Infix defines its own Kconfig options with unprefixed names (IMAGE_*,
QEMU_*, TRUSTED_KEYS*) and an INFIX_ prefix. Unprefixed names risk
clashing with Buildroot and with other br2-externals/spins that source
our tree.
Rename all 86 options to a common IX_ prefix, collapsing the existing
INFIX_ ones, e.g. INFIX_IMAGE_ID becomes IX_IMAGE_ID. The os-release
INFIX_DESC field is a runtime interface, not a Kconfig option, and is
kept; the qemu Config.in generator's @ARCH@ symbol is updated to match.
Closes#1305
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Releases exposed the RAUC upgrade bundle only inside the per-arch
tarball, and shipped no ready-to-flash Raspberry Pi image; users had
to unpack the tarball or assemble an image from a separate bootloader.
Upload output/images/*.pkg as its own artifact, and build an rpi64 SD
card image in the aarch64 release leg before rootfs.squashfs is
stripped from the tarball, combining it with the rpi64 bootloader from
the latest-boot release. Publish both as release assets; the tarball
still carries the .pkg too.
Closes#1084
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Reorder the README so newcomers see the product before the philosophy:
CLI demo and web UI up top, a "Try it in 5 minutes" section linking the
GNS3 and build-from-source guides, then hardware and the rest. Tone
down the remaining marketing prose in the hardware and use-case lists.
Rename CODE-OF-CONDUCT.md to CODE_OF_CONDUCT.md so GitHub recognises it
as the community code of conduct, and link the .github/ health files
from the README.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
GitHub now publishes a sha256 checksum for each release asset, so the
separately generated .sha256 files are redundant.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add govulncheck CI and Dependabot for the two Go modules, src/webui
and src/netbrowse, so vendored dependencies don't quietly accumulate
CVEs between manual updates.
The workflow reports every finding in the run summary but only fails
on vulnerabilities our code actually calls in a dependency. Called
stdlib vulnerabilities are surfaced too, but they're fixed by bumping
the Buildroot host Go rather than a module's go.mod, so they don't
gate the build.
Dependabot ignores openconfig/goyang: it's pinned to our kernelkit
fork via a replace directive and stepped by hand.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Finishes the migration started in 63f46d4d: setup-mkdocs was still
referenced via a relative ./.github/actions path, which GitHub resolves
against the calling repo, not infix, breaking spins (e.g. Styx) that
reuse build.yml/build-release.yml. Use kernelkit/actions/setup-mkdocs@v1.2.
Signed-off-by: Richard Alpe <richard@bit42.se>
Build the mkdocs User's Guide into WebUI images and surface it in the UI.
post-build.sh runs `mkdocs build` from the top-level mkdocs.yml into
/var/www/guide when the webui package is selected and mkdocs is on the
build host; nginx serves it read-only at /guide/. The build is
best-effort — a missing mkdocs warns and ships without the guide rather
than failing — and minimal images (no webui) skip it.
The WebUI gates a book icon in the topbar and a User Guide item in the
user menu on the docs being present on disk (os.Stat, fail-closed), both
opening /guide/ in a new tab.
CI: a local setup-mkdocs composite action installs mkdocs and the
plugins from mkdocs.yml; the build and release workflows run it before
the build so images produced in CI include the guide. developers-guide
documents the new build dependency and restores the missing
mkdocs-glightbox plugin.
Fixes#633
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This commit introduces xpath coverage test report. It plugs into transport layer of test system and generates .md report.
Commit also introduces "make xpath-coverage-report" used to generate pdf out of md.
Resolves: #581
Signed-off-by: Ejub Sabic <ejub1946@outlook.com>
The regression tests do not pass for some reason, could be faulty test
runner (Lifeboat) -- container and DHCP tests failing since Apr 30), so
tests are disabled until the runner is fixed.
[skip ci]
Issue #1392
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Without INFIX_RELEASE, make test resolves INFIX_ARTIFACT to the
unversioned infix-x86_64, but release builds produce versioned
artifacts (infix-x86_64-v26.04.0-rc1.qcow2 etc.), causing the
test environment to fail with "No such file or directory".
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add an x86_64 regression test job to release.yml that runs after the
build and gates publishing — the release job now requires both build
and test to succeed.
Update test.yml's artifact restore step to use a glob so it handles
both the unversioned CI artifact name (infix-x86_64.tar.gz) and the
versioned release artifact name (infix-x86_64-26.04.0.tar.gz).
Fixes#1392
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add board support for the BananaPi BPI-R4 router board, based on the
MediaTek MT7988A (Filogic 880) SoC with quad-core Cortex-A73 CPU.
The BPI-R4 is the successor to the BPI-R3 but uses entirely different
silicon: the internal switch runs at 2.5 GbE per port, the two SFP+
uplinks use native USXGMII at up to 10 Gbps, and WiFi is provided by
a MediaTek MT7996E PCIe module supporting tri-band WiFi 7 (2.4/5/6 GHz).
Two board variants, BPI-R4-2g5 and BPI-R4P, replace one SFP+ cage with
a 2.5 GbE RJ45 port (using the MT7988A internal 2.5G PHY); the R4P adds
an optional PoE daughterboard on that port. Both use the upstream
mt7988a-bananapi-bpi-r4-2g5 device tree.
Interfaces:
- Standard R4: eth1 (gmac1/sfp2 LAN cage) → sfp2, eth2 (gmac2/sfp1 WAN cage) → sfp1
- R4-2g5/R4P: eth1 (2.5G PHY) → wan, eth2 (gmac2/sfp1 WAN cage) → sfp1
Factory reset / WPS button (GPIO14, active-low): detected by U-Boot at
boot for factory reset; reused by Linux as KEY_WPS_BUTTON at runtime.
eMMC install note: the MT7988A eMMC (pins 38-49) and SD card (pins 32-37)
use separate physical pads so there is no electrical bus sharing, unlike
some BPi-R3 configurations. However, a single MMC controller
(mmc@11230000) handles both, so only one is active per boot session.
The eMMC install procedure therefore still requires an intermediate SPI
NAND bootloader step until a Linux-side install path is tested.
SD card build (bpi_r4_sd_boot_defconfig) now uses the new
mt7988a_bpir4_sd U-Boot defconfig with cap-sd-highspeed enabled,
giving 50 MHz SD transfers instead of the previous 25 MHz legacy mode.
Also adds MT7988/MT7996 firmware support to the buildroot linux-firmware
package, for 2.5 GbE port PHY and WiFi7 extension board, and updates the
aarch64_defconfig, aarch64_minimal_defconfig, the arch README, CI
boot/image workflows, mkimage.sh, and the ChangeLog.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
statd now uses avahi-client for mDNS neighbor tracking, so the
native build needs libavahi-client-dev to satisfy pkg-config.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Fixes a regression from 0c11cea where local composite actions
(.github/actions/) were referenced with relative paths. When spins
reuse our reusable workflows, GitHub resolves relative action paths
in the context of the calling repo, not infix — breaking the build.
Replace all uses of ./.github/actions/{cache-restore,podman-cleanup}
with kernelkit/actions/{cache-restore,podman-cleanup}@v1 (new repo).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Add Raspberry Pi 2B to the bootloader build matrix and raspberrypi-rpi2
to the SD card image builder, enabling full RPi 2B image creation.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Catch ARM 32-bit build regressions early by adding arm targets
to the familty of Infix image and release builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
When PR #1271 was merged (commit c34c8db4), it:
1. Created a new coverity-build target in src/Makefile
2. Updated .github/workflows/coverity.yml to call make coverity-build
3. Forgot to add coverity-build as an explicit target in the top-level Makefile
This commit also simplifies src/Makfile a lot for readability.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's give Coverity Scan its own make target so we can reuse 'make check'
for our own scan-build or cppcheck needs.
[skip ci]
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Release tarballs waste ~131MB per architecture by including both
rootfs.itb and rootfs.squashfs, even though rootfs.itb already
contains the squashfs (itb = 4096-byte header + squashfs).
This change removes rootfs.squashfs from releases and provides two
solutions for users who need it:
1. utils/extract-squashfs.sh - Full-featured utility for extracting
squashfs from release tarballs or .itb files. Includes validation
and helpful error messages.
2. board/common/qemu/qemu.sh - Auto-extraction support. When running
in initrd mode, automatically extracts rootfs.squashfs from
rootfs.itb if missing. Zero user impact - ./qemu.sh just works!
Space savings: ~262MB per release (2 architectures × 131MB)
Fixes#858
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Prevent patch releases from stealing the "latest" tag from newer minor
versions. Only vXX.YY and vXX.YY.0 releases should be marked as latest.
Fixes#1187
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Collect only the most relevant info for SBOM. The CycloneDX format seems
to be what most tools are standardizing around, and they suggest saving
manifest.csv and cpe.json files. This commit includes all *.csv files
and drops sources and licenses for release builds, as decided in #1192Fixes#1217resolves#1192
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Allow a workflow caller to run pre-build scripts though a workflow
call variable. This is potentially dangerous as code can be injected
here. If for example a malicious actor wants to run there C2 code in
the context of someone else they could perhaps inject it here. I
assume this is protected by the same mecahism as the workflow files
themself. I.e. github users untrusted to the Infix org won't be able
to trigger workflows before being explicitly allowed to do so.
This patch also adds a checkout secret. This allows upstream callers
to fetch there own spin / fork though the infix workflows, if they
provide a checkout token with the correct permissions to do so.
Signed-off-by: Richard Alpe <richard@bit42.se>
Joachim Wiberg