZ_SOURCE = initviz-$(INITVIZ_VERSION).tar.gz
+INITVIZ_LICENSE = GPL-2.0-or-later
+INITVIZ_LICENSE_FILES = COPYING
+
+# Target package: bootchartd collector daemon
+define INITVIZ_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) \
+		$(MAKE) -C $(@D) collector
+endef
+
+define INITVIZ_INSTALL_TARGET_CMDS
+	$(TARGET_MAKE_ENV) $(MAKE) -C $(@D) \
+		DESTDIR=$(TARGET_DIR) \
+		EARLY_PREFIX= \
+		install-collector
+endef
+
+$(eval $(generic-package))

package/klish/klish.svc

@@ -1 +1 @@
-service <!> log [2345] /usr/bin/klishd -d -- CLI backend daemon
+service <!> log:null [12345] /usr/bin/klishd -d -- CLI backend daemon

package/mdns-alias/mdns-alias.svc

@@ -1,5 +1,5 @@
 # Avahi advertises the system default hostname, this service advertises
 # /etc/hostname (-H) and, optionally, network.local as CNAMEs.  Changes
 # to /etc/default/mdns-alias will cause Finit to restart not reload.
-service <service/mdns/running> env:-/etc/default/mdns-alias \
+service <pid/mdns> env:-/etc/default/mdns-alias \
 	[2345] mdns-alias -H $MDNS_ALIAS_ARGS --

package/rousette/0001-Log-HTTP-headers-and-the-input-data-payload.patch

@@ -1,7 +1,7 @@
-From a4136d889237dadb9253ea7eb668a525dd779e6d Mon Sep 17 00:00:00 2001
+From 65a99da7e857d1f6fd111d0428622563fd895810 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 12 Jun 2025 10:33:42 +0100
-Subject: [PATCH 01/38] Log HTTP headers and the input data payload
+Subject: [PATCH 01/42] Log HTTP headers and the input data payload
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -12,6 +12,7 @@ Hažlinský just found.
 
 Change-Id: I2a930a02c7d30c051390fe73e6af9849edd580b4
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 10 ++++++++--
  1 file changed, 8 insertions(+), 2 deletions(-)

package/rousette/0002-restconf-prevent-throwing-exception-in-withRestconfE.patch

@@ -1,7 +1,7 @@
-From 6c5b482ea5c9fbc1149a0864b05d1bb1fa7100bf Mon Sep 17 00:00:00 2001
+From 729bb0619d7cb14ca3bf97f56d3c6550bd2e75f0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Fri, 13 Jun 2025 10:47:55 +0200
-Subject: [PATCH 02/38] restconf: prevent throwing exception in
+Subject: [PATCH 02/42] restconf: prevent throwing exception in
  withRestconfExceptions wrapper
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -23,6 +23,7 @@ handle such situations.
 Bug: https://github.com/CESNET/rousette/issues/19
 Change-Id: Ifbd74b9bdc0ca66c4e5449a7673ef2f12ae9215e
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp        |  2 +-
  tests/restconf-plain-patch.cpp | 24 ++++++++++++++++++++++++

package/rousette/0003-CI-switch-to-the-new-cloud-s-Swift-URL.patch

@@ -1,7 +1,7 @@
-From 41c9d9cab47a88ee6c70ab8009b789226c0982fe Mon Sep 17 00:00:00 2001
+From f548df0c693ffd1625fbcb843c6f914972315179 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Tue, 17 Jun 2025 12:46:27 +0200
-Subject: [PATCH 03/38] CI: switch to the new cloud's Swift URL
+Subject: [PATCH 03/42] CI: switch to the new cloud's Swift URL
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,6 +9,7 @@ Organization: Wires
 
 Change-Id: I69f8351394262a2a9b691422592741bfb40a8e38
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  ci/build.sh | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

package/rousette/0004-restconf-crash-instead-of-a-deadlock-when-the-handle.patch

@@ -1,7 +1,7 @@
-From ec8673126929b6459fcd99c84a79993a725b40e1 Mon Sep 17 00:00:00 2001
+From 8c441795f1050412fc953518917f3d494edd6be1 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Fri, 13 Jun 2025 10:47:55 +0200
-Subject: [PATCH 04/38] restconf: crash instead of a deadlock when the handler
+Subject: [PATCH 04/42] restconf: crash instead of a deadlock when the handler
  throws
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -38,6 +38,7 @@ Signed-off-by: Jan Kundrát <jan.kundrat@cesnet.cz>
 Bug: https://github.com/CESNET/rousette/issues/19
 Change-Id: I2c090b9a76b062101ba422a7d50e8e699779e203
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 28 ++++++++++++++++++++++++++++
  src/restconf/Server.h   |  4 ++++

package/rousette/0005-doc-let-s-stop-calling-this-an-almost-RESTCONF-serve.patch

@@ -1,7 +1,7 @@
-From 37ca95c387d76c3f296a4e44b211772a1ca155ab Mon Sep 17 00:00:00 2001
+From 130a5f43c3cb06e0a97e8eb580f97a526c8c9d8a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Wed, 18 Jun 2025 12:01:04 +0200
-Subject: [PATCH 05/38] doc: let's stop calling this "an almost-RESTCONF
+Subject: [PATCH 05/42] doc: let's stop calling this "an almost-RESTCONF
  server"
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -10,6 +10,7 @@ Organization: Wires
 
 Change-Id: If55ace481c78d838a811ded76a564f8fb59f9233
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  README.md | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

package/rousette/0006-close-long-lived-connections-on-SIGTERM.patch

@@ -1,7 +1,7 @@
-From 4eae6200aa812950ebbac1660a1899f4edf41e11 Mon Sep 17 00:00:00 2001
+From 7b8c1d90594dbc65eeb0ea767e3a50b92db8aea3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Wed, 7 Aug 2024 19:07:35 +0200
-Subject: [PATCH 06/38] close long-lived connections on SIGTERM
+Subject: [PATCH 06/42] close long-lived connections on SIGTERM
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -24,6 +24,7 @@ hope it is).
 Change-Id: If442134783ba1d699de47c51a9068378f53e8339
 Co-authored-by: Tomas Pecka <tomas.pecka@cesnet.cz>
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                      |  1 +
  src/clock.cpp                       |  7 +--

package/rousette/0007-restconf-refactor-server-stop.patch

@@ -1,7 +1,7 @@
-From ca2894d4888c673d227fc196a25f83ded20e8f04 Mon Sep 17 00:00:00 2001
+From be28d13811e617d9cdb74bd6d27f4c8634fe4d02 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 30 Jun 2025 15:38:02 +0200
-Subject: [PATCH 07/38] restconf: refactor server stop
+Subject: [PATCH 07/42] restconf: refactor server stop
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -21,6 +21,7 @@ does not seem like it should be called from *every* io_service.)
 
 Change-Id: I2f33c38a78dce4081a03326c9a9bb25817fc9d2f
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 13 +++++--------
  1 file changed, 5 insertions(+), 8 deletions(-)

package/rousette/0008-tests-use-std-string-starts_with.patch

@@ -1,7 +1,7 @@
-From 9961430bacdd8dbac64a01b2a2ffb6a4b7e806b6 Mon Sep 17 00:00:00 2001
+From edc6f47fe49d9873f9c7257d66fbf8b362a6c7ac Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 13 May 2025 13:48:35 +0200
-Subject: [PATCH 08/38] tests: use std::string::starts_with
+Subject: [PATCH 08/42] tests: use std::string::starts_with
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -11,6 +11,7 @@ We are C++20, so we can use line, which is more readable.
 
 Change-Id: I40d4038b421f6bc1fcf320f609b50d5ce7018a45
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  tests/restconf_utils.cpp | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

package/rousette/0009-tests-add-SSE-event-watcher-for-comments.patch

@@ -1,7 +1,7 @@
-From 746c0cdfef6808f393be7946630b8acbb0636706 Mon Sep 17 00:00:00 2001
+From 8f6ce5d8efd7e5ce4adb6e188dbec14ad86fa0e8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 22 Jul 2025 17:47:50 +0200
-Subject: [PATCH 09/38] tests: add SSE event watcher for comments
+Subject: [PATCH 09/42] tests: add SSE event watcher for comments
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -12,6 +12,7 @@ which should be ignored, i.e., lines starting with colon.
 
 Change-Id: If54f0af05b4884aab01325f12fd0a6859791b41b
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  tests/event_watchers.cpp |  7 ++++++-
  tests/event_watchers.h   |  4 +++-

package/rousette/0010-http-send-keep-alive-pings-from-EventStream.patch

@@ -1,7 +1,7 @@
-From 5becffe8a1dd47c8836ce1800a1b72acdf86021f Mon Sep 17 00:00:00 2001
+From fc240be374f70b0f006bb83152364678ffdbfa86 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 12 May 2025 14:56:54 +0200
-Subject: [PATCH 10/38] http: send keep-alive pings from EventStream
+Subject: [PATCH 10/42] http: send keep-alive pings from EventStream
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -32,6 +32,7 @@ to the server when the server sends these "keep-alive comments".
 
 Change-Id: I57e510d0b61ac7ed032c582779780c64768b7d53
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/clock.cpp                       |  4 +-
  src/http/EventStream.cpp            | 44 +++++++++++++--

package/rousette/0011-refactor-event-streams-use-named-constructors.patch

@@ -1,7 +1,7 @@
-From ff4ff1c193083feca76d9f0f4485e4b175c373c2 Mon Sep 17 00:00:00 2001
+From 1375ecb15ef534ca2856f46f957686ccc23ab7fc Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Wed, 23 Jul 2025 14:27:26 +0200
-Subject: [PATCH 11/38] refactor: event streams use named constructors
+Subject: [PATCH 11/42] refactor: event streams use named constructors
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -18,6 +18,7 @@ This way, the code is more readable and the intention should be clearer.
 
 Change-Id: Iac96c49c20670dfe924d7c8db33328ed9c2fc9dd
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/clock.cpp                       |  3 +--
  src/http/EventStream.cpp            | 20 ++++++++++++++++++++

package/rousette/0012-refactor-a-better-convention-for-weak_from_this-lock.patch

@@ -1,7 +1,7 @@
-From f4602a03adc9134a9b7a9d338e900b40557da6c4 Mon Sep 17 00:00:00 2001
+From fd0dbd116f249cd8a4d00b677ed2976b19a28b1e Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 7 Aug 2025 12:14:02 +0200
-Subject: [PATCH 12/38] refactor: a better convention for weak_from_this->lock
+Subject: [PATCH 12/42] refactor: a better convention for weak_from_this->lock
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -11,6 +11,7 @@ It is not a "client", so let's stop calling it a "client". My bad.
 
 Change-Id: Id8dc4d92c3ade8d86697366d0102e84bd466f504
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 44 ++++++++++++++++++++--------------------
  1 file changed, 22 insertions(+), 22 deletions(-)

package/rousette/0013-fix-a-possible-bad_weak_ptr-exception.patch

@@ -1,7 +1,7 @@
-From 4e9b535a59861f25c0602eaa1fc39126d7cd9899 Mon Sep 17 00:00:00 2001
+From cb0c00ceba7ac4b225382ffacef919f2573dc5cb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 7 Aug 2025 12:21:54 +0200
-Subject: [PATCH 13/38] fix a possible bad_weak_ptr exception
+Subject: [PATCH 13/42] fix a possible bad_weak_ptr exception
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -10,6 +10,7 @@ Organization: Wires
 Change-Id: I8c7f7a943a1d848f15527988cb76c2a0a10089e6
 Fixes: 4eae6200 (close long-lived connections on SIGTERM)
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

package/rousette/0014-http-add-optional-callbacks-to-EventStream.patch

@@ -1,7 +1,7 @@
-From 6bca750f866b5b14c4d9c3da68e5c8f1e4eee36c Mon Sep 17 00:00:00 2001
+From 91e8e41b5f22629820799b48977a90f57f01f424 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 19 May 2025 12:11:09 +0200
-Subject: [PATCH 14/38] http: add optional callbacks to EventStream
+Subject: [PATCH 14/42] http: add optional callbacks to EventStream
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -15,6 +15,7 @@ disconnects.
 
 Change-Id: Icfc2959e38b812b7c18f45976415209b29151c7b
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 18 +++++++++++++++---
  src/http/EventStream.h   | 10 ++++++++--

package/rousette/0015-restconf-add-internal-RPC-handler-dispatcher.patch

@@ -1,7 +1,7 @@
-From f6ee629de8abef42a24c42b185052b0c8e78bd6b Mon Sep 17 00:00:00 2001
+From 39f43493339984e3a3c256bc818f11aee71375f9 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 19 May 2025 12:23:16 +0200
-Subject: [PATCH 15/38] restconf: add internal RPC handler dispatcher
+Subject: [PATCH 15/42] restconf: add internal RPC handler dispatcher
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -15,6 +15,7 @@ ietf-subscribed-notifications:establish-subscription RPC is coming soon.
 
 Change-Id: I99121a511011229e4098f95e91601b39d333444a
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 24 ++++++++++++++++++++----
  tests/restconf-rpc.cpp  | 18 ++++++++++++++++++

package/rousette/0016-tests-processing-incomplete-events-in-SSE-client.patch

@@ -1,7 +1,7 @@
-From b7966613b43b01402c9f0af286a0b3237161779d Mon Sep 17 00:00:00 2001
+From fe57a9ac8024e4115c45d9c256d5048e17fe9fdb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 2 Sep 2025 15:33:43 +0200
-Subject: [PATCH 16/38] tests: processing incomplete events in SSE client
+Subject: [PATCH 16/42] tests: processing incomplete events in SSE client
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -14,6 +14,7 @@ a complete event, once available.
 
 Change-Id: Ied07e69e8b518f20fcc82134a4c041e7ec3a06d6
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  tests/restconf_utils.cpp | 53 +++++++++++++++++++++++-----------------
  tests/restconf_utils.h   |  3 ++-

package/rousette/0017-EventStream-fix-possible-heap-use-after-free.patch

@@ -1,7 +1,7 @@
-From 1067e05674633b97d64b428686aff44822230c5f Mon Sep 17 00:00:00 2001
+From 5686bf2fcf351e999043fe3e6e788e1ed502116a Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 8 Sep 2025 20:24:15 +0200
-Subject: [PATCH 17/38] EventStream: fix possible heap-use-after-free
+Subject: [PATCH 17/42] EventStream: fix possible heap-use-after-free
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -65,6 +65,7 @@ before actually resuming the response.
 
 Change-Id: Ifdb1f8610cacffca3bb49da17aa9b1d267cdd472
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 17 ++++++++++++++++-
  1 file changed, 16 insertions(+), 1 deletion(-)

package/rousette/0018-Use-a-working-version-of-nghttp2-asio.patch

@@ -1,7 +1,7 @@
-From fff342945eb3c8deb6f7aa67aca54f9c9f87f3ec Mon Sep 17 00:00:00 2001
+From 07131a39ca9c5a27fe7b1a5c628f3519c2efc0e5 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 11 Sep 2025 18:56:31 +0200
-Subject: [PATCH 18/38] Use a working version of nghttp2-asio
+Subject: [PATCH 18/42] Use a working version of nghttp2-asio
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -15,6 +15,7 @@ Link: https://github.com/nghttp2/nghttp2-asio/pull/9
 Link: https://github.com/nghttp2/nghttp2-asio/pull/25
 Change-Id: Iec9619ce45e7e76f0781d39966d0b6c7cc6fa778
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  .zuul.yaml | 2 +-
  README.md  | 3 ++-

package/rousette/0019-ping-use-a-monotonic-timer.patch

@@ -1,7 +1,7 @@
-From ffc52b2e454ae4ac4fa1948cb76a9469026d453e Mon Sep 17 00:00:00 2001
+From f71d4467409885078395c8d59c4390ddc1782d33 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Mon, 6 Oct 2025 22:35:27 +0200
-Subject: [PATCH 19/38] ping: use a monotonic timer
+Subject: [PATCH 19/42] ping: use a monotonic timer
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -16,6 +16,7 @@ deprecated, use the other function.
 
 Change-Id: I40383721ecb0f12bfcb3f638124a32150a29bf48
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 2 +-
  src/http/EventStream.h   | 4 ++--

package/rousette/0020-tests-use-a-monotonic-timer.patch

@@ -1,7 +1,7 @@
-From 4493316404f31354ea18bc92a1706a3834ad972b Mon Sep 17 00:00:00 2001
+From f842f027aa462486c1cc5cb9c47e0398b3242fe7 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Mon, 6 Oct 2025 22:50:11 +0200
-Subject: [PATCH 20/38] tests: use a monotonic timer
+Subject: [PATCH 20/42] tests: use a monotonic timer
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,6 +9,7 @@ Organization: Wires
 
 Change-Id: I89cdd08082b025643dac81788ca174d3c2177089
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  tests/restconf-eventstream.cpp | 2 +-
  tests/restconf_utils.cpp       | 6 +++---

package/rousette/0021-port-to-libyang-v4.patch

@@ -1,7 +1,7 @@
-From 8077a63ac97529d56782d2315f23c44f6036b85f Mon Sep 17 00:00:00 2001
+From 462dca24ef3cb3ae8bb5c6f7a349b94308281f9c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 23 Oct 2025 18:17:37 +0200
-Subject: [PATCH 21/38] port to libyang v4
+Subject: [PATCH 21/42] port to libyang v4
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -41,6 +41,7 @@ Depends-on: https://gerrit.cesnet.cz/c/CzechLight/dependencies/+/8990
 Bug: https://github.com/CESNET/libyang/pull/2448
 Depends-on: https://github.com/sysrepo/sysrepo/commit/6dc5641762962b93d54a54443e2fd43aa319a7a6
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                   |  6 +++---
  src/restconf/Server.cpp          |  2 +-

package/rousette/0022-restconf-prevent-lock-order-inversion.patch

@@ -1,7 +1,7 @@
-From b4bf655502d949a5f351e6acd313f47eecefb062 Mon Sep 17 00:00:00 2001
+From 4b08c23436972e80760abe397806867a1d4d486c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 13 Oct 2025 12:26:46 +0200
-Subject: [PATCH 22/38] restconf: prevent lock order inversion
+Subject: [PATCH 22/42] restconf: prevent lock order inversion
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -29,6 +29,7 @@ callbacks to EventStream"), I am not sure.
 See-also: 6bca750f866b5b14c4d9c3da68e5c8f1e4eee36c ("http: add optional callbacks to EventStream")
 Change-Id: Ib6626c127ff2eb5feb1d17dece28e70265749df4
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/http/EventStream.cpp | 14 +++++++++-----
  1 file changed, 9 insertions(+), 5 deletions(-)

package/rousette/0023-refactor-do-not-pollute-scope-with-unnecessary-varia.patch

@@ -1,7 +1,7 @@
-From 27cbe6750bdfc9f346421e55ebe555b8c036d77c Mon Sep 17 00:00:00 2001
+From 24a35b1f1424826202ecaebf7aa04dccdf6ad2f4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 11 Nov 2025 15:01:21 +0100
-Subject: [PATCH 23/38] refactor: do not pollute scope with unnecessary
+Subject: [PATCH 23/42] refactor: do not pollute scope with unnecessary
  variables
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -13,6 +13,7 @@ nothing.
 
 Change-Id: I5b9b1a077d44d088084c3b2b93359ab7464ec8aa
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 6 +++---
  1 file changed, 3 insertions(+), 3 deletions(-)

package/rousette/0024-restconf-validate-input-for-internal-rpcs.patch

@@ -1,7 +1,7 @@
-From 5592ae49cd7607fdcb2c9e554a521b53545e761b Mon Sep 17 00:00:00 2001
+From 228aa9ea848d437565b5f90972a0c4b23b279337 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 21 Oct 2025 17:23:44 +0200
-Subject: [PATCH 24/38] restconf: validate input for internal rpcs
+Subject: [PATCH 24/42] restconf: validate input for internal rpcs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -23,6 +23,7 @@ the RPC.
 
 Change-Id: I55296895e6993b4ca27d21ce2a64ec2d159a35fc
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp | 36 +++++++++++++++++++++++++++++-------
  1 file changed, 29 insertions(+), 7 deletions(-)

package/rousette/0025-tests-allow-read-from-parts-ietf-subscribed-notifica.patch

@@ -1,7 +1,7 @@
-From c2413237501eea3125fe31a9701919d14402737f Mon Sep 17 00:00:00 2001
+From 163ebff977aff8fea8e342f35314697f89e5bb82 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 11 Nov 2025 17:30:33 +0100
-Subject: [PATCH 25/38] tests: allow read from parts
+Subject: [PATCH 25/42] tests: allow read from parts
  ietf-subscribed-notifications for anonymous user
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -16,6 +16,7 @@ access for users.
 
 Change-Id: I50e49c8c60b7e6be47c51f3d8cd546fbb6f49294
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  tests/restconf-reading.cpp | 5 ++++-
  tests/restconf_utils.cpp   | 4 ++++

package/rousette/0026-restconf-establish-subscription-RPC-for-subscribed-n.patch

@@ -1,7 +1,7 @@
-From aa04b0a99fb51aed998aa9f1ab0a527cc09e647f Mon Sep 17 00:00:00 2001
+From 0f13a7262ddf58f400a53cfedb038344abb929f0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 19 May 2025 12:11:09 +0200
-Subject: [PATCH 26/38] restconf: establish-subscription RPC for subscribed
+Subject: [PATCH 26/42] restconf: establish-subscription RPC for subscribed
  notifications
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -21,6 +21,7 @@ the follow-up patch.
 
 Change-Id: I0217e5abc56cfd73859dbcc610fb1f342dc33a10
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                              |   8 +-
  src/restconf/DynamicSubscriptions.cpp       | 177 ++++++++++++++

package/rousette/0027-refactor-restconf-stream-request-types.patch

@@ -1,7 +1,7 @@
-From e2c8036130a2265476579ffa9f4354741b54bbd5 Mon Sep 17 00:00:00 2001
+From b2be7b3b43cb95b5bfc1e0b774de7dbac4376809 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 13 Oct 2025 16:10:51 +0200
-Subject: [PATCH 27/38] refactor: restconf stream request types
+Subject: [PATCH 27/42] refactor: restconf stream request types
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -21,6 +21,7 @@ will not have it.
 See-also: 97ceef119c900c37bbaa27860c3b43cfa6d69f95 ("restconf: refactor uri parser for stream URIs")
 Change-Id: Idc1e05f7ff05cea84b5806f60e217605f75e7a9f
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/Server.cpp |  2 +-
  src/restconf/uri.cpp    | 15 ++++++++-------

package/rousette/0028-restconf-endpoint-for-subscribed-notifications.patch

@@ -1,7 +1,7 @@
-From b3a55ae0a1ef9e092b0c8f0d7c3dbd7baa708cc8 Mon Sep 17 00:00:00 2001
+From 5f4c781728d888d3e1c8db9c1c78c545caae824c Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 29 Jul 2025 11:39:21 +0200
-Subject: [PATCH 28/38] restconf: endpoint for subscribed notifications
+Subject: [PATCH 28/42] restconf: endpoint for subscribed notifications
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -27,6 +27,7 @@ of boost::asio is not enough.
 
 Change-Id: I07dcdd3fb9ef4f05f93ae6dda0e0d71094a0bbfc
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                              |   1 +
  src/restconf/DynamicSubscriptions.cpp       | 127 ++++++++++++-

package/rousette/0029-restconf-dynamic-subscriptions-shutdown-method.patch

@@ -1,7 +1,7 @@
-From 9c39cdd8a8a6bb8fb94d4f943313ec8c4a1823d7 Mon Sep 17 00:00:00 2001
+From dc462f432a2360f4ed9c7b5e2a17051074674f01 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 10 Nov 2025 19:58:36 +0100
-Subject: [PATCH 29/38] restconf: dynamic subscriptions shutdown method
+Subject: [PATCH 29/42] restconf: dynamic subscriptions shutdown method
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -13,6 +13,7 @@ cannot call its terminate() method.
 
 Change-Id: I4532bbafff7c7386a18ed0636f1102842d2749fa
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/DynamicSubscriptions.cpp | 10 ++++++++++
  src/restconf/DynamicSubscriptions.h   |  1 +

package/rousette/0030-restconf-terminate-subsc.-notification-streams-after.patch

@@ -1,7 +1,7 @@
-From 3154d9209dc876fee43d9e83907ab44e06008c65 Mon Sep 17 00:00:00 2001
+From ac1097419badcee117d5c90331db9fa5771bb842 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 14 Oct 2025 12:25:20 +0200
-Subject: [PATCH 30/38] restconf: terminate subsc. notification streams after
+Subject: [PATCH 30/42] restconf: terminate subsc. notification streams after
  60s with no client
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
@@ -18,6 +18,7 @@ is 60 seconds.
 
 Change-Id: Id399d108069704fa8ab79b9ef6ab855dd62cfc8d
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/DynamicSubscriptions.cpp       | 72 ++++++++++++++++++---
  src/restconf/DynamicSubscriptions.h         | 22 ++++++-

package/rousette/0031-restconf-add-kill-delete-subscription-RPCs.patch

@@ -1,7 +1,7 @@
-From 22cfcbf52be604afe0caafc892f4b7befe03b9db Mon Sep 17 00:00:00 2001
+From f8d6053c6777476384d9c32564e5faf355edbafa Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 8 Apr 2025 17:00:59 +0200
-Subject: [PATCH 31/38] restconf: add {kill,delete}-subscription RPCs
+Subject: [PATCH 31/42] restconf: add {kill,delete}-subscription RPCs
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -21,6 +21,7 @@ disconnects.
 
 Change-Id: I443d6fd88f2797045b5ae0a7d7e1a761fe74e7cb
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/DynamicSubscriptions.cpp       |  44 +++++
  src/restconf/DynamicSubscriptions.h         |   2 +

package/rousette/0032-restconf-add-subscribed-notifications-filtering.patch

@@ -1,7 +1,7 @@
-From c5558b12ee67280b6281b639c3d8652cec3c7fa6 Mon Sep 17 00:00:00 2001
+From da35875a545a4709da0662bb6ea104dcdba85582 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Wed, 19 Mar 2025 14:39:05 +0100
-Subject: [PATCH 32/38] restconf: add subscribed notifications filtering
+Subject: [PATCH 32/42] restconf: add subscribed notifications filtering
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -12,6 +12,7 @@ filters.
 
 Change-Id: Iee973a6a2d03b4a0d90f952afe5436ce701787ae
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                              |  2 +-
  src/restconf/DynamicSubscriptions.cpp       | 13 ++++-

package/rousette/0033-cmake-wrap-long-line.patch

@@ -1,7 +1,7 @@
-From fe91af1eb38888d7eacb36cb5a299bd3163f7c60 Mon Sep 17 00:00:00 2001
+From 36b8ec2f65a456bf97b97ed4b3d74bb323cf85b8 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 14 Oct 2025 17:22:00 +0200
-Subject: [PATCH 33/38] cmake: wrap long line
+Subject: [PATCH 33/42] cmake: wrap long line
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,6 +9,7 @@ Organization: Wires
 
 Change-Id: Id94e18d581dbfbe2e6d386be6a232544f9344eec
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt | 7 ++++++-
  1 file changed, 6 insertions(+), 1 deletion(-)

package/rousette/0034-restconf-support-replays-in-subscribed-notifications.patch

@@ -1,7 +1,7 @@
-From 817debab72d10f2f30e83f1630bebdcdf3ec9455 Mon Sep 17 00:00:00 2001
+From f633e7ffd39955051d886b7977e8a8ecfffda2b4 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Mon, 10 Mar 2025 15:33:08 +0100
-Subject: [PATCH 34/38] restconf: support replays in subscribed notifications
+Subject: [PATCH 34/42] restconf: support replays in subscribed notifications
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,6 +9,7 @@ Organization: Wires
 
 Change-Id: Idfc3ceb99c8111c5575c1c8b94d539f234fa43be
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                              |   1 +
  src/restconf/DynamicSubscriptions.cpp       |  24 ++++-

package/rousette/0035-restconf-refactor-getting-datastore-from-string.patch

@@ -1,7 +1,7 @@
-From 7d6b1a463fdacefaf7a7057564f6f4d4a8cb4632 Mon Sep 17 00:00:00 2001
+From f58dc52c4e7445a06484bce0bbfeac831004ce02 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tom=C3=A1=C5=A1=20Pecka?= <tomas.pecka@cesnet.cz>
 Date: Tue, 25 Mar 2025 11:06:26 +0100
-Subject: [PATCH 35/38] restconf: refactor getting datastore from string
+Subject: [PATCH 35/42] restconf: refactor getting datastore from string
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -11,6 +11,7 @@ This will be useful when processing YANG push requests.
 
 Change-Id: I1e76335c8d674e81890d6cd1e973adaf521eb205
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  src/restconf/uri.cpp           | 19 +++++--------------
  src/restconf/utils/sysrepo.cpp | 16 ++++++++++++++++

package/rousette/0036-build-remove-duplicate-line.patch

@@ -1,7 +1,7 @@
-From c1d5d143020ddc51c3886b82e87d463cf3211fca Mon Sep 17 00:00:00 2001
+From 8a541a83176eb44fbe501a91b7a4ef0576f60ba3 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Fri, 21 Nov 2025 10:44:47 +0100
-Subject: [PATCH 36/38] build: remove duplicate line
+Subject: [PATCH 36/42] build: remove duplicate line
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -10,6 +10,7 @@ Organization: Wires
 Fixes: 817debab restconf: support replays in subscribed notifications
 Change-Id: I4d2ea8429a4cb7b77f8739aff7a26a03cf535756
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt | 1 -
  1 file changed, 1 deletion(-)

package/rousette/0037-remove-obsolete-targets.patch

@@ -1,7 +1,7 @@
-From ed62a496744de0e0dc31171167d5d6f69f54af93 Mon Sep 17 00:00:00 2001
+From 538dbbff9604c00fd3875c88d0ed19074dfa0bfb Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Fri, 21 Nov 2025 12:54:44 +0100
-Subject: [PATCH 37/38] remove obsolete targets
+Subject: [PATCH 37/42] remove obsolete targets
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -9,6 +9,7 @@ Organization: Wires
 
 Change-Id: Idde217a4ae1bc6f03657d9609e0ec1b0a47a9747
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt |  9 --------
  src/clock.cpp  | 62 --------------------------------------------------

package/rousette/0038-port-to-libyang-v4.2.patch

@@ -1,7 +1,7 @@
-From 5a1d0dac28c1a78e90d3906693228584adcf3ab1 Mon Sep 17 00:00:00 2001
+From 6adfafa9324ee0bfd50d0dab7c7657138a4a55a0 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Jan=20Kundr=C3=A1t?= <jan.kundrat@cesnet.cz>
 Date: Thu, 20 Nov 2025 16:13:43 +0100
-Subject: [PATCH 38/38] port to libyang v4.2
+Subject: [PATCH 38/42] port to libyang v4.2
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
@@ -10,6 +10,7 @@ Organization: Wires
 Depends-on: https://gerrit.cesnet.cz/c/CzechLight/dependencies/+/9012
 Change-Id: I1ac6b25a3c1034f06917594732f066fd77d4b26b
 Signed-off-by: Mattias Walström <lazzer@gmail.com>
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
 ---
  CMakeLists.txt                              |  2 +-
  src/restconf/Server.cpp                     | 10 +++++-----

package/rousette/0039-Add-log-level-LEVEL-command-line-option.patch

@@ -0,0 +1,88 @@
+From c617503c76dcfe75e73c5f1af3dd6c17c2ca3fd4 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Sun, 28 Sep 2025 06:04:12 +0200
+Subject: [PATCH 39/42] Add '--log-level LEVEL' command line option
+Organization: Wires
+
+The default 'trace' log level is quite verbose for production systems.
+This commit changes the default to 'info' and adds a command line option
+to control the log level.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/restconf/main.cpp | 30 ++++++++++++++++++++++++++++--
+ 1 file changed, 28 insertions(+), 2 deletions(-)
+
+diff --git a/src/restconf/main.cpp b/src/restconf/main.cpp
+index b1e2bc6..66c782d 100644
+--- a/src/restconf/main.cpp
++++ b/src/restconf/main.cpp
+@@ -19,6 +19,7 @@
+ #include <spdlog/sinks/ansicolor_sink.h>
+ #include <sys/types.h>
+ #include <sys/stat.h>
++#include <iostream>
+ #include <docopt.h>
+ #include <spdlog/spdlog.h>
+ #include <sysrepo-cpp/Session.hpp>
+@@ -27,11 +28,12 @@
+ static const char usage[] =
+   R"(Rousette - RESTCONF server
+ Usage:
+-  rousette [--syslog] [--timeout <SECONDS>] [--help]
++  rousette [--syslog] [--timeout <SECONDS>] [--log-level <LEVEL>] [--help]
+ Options:
+   -h --help                         Show this screen.
+   -t --timeout <SECONDS>            Change default timeout in sysrepo (if not set, use sysrepo internal).
+   --syslog                          Log to syslog.
++  --log-level <LEVEL>               Set log level (trace, debug, info, warn, error, critical, off) [default: info].
+ )";
+ #ifdef HAVE_SYSTEMD
+ 
+@@ -76,10 +78,34 @@ int main(int argc, char* argv [])
+ {
+     auto args = docopt::docopt(usage, {argv + 1, argv + argc}, true,""/* version */, true);
+     auto timeout = std::chrono::milliseconds{0};
++    auto logLevel = spdlog::level::info;
+ 
+     if (args["--timeout"]) {
+         timeout = std::chrono::milliseconds{args["--timeout"].asLong() * 1000};
+     }
++
++    if (args["--log-level"]) {
++        auto levelStr = args["--log-level"].asString();
++        if (levelStr == "trace") {
++            logLevel = spdlog::level::trace;
++        } else if (levelStr == "debug") {
++            logLevel = spdlog::level::debug;
++        } else if (levelStr == "info") {
++            logLevel = spdlog::level::info;
++        } else if (levelStr == "warn" || levelStr == "warning") {
++            logLevel = spdlog::level::warn;
++        } else if (levelStr == "error" || levelStr == "err") {
++            logLevel = spdlog::level::err;
++        } else if (levelStr == "critical") {
++            logLevel = spdlog::level::critical;
++        } else if (levelStr == "off") {
++            logLevel = spdlog::level::off;
++        } else {
++            std::cerr << "Invalid log level: " << levelStr << std::endl;
++            std::cerr << "Valid levels: trace, debug, info, warn, error, critical, off" << std::endl;
++            return 1;
++        }
++    }
+     if (args["--syslog"].asBool()) {
+         auto syslog_sink = std::make_shared<spdlog::sinks::syslog_sink_mt>("rousette", LOG_PID, LOG_USER, true);
+         auto logger = std::make_shared<spdlog::logger>("rousette", syslog_sink);
+@@ -95,7 +121,7 @@ int main(int argc, char* argv [])
+         auto logger = std::make_shared<spdlog::logger>("rousette", stdout_sink);
+         spdlog::set_default_logger(logger);
+     }
+-    spdlog::set_level(spdlog::level::trace);
++    spdlog::set_level(logLevel);
+ 
+     /* We will parse URIs using boost::spirit's alnum/alpha/... matchers which are locale-dependent.
+      * Let's use something stable no matter what the system is using
+-- 
+2.43.0
+

package/rousette/0040-sr-lower-log-message-severity-to-debug.patch

@@ -0,0 +1,46 @@
+From 3d4262c6c2e334fa6577a69e0483a19f638e43fd Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 19 Mar 2026 17:21:20 +0100
+Subject: [PATCH 40/42] sr: lower log message severity to debug
+Organization: Wires
+
+On non-CzechLight hardware this message fires on every startup.  It is
+not a warning condition, and at debug level it won't clutter the log at
+the default info level.  Also lower the NACM startup diagnostic from
+info to debug for the same reason.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/auth/Nacm.cpp        | 2 +-
+ src/sr/OpticalEvents.cpp | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/src/auth/Nacm.cpp b/src/auth/Nacm.cpp
+index 284fa85..a4cc8cc 100644
+--- a/src/auth/Nacm.cpp
++++ b/src/auth/Nacm.cpp
+@@ -98,7 +98,7 @@ Nacm::Nacm(sysrepo::Connection conn)
+     m_srSub.onModuleChange(
+         "ietf-netconf-acm", [&](auto session, auto, auto, auto, auto, auto) {
+             m_anonymousEnabled = validAnonymousNacmRules(session, ANONYMOUS_USER_GROUP);
+-            spdlog::info("NACM config validation: Anonymous user access {}", m_anonymousEnabled ? "enabled" : "disabled");
++            spdlog::debug("NACM config validation: Anonymous user access {}", m_anonymousEnabled ? "enabled" : "disabled");
+             return sysrepo::ErrorCode::Ok;
+         },
+         std::nullopt,
+diff --git a/src/sr/OpticalEvents.cpp b/src/sr/OpticalEvents.cpp
+index 3f78ddc..a2cefe7 100644
+--- a/src/sr/OpticalEvents.cpp
++++ b/src/sr/OpticalEvents.cpp
+@@ -47,7 +47,7 @@ OpticalEvents::OpticalEvents(sysrepo::Session session)
+         }
+     }
+ 
+-    spdlog::warn("Telemetry disabled. No CzechLight YANG modules found.");
++    spdlog::debug("Telemetry disabled. No CzechLight YANG modules found.");
+ }
+ 
+ sysrepo::ErrorCode OpticalEvents::onChange(sysrepo::Session session, const std::string& module)
+-- 
+2.43.0
+

package/rousette/0041-restconf-add-audit-trail-for-datastore-write-operati.patch

@@ -0,0 +1,134 @@
+From 2877c5a6a139b15e42f99c5aba4127b427154707 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 19 Mar 2026 17:21:25 +0100
+Subject: [PATCH 41/42] restconf: add audit trail for datastore write
+ operations
+Organization: Wires
+
+Log an info message before and after committing changes to sysrepo,
+matching the style of netopeer2's audit trail.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/restconf/Server.cpp        | 14 ++++++++++++++
+ src/restconf/utils/sysrepo.cpp | 17 +++++++++++++++++
+ src/restconf/utils/sysrepo.h   |  1 +
+ 3 files changed, 32 insertions(+)
+
+diff --git a/src/restconf/Server.cpp b/src/restconf/Server.cpp
+index 3c7c3c7..15eec92 100644
+--- a/src/restconf/Server.cpp
++++ b/src/restconf/Server.cpp
+@@ -17,10 +17,12 @@
+ #include "restconf/Exceptions.h"
+ #include "restconf/NotificationStream.h"
+ #include "auth/Http.h"
++#include "NacmIdentities.h"
+ #include "restconf/Server.h"
+ #include "restconf/YangSchemaLocations.h"
+ #include "restconf/uri.h"
+ #include "restconf/utils/dataformat.h"
++#include "restconf/utils/sysrepo.h"
+ #include "restconf/utils/yang.h"
+ #include "sr/OpticalEvents.h"
+ 
+@@ -594,8 +596,10 @@ void processPost(std::shared_ptr<RequestContext> requestCtx, const std::chrono::
+     createdNodes.begin()->newMeta(*modNetconf, "operation", "create");
+     yangInsert(*requestCtx, *createdNodes.begin());
+ 
++    spdlog::info("user \"{}\" committing changes to {} ...", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+     requestCtx->sess.editBatch(*edit, sysrepo::DefaultOperation::Merge);
+     requestCtx->sess.applyChanges(timeout);
++    spdlog::info("user \"{}\" committed changes to {}.", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+ 
+     requestCtx->res.write_head(201,
+                                {
+@@ -682,8 +686,10 @@ void processYangPatchImpl(const std::shared_ptr<RequestContext>& requestCtx, con
+     }
+ 
+     if (mergedEdits) {
++        spdlog::info("user \"{}\" committing changes to {} ...", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+         requestCtx->sess.editBatch(*mergedEdits, sysrepo::DefaultOperation::Merge);
+         requestCtx->sess.applyChanges(timeout);
++        spdlog::info("user \"{}\" committed changes to {}.", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+     }
+ }
+ 
+@@ -726,12 +732,16 @@ void processPutOrPlainPatch(std::shared_ptr<RequestContext> requestCtx, const st
+         validateInputMetaAttributes(ctx, *edit);
+ 
+         if (requestCtx->req.method() == "PUT") {
++            spdlog::info("user \"{}\" committing changes to {} ...", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+             requestCtx->sess.replaceConfig(edit, std::nullopt, timeout);
++            spdlog::info("user \"{}\" committed changes to {}.", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+ 
+             requestCtx->res.write_head(edit ? 201 : 204, {CORS});
+         } else {
++            spdlog::info("user \"{}\" committing changes to {} ...", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+             requestCtx->sess.editBatch(*edit, sysrepo::DefaultOperation::Merge);
+             requestCtx->sess.applyChanges(timeout);
++            spdlog::info("user \"{}\" committed changes to {}.", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+             requestCtx->res.write_head(204, {CORS});
+         }
+         requestCtx->res.end();
+@@ -763,8 +773,10 @@ void processPutOrPlainPatch(std::shared_ptr<RequestContext> requestCtx, const st
+         yangInsert(*requestCtx, *replacementNode);
+     }
+ 
++    spdlog::info("user \"{}\" committing changes to {} ...", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+     requestCtx->sess.editBatch(*edit, sysrepo::DefaultOperation::Merge);
+     requestCtx->sess.applyChanges(timeout);
++    spdlog::info("user \"{}\" committed changes to {}.", requestCtx->sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(requestCtx->sess.activeDatastore()));
+ 
+     if (requestCtx->req.method() == "PUT") {
+         requestCtx->res.write_head(nodeExisted ? 204 : 201, {CORS});
+@@ -1219,8 +1231,10 @@ Server::Server(
+                             deletedNode->newMeta(*netconf, "operation", "delete");
+                         }
+ 
++                        spdlog::info("user \"{}\" committing changes to {} ...", sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(sess.activeDatastore()));
+                         sess.editBatch(*edit, sysrepo::DefaultOperation::Merge);
+                         sess.applyChanges(timeout);
++                        spdlog::info("user \"{}\" committed changes to {}.", sess.getNacmUser().value_or(ANONYMOUS_USER), datastoreToString(sess.activeDatastore()));
+                     } catch (const sysrepo::ErrorWithCode& e) {
+                         if (e.code() == sysrepo::ErrorCode::Unauthorized) {
+                             throw ErrorResponse(403, "application", "access-denied", "Access denied.", restconfRequest.path);
+diff --git a/src/restconf/utils/sysrepo.cpp b/src/restconf/utils/sysrepo.cpp
+index 9f14cc7..d3bcc39 100644
+--- a/src/restconf/utils/sysrepo.cpp
++++ b/src/restconf/utils/sysrepo.cpp
+@@ -38,4 +38,21 @@ sysrepo::Datastore datastoreFromString(const std::string& datastore)
+ 
+     throw std::runtime_error("Unknown datastore '" + datastore + "'");
+ }
++
++std::string datastoreToString(sysrepo::Datastore datastore)
++{
++    switch (datastore) {
++    case sysrepo::Datastore::Running:
++        return "running";
++    case sysrepo::Datastore::Operational:
++        return "operational";
++    case sysrepo::Datastore::Candidate:
++        return "candidate";
++    case sysrepo::Datastore::Startup:
++        return "startup";
++    case sysrepo::Datastore::FactoryDefault:
++        return "factory-default";
++    }
++    throw std::runtime_error("Unknown datastore");
++}
+ }
+diff --git a/src/restconf/utils/sysrepo.h b/src/restconf/utils/sysrepo.h
+index 0eced9e..b8dd399 100644
+--- a/src/restconf/utils/sysrepo.h
++++ b/src/restconf/utils/sysrepo.h
+@@ -27,4 +27,5 @@ public:
+ };
+ 
+ sysrepo::Datastore datastoreFromString(const std::string& datastore);
++std::string datastoreToString(sysrepo::Datastore datastore);
+ }
+-- 
+2.43.0
+

package/rousette/0042-restconf-strip-redundant-fields-from-syslog-journald.patch

@@ -0,0 +1,37 @@
+From 87f1984ea8d07d7e55c0ad08e24ba9adeefd6aca Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 19 Mar 2026 17:54:11 +0100
+Subject: [PATCH 42/42] restconf: strip redundant fields from syslog/journald
+ log messages
+Organization: Wires
+
+When logging to syslog or journald, the timestamp, program name, and log
+level are all provided by the logging infrastructure itself. Use a bare
+message-only pattern to avoid the duplication.
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/restconf/main.cpp | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/src/restconf/main.cpp b/src/restconf/main.cpp
+index 66c782d..63f8760 100644
+--- a/src/restconf/main.cpp
++++ b/src/restconf/main.cpp
+@@ -110,11 +110,13 @@ int main(int argc, char* argv [])
+         auto syslog_sink = std::make_shared<spdlog::sinks::syslog_sink_mt>("rousette", LOG_PID, LOG_USER, true);
+         auto logger = std::make_shared<spdlog::logger>("rousette", syslog_sink);
+         spdlog::set_default_logger(logger);
++        spdlog::set_pattern("%v");
+ #ifdef HAVE_SYSTEMD
+     } else if (is_journald_active()) {
+         auto sink = std::make_shared<journald_sink<std::mutex>>();
+         auto logger = std::make_shared<spdlog::logger>("rousette", sink);
+         spdlog::set_default_logger(logger);
++        spdlog::set_pattern("%v");
+ #endif
+     } else {
+         auto stdout_sink = std::make_shared<spdlog::sinks::ansicolor_stdout_sink_mt>();
+-- 
+2.43.0
+

package/skeleton-init-finit/skeleton/etc/finit.d/available/avahi.conf

@@ -1,2 +1,2 @@
-service <!> name:mdns env:-/etc/default/avahi \
+service <!pid/confd,usr/bootstrap> name:mdns env:-/etc/default/avahi \
 	[2345] avahi-daemon -s $AVAHI_ARGS -- Avahi mDNS-SD daemon

package/skeleton-init-finit/skeleton/etc/finit.d/available/dnsmasq.conf

@@ -1 +1 @@
-service [S12345] <!pid/syslogd> dnsmasq -k -u root -- DHCP/DNS proxy
+service [S12345] <!service/dbus/ready> dnsmasq -k -u root -- DHCP/DNS proxy

package/skeleton-init-finit/skeleton/etc/finit.d/available/nginx.conf

@@ -1,2 +1,2 @@
-service <usr/mkcert> env:-/etc/default/nginx \
+service <usr/mkcert,service/confd/ready> env:-/etc/default/nginx \
 	[2345] nginx -g 'daemon off;' $NGINX_ARGS -- Web server

package/statd/statd.conf

@@ -1,3 +1,3 @@
 #set DEBUG=1
 
-service name:statd log [S12345] <pid/confd> statd -f -p /run/statd.pid -n -- Status daemon
+service name:statd [12345] <pid/confd> statd -f -p /run/statd.pid -n -- Status daemon