Fixes a regression from 0c11cea where local composite actions
(.github/actions/) were referenced with relative paths. When spins
reuse our reusable workflows, GitHub resolves relative action paths
in the context of the calling repo, not infix — breaking the build.
Replace all uses of ./.github/actions/{cache-restore,podman-cleanup}
with kernelkit/actions/{cache-restore,podman-cleanup}@v1 (new repo).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Before netd starts confd might want to create .conf file for it to run,
so we sort of depend on /etc/net.d existing at boot.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Two races could prevent DHCP-learned default routes from being installed
at boot:
1. The signal from the DHCP client script could be lost leaving conf.d
updated but frr.conf stale.
2. Even when the signal was received, 'vtysh -b' could fail because the
FRR daemon chain (mgmtd→zebra→staticd) writes PID files before being
fully operational, causing netd to give up with no retry.
Fix both by refactoring netd to use libev:
- Use an inotify watch of CONF_DIR, so netd reacts directly to file
changes without depending on signal delivery.
- On backend_apply() failure, schedule a retry in 5s and call pidfile()
unconditionally so dependent services are not blocked waiting for the
Finit condition 'pid/netd' to be satisfied.
We also take this opportunity to rename /etc/netd/conf.d/ to /etc/net.d/
The extra /etc/netd/ directory level served no purpose — nothing else
lives there. Flatten to /etc/net.d/ which reads more naturally as the
drop-in directory for network configuration snippets.
Also, reduce logging a bit since each netd backend already logs success
or fail which is sufficient to know that a configuration change has been
applied or not.
Finally, with the new inotify processing in netd it's redundant to call
'initctl reload netd' from the udhcpc script, in fact it will only cause
unnecessary overhead, so we drop it.
Fixes#1438
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add a must expression to ensure users do not set static neighbors when
the interface type is not point-to-multipoint or non-broadcast.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The MVEBU SafeXcel Crypto Engine firmware (linux-firmware minifw) was
originally added in 70c12c3 to the generic aarch64 defconfigs to silence
kernel probe failures on Marvell Armada SoCs (37xx, 7k, 8k, CN913x):
crypto-safexcel f2800000.crypto: Firmware load failed.
crypto-safexcel f2800000.crypto: HW init failed (-2)
It was then accidentally dropped in 0e2d12e (kernel upgrade to 6.18),
which rebased on a tree that predated the firmware addition.
Rather than restoring it to the generic defconfigs, move it to the two
Marvell board Config.in files where it actually belongs — consistent
with how RTL8169 firmware was handled for the Raspberry Pi CM4 IoT
Router Board Mini in 68313773.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A legacy name length limit in firewalld triggered problems with longer
policy names. This patch to firewalld lifts that limit by checking the
backend in use, no limit for nftables.
Fixes#1389
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Increase Zebra NETLINK buffer to fix reported issues with zebra being
out of sync with kernel routes and interface changes.
Also, try '-a' option to allow other processes to delete zebra routes.
Other changes in this commit:
- Minor fixes to Finit service files for consistency
- Empty daemon.conf stub files to silence bogus mgmtd errors at startup
- Relocate all skeleton files from board/common to separate from files
that are actual Infix additions and what's package system integration
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This is a follow-up to c559b8f2 (new-frr) where netd now is responsible
for funneling static routes, as well as routes from DHCP clients, into
the kernel via Frr.
For this to work, in particular at boot, any DHCP client must wait for
netd to have started or any default routes learned will be lost.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
DNS does not allow CNAME records at an apex domain (e.g. kernelkit.org),
so GitHub Pages cannot reliably redirect kernelkit.github.io to it. A
www subdomain can carry a CNAME pointing directly to kernelkit.github.io,
giving GitHub full control over the mapping and making the redirect work.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
The weird `if env | grep -q 'reset-volumes'` construct is due to Klish
not sanitizing names before constructing variables, which leads to env
variables with '-' in them, not allowed in POSIX sh.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
curl's SCP/SFTP backend (libssh2) does not support interactive password
prompting — it fails with an authentication error unless credentials are
supplied non-interactively.
Replace the curl path for SSH URIs with native scp(1), which inherits
the TTY and prompts the user for a password as expected. Both scp://
and sftp:// URIs are handled by parsing the URI into a [user@]host:path
argument. Port is extracted if present and passed via -P. If no user
is embedded in the URI, the -u flag value (remote_user) is used instead.
Host-key verification is skipped with -o StrictHostKeyChecking=no, the
same trade-off already made by the test framework.
When the destination URI ends with '/', a meaningful remote filename is
derived from the source: the datastore's on-disk filename (e.g.,
startup-config.cfg), the datastore short-name for in-memory stores, or
the source file's own basename for plain file copies.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Add input validation patterns to string-type leaves in container,
firewall, DHCP, and interface YANG models. Also use mkdtemp() for
temporary key files in keystore.
Signed-off-by: Mattias Walström <lazzer@gmail.com>
Any exception raised by fn() propagated immediately out of the retry
loop, effectively making until() a single-shot call the moment any
transient error occurred.
Fix by wrapping fn() in a try/except inside the loop and treating any
exception as a "not yet" result. The last exception is preserved and
re-raised if all attempts are exhausted, so failure output is still
meaningful. Also fix a missing newline at end of file.
Fixes#1403
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
