Merge pull request #1395 from kernelkit/run-fix

Fix extration of rootfs.squashfs in release tarball
board/common: fix extration of rootfs.squashfs in release tarball
2026-07-27 19:23:02 +02:00 · 2026-02-03 15:13:18 +01:00 · 2026-02-03 15:05:20 +01:00 · 2026-02-03 09:58:13 +01:00 · 2026-02-03 09:55:05 +01:00 · 2026-02-03 08:09:05 +01:00
126 changed files with 1330 additions and 472 deletions
@@ -1,6 +1,6 @@
 menu "Board Support"

-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
@@ -1,5 +0,0 @@
-if BR2_arm
-
-source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
-
-endif
@@ -1 +0,0 @@
-
@@ -34,6 +34,10 @@ Infix comes preconfigured with:

 The easiest way to get started is using an SD card:

+> [!NOTE]
+> SD card boot works but we have observed stability issues. For production
+> use or long-term reliability, we recommend installing to eMMC (see below).
+
 1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
 2. **Flash the image to an SD card:** see [this guide][0]
 3. **Set boot switches:**
@@ -53,8 +57,8 @@ The BPI-R3 has a 4-position DIP switch that controls boot media:

 | Position | Mode        | Description                           |
 |----------|-------------|---------------------------------------|
-| 0000     | SD card     | Boot from microSD card (recommended)  |
-| 0110     | eMMC        | Boot from internal eMMC storage       |
+| 0000     | SD card     | Boot from microSD card                |
+| 0110     | eMMC        | Boot from internal eMMC (recommended) |
 | 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |

 > [!NOTE]
@@ -67,10 +71,16 @@ For production deployments or better performance, you can install Infix
 to the internal eMMC storage. This is more complex but provides faster
 boot times and eliminates the external SD card.

+> [!IMPORTANT]
+> While Infix boots on both SD card and eMMC, we have observed stability
+> issues with SD cards on this platform. **eMMC is recommended** for
+> reliable operation.
+
 ### Why Use eMMC?

 **Advantages:**

+- More reliable than SD card (stability issues observed with SD cards)
 - Faster boot and better performance
 - No external SD card to manage
 - More robust for industrial/embedded deployments
@@ -218,8 +218,8 @@
      "symmetric-key": [
        {
          "name": "wifi",
-          "infix-keystore:symmetric-key": "infixinfix",
-          "infix-keystore:key-format": "infix-crypto-types:wifi-preshared-key-format"
+          "cleartext-symmetric-key": "aW5maXhpbmZpeA==",
+          "key-format": "infix-crypto-types:passphrase-key-format"
        }
      ]
    }
@@ -578,6 +578,7 @@ CONFIG_PHY_SAMSUNG_USB2=y
 CONFIG_NVMEM_LAYOUT_ONIE_TLV=y
 CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
@@ -597,8 +598,11 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,bpf"
 CONFIG_CRYPTO_CCM=m
@@ -5,7 +5,7 @@ config BR2_PACKAGE_RASPBERRYPI_RPI64
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169
 	help
 	  Raspberry Pi 64-bit adds support for the Raspberry Pi family of
 	  of single-board computers (SBC), RPi 3B and later, including the
@@ -107,8 +107,10 @@ To configure WiFi as a client, first store your WiFi password in the keystore:
 ```
 admin@infix:/> configure
 admin@infix:/config/> edit keystore symmetric-key mywifi
-admin@infix:/config/keystore/…/mywifi/> set key-format wifi-preshared-key-format
-admin@infix:/config/keystore/…/mywifi/> set symmetric-key YourWiFiPassword
+admin@infix:/config/keystore/…/mywifi/> set key-format passphrase-key-format
+admin@infix:/config/keystore/…/mywifi/> change cleartext-symmetric-key
+Passphrase: ************
+Retype passphrase: ************
 admin@infix:/config/keystore/…/mywifi/> leave
 ```

@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/arm/raspberrypi-rpi2/Config.in"
+
+endif
@@ -1,5 +1,5 @@
-aarch32
-=======
+Arm 32-bit
+==========

 Board Specific Documentation
 ----------------------------
@@ -0,0 +1 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm/*/*.mk))
@@ -395,6 +395,9 @@ CONFIG_RASPBERRYPI_POWER=y
 CONFIG_PWM=y
 CONFIG_PWM_BCM2835=y
 CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
@@ -412,8 +415,10 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
 CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_CCM=y
 CONFIG_CRYPTO_GCM=y
@@ -5,11 +5,10 @@ config BR2_PACKAGE_RASPBERRYPI_RPI2
 	select BR2_PACKAGE_FEATURE_WIFI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
 	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
-
 	help
 	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
 	  (SBC) with BCM2836 quad-core Cortex-A7 processor.

-	  This was the only Raspberry Pi model with the BCM2836 and the 2B
-	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
-	  the v1.2 board revision.
+	  This was the only Raspberry Pi model with the BCM2836 and the rare
+	  RPi 2B board revision v1.2 actually got an underclocked BCM2837,
+	  which is the saem Cortex-A53 as the RPi3, but w/o wifi.
@@ -21,9 +21,8 @@ The board features:
 How to Build
 ------------

-Since there are no pre-built images for ARM32, you need to build both Infix
-and the bootloader from source.
-
+Since there are no pre-built images for ARM 32-bit, you need to build both
+Infix and the bootloader from source.

 1. Clone the repository

@@ -37,12 +36,12 @@ and the bootloader from source.

 3. Build Infix (in another tree)

-        make O=x-arm32 aarch32_defconfig
-        make O=x-arm32
+        make O=x-arm arm_defconfig
+        make O=x-arm

 4. Create the SD card image

-        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
+        ./utils/mkimage.sh -b x-boot -r x-arm raspberrypi-rpi2

 The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`

@@ -231,7 +231,7 @@ config QEMU_NET_MODEL
 	  if you want to play with low-level stuff like ethtool, you
 	  might want to test the Intel 82545EM driver, e1000.

-	  Note: ARM32 uses virtio-net-device (MMIO) by default.
+	  Note: ARM 32-bit uses virtio-net-device (MMIO) by default.

 config QEMU_NET_BRIDGE_DEV
 	string "Bridge device"
@@ -83,7 +83,7 @@ loader_args()

 append_args()
 {
-    # ARM32 doesn't support virtio console properly, always use serial
+    # ARM 32-bit doesn't support virtio console properly, always use serial
    if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "console=ttyAMA0 "
    elif [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
@@ -122,7 +122,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	# ARM32 virt machine uses MMIO virtio devices, not PCI
+	# ARM 32-bit virt machine uses MMIO virtio devices, not PCI
 	if [ "$CONFIG_QEMU_arm" ]; then
 	    echo -n "-drive file=qemu.qcow2,if=none,format=qcow2,id=rootfs "
 	    echo -n "-device virtio-blk-device,drive=rootfs "
@@ -189,7 +189,7 @@ rw_args()
 	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
    fi

-    # ARM32 virt machine uses MMIO virtio devices, not PCI
+    # ARM 32-bit virt machine uses MMIO virtio devices, not PCI
    if [ "$CONFIG_QEMU_arm" ]; then
 	echo -n "-drive file=aux.ext4,if=none,format=raw,id=aux "
 	echo -n "-device virtio-blk-device,drive=aux "
@@ -358,13 +358,12 @@ extract_squashfs()
 run_qemu()
 {
    # Auto-extract rootfs.squashfs from rootfs.itb if needed for initrd mode
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	if [ "$CONFIG_QEMU_ROOTFS" = "rootfs.squashfs" ] && [ ! -f "rootfs.squashfs" ]; then
-	    if [ -f "rootfs.itb" ]; then
-		extract_squashfs "rootfs.itb" "rootfs.squashfs"
-	    else
-		die "Missing rootfs.squashfs and cannot find rootfs.itb to extract it from"
-	    fi
+    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ] && [ ! -f "$CONFIG_QEMU_ROOTFS" ]; then
+	itb="${CONFIG_QEMU_ROOTFS%.squashfs}.itb"
+	if [ -f "$itb" ]; then
+	    extract_squashfs "$itb" "$CONFIG_QEMU_ROOTFS"
+	else
+	    die "Missing $CONFIG_QEMU_ROOTFS and cannot find $itb to extract it from"
 	fi
    fi

@@ -1,23 +1,49 @@
 #!/bin/sh
+# Prompt for a secret with confirmation, then encode and output it.
+#
+# Default mode: hash with mkpasswd (for system passwords)
+#    askpass [OUTPUT]
+#
+# Base64 mode (-b): base64-encode (for keystore passphrases)
+#    askpass -b [OUTPUT]
+#
+# If OUTPUT is given, result is written to the file.
+# If omitted, result is written to stdout.
 # shellcheck disable=SC3045

+LABEL="New password"
+MODE=hash
+if [ "$1" = "-b" ]; then
+    LABEL="Passphrase"
+    MODE=base64
+    shift
+fi
 OUTPUT=$1

-read -r -s -p "New password: " password
+read -r -s -p "$LABEL: " secret
 >&2 echo
-read -r -s -p "Retype password: " password_again
+read -r -s -p "Retype $LABEL: " secret_again
 >&2 echo

-if [ "$password" != "$password_again" ]; then
-    echo "Passwords do not match, try again."
+if [ "$secret" != "$secret_again" ]; then
+    echo "${LABEL}s do not match, try again."
    exit 1
 fi

-if [ -z "$OUTPUT" ]; then
-    echo "$password"
-    exit 0
+if [ -z "$secret" ]; then
+    echo "Empty $LABEL, try again."
+    exit 1
+fi
+
+if [ "$MODE" = "base64" ]; then
+    encoded=$(printf '%s' "$secret" | base64 -w 0)
+else
+    encoded=$(printf '%s\n' "$secret" | mkpasswd -s)
 fi

 umask 0177
-echo "$password" | mkpasswd -s > "$OUTPUT"
-exit 0
+if [ -z "$OUTPUT" ]; then
+    echo "$encoded"
+else
+    printf '%s' "$encoded" > "$OUTPUT"
+fi
@@ -63,6 +63,21 @@ calc_sha()
    sha256sum "$1" 2>/dev/null | awk '{print $1}'
 }

+# Calculate a combined SHA256 over the container script and its
+# optional env file.  Environment variables are stored separately
+# from the script, so both must be included in the checksum to
+# detect configuration changes such as added/changed env vars.
+calc_config_sha()
+{
+    _envfile="/run/containers/args/${name}.env"
+
+    if [ -f "$_envfile" ]; then
+	cat "$1" "$_envfile" | sha256sum | awk '{print $1}'
+    else
+	calc_sha "$1"
+    fi
+}
+
 # Check image transport, return 0 if remote, 1 if local
 is_remote()
 {
@@ -124,7 +139,7 @@ is_uptodate()
 		    # If SHA matches, check container instance
 		    if [ "$stored_sha" = "$current_sha" ]; then
 			if podman container exists "$name"; then
-			    config_sha=$(calc_sha "$script")
+			    config_sha=$(calc_config_sha "$script")
 			    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)
 			    container_img_sha=$(podman inspect "$name" --format '{{index .Config.Labels "meta-image-sha256"}}' 2>/dev/null)

@@ -143,7 +158,7 @@ is_uptodate()
    else
 	# Remote image optimization: check config-sha256 only
 	if podman container exists "$name"; then
-	    config_sha=$(calc_sha "$script")
+	    config_sha=$(calc_config_sha "$script")
 	    container_sha=$(podman inspect "$name" --format '{{index .Config.Labels "config-sha256"}}' 2>/dev/null)

 	    if [ "$container_sha" = "$config_sha" ]; then
@@ -459,7 +474,7 @@ create()
 	fi

 	# Add config checksum label
-	args="$args --label config-sha256=$(calc_sha "$script")"
+	args="$args --label config-sha256=$(calc_config_sha "$script")"
    fi

    # shellcheck disable=SC2048
@@ -415,6 +415,7 @@ CONFIG_PHY_STARFIVE_JH7110_DPHY_RX=y
 CONFIG_PHY_STARFIVE_JH7110_PCIE=y
 CONFIG_PHY_STARFIVE_JH7110_USB=y
 CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
@@ -452,6 +453,7 @@ CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
 CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_SECURITY=y
 CONFIG_LSM=""
 CONFIG_CRYPTO_CCM=m
@@ -306,7 +306,10 @@ CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT2_FS_POSIX_ACL=y
 CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
 CONFIG_BTRFS_FS=y
 CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FUSE_FS=y
@@ -321,8 +324,11 @@ CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
 CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
+CONFIG_NLS_DEFAULT="iso8859-15"
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_ISO8859_15=y
+CONFIG_NLS_UTF8=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
@@ -27,18 +27,16 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_8169=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -53,7 +51,6 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -74,7 +71,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -87,7 +83,6 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -95,6 +90,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -125,7 +121,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -137,11 +133,7 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -149,6 +141,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
 BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
@@ -166,6 +163,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -8,13 +8,14 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,17 +27,16 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -51,15 +51,13 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -67,7 +65,6 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -78,6 +75,7 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -86,6 +84,7 @@ BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -101,7 +100,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -112,11 +111,7 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://kernelkit.org"
-INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://kernelkit.org/infix/"
-INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_BANANAPI_BPI_R3=y
 BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S=y
@@ -124,6 +119,11 @@ BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_RASPBERRYPI_RPI64=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+INFIX_VENDOR_HOME="https://kernelkit.org"
+INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
+INFIX_HOME="https://github.com/kernelkit/infix/"
+INFIX_DOC="https://kernelkit.org/infix/"
+INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
@@ -137,6 +137,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -144,11 +145,8 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_ONIEPROM=y
-BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
-BR2_PACKAGE_GETENT=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,18 +24,16 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -50,10 +48,12 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
@@ -62,31 +62,49 @@ BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
+BR2_PACKAGE_LIBPAM_RADIUS_AUTH=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
 BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
+BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
+BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_IPERF3=y
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
+BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NETCAT_OPENBSD=y
+BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_NMAP=y
+BR2_PACKAGE_NMAP_NCAT=y
+BR2_PACKAGE_NMAP_NMAP=y
+BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
 BR2_PACKAGE_TCPDUMP=y
+BR2_PACKAGE_TRACEROUTE=y
+BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
+BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_GETENT=y
+BR2_PACKAGE_HTOP=y
+BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -102,7 +120,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -114,12 +132,17 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
@@ -137,12 +160,16 @@ BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_ONIEPROM=y
+BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 IMAGE_ITB_AUX=y
 IMAGE_ITB_QCOW=y
 IMAGE_ITB_RAUC=y
@@ -3,13 +3,13 @@ BR2_cortex_a7=y
 BR2_ARM_FPU_NEON_VFPV4=y
 BR2_TOOLCHAIN_EXTERNAL=y
 BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN_ARMV7_EABIHF_GLIBC_STABLE=y
 BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -24,18 +24,16 @@ BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/rootfs"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/arm/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/linux_defconfig"
+BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -50,6 +48,7 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
@@ -78,6 +77,7 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -102,7 +102,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -114,6 +114,9 @@ BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_RASPBERRYPI_RPI2=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -37,5 +37,6 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -43,6 +43,7 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -1,5 +1,6 @@
 BR2_riscv=y
 BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
 BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
 BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
@@ -17,7 +18,6 @@ BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
-BR2_SYSTEM_DEFAULT_PATH="/bin:/sbin:/usr/bin:/usr/sbin"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
@@ -36,21 +36,17 @@ BR2_LINUX_KERNEL_INTREE_DTS_NAME="starfive/jh7110-starfive-visionfive-2-v1.3b"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
+BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
-BR2_PACKAGE_LINUX_FIRMWARE=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT61=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT73=y
 BR2_PACKAGE_LINUX_FIRMWARE_RALINK_RT2XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_81XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_87XX=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_88XX=y
-BR2_PACKAGE_LINUX_FIRMWARE_RTL_RTW88=y
 BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
@@ -61,12 +57,10 @@ BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -87,7 +81,6 @@ BR2_PACKAGE_CONNTRACK_TOOLS=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPERF3=y
@@ -100,7 +93,6 @@ BR2_PACKAGE_MTR=y
 BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
-BR2_PACKAGE_NFTABLES=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
@@ -108,6 +100,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -115,6 +108,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_WHOIS=y
+BR2_PACKAGE_WIREGUARD_TOOLS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_NEOFETCH=y
 BR2_PACKAGE_SUDO=y
@@ -137,7 +131,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -173,11 +167,15 @@ BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/riscv64/visio
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
@@ -190,6 +188,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -17,16 +17,16 @@ BR2_SYSTEM_BIN_SH_NONE=y
 BR2_PACKAGE_RPI_FIRMWARE=y
 BR2_PACKAGE_RPI_FIRMWARE_BOOTCODE_BIN=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI=y
-BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/config.txt"
-BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/cmdline.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/cmdline.txt"
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_BAREBOX=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
 BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2025.06.0"
 BR2_TARGET_BAREBOX_BOARD_DEFCONFIG="rpi"
-BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/extras.config"
-BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/aarch32/raspberrypi-rpi2/barebox/env"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/extras.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="${BR2_EXTERNAL_INFIX_PATH}/board/arm/raspberrypi-rpi2/barebox/env"
 BR2_TARGET_BAREBOX_IMAGE_FILE="images/barebox-raspberry-pi-2.img"
 BR2_PACKAGE_HOST_BMAP_TOOLS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
@@ -38,6 +38,7 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 BR2_PACKAGE_BOOTLOADER_SPLASHSCREEN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
@@ -26,13 +26,12 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
@@ -56,6 +55,7 @@ BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -89,6 +89,7 @@ BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
 BR2_PACKAGE_NMAP_NPING=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -119,7 +120,7 @@ BR2_PACKAGE_WATCHDOGD_LOADAVG=y
 BR2_PACKAGE_WATCHDOGD_FILENR=y
 BR2_PACKAGE_WATCHDOGD_MEMINFO=y
 BR2_PACKAGE_WATCHDOGD_FSMON=y
-BR2_PACKAGE_WATCHDOGD_TEMPMON
+BR2_PACKAGE_WATCHDOGD_TEMPMON=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
@@ -138,13 +139,15 @@ BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://kernelkit.org/infix/"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_FEATURE_WIFI=y
-BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_FEATURE_WIFI_MEDIATEK=y
+BR2_PACKAGE_FEATURE_WIFI_REALTEK=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
@@ -26,18 +26,17 @@ BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNA
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.7"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.18.8"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
 BR2_PACKAGE_DBUS_CXX=y
 BR2_PACKAGE_DBUS_GLIB=y
 BR2_PACKAGE_DBUS_TRIGGERD=y
@@ -51,13 +50,13 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
+BR2_PACKAGE_SYSREPO_GROUP="sysrepo"
 BR2_PACKAGE_LINUX_PAM=y
 BR2_PACKAGE_ONIGURUMA=y
 BR2_PACKAGE_AVAHI_DAEMON=y
@@ -65,7 +64,6 @@ BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
 BR2_PACKAGE_CHRONY=y
 BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_FRR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
@@ -76,6 +74,7 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NGINX=y
 BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
 BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
+BR2_PACKAGE_ODHCP6C=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -118,6 +117,7 @@ BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FDT_ADD_PUBKEY=y
 INFIX_VENDOR_HOME="https://kernelkit.org"
 INFIX_DESC="Infix is an immutable, friendly, and secure operating system that turns any ARM or x86 device into a powerful, manageable network appliance. Deploy on anything from $35 Raspberry Pi boards to enterprise switches as routers, IoT gateways, or edge devices. Infix models Linux networking features using YANG so you can manage your devices using NETCONF/RESTCONF APIs and focus on your business logic running in isolated containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
@@ -136,6 +136,7 @@ BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
 BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
+BR2_PACKAGE_FIREWALL=y
 BR2_PACKAGE_IITO=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
@@ -3,7 +3,7 @@ Change Log

 All notable changes to the project are documented in this file.

-[v26.01.0][UNRELEASED]
+[v26.01.0][] - 2026-02-03
 -------------------------

 > [!IMPORTANT]
@@ -23,7 +23,7 @@ All notable changes to the project are documented in this file.

 Noteworthy changes and additions in this release are marked below in bold text.

- Upgrade **Linux kernel to 6.18.7** (LTS)
+- **Upgrade Linux kernel from 6.12.65 to 6.18.8 (LTS)**
 - Upgrade Buildroot to 2025.02.10 (LTS)
 - Upgrade libyang to 4.2.2
 - Upgrade sysrepo to 4.2.10
@@ -53,6 +53,9 @@ Noteworthy changes and additions in this release are marked below in bold text.
  removed during upgrade (for the rest of the configuration to apply) and you
  need to reconfigure them again.  See the [WiFi][] documentation for details
 - Add support for **WireGuard VPN tunnels**.
+- Updated CLI change command to support `cleartext-symmetric-key` (type binary).
+  Used by both WireGuard and WiFi, with application-specific `key-format` for
+  keys and passphrases
 - New default NACM privilege levels (user levels) in `factory-config`:
  `operator` (network & container manager) and `guest` (read-only).  For
  details, see the updated system configuration documentation, as well as a
@@ -66,12 +69,18 @@ Noteworthy changes and additions in this release are marked below in bold text.

 ### Fixes

+- Fix #515: add per-interface IPv6 forwarding control using the Linux 6.17+
+  `force_forwarding` sysctl.  This provides true per-interface IPv6 forwarding
+  similar to IPv4, correctly mapping to the ietf-ip.yang model semantics
 - Fix #1082: Wi-Fi interfaces always scanned, introduce a `scan-mode` to the
  Wi-Fi concept in Infix
+- Fix #1313: Container is not restarted if environment variable is changed
 - Fix #1314: Raspberry Pi 4B with 1 or 8 GiB RAM does not boot.  This was due
  newer EEPROM firmware in newer boards require a newer rpi-firmware package
 - Fix #1345: firewall not updating when interfaces become bridge/lag ports
 - Fix #1346: firewall complains in syslog, missing `/etc/firewalld/firewalld.conf`
+- Fix Raspberry Pi 2B build, among other things, the `aarch32_defconfig` did
+  not include a dtb.  Please note, the platform has now been renamed to `arm`
 - Fix default password hash in `do password encrypt` command.  New hash is the
  same as the more commonly used `change password` command, *yescrypt*
 - Prevent MOTD from showing on non-shell user login attempts
@@ -31,6 +31,7 @@ CLI has several keybindings, most significant first:
 | Ctrl-q  | Ctrl-v         | Insert next character literally                  |
 | Ctrl-r  |                | History, reversed interactive search (i-search)  |
 | Ctrl-t  |                | Transpose/Swap characters before and at cursor   |
+| Meta-#  | Alt-Shift-3    | Prepend # to current line and submit to history  |

 ## What is Meta?

@@ -415,13 +415,12 @@ admin@example:/>

 ## IPv6 forwarding

-Due to how the Linux kernel manages IPv6 forwarding, we can not fully
-control it per interface via this setting like how IPv4 works.  Instead,
-IPv6 forwarding is globally enabled when at least one interface enable
-forwarding, otherwise it is disabled.
+Forwarding must be enabled on an interface for it to route IPv6
+traffic (static or dynamic).  The setting is per-interface and works
+the same way as IPv4 forwarding.

-The following table shows the system IPv6 features that the `forwarding`
-setting control when it is *Enabled* or *Disabled:
+The following table shows the IPv6 features that the `forwarding`
+setting controls when it is *Enabled* or *Disabled*:

 | **IPv6 Feature**                         | **Enabled** | **Disabled** |
 |:-----------------------------------------|:------------|:-------------|
@@ -0,0 +1,193 @@
+# Keystore
+
+The Infix keystore is a centralized storage system for cryptographic keys
+used throughout the system.  It is based on the IETF standards [RFC 9641][1]
+(Keystore) and [RFC 9640][2] (Cryptographic Types), with Infix extensions
+for WiFi and WireGuard key formats.
+
+## Overview
+
+The keystore supports two types of cryptographic keys:
+
+1. **Asymmetric Keys** — public/private key pairs used for:
+    - SSH host authentication (RSA keys)
+    - WireGuard VPN tunnels (X25519 keys)
+
+2. **Symmetric Keys** — shared secrets used for:
+    - WiFi authentication (WPA2/WPA3 pre-shared keys)
+    - WireGuard VPN pre-shared keys
+
+All keys are stored under the `ietf-keystore` configuration path and can be
+managed via CLI, NETCONF, or RESTCONF.
+
+### Supported Formats
+
+| **Asymmetric Key Format**                                | **Use Case**  | **Key Type** |
+|----------------------------------------------------------|---------------|--------------|
+| `rsa-private-key-format` / `ssh-public-key-format`       | SSH host keys | RSA          |
+| `x25519-private-key-format` / `x25519-public-key-format` | WireGuard VPN | Curve25519   |
+
+| **Symmetric Key Format**        | **Use Case**                          |
+|-----------------------------|-----------------------------------|
+| `passphrase-key-format`     | Human-readable passphrases (WiFi) |
+| `octet-string-key-format`   | Raw symmetric keys (WireGuard)    |
+
+## Asymmetric Keys
+
+Asymmetric keys consist of a public/private key pair.  The public key can be
+shared freely, while the private key must be kept secure.
+
+### SSH Host Keys
+
+SSH host keys identify the system during SSH and NETCONF connections.  The
+default host key is automatically generated on first boot and stored in the
+keystore with the name `genkey`.
+
+See [SSH Management](management.md) for details on generating and importing
+custom SSH host keys.
+
+### WireGuard Keys
+
+WireGuard uses X25519 elliptic curve cryptography for key exchange.  Each
+WireGuard interface requires a public/private key pair stored as an asymmetric
+key in the keystore.  Key pairs can be generated directly from the CLI:
+
+<pre class="cli"><code>admin@example:/> <b>wireguard genkey</b>
+Private: aMqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP=
+Public:  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP=
+</code></pre>
+
+See [WireGuard VPN](vpn-wireguard.md) for key generation and configuration
+examples.
+
+## Symmetric Keys
+
+Symmetric keys are shared secrets where the same key must be configured on
+all systems that need to communicate.
+
+### WiFi Pre-Shared Keys
+
+WiFi networks secured with WPA2 or WPA3 use pre-shared keys stored as
+symmetric keys in the keystore with `passphrase-key-format`.  The
+passphrase must be 8-63 printable ASCII characters.
+
+Since symmetric keys are stored as binary (base64-encoded), the CLI
+provides the `change` command to enter passphrases interactively:
+
+<pre class="cli"><code>admin@example:/config/keystore/…/my-wifi-key/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
+</code></pre>
+
+See [WiFi](wifi.md) for complete configuration examples.
+
+### WireGuard Pre-Shared Keys
+
+WireGuard supports optional pre-shared keys (PSK) that add a layer of
+symmetric encryption alongside Curve25519.  PSKs use the standard IETF
+`octet-string-key-format` (32 random bytes).  This provides defense-in-depth
+against future quantum computers that might break elliptic curve cryptography.
+Note, however, that WireGuard’s authentication and initial key agreement
+remain Curve25519-based, so PSKs only protect the session encryption,
+not the handshake itself.
+
+PSKs can be generated directly from the CLI:
+
+<pre class="cli"><code>admin@example:/> <b>wireguard genpsk</b>
+cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=
+</code></pre>
+
+See [WireGuard VPN](vpn-wireguard.md) for PSK generation and usage examples.
+
+## Viewing Keys
+
+The `show keystore` command in admin-exec mode gives an overview of all
+keys in the keystore.  Passphrases (WiFi passwords) are decoded and shown
+in cleartext, while binary keys (WireGuard PSKs) are shown as base64:
+
+<pre class="cli"><code>admin@example:/> <b>show keystore</b>
+────────────────────────────────────────────────────────────────────────
+<span class="title">Symmetric Keys</span>
+<span class="header">NAME                         FORMAT        VALUE                        </span>
+my-wifi-key                  passphrase    MySecretPassword
+wg-psk                       octet-string  zYr83O4Ykj9i1gN+/aaosJxQx...
+
+────────────────────────────────────────────────────────────────────────
+<span class="title">Asymmetric Keys</span>
+<span class="header">NAME                         TYPE    PUBLIC KEY                         </span>
+genkey                       rsa     MIIBCgKCAQEAnj0YinjhYDgYbEGuh7...
+wg-tunnel                    x25519  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1...
+</code></pre>
+
+To see the full (untruncated) details of a specific key, use the
+`symmetric` or `asymmetric` qualifier with the key name:
+
+<pre class="cli"><code>admin@example:/> <b>show keystore symmetric my-wifi-key</b>
+name                : my-wifi-key
+format              : passphrase
+value               : MySecretPassword
+
+admin@example:/> <b>show keystore asymmetric genkey</b>
+name                : genkey
+algorithm           : rsa
+public key format   : ssh-public-key
+public key          : MIIBCgKCAQEAnj0YinjhY...full key...IDAQAB
+</code></pre>
+
+> [!NOTE]
+> The `show keystore` command is protected by NACM.  Only users in the
+> `admin` group can view keystore data.  Operator-level users will see a
+> message indicating that no keystore data is available.
+
+The full configuration-mode view (including private keys) is still
+available via `configure` and then `show keystore`:
+
+<pre class="cli"><code>admin@example:/config/> <b>show keystore</b>
+</code></pre>
+
+> [!WARNING]
+> The configuration-mode `show keystore` displays private keys in
+> cleartext.  Be careful when viewing keys on shared screens or in
+> logged sessions.  The admin-exec `show keystore` command never
+> displays private keys.
+
+## Deleting Keys
+
+<pre class="cli"><code>admin@example:/> <b>configure</b>
+admin@example:/config/> <b>delete keystore asymmetric-key mykey</b>
+admin@example:/config/> <b>leave</b>
+</code></pre>
+
+> [!CAUTION]
+> Deleting a key that is referenced by a service (SSH, WireGuard, WiFi) will
+> cause that service to fail.  Verify the key is not in use before deletion.
+
+## Security Considerations
+
+The keystore is protected by NACM (Network Access Control Model) rules.
+Only users in the `admin` group can view or modify cryptographic keys.
+See [NACM](nacm.md) for details on access control.
+
+Private keys are stored in cleartext in the configuration database.
+Configuration files and backups containing the keystore should be treated
+as sensitive and protected accordingly.
+
+### Key Validation
+
+Symmetric key values are stored as binary (base64-encoded).  The system
+validates them based on their declared format:
+
+- `passphrase-key-format`:  Used by WiFi, must decode to 8-63 ASCII characters
+- `octet-string-key-format`: Used by Wireguard, must decode to exactly 32 bytes (256 bits)
+
+## References
+
+- [RFC 9641 - A YANG Data Model for a Keystore][1]
+- [RFC 9640 - YANG Data Types and Groupings for Cryptography][2]
+- [WiFi Documentation](wifi.md)
+- [WireGuard VPN Documentation](vpn-wireguard.md)
+- [SSH Management](management.md)
+- [NACM Access Control](nacm.md)
+
+[1]: https://datatracker.ietf.org/doc/html/rfc9641
+[2]: https://datatracker.ietf.org/doc/html/rfc9640
@@ -47,6 +47,11 @@ RSA for now, thus the private key must be
 `ietf-crypto-types:rsa-private-key-format` and the public key
 `ietf-crypto-types:ssh-public-key-format`

+> [!TIP]
+> For comprehensive information about the keystore, including key management,
+> security considerations, and examples for different key types, see the
+> [Keystore documentation](keystore.md).
+
 ### Use your own SSH hostkeys

 Hostkeys can be generated with OpenSSL:
@@ -26,31 +26,25 @@ Key features of WireGuard:
 WireGuard uses public-key cryptography similar to SSH.  Each WireGuard interface
 requires a private key, and each peer is identified by its public key.

-**Generate a WireGuard key pair using the `wg` command:**
-
-```bash
-admin@example:~$ wg genkey | tee privatekey | wg pubkey > publickey
-admin@example:~$ cat privatekey
-aMqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP=
-admin@example:~$ cat publickey
-bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP=
-```
-
-This generates a private key, saves it to `privatekey`, derives the public key,
-and saves it to `publickey`.
-
-**Import the private key into the keystore:**
+**Import the key pair into the keystore:**

 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit keystore asymmetric-key wg-site-a</b>
+admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>do wireguard genkey</b>
+Private: aMqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP=
+Public:  bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP=
 admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>set public-key-format x25519-public-key-format</b>
 admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>set private-key-format x25519-private-key-format</b>
 admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>set public-key bN1CwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP6KsrCwZ1lTP=</b>
-admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>set private-key aMqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP=</b>
+admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>set cleartext-private-key aMqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP5JrqBvZqkSP=</b>
 admin@example:/config/keystore/asymmetric-key/wg-site-a/> <b>leave</b>
 admin@example:/>
 </code></pre>

+> [!TIP]
+> The `do` prefix allows running admin-exec commands from configure context.
+> Use the base for `wireguard genkey` when in admin-exec context.
+
 **Import peer public keys into the truststore:**

 <pre class="cli"><code>admin@example:/> <b>configure</b>
@@ -63,8 +57,7 @@ admin@example:/>

 > [!IMPORTANT]
 > Keep private keys secure!  Never share your private key.  Only exchange
-> public keys with peers.  Delete the `privatekey` file after importing it
-> into the keystore.
+> public keys with peers.

 ## Point-to-Point Configuration

@@ -394,20 +387,17 @@ recording traffic today would still need the PSK even if they break Curve25519
 later.  However, peer authentication still relies on Curve25519, so PSKs don't
 provide complete post-quantum security.

-**Generate a preshared key using `wg genpsk`:**
+**Generate a preshared key:**

-```bash
-admin@example:~$ wg genpsk > preshared.key
-admin@example:~$ cat preshared.key
+<pre class="cli"><code>admin@example:/config/> <b>do wireguard genpsk</b>
 cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=
-```
+</code></pre>

 **Import the preshared key into the keystore:**

-<pre class="cli"><code>admin@example:/> <b>configure</b>
-admin@example:/config/> <b>edit keystore symmetric-key wg-psk</b>
-admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set key-format wireguard-symmetric-key-format</b>
-admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=</b>
+<pre class="cli"><code>admin@example:/config/> <b>edit keystore symmetric-key wg-psk</b>
+admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set key-format octet-string-key-format</b>
+admin@example:/config/keystore/symmetric-key/wg-psk/> <b>set cleartext-symmetric-key cO2DxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2mUQ7LtsrDxZ2m=</b>
 admin@example:/config/keystore/symmetric-key/wg-psk/> <b>end</b>
 admin@example:/config/interface/wg0/> <b>edit wireguard peers wg-peers peer remote</b>
 admin@example:/config/interface/…/wg-peers/peer/remote/> <b>set preshared-key wg-psk</b>
@@ -420,5 +410,4 @@ on both sides.

 > [!IMPORTANT]
 > Preshared keys must be kept secret and exchanged through a secure channel,
-> just like passwords.  Delete the `preshared.key` file after importing it
-> into both peer keystores.
+> just like passwords.
@@ -241,6 +241,23 @@ In the CLI, signal strength is reported as: excellent, good, fair or bad.
 For precise signal strength values in dBm, use NETCONF or RESTCONF to access
 the `signal-strength` leaf in the operational datastore.

+## Passphrase Requirements
+
+To ensure your connection is secure and compatible with all network
+hardware, your passphrase must meet the following criteria:
+
+- Length: Between 8 and 63 characters
+- Characters: Use only standard English keyboard characters
+    - Allowed: Letters (A-Z, a-z), numbers (0-9), and common symbols (e.g., ! @ # $ % ^ & * ( ) _ + - = [ ] { } | ; : ' " , . < > / ? ~)
+    - Spaces: Spaces are allowed, but not at the very beginning or very end of the passphrase
+    - Prohibited: Emojis, accented characters (like á or ñ), and special "control" characters
+
+> [!TIP] Why the limit?
+> Standard WiFi security (WPA2/WPA3) requires a minimum of 8 characters to
+> prevent "brute-force" hacking.  The character limit ensures your password
+> works on older routers and various operating systems.  
+> Tips for password strength, see [XKCD #936](https://xkcd.com/936/).
+
 ## Station Mode (Client)

 Station mode connects to an existing Wi-Fi network. Before configuring station
@@ -253,11 +270,16 @@ Create a keystore entry for your WiFi password (8-63 characters):

 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit keystore symmetric-key my-wifi-key</b>
-admin@example:/config/keystore/…/my-wifi-key/> <b>set key-format wifi-preshared-key-format</b>
-admin@example:/config/keystore/…/my-wifi-key/> <b>set symmetric-key MyPassword123</b>
+admin@example:/config/keystore/…/my-wifi-key/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/my-wifi-key/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
 admin@example:/config/keystore/…/my-wifi-key/> <b>leave</b>
 </code></pre>

+The `change` command prompts for the passphrase interactively and
+handles the base64 encoding required by the keystore automatically.
+
 ### Step 2: Connect to Network

 Configure station mode with the SSID and password to connect:
@@ -276,8 +298,9 @@ name                : wifi0
 type                : wifi
 operational status  : up
 physical address    : f0:09:0d:36:5f:86
-SSID                : MyHomeNetwork
-Signal              : excellent
+mode                : station
+ssid                : MyHomeNetwork
+signal              : -52 dBm (good)
 </code></pre>

 **Station configuration parameters:**
@@ -310,8 +333,10 @@ create a keystore entry for your WiFi password and configure the AP interface:

 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit keystore symmetric-key my-wifi-secret</b>
-admin@example:/config/keystore/…/my-wifi-secret/> <b>set key-format wifi-preshared-key-format</b>
-admin@example:/config/keystore/…/my-wifi-secret/> <b>set symmetric-key MySecurePassword123</b>
+admin@example:/config/keystore/…/my-wifi-secret/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/my-wifi-secret/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
 admin@example:/config/keystore/…/my-wifi-secret/> <b>end</b>
 </code></pre>

@@ -371,14 +396,20 @@ admin@example:/config/hardware/component/radio0/wifi-radio/> <b>leave</b>

 <pre class="cli"><code>admin@example:/> <b>configure</b>
 admin@example:/config/> <b>edit keystore symmetric-key main-secret</b>
-admin@example:/config/keystore/…/main-secret/> <b>set key-format wifi-preshared-key-format</b>
-admin@example:/config/keystore/…/main-secret/> <b>set symmetric-key MyMainPassword</b>
+admin@example:/config/keystore/…/main-secret/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/main-secret/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
 admin@example:/config/> <b>edit keystore symmetric-key guest-secret</b>
-admin@example:/config/keystore/…/guest-secret/> <b>set key-format wifi-preshared-key-format</b>
-admin@example:/config/keystore/…/guest-secret/> <b>set symmetric-key GuestPassword123</b>
+admin@example:/config/keystore/…/guest-secret/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/guest-secret/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
 admin@example:/config/> <b>edit keystore symmetric-key iot-secret</b>
-admin@example:/config/keystore/…/iot-secret/> <b>set key-format wifi-preshared-key-format</b>
-admin@example:/config/keystore/…/iot-secret/> <b>set symmetric-key IoTDevices2025</b>
+admin@example:/config/keystore/…/iot-secret/> <b>set key-format passphrase-key-format</b>
+admin@example:/config/keystore/…/iot-secret/> <b>change cleartext-symmetric-key</b>
+Passphrase: ************
+Retype passphrase: ************
 admin@example:/config/keystore/…/iot-secret/> <b>leave</b>
 </code></pre>

@@ -466,8 +497,8 @@ If issues arise, try the following troubleshooting steps:

 1. **Verify signal strength**: Check that the target network shows
   "good" or "excellent" signal in scan results
-2. **Check credentials**: Verify the preshared key in the keystore
-   matches the network password
+2. **Check credentials**: Use `show keystore symmetric <name>` to verify
+   the passphrase matches the network password
 3. **Review logs**: Check system logs with `show log` for Wi-Fi related
   errors
 4. **Regulatory compliance**: Ensure the country-code on the radio
@@ -53,6 +53,7 @@ nav:
      - Access Control (NACM): nacm.md
      - Hardware Info & Status: hardware.md
      - Management: management.md
+      - Keystore: keystore.md
      - Syslog Support: syslog.md
      - Support Data: support.md
      - Upgrade: upgrade.md
@@ -21,7 +21,7 @@ CFLAGS="$(INFIX_CFLAGS)"
 endef

 define BIN_PERMISSIONS
-	/usr/bin/copy  d 04750 root klish - - - - -
+	/usr/bin/copy  f 04750 root klish - - - - -
 endef

 define BIN_BUILD_PYTHON
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  6e098390be2a78a56cf94eecb9d28b11c1791dd2c364e59602bbd664b508fd57  klish-plugin-sysrepo-a4b1fae697b51614dc75989e8f4fc8d277689d16-git4.tar.gz
+sha256  7bfdaef838ee8bd3995140c40144abe79ff1c6391c7b48445e6728cd4e7e56a8  klish-plugin-sysrepo-2f14503c7ea6eb24c8adaf0cf2cf7a511114b09e-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_PLUGIN_SYSREPO_VERSION = a4b1fae697b51614dc75989e8f4fc8d277689d16
+KLISH_PLUGIN_SYSREPO_VERSION = 2f14503c7ea6eb24c8adaf0cf2cf7a511114b09e
 KLISH_PLUGIN_SYSREPO_SITE = https://github.com/kernelkit/klish-plugin-sysrepo.git
 #KLISH_PLUGIN_SYSREPO_VERSION = cdd3eb51a7f7ee0ed5bd925fa636061d3b1b85fb
 #KLISH_PLUGIN_SYSREPO_SITE = https://src.libcode.org/pkun/klish-plugin-sysrepo.git
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  39a73fdaa7e41001e804e2bbdebdc885da79d540f0246777e8fd1c0dd9fc9475  klish-1c31f50ab775d467fa18f2e0a798006949536a2a-git4.tar.gz
+sha256  cd9bc969350b8b30d9a7a31b0f19fb3218c602f04fe7e6a1d80682a75ed26d18  klish-3ae496c43d90354ffa94d364d7775c089f0e119a-git4.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 1c31f50ab775d467fa18f2e0a798006949536a2a
+KLISH_VERSION = 3ae496c43d90354ffa94d364d7775c089f0e119a
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -1,4 +1,4 @@
-From 0da46e7eaa8896066c9ef549ee6ff95a713285f7 Mon Sep 17 00:00:00 2001
+From 255ad0d9e977b007aa5099e52b5512e4f7a65e07 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
 Subject: [PATCH 01/32] net: phy: marvell10g: Support firmware loading on
@@ -1,4 +1,4 @@
-From 6ca7c41f05512829625df7f89c9cedfa8fce4954 Mon Sep 17 00:00:00 2001
+From 928a14f7f60993bf67dce407fe213a19f7d653d6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
 Subject: [PATCH 02/32] net: phy: marvell10g: Fix power-up when strapped to
@@ -1,4 +1,4 @@
-From 4ddca512b7f01fc8a3296b04252552e78d3aa084 Mon Sep 17 00:00:00 2001
+From c3c6b12c6e6139dc887bf291ec3c805b7cd5388b Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
 Subject: [PATCH 03/32] net: phy: marvell10g: Add LED support for 88X3310
@@ -1,4 +1,4 @@
-From c064ebbc07a2fe41ea6d34f1c19804a26a37214b Mon Sep 17 00:00:00 2001
+From d45fdac6168d2bc77bb95aa4b72488e3fa949abe Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
 Subject: [PATCH 04/32] net: phy: marvell10g: Support LEDs tied to a single
@@ -1,4 +1,4 @@
-From ac10b342937848aefe4c09ee054cb13a973564e5 Mon Sep 17 00:00:00 2001
+From dfdde0010c609b8ea89be49d7bfc22750b12d92d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
 Subject: [PATCH 05/32] net: phy: Do not resume PHY when attaching
@@ -1,4 +1,4 @@
-From 2ea2108430d61be4b2c607782c4d70d65606504c Mon Sep 17 00:00:00 2001
+From a77410775141901ea1f400421395d0a9b558e205 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
 Subject: [PATCH 06/32] net: bridge: avoid classifying unknown multicast as
@@ -1,4 +1,4 @@
-From 0b500d7ce8fd3e9a64c1e61b64dc7e28f1441280 Mon Sep 17 00:00:00 2001
+From ab2d786290e4760babe80f87aceccc05b43445b7 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
 Subject: [PATCH 07/32] net: bridge: Ignore router ports when forwarding L2
@@ -1,4 +1,4 @@
-From 11275834a80df2c7c9ebc3c185f7307c34177fe1 Mon Sep 17 00:00:00 2001
+From 72a1cbf579a58d45b89338dd9d2144e9d5ec0ed4 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
 Subject: [PATCH 08/32] net: bridge: drop delay for applying strict multicast
@@ -1,4 +1,4 @@
-From 5c8691c3eeda59299e0dac6ef6df7ae2cbb247c0 Mon Sep 17 00:00:00 2001
+From e9ec03fb91dcc5c55754562656d107a17194b8be Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
 Subject: [PATCH 09/32] net: bridge: Differentiate MDB additions from
@@ -1,4 +1,4 @@
-From 75a358d785acab5bc1fae8eaff98eb62bf61605a Mon Sep 17 00:00:00 2001
+From fa6387518314725d640846514292153016efb53d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
 Subject: [PATCH 10/32] nvmem: layouts: onie-tlv: Let device probe even when
@@ -1,4 +1,4 @@
-From 57d37c39d87b59ea3e808dcdd7ea762103dd3e3f Mon Sep 17 00:00:00 2001
+From 4e6aaf7f4aaf1963a98bcc3a8e04169f901eb8fe Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 11 Aug 2024 11:27:35 +0200
 Subject: [PATCH 11/32] net: usb: r8152: add r8153b support for link/activity
@@ -1,4 +1,4 @@
-From 9e770f7f46bd38c38b820c72bd4de0ff94b25f06 Mon Sep 17 00:00:00 2001
+From 648987531072effe796ef3fac6b2f9259f082695 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 10 Aug 2025 18:52:54 +0200
 Subject: [PATCH 12/32] arm64: dts: mediatek: mt7986a: rename BPi R3 ports to
@@ -1,4 +1,4 @@
-From 4935a1baf872efaa99a7fdbe4ba6d55634bec644 Mon Sep 17 00:00:00 2001
+From 3e90bfcf47de8d09d8fe975315186beaf18b3c8f Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 20 Aug 2025 21:38:24 +0200
 Subject: [PATCH 13/32] drm/panel-simple: Add a timing for the Raspberry Pi 7"
@@ -1,4 +1,4 @@
-From 4f1c58f67e64ef82b9bd3ec9b9c194d8ab8ce5c3 Mon Sep 17 00:00:00 2001
+From 989adffc496130cf79e63e7486b6ce0dbdde38c3 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 21 Aug 2025 11:20:23 +0200
 Subject: [PATCH 14/32] input:touchscreen:edt-ft5x06: Add polled mode
@@ -1,4 +1,4 @@
-From 0efc077ad790a598b18b4fab2b9dd614417e204b Mon Sep 17 00:00:00 2001
+From 56b1b5c9cf340e3cc954180f18d2c455408eb8d4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
 Subject: [PATCH 15/32] [FIX] net: dsa: mv88e6xxx: Fix timeout on waiting for
@@ -1,4 +1,4 @@
-From d77bb7ae1ec02a191832ecff5a7e023980e2a02d Mon Sep 17 00:00:00 2001
+From fd256efa7865ff09830bd18f326075242b773c98 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
 Subject: [PATCH 16/32] net: dsa: mv88e6xxx: Improve indirect register access
@@ -1,4 +1,4 @@
-From b876e4718bc9f28cf898bddb8fe5f127b2b582b6 Mon Sep 17 00:00:00 2001
+From b6918d761fcd859f67fdc14429e269dda657e50d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
 Subject: [PATCH 17/32] net: dsa: mv88e6xxx: Honor ports being managed via
@@ -1,4 +1,4 @@
-From 2d6aab8ab0ba0465a420cfd34f29dc80765d07e6 Mon Sep 17 00:00:00 2001
+From 98176be49294c8d1a2298601e8e3678834ff9a0d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
 Subject: [PATCH 18/32] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
@@ -1,4 +1,4 @@
-From 29f5994c627c326f062a7e4b1c6ec8b00a30d53a Mon Sep 17 00:00:00 2001
+From c758a83ae13bd4f4068d73d073033b3422ee616a Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
 Subject: [PATCH 19/32] net: dsa: tag_dsa: Use tag priority as initial
@@ -1,4 +1,4 @@
-From bc037d0641c9966c676f61080b400774b30bf26f Mon Sep 17 00:00:00 2001
+From 4a6728ce6cd21d250ffa448fcea329c43a2fd8a0 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
 Subject: [PATCH 20/32] net: dsa: Support MDB memberships whose L2 addresses
@@ -1,4 +1,4 @@
-From e51540686e673fff781944b04397435c61e5fc81 Mon Sep 17 00:00:00 2001
+From 3fc20bcfab7493df99038b9f0dbd9c08af2b80fd Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
 Subject: [PATCH 21/32] net: dsa: Support EtherType based priority overrides
@@ -1,4 +1,4 @@
-From 550559c5275610b58322692c121194b15cf1f9e6 Mon Sep 17 00:00:00 2001
+From 116f78aa422f2396f3569fbd7b0f9376b4426166 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
 Subject: [PATCH 22/32] net: dsa: mv88e6xxx: Support EtherType based priority
@@ -1,4 +1,4 @@
-From 4411eea4232e445db1d9b35f62cc1168874617e4 Mon Sep 17 00:00:00 2001
+From a3c810edd1110c3db1c4ea61be18469da3327b1e Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 11:04:22 +0200
 Subject: [PATCH 23/32] net: dsa: mv88e6xxx: Add mqprio qdisc support
@@ -1,4 +1,4 @@
-From 1acad33cba1d7a199ce6386d58b589307ff3ee8c Mon Sep 17 00:00:00 2001
+From f73be899c92dbbb0749e126b52bafe719ad9bcfa Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 29 May 2024 13:20:41 +0200
 Subject: [PATCH 24/32] net: dsa: mv88e6xxx: Use VLAN prio over IP when both
@@ -1,4 +1,4 @@
-From 463e8eb7bc4673c77f56628252c495ee840cf35d Mon Sep 17 00:00:00 2001
+From 183267ad1ee42afbd6960550f6b75b60c93b3de6 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 26 Nov 2024 19:45:59 +0100
 Subject: [PATCH 25/32] [FIX] net: dsa: mv88e6xxx: Trap locally terminated
@@ -1,4 +1,4 @@
-From 75795ed5e3d522c4185005a812679c2bd67010cb Mon Sep 17 00:00:00 2001
+From fc64b3536d3e9b9db0d38ee812bf5f2d826e8a20 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 16 Jan 2025 12:35:12 +0100
 Subject: [PATCH 26/32] net: dsa: mv88e6xxx: collapse disabled state into
@@ -1,4 +1,4 @@
-From 6226d56b75e1087881a150f511ab78457edf9a52 Mon Sep 17 00:00:00 2001
+From b5f738be2b2d060722e40110c3f34ee495789c70 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 12 Feb 2025 22:03:14 +0100
 Subject: [PATCH 27/32] net: dsa: mv88e6xxx: Only activate LAG offloading when
@@ -1,4 +1,4 @@
-From a3fd03baa707011d9013dc1110064ae9f7674e20 Mon Sep 17 00:00:00 2001
+From f5635e0189dc4c6cf34adec22198231f3318ef5d Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Wed, 14 Jan 2026 18:22:41 +0100
 Subject: [PATCH 28/32] net: dsa: mv88e6xxx: Add LED support for 6393X
@@ -1,4 +1,4 @@
-From 9bd08559ecb3dad89f67ab40c375d375d57ea019 Mon Sep 17 00:00:00 2001
+From 1f73a56bf784cc6d48d19069a5ee5103bafa5355 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Thu, 15 Jan 2026 22:47:37 +0100
 Subject: [PATCH 29/32] wifi: brcmfmac: support deletion and recreation of
@@ -1,4 +1,4 @@
-From 719c24648159177aacc03a8f5e4b6da63e6e0d28 Mon Sep 17 00:00:00 2001
+From 8e17a213b71db25b4748cf73c7413b6b82c6fbf9 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Mon, 19 Jan 2026 13:06:53 +0100
 Subject: [PATCH 30/32] wifi: brcmfmac: check connection state before querying
@@ -1,4 +1,4 @@
-From a32da01444346e8e1cd70bfc0dccc97d0b12bf56 Mon Sep 17 00:00:00 2001
+From b95a87f2e34b4706b7beaa250020fe366af64520 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:12:10 +0100
 Subject: [PATCH 31/32] wifi: brcmfmac: suppress log spam for
@@ -1,4 +1,4 @@
-From 743891bbd05b33ee0ab139ab392472df23acbba7 Mon Sep 17 00:00:00 2001
+From 2e9805533f12711a22fbca9551f1da5360ff4537 Mon Sep 17 00:00:00 2001
 From: Mattias Walström <lazzer@gmail.com>
 Date: Tue, 20 Jan 2026 20:18:45 +0100
 Subject: [PATCH 32/32] wifi: brcmfmac: reduce log noise during AP to station
@@ -1,2 +1,2 @@
 # Calculated with utils/kernel-refresh.sh
-sha256   b726a4d15cf9ae06219b56d87820776e34d89fbc137e55fb54a9b9c3015b8f1e  linux-6.18.7.tar.xz
+sha256   37f0c5d5c242c1d604e87d48f08795e861a5a85f725b4ca11d0a538f12ff8cff  linux-6.18.8.tar.xz
@@ -190,7 +190,7 @@ def interface(args: List[str]) -> None:
    elif len(args) == 1:
        iface = args[0]
        if is_valid_interface_name(iface):
-            cli_pretty(data, f"show-interfaces", "-n", iface)
+            cli_pretty(data, "show-interfaces", "-n", iface)
        else:
            print(f"Invalid interface name: {iface}")
    else:
@@ -659,6 +659,25 @@ def nacm(args: List[str]) -> None:
        print(f"Unknown NACM subcommand: {subcommand}")


+def keystore(args: List[str]) -> None:
+    data = get_json("/ietf-keystore:keystore", "running", quiet=True)
+    if not data:
+        user = os.environ.get('USER', 'unknown')
+        print(f'No keystore data available (check NACM permissions for "{user}").')
+        return
+
+    if RAW_OUTPUT:
+        print(json.dumps(data, indent=2))
+        return
+
+    if len(args) == 0 or not args[0]:
+        cli_pretty(data, "show-keystore")
+    elif len(args) >= 2 and args[0] in ("symmetric", "asymmetric"):
+        cli_pretty(data, "show-keystore", "-t", args[0], "-n", args[1])
+    else:
+        print("Usage: show keystore [symmetric <name> | asymmetric <name>]")
+
+
 def execute_command(command: str, args: List[str]):
    command_mapping = {
        'bfd': bfd,
@@ -667,6 +686,7 @@ def execute_command(command: str, args: List[str]):
        'dhcp': dhcp,
        'hardware': hardware,
        'interface': interface,
+        'keystore': keystore,
        'lldp': lldp,
        'nacm': nacm,
        'ntp': ntp,
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Mattias WalströmandGitHub	f47bf0e0b1	Merge pull request #1395 from kernelkit/run-fix Fix extration of rootfs.squashfs in release tarball	2026-02-03 15:13:18 +01:00
Joachim Wiberg	e7108f52cf	board/common: fix extration of rootfs.squashfs in release tarball [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-03 15:05:20 +01:00
Joachim WibergandGitHub	26c7fe40c0	Merge pull request #1391 from kernelkit/update-bpi-recommendations Doc: Update recommendations for bpi-r3	2026-02-03 09:58:13 +01:00
Mattias Walström	1e6286f1d3	Doc: Update recommendations for bpi-r3 [skip ci]	2026-02-03 09:55:05 +01:00
Joachim WibergandGitHub	fe56591d8d	Merge pull request #1379 from kernelkit/copilot/add-infix-keystore-documentation Keystore refactor and documentation Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-03 08:09:05 +01:00
Joachim WibergandGitHub	18c812c1b4	Merge pull request #1390 from kernelkit/fix-boot-defconfigs Add missing `fdt_add_pubkey` tool to bootloader defconfigs	2026-02-03 07:39:54 +01:00
Joachim Wiberg	bb199590ce	configs: add missing fdt_add_pubkey to bootloader defconfigs Follow-up to `c152c5f361` [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-03 07:35:25 +01:00
Joachim Wiberg	047d818cbd	doc: update ChangeLog with new 'change' command feature Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:45 +01:00
Joachim Wiberg	2b6588eaf4	cli: add 'show keystore' command to admin-exec Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:13 +01:00
Joachim Wiberg	08742df166	doc: ux update with new 'change' and 'do wireguard' commands Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:12 +01:00
Joachim Wiberg	2a176d5888	cli: add 'wireguard <genkey \| genpsk>' command to admin-exec Helper command to improve the UX for setting up Wireguard tunnels. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:11 +01:00
Joachim Wiberg	93dfd00754	packge/klish-plugin-sysrepo: add 'change cleartext-symmetric-key' This update brings new support for editing cleartext-symmetric-keys with the 'change' command. The cleartext-symmetric-key is of type binary and its use differs between different key-formats. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:10 +01:00
Joachim Wiberg	94808331da	doc: update docs with keystore format changes Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:09 +01:00
Joachim Wiberg	74a09d2c1b	board/aarch64: update bpi factory-config and rpi readme example Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:08 +01:00
Joachim Wiberg	0c1aede731	confd: add wifi passphrase and key validation to SR_EV_CHANGE Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:08 +01:00
Joachim Wiberg	5ceda4569e	confd: restore IETF standard keystore leaf types and NACM rules Infix key format identities now derive from the IETF bases, so the standard identityref accepts them without any need for deviations. This also preserves the nacm default rules, which were inadvertently dropped before. Also rename format identities for generality: - wifi-preshared-key-format -> renamed: 'passphrase-key-format' - wireguard-symmetric-key-format -> use IETF 'octet-string-key-format' Since cleartext-symmetric-key is now type binary (base64-encoded), the WiFi backends (station and AP) decode values before passing them to wpa_supplicant and hostapd. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:07 +01:00
Joachim Wiberg	683f696e19	utils: add 'scan' feature to ixll Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:06 +01:00
Joachim Wiberg	ad7c6573c8	doc: minor syntax fixes to match YANG model Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:50:05 +01:00
Joachim Wiberg	72860aa1b5	doc: add comprehensive keystore documentation Fixes #914 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-02 17:49:41 +01:00
Joachim WibergandGitHub	69acd21f19	Merge pull request #1386 from kernelkit/container-restart-on-env Container restart on env	2026-02-02 09:16:35 +01:00
Joachim Wiberg	eeabb44bd5	doc: update ChangeLog Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-01 12:36:25 +01:00
Joachim Wiberg	76bfd6c57f	test: update test to verify container restart on env change Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-01 10:40:45 +01:00
Joachim Wiberg	3d7fb595fb	board/common: container not restarting on env variable changes Environment variables are stored in a separate .env file from the main container script. The config SHA256 checksum only covered the script file, so changes to env vars went undetected -- the container was not recreated and kept running with stale values. Include the env file contents in the config checksum calculation so that any change to environment variables triggers a proper container restart. Fixes #1313 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-01 10:40:45 +01:00
Joachim Wiberg	98a39d989c	package/klish: add support for insert-comment Type a command, regret you typed so much before checking something else, comment it out for later with Meta-# (Alt-Shift-3). The whole line is now commented out and saved to history. Recall it later with Ctrl-P or Up arrow, delete the leading # with Ctrl-D, and run it. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-02-01 10:40:44 +01:00
Joachim WibergandGitHub	8e699736b8	Merge pull request #1380 from kernelkit/copilot/handle-ipv6-forwarding-netfilter	2026-01-30 23:40:36 +01:00
Joachim WibergandGitHub	80ab53ecbc	Merge pull request #1383 from kernelkit/kernel-upgrade-3c441547-c319-40de-bb33-e2e50bf0b2c2 Upgrade to kernel 6.18.8	2026-01-30 14:06:35 +01:00
Joachim Wiberg	7ce668904a	doc: update ChangeLog [skip ci] Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 13:09:20 +01:00
Joachim Wiberg	93fceb9a5f	doc: update IPv6 forwarding documentation Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 13:09:19 +01:00
Joachim Wiberg	4f876bc58e	test: update nacm basic test spec. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 13:09:18 +01:00
Joachim Wiberg	db0c6417b2	test: add IPv6 forwarding verification to routing-basic Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 13:09:14 +01:00
ael-bot	aeef240289	Upgrade Linux kernel to 6.18.8	2026-01-30 10:20:43 +00:00
Joachim Wiberg	129f92afdd	statd: use IPv6 force_forwarding in operational state Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 09:11:41 +01:00
Joachim Wiberg	717c1c02f1	confd: use force_forwarding sysctl for IPv6 Introduced in Linux 6.17, the force_forwding flag corresponds to the ipv4 forwarding flag, which maps perfectly to the ietf-ip.yang model. Fixes #515 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-30 09:11:40 +01:00
Joachim WibergandGitHub	50514b4fc2	Merge pull request #1375 from kernelkit/aarch32-fixes Sync defconfigs, fix aarch32 (now arm) build	2026-01-29 23:10:36 +01:00
Joachim Wiberg	c152c5f361	configs: fix fdt_add_pubkey host tool Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:42:50 +01:00
Joachim Wiberg	e7943b5e05	board,configs: rename aarch32 -> arm for consistency with BR2_ARCH All build scripts use $BR2_ARCH to determine location of critical board files and configuration. As per previous decisions, the BR2_ARCH variable controls all naming in Infix and for consistency the defconfig files are also renamed. This fixes the issue with missing DTB file(s) for the Raspberry Pi 2B. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:42:50 +01:00
Joachim Wiberg	64a04eb784	configs: sync aarch32 defconfigs, drop post-image.sh - Bump toolchain to match other build targets GCC 13 -> 14 - Drop post-build.sh to match other build targets - Add features to arm_defconfig, all except containers - Enable chck hashes Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:42:49 +01:00
Joachim Wiberg	1042ca8bb2	configs: sync defconfigs - Fix locations of packages to match 'make update-defconfig' order - Fix defconfig syntax for watchdogd tempmon ... - Enable check hashes on all defconfigs - Add missing wireguard and wifi support to RiscV - Rename dongle support for X86_64 build Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:42:25 +01:00
Joachim Wiberg	6831377369	board: relocate firmware selction for IoT Router Board Mini The RTL8169 firmware was specifically added for the Raspberry Pi Compute Module 4 IoT Router Board Mini, it does not need to be part of defconfig. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:41:33 +01:00
Joachim Wiberg	16f26b02a8	board: sync linux_defconfigs between archs - Enable Ext2 support where missing - Enable POSIX_ACLs where missing - Sync NLS code pages Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 20:41:26 +01:00
Joachim Wiberg	87a6637c13	bin: copy is a file, not a directory Fixes a warning from fakeroot by adjusting the type in the permission table. Apparently the chown + chmod operations were always done even though the type was wrong. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>	2026-01-29 17:54:54 +01:00
				`@@ -0,0 +1 @@`
				`include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/arm//.mk))`