The xpath_to_uri() method only processed the first predicate in XPath
expressions with multiple [key='value'] patterns. Each re.sub() call
was performed on the original xpath instead of the result the previous
substitutions, causing subsequent predicates to be ignored.
Example XPath that would fail:
/infix-firewall:firewall/zone[name='untrusted']/interface[.='e2']
Would incorrectly convert to:
/infix-firewall:firewall/zone[name='untrusted']/interface=e2
Instead of the correct RESTCONF URL:
/infix-firewall:firewall/zone=untrusted/interface=e2
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Before this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:33:00)
# Traceback (most recent call last):
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# AssertionError: Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
After this change:
ok 2 - Configure basic end-device firewall
not ok 3 - Verify unused interface assigned to default zone
# Exiting (2025-09-25 11:35:00)
# File "/home/jocke/src/x-misc/test/./case/infix_firewall/basic/test.py", line 127, in <module>
# assert unused_if not in public_zone["interface"], \
# ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
# Unused interface e4 should be in default zone 'public', got interfaces: ['e2', 'e3', 'e5', 'e7', 'e8']
Slightly shorter and arguably easier to read for a non-pythonic human.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A very common pattern in our tests is:
if (condition):
print(f"the condition failed with {output}")
test.fail()
This change allows us to write:
if (condition):
test.fail(f"the condition failed with {output}")
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The rauc event logger is a separate glib logger that by default logs to
the system console, with annoying ANSI escape sequences. This commit
drops the default stdout/stderr redirect of these log messages and adds
a more exhaustive bundle install and event log, in json format, instead.
For more information about event logging, see the rauc documentation:
https://rauc.readthedocs.io/en/latest/advanced.html
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- Drop 'local', not available in POSIX shell scripts
- Check for an assortment of backup file combos
- Simplify nested if-statements, skip whitelist first
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The default 'trace' log level is quite verbose for our production systems.
This commit changes the default to 'info' and adds a command line option
to control the log level if needed.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To be able to maintain our own set of patches on top rousette, a kkit
branch have been set up with a reduced set of backported fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- cli: add '-r' to log/pager/follow for "raw" control chars, including unicode
- sysklogd: backport unicode fix for em-dash character (—) in slogan
- sysklogd: drop old patches
- sysklogd: run in 8-bit safe mode
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add concurrency control to trigger workflow to cancel in-progress builds
when new events (like adding ci:main label) occur on the same PR. This
prevents resource waste from duplicate builds and handles the common
workflow where developers add the ci:main label after PR creation.
Fixes#1154
Adjust DHCP client retry behavior:
-t 3 (was -t 10) : Maximum discovery attempts per cycle
-T 5 (was -T 3) : Seconds to wait between attempts
-A 30 (was -A 10) : Seconds to wait after all attempts fail
Before: 10 attempts × 3 seconds = 30 seconds of rapid trying, then 10
second pause = 40 second total cycle
After: 3 attempts × 5 seconds = 15 seconds of trying, then 30 second
pause = 45 second total cycle
=> 70% fewer log messages during active attempts, with longer quiet
periods between cycles.
Fixes#1100
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add HISTCONTROL=ignoreboth to ignore duplicate commands and those
starting with space, enable histappend, and improve tab completion
behavior. Also add /etc/inputrc for better readline key bindings.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
To reduce the duplication of effort between 9pm and the Infamy framework
this change consolidates the move from local 'infamy: title:' extension
to 9pm 'name:'.
For the parameterized tunnel tests we leverage the 9pm dynamic test-spec
variable, which looks for a correspodning <case>.adoc instead of static
Readme.adoc, when generating the test report.
Each test documentation should cover all aspects of the test, much like
the usage text of a UNIX program. To this end, the tunnel test docs are
now more spelled out, including all invariants.
Some refactoring of these tests were also necessary, e.g., replacing any
reserved Python keywords like 'type', and other PEP-8 fixes.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Import new 9pm version for improved test report generation. With this
in place we can take the opportunity to also refactor and simplify the
test spec. generation.
Fixes#1129
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit greatly simplifies AsciiDoc image references in generated
Readme.adoc files. The two focused use-cases that remain after this
change are working references in:
- Generated output/images/test-report.pdf
- Viewing test's Readme.adoc from GitHub
Previously we aimed to have working images also when the test's Readme
was included in the parent directory's Readme.adoc. This, however, is
not supported as of this commit. It seems unlikely also to ever be a
supported feature of AsciiDoc on GitHub, for details, see the following
issue: <https://github.com/github/markup/issues/1095>
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
It should be possible to create test reports manually, so logically
the GitHub workflow should call a make rule in test.mk
Untested: branding, or any case where Infix is used as a BR2_EXTERNAL
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The motd-banner was behind on the new slogan:
.-------.
| . . | Infix OS — Immutable.Friendly.Secure
|-. v .-| https://kernelkit.org
'-'---'-'
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit completes the collection. We now have small, medium, and
large sizes. Useful for easy conversion to other formats, e.g., bmp.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
For a heavily loaded system, 10 seconds/retries is not enough time to
expect containers to have started up. Particularly after the changes
done recently to do prune before and after a container is started.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Usually the CNI bridge plugin "takes care" of enabling IPv4 forwarding
on all interfaces, see issue #1125, but when the container tests are run
in a different order from the infix_containers.yaml, Infix may reset the
IPv4 forwarding on this critical interface.
This change is both future proof and also ensures the test works as it
was intended even if tests are run out-of-order.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- the port-mapping plugin supports iptables or nftables
- the firewall plugin support only iptables or firewalld
Enforce use of iptables wrapper for nftables, for now, in both plugins.
This all needs to be refactored to run podman with "unmanaged" networks
in the future.
Related to issue #1125
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When a container's image is on an inaccessible remote server, the
container wrapper script waits in the background for any netowrk
changes to retry download of the image.
This change avoids the dangerous previous construct, and is also
easier to read: timeuot after 60 seconds unless ip monitor reads
at least one event before that.
Fixes#1124
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The extended kill delay (10 sec) is sometimes not enough for complex
system containers. Also, podman sometimes take the opportunity to do
housekeeping tasks when stopping a container. So, allow for up to 30
sec. grace period before we send SIGKILL.
With the latest image prune extension, set a 60 sec. timeout for the
cleanup task, in case podman gets stuck. This to prevent any future
mishaps.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Highlights:
- fixes to systemd and s6 type services
- bare-bones libsystemd replacement with #include <systemd/sd-daemon.h>
- new reload:script mimicking systemd ExecReload, and
- new stop:script mimicking systemd ExecStop
- exit status/signal info when a process dies
- service kill:SEC now support up to 300 sec.
- the /tmp/norespawn trick now also covers service_retry()
- the sysv 'stop' command process environment is now same as 'start'
- State machine ordering issue: enter new config generation after
services disabled in previous generation have been stopped
Full changelog at:
- <https://github.com/troglobit/finit/releases/tag/4.13>
- <https://github.com/troglobit/finit/releases/tag/4.14>
Fixes#1123
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
As Infix matures as an operating system it is quickly becoming more and
more useful also for end-device use-cases. The README should reflect
this change in focus.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
From the documentation:
> 'podman image prune' removes all dangling images from local storage.
> With the all option, all unused images are deleted (i.e., images not
> in use by any container).
>
> The image prune command does not prune cache images that only use
> layers that are necessary for other images.
So, when the container script is called in the cleanup phase of the
lifetime of a container, we can use the '--all' option to ensure we also
remove this container's loaded image. In the case this happens before
a reboot of the system, there will be no old version of the image loaded
to /var/lib/containers after boot.
Issue #1098
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The board/common/uboot/extras.config was updated with CONFIG_MMC_PCI
*after* we last built the SparX5i bootloader, and this was really only
needed for the Qemu build, so let's move the requirement there.
Also, we now (Buildroot 2025.02) need to update the dependencies for the
Fireant bootloader with libbsd (for some reason) and dtc, of course.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit migrates the bootloader build from Raspberry Pi 4 board
package to a dedicated bootloader defconfig. The idea is to set up
dedicated wokflows for building bootloaders, which change rarely,
streamlining the Infix image builds.
A dedicated workflow, or job in an existing workflow, can then do
the composition to minimal SD-card images useful for starting up
Infix on boards where SD-card is the primary boot source.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
