Merge pull request #1533 from kernelkit/fix-yang-errors

confd: fix libyang must-expression warnings in NTP and WireGuard YANG

src/confd/yang/confd.inc

@@ -48,11 +48,11 @@ MODULES=(
 	"ieee802-ethernet-phy-type@2025-09-10.yang"
 	"infix-ethernet-interface@2026-05-21.yang"
 	"infix-factory-default@2023-06-28.yang"
-	"infix-interfaces@2026-05-18.yang -e vlan-filtering"
+	"infix-interfaces@2026-06-11.yang -e vlan-filtering"
 	"ietf-crypto-types -e cleartext-symmetric-keys"
 	"infix-crypto-types@2026-02-14.yang"
 	"ietf-keystore -e symmetric-keys"
-	"infix-ntp@2026-03-09.yang"
+	"infix-ntp@2026-06-11.yang"
 	"infix-keystore@2025-12-17.yang"
 	"ieee1588-ptp-tt@2023-08-14.yang -e timestamp-correction"
 	"ieee802-dot1as-gptp@2025-12-10.yang"

src/confd/yang/confd/infix-if-wireguard.yang

@@ -36,6 +36,19 @@ submodule infix-if-wireguard {
   contact      "kernelkit@googlegroups.com";
   description  "WireGuard VPN tunnel interface";
 
+  revision 2026-06-11 {
+    description "Fix private-key/public-key-bag key-format must expressions.
+
+                 deref() of a *-ref leafref resolves to the referenced key's
+                 'name' leaf, so 'deref(.)/ks:public-key-format' looked for the
+                 format leaf as a child of 'name' (which does not exist).  Step
+                 up to the key entry with 'deref(.)/../...', matching the
+                 working preshared-key must.  For the truststore public-key-bag,
+                 public-key-format lives under the 'public-key' list, so descend
+                 via 'deref(.)/../ts:public-key/ts:public-key-format'.";
+    reference "internal";
+  }
+
   revision 2025-11-09 {
     description "Initial revision";
     reference "internal";
@@ -149,9 +162,9 @@ submodule infix-if-wireguard {
         type ks:central-asymmetric-key-ref;
         mandatory true;
         description "Reference to WireGuard private key (X25519/Curve25519 format)";
-        must "not(deref(.)/ks:public-key-format) or "
-          + "(derived-from-or-self(deref(.)/ks:public-key-format,  'ixct:x25519-public-key-format') and "
-          + "derived-from-or-self(deref(.)/ks:private-key-format,  'ixct:x25519-private-key-format'))" {
+        must "not(deref(.)/../ks:public-key-format) or "
+          + "(derived-from-or-self(deref(.)/../ks:public-key-format,  'ixct:x25519-public-key-format') and "
+          + "derived-from-or-self(deref(.)/../ks:private-key-format,  'ixct:x25519-private-key-format'))" {
           error-message "Private key must be in WireGuard (X25519/Curve25519) format";
         }
       }
@@ -177,8 +190,8 @@ submodule infix-if-wireguard {
 
         leaf public-key-bag {
           type ts:central-public-key-bag-ref;
-          must "not(deref(.)/ts:public-key-format) or "
-            + "(derived-from-or-self(deref(.)/ts:public-key-format,  'ixct:x25519-public-key-format'))" {
+          must "not(deref(.)/../ts:public-key/ts:public-key-format) or "
+            + "(derived-from-or-self(deref(.)/../ts:public-key/ts:public-key-format,  'ixct:x25519-public-key-format'))" {
             error-message "Public key must be in WireGuard (X25519/Curve25519) format";
           }
           description "Reference to public key bag containing peer public keys";

src/confd/yang/confd/infix-interfaces.yang

@@ -41,6 +41,12 @@ module infix-interfaces {
   contact      "kernelkit@googlegroups.com";
   description  "Linux bridge and lag extensions for ietf-interfaces.";
 
+  revision 2026-06-11 {
+    description "Fix WireGuard key-format must expressions, see
+                 infix-if-wireguard@2026-06-11.";
+    reference "internal";
+  }
+
   revision 2026-05-18 {
     description "Track ieee802-ethernet-interface@2025-09-10 upgrade
                  (IEEE Std 802.3.2-2025): operational data now exposes

src/confd/yang/confd/infix-ntp.yang

@@ -29,6 +29,17 @@ module infix-ntp {
   contact      "kernelkit@googlegroups.com";
   description  "Infix deviations and augments to ietf-ntp.";
 
+  revision 2026-06-11 {
+    description "Fix iburst/burst peer-mode must expressions.
+
+                 The must was attached to the iburst/burst leaf, so the
+                 context node was the leaf itself; 'ntp:iburst'/'ntp:burst'
+                 then resolved as a non-existent child of the leaf, which
+                 libyang flagged as an unresolved schema node.  Reference
+                 the leaf's own value with '.' instead.";
+    reference "internal";
+  }
+
   revision 2026-03-09 {
     description "Add stratumweight to NTP server configuration.
 
@@ -351,7 +362,7 @@ module infix-ntp {
 
   deviation "/ntp:ntp/ntp:unicast-configuration/ntp:iburst" {
     deviate add {
-      must "not(ntp:iburst and ../type = 'ntp:uc-peer')" {
+      must "not(. = 'true' and ../type = 'ntp:uc-peer')" {
         error-message "iburst option is not supported in peer mode";
       }
     }
@@ -359,7 +370,7 @@ module infix-ntp {
 
   deviation "/ntp:ntp/ntp:unicast-configuration/ntp:burst" {
     deviate add {
-      must "not(ntp:burst and ../type = 'ntp:uc-peer')" {
+      must "not(. = 'true' and ../type = 'ntp:uc-peer')" {
         error-message "burst option is not supported in peer mode";
       }
     }