Previously, post-image.sh was able to create QEMU images from an
existing release tarball. This was useful when you wanted to test a
new bootloader build without having to wait for a full Infix build.
Restore this capability by adding a separate image target for it, and
then allow image-itb-qcow to source its input images from that instead
of a locally build squash+aux.
Limit support to x86, like we do on the "official" appliances on the
marketplace. Aarch64 has never really been used AFAIK.
Avoid the os-release import, since all that info is not important now
that these appliance files are only for development scenarios. In all
other cases, the official one, based on a proper release, should be
used.
We have not installed .dtb:s to $O/images/ for quite some time, and
nobody cared. That goes to show that this is not really used.
The image is still useful at times, so if it needed in the future,
then we can resurrect it from the logs and refactor it to an image
package.
Add a generic image target to build aux.ext4, which can be used both
when creating target-specific SD-card images, and when creating
regular disk images.
While we're here, make sure that we don't need a RAUC bundle in order
to generate aux.ext4 (which mkrauc-status.sh did). This saves us time
on _every_ incremental build.
Rather than using the creation of a signed image as a proxy for
whether the trusted keys should be installed RAUC/U-Boot's trust
stores, use the dedicated option.
The board/*/*/*.mk is very broad, intended to hit all board specific
definitions, but may also cause duplicate inclusions, e.g., in
board/common.
Let each architecture do the inclusion instead.
Validate keys in gen_hostkey() before passing empty keys to shell scripts,
preventing:
Nov 04 2024 10:54:25 confd[2697]: SSH key (genkey) does not exist, generating...
Nov 04 2024 10:54:25 confd[2697]: writing RSA key
Nov 04 2024 10:54:26 confd[2697]: do_convert_from_pkcs8: /tmp/tmp.FH1Hr1 is not a recognised public key format
Also, fix base64 content formatting with proper 64-character line wrapping
using printf+fold instead of echo.
Use PKCS#1 RSA format for public keys as required by netopeer2-server, while
keeping PKCS#8 format for private keys. Use proper ssh-keygen format flag
(PKCS8) for correct conversion.
Fixes#1289
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
- firewall: allow traffic to be forwarded from lan to wan zone
- dhcpv6: enable client on wan interface
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Now that we've got everything working, it's just annoying, so disable it
but leave it in with a comment.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Simplify fallback MAC detection to return lowest valid MAC address.
This is the easiest to document and explain to end users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Set LANG=C.UTF-8 in finit.conf for system-wide coverage, in profile.d
for login shells, and in bash.bashrc for interactive shells to ensure
comprehensive Unicode support across all user interactions.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Devices should tell the server what they are in case an administrator
wants to group or hand out dedicated leases and information to some
devices on the lan.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
This allows us to gather better product information in /run/system.json
also for x86 based systems. For Qemu x86_64 systems the 'product-name'
changes from 'VM' to 'Standard PC (i440FX + PIIX, 1996)'.
Also, add new 'product-version' field for, e.g., board revisions, and add
missing 'serial-number' value for systems like Rasperry Pi that inject it
in the device tree.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate that DHCP options were requested in the parameter request
list before applying them. This prevents malicious or misconfigured
DHCP servers from forcing unwanted configuration changes.
Validates: hostname (12), DNS (6), domain (15), search (119),
router (3), static routes (121), and NTP (42).
Fail-safe behavior: rejects options if config file unavailable.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Resolve race condition between DHCP and configured hostname by introducing
priority-based hostname management using /etc/hostname.d/ directory pattern.
Priority order (highest wins):
90-dhcp-<iface> - DHCP assigned hostname
50-configured - YANG /system/hostname config
10-default - Bootstrap/factory default
The new /usr/libexec/infix/hostname helper reads all sources and applies the
highest priority hostname. It exits early if hostname unchanged, preventing
unnecessary service restarts.
Fixes#1112
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
After some discussion we agreed that this operation is the domain of
confd (or dagger) and any DHCP client should not mess with the admin
state of the interface it runs on.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Basic DHCPv6 support as a per-interface ipv6 setting, not in line with
the IETF YANG model, which has this as a root container.
Note, this also fixes DHCPv4 option inference after the relocation of
/dhcp-client to /interfaces, in 764bd8e.
Fixes#1110
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Release tarballs waste ~131MB per architecture by including both
rootfs.itb and rootfs.squashfs, even though rootfs.itb already
contains the squashfs (itb = 4096-byte header + squashfs).
This change removes rootfs.squashfs from releases and provides two
solutions for users who need it:
1. utils/extract-squashfs.sh - Full-featured utility for extracting
squashfs from release tarballs or .itb files. Includes validation
and helpful error messages.
2. board/common/qemu/qemu.sh - Auto-extraction support. When running
in initrd mode, automatically extracts rootfs.squashfs from
rootfs.itb if missing. Zero user impact - ./qemu.sh just works!
Space savings: ~262MB per release (2 architectures × 131MB)
Fixes#858
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Check if partition/LABEL is available before trying to run tune2fs and
mount commands on it. This change masks the kernel output:
LABEL=var: Can't lookup blockdev
commne when running `make run` on x86_64 builds.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
In 45efa94 we introduced new mount options for the: 'aux', 'cfg', and
'var' partitions. To save boot time, we also disabled the periodic fsck
check, which does not affect journal replay or other Ext4 safety or
integrity checks. The latter involved calling tune2fs at runtime, but
this caused the following to appear for the 'aux' partition, which is a
reduced ext4 for systems that need to change U-Boot settings, e.g., to
set MAC address on systems without a VPD.
EXT4-fs: Mount option(s) incompatible with ext2
Note, this is a "bogus" warning, setting the fstypt to ext2 in fstab is
not the way around this one. That's been tried.
To make matters worse, the new mount option(s), e.g., 'commit=30', gave
us another set of warnings from the kernel. This was due to the fstype
being 'auto', so the kernel objected to options not being applicable to
every filesystem it tried before ending up with extfs:
squashfs: Unknown parameter 'commit'
vfat: Unknown parameter 'commit'
exfat: Unknown parameter 'commit'
fuseblk: Unknown parameter 'commit'
btrfs: Unknown parameter 'errors'
This commit explicitly sets cfg and var to ext4, leaving mnt as auto, we
also check before calling tune2fs that the partition/disk image is ext4.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Joachim Wiberg