board/common: tune kernel memory settings

Add vm.conf with sysctl parameters optimized for embedded network
devices 512MB-8GB of memory.

Focus on fast recovery and determinism.
- Panic on OOM
- Aggressive dirty page writeback
- Increased watermark scale factor for proactive reclaim

Includes tuning guide documentation for alternative scenarios.

Signed-off-by: Richard Alpe <richard@bit42.se>

.github/CHECKLIST.md

@@ -3,34 +3,39 @@ Checklists for Pull Requests and Releases
 
 Maintainer checklists for reviewing pull requests and doing releases.
 
-
 Pull Requests
 -------------
 
- - If applicable, is there a readable ChangeLog entry?
- - If any LICENSE file has been updated, has the `.hash` file been updated?
- - If any change to a Finit `.svc` file, does any run/task linger?  
-   I.e., is there a runlevel and/or condition defined to prevent them
-   from running outside of their intended runlevel?
- - If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
-   - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
- - If any change to logging, have the resulting logs been audited?
-   - Check for duplicate entries, misspellings
-   - Check for sneaky severity changes, e.g., error vs note, error vs warning
- - If new subsystem, or major changes to a subsystem, have the docs been updated?
- - If change to mDNS, has it been tested with netbrowse?
- - If change to `_defconfig`, verify `local.mk` and sync with other archs
-   - Test manually as well, e.g., CLI changes do not have ha regression tests
-   - Build from distclean, or use artifacts built by build servers, for manual tests
-
+- If applicable, is there a readable ChangeLog entry?
+- If any LICENSE file has been updated, has the `.hash` file been updated?
+- If any change to a Finit `.svc` file, does any run/task linger?  
+  I.e., is there a runlevel and/or condition defined to prevent them
+  from running outside of their intended runlevel?
+- If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
+  - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
+- If any change to logging, have the resulting logs been audited?
+  - Check for duplicate entries, misspellings
+  - Check for sneaky severity changes, e.g., error vs note, error vs warning
+- If new subsystem, or major changes to a subsystem, have the docs been updated?
+- If change to mDNS, has it been tested with netbrowse?
+- If change to `_defconfig`, verify `local.mk` and sync with other archs
+  - Test manually as well, e.g., CLI changes do not have ha regression tests
+  - Build from distclean, or use artifacts built by build servers, for manual tests
 
 Releases
 --------
 
- - Make at least one -betaN release to verify the GitHub workflow well in time release day
-   - Stuff happens, remember kernelkit/infix#735
- - Make at least one -rcN to flush out any issues in customer repos
-   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
- - Ensure the markdown link for the release diff is updated
- - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
- - Sync tags for all repo. sync activities
+Recommended checkpoints, use at your own discretion:
+
+- Make at least one -betaN release to verify the GitHub workflow well in time release day
+  - Stuff happens, remember kernelkit/infix#735
+- Make at least one -rcN to flush out any issues in customer repos
+  - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+- Verify release artifacts (checksums, completeness, no corrupted files)
+- Test on actual hardware for at least one architecture
+- Review ChangeLog for completeness
+- Check for release-blocking issues
+- Verify generated GNS3 appliance, no marketplace update on -rc builds
+- Ensure the markdown link for the release diff is updated
+- Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
+- Sync tags for all repo. sync activities

.github/CONTRIBUTING.md

@@ -9,15 +9,15 @@ forms of collaboration as well.  [Let's talk!][support] :handshake:
 
 If you are unsure how to start implementing an idea or fix:
 
- - :bug: open an issue, there are human friendly templates for _bugs_
-   and _feature requests_ at <https://github.com/kernelkit/infix/issues>
- - :speech_balloon: use the [Q&A Forum][discuss]
- - :technologist: The [Developer's Guide][devguide] is also a useful start
+- :bug: open an issue, there are human friendly templates for _bugs_
+  and _feature requests_ at <https://github.com/kernelkit/infix/issues>
+- :speech_balloon: use the [Q&A Forum][discuss]
+- :technologist: The [Developer's Guide][devguide] is also a useful start
 
-> _Talking about code and problems first is often the best way to get
+> [!IMPORTANT]
+> Talking about code and problems first is often the best way to get
 > started before submitting a pull request.  We have found it always
-> saves time, yours and ours._
-
+> saves time, yours and ours.
 
 :sparkles: General Guidelines
 -----------------------------
@@ -27,21 +27,20 @@ version the change is made against, what it does, and, more importantly
 *why* -- from your perspective, why is it a bug, why does the code need
 changing in this way.  Start with why.
 
- - :bug: Bug reports need metadata like Infix version or commit hash
- - :adhesive_bandage: Bug fixes also need version, and (preferably) a
-   corresponding issue number for the ChangeLog
- - :new: New features, you need to get approval of the YANG model first!  
-   :speech_balloon: Please use the [Forum][discuss], e.g., category:
-   *Ideas*, or open a :pray: feature request issue
- - :white_check_mark: New features also need new regression tests, this
-   can be basic tests or more complex use-case tests comprising multiple
-   subsystems, see [Testing Changes](#test_tube-testing-changes), below
+- :bug: Bug reports need metadata like Infix version or commit hash
+- :adhesive_bandage: Bug fixes also need version, and (preferably) a
+  corresponding issue number for the ChangeLog
+- :new: New features, you need to get approval of the YANG model first!  
+  :speech_balloon: Please use the [Forum][discuss], e.g., category:
+  *Ideas*, or open a :pray: feature request issue
+- :white_check_mark: New features also need new regression tests, this
+  can be basic tests or more complex use-case tests comprising multiple
+  subsystems, see [Testing Changes](#test_tube-testing-changes), below
 
 Please take care to ensure you follow the project coding style and the
 commit message format.  If you follow these recommendations you help
 the maintainers and make it easier for them to include your code.
 
-
 :woman_technologist: Coding Style
 ---------------------------------
 
@@ -51,39 +50,40 @@ and it is expected that you provide a human-readable summary for the
 release notes (ChangeLog) and at least a configuration example in the
 manual for new features.
 
-> **Tip:** consider ["Readme driven development"][RDD] for new features.
-> It is amazing how many flaws in your own bright ideas come to bare
-> when you suddenly have to explain them to someone else!
+> [!TIP]
+> Consider ["Readme driven development"][RDD] for new features.  It is
+> amazing how many flaws in your own bright ideas come to bare when you
+> suddenly have to explain them to someone else!
 
 We expect code contributions for:
 
- - C code in [Linux Coding Style][Linux]
- - Python code should follow [PEP-8][]
+- C code in [Linux Coding Style][Linux]
+- Python code should follow [PEP-8][]
 
+> [!IMPORTANT]
 > **However,** always submit code that follows the style of surrounding
 > code!  Legacy takes precedence, and remember, we read code a lot more
 > than write it, so legibility is important.
 
 The ChangeLog deserves a separate mention:
 
- - Releases are listed in reverse chronological order order, so the
-   latest/next release is at the beginning of the file
- - Only *user-facing bugs and features* are detailed, so code refactor,
-   new tests, etc. are not listed.
- - Add your changes/features to the Changes section
- - Add your Fix line in the Fixes section, in numeric order 
- - Changes and fixes without an issue number are listed after all
-   numbered ones
- - YANG model changes are documented in their respective model, for
-   standard models, e.g., for `ietf-interfaces.yang`, the corresponding
-   `infix-interfaces.yang` detail augments/deviations as revisions.
+- Releases are listed in reverse chronological order order, so the
+  latest/next release is at the beginning of the file
+- Only *user-facing bugs and features* are detailed, so code refactor,
+  new tests, etc. are not listed.
+- Add your changes/features to the Changes section
+- Add your Fix line in the Fixes section, in numeric order
+- Changes and fixes without an issue number are listed after all
+  numbered ones
+- YANG model changes are documented in their respective model, for
+  standard models, e.g., for `ietf-interfaces.yang`, the corresponding
+  `infix-interfaces.yang` detail augments/deviations as revisions.
 
 A final note, lines of code are allowed to be longer than 72 characters
 these days, unless you live by PEP-8 (see above).  There is no enforced
 maximum, but the team usually keep it around 100 characters for both C
 and Python.
 
-
 :test_tube: Testing Changes
 ---------------------------
 
@@ -97,9 +97,8 @@ the same pull request.
 
 For help getting started with testing, see the following resources:
 
- - [Developer's Guide][devguide]
- - [Regression Testing][testing]
-
+- [Developer's Guide][devguide]
+- [Regression Testing][testing]
 
 :memo: Commit Messages
 ----------------------
@@ -110,45 +109,135 @@ proud of your work and set up a proper GIT identity for your commits:
 
 <img src="../doc/jack.png" width=70 align="right">
 
-    $ git config --global user.name "Jacky Linker"
-    $ git config --global user.email jacky.linker@example.com
+```bash
+$ git config --global user.name "Jacky Linker"
+$ git config --global user.email jacky.linker@example.com
+```
 
 Example commit message from one of many [online guides][cbeams].  Use
 `git commit -s` to automatically add a `Signed-off-by` for proof of
 origin, see [DCO][] for more info.
 
-    subsystem: brief, but clear and concise summary of changes
-    
-    More detailed explanatory text, if necessary.  Wrap it to about 72
-    characters or so.  In some contexts, the first line is treated as
-    the subject of an email and the rest of the text as the body.  The
-    empty line separating summary from body is critical.  Tools like
-    rebase can get confused if the empty line is missing.
-    
-    Further paragraphs should be separated with empty lines.
-    
-     - Bullet points are okay, too
-    
-     - Typically a hyphen or asterisk is used for the bullet, preceded
-       by a single space, with blank lines in between, but conventions
-       vary here
+```text
+subsystem: brief, but clear and concise summary of changes
 
-	If you use an issue tracker, put references to them at the bottom,
-	like this:
+More detailed explanatory text, if necessary.  Wrap it to about 72
+characters or so.  In some contexts, the first line is treated as
+the subject of an email and the rest of the text as the body.  The
+empty line separating summary from body is critical.  Tools like
+rebase can get confused if the empty line is missing.
 
-	Resolves: #123
-	See also: #456, #789
+Further paragraphs should be separated with empty lines.
 
-    Signed-off-by: Jacky Linker <jacky.linker@example.com>
+ - Bullet points are okay, too
+
+ - Typically a hyphen or asterisk is used for the bullet, preceded
+   by a single space, with blank lines in between, but conventions
+   vary here
+
+If you use an issue tracker, put references to them at the bottom,
+like this:
+
+Resolves: #123
+See also: #456, #789
+
+Signed-off-by: Jacky Linker <jacky.linker@example.com>
+```
 
 This is an example of how to [automatically close][closing] an issue
 when the commit is merged to mainline.  Several keywords are available.
 
+:lock_with_ink_pen: Signing Commits with GPG
+---------------------------------------------
+
+To ensure the authenticity and integrity of your contributions, we
+**require** all commits to be signed with GPG.  This cryptographically
+verifies that commits come from a trusted source.
+
+### Generating a GPG Key
+
+If you don't already have a GPG key, generate one:
+
+```bash
+$ gpg --full-generate-key
+```
+
+When prompted, choose:
+- Key type: `RSA and RSA` (default)
+- Key size: `4096` bits (recommended for security)
+- Expiration: `0` (key does not expire)
+- Real name and email: Use the same email as your Git configuration
+
+> [!NOTE]
+> We recommend keys that do not expire for signing commits.  Expiration
+> creates a "usability time bomb" without providing meaningful security
+> benefits for code signing.  See [this article][pgpfan] for details.
+
+### Configuring Git to Sign Commits
+
+First, find your GPG key ID:
+
+```bash
+$ gpg --list-secret-keys --keyid-format=long
+```
+
+Look for the line starting with `sec`, the key ID is the part after the `/`.
+For example, in `sec   rsa4096/ABCD1234EFGH5678`, the key ID is `ABCD1234EFGH5678`.
+
+Configure Git to use your GPG key:
+
+```bash
+$ git config --global user.signingkey ABCD1234EFGH5678
+$ git config --global commit.gpgsign true
+```
+
+The second command enables automatic signing for all commits.  Alternatively,
+you can sign individual commits with `git commit -S`.
+
+### Publishing Your Public Key
+
+To allow others to verify your signatures, publish your public key to a
+keyserver:
+
+```bash
+$ gpg --keyserver hkps://keys.openpgp.org --send-keys ABCD1234EFGH5678
+```
+
+> [!IMPORTANT]
+> The keyserver will send a verification email to the address associated
+> with your key.  You **must** click the link in that email to confirm
+> ownership before your key becomes searchable by email address.
+
+Alternative keyservers you can use:
+- `hkps://keyserver.ubuntu.com`
+- `hkps://pgp.mit.edu`
+
+### Adding Your GPG Key to GitHub
+
+For GitHub to show your commits as "Verified", you need to add your public
+key to your account:
+
+1. Export your public key:
+   ```bash
+   $ gpg --armor --export ABCD1234EFGH5678
+   ```
+
+2. Copy the entire output, including the `-----BEGIN PGP PUBLIC KEY BLOCK-----`
+   and `-----END PGP PUBLIC KEY BLOCK-----` lines.
+
+3. Go to [GitHub Settings → SSH and GPG keys](https://github.com/settings/keys)
+
+4. Click **New GPG key** and paste your public key.
+
+Now your signed commits will display a "Verified" badge on GitHub! :white_check_mark:
+
+For more details, see GitHub's [official documentation on commit signature verification][gpg-verify].
 
 :twisted_rightwards_arrows: Pull Requests
 -----------------------------------------
 
-> _The git repository is the canonical location for information._
+> [!NOTE]
+> _The git repository is the canonical location for all information._
 
 A pull request should preferably address a single issue or change.  This
 may of course include multiple related changes, but what is important to
@@ -167,7 +256,6 @@ Buildroot, consider the pull request message body similar to the cover
 letter for a series of patches -- it's a summary of changes, and it is
 lost when the changes are merged to the mainline branch.
 
-
 :balance_scale: Code of Conduct
 -------------------------------
 
@@ -184,6 +272,8 @@ other contributions that are not aligned to this Code of Conduct."*
 [PEP-8]:    https://peps.python.org/pep-0008/
 [RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
 [cbeams]:   https://cbea.ms/git-commit/#seven-rules
-[conduct]:  CODE-OF-CONDUCT.md
-[DCO]:      https://developercertificate.org/
-[closing]:  https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[conduct]:    CODE-OF-CONDUCT.md
+[DCO]:        https://developercertificate.org/
+[closing]:    https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests
+[gpg-verify]: https://docs.github.com/en/authentication/managing-commit-signature-verification
+[pgpfan]:     https://articles.59.ca/doku.php?id=pgpfan:expire

.github/workflows/bitsign.yml

@@ -0,0 +1,215 @@
+name: bitSign Infix Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      release_version:
+        description: 'Release version (e.g., v25.08.0)'
+        required: true
+        type: string
+  push:
+    branches: [ sign-with-bitsign ]
+
+jobs:
+  sign-infix-release:
+    runs-on: ubuntu-latest
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    - name: Validate release version format
+      id: validate
+      run: |
+        # Use default version for push events, input version for manual dispatch
+        if [ "${{ github.event_name }}" = "push" ]; then
+          VERSION="v25.08.0"
+          echo "Using default version for push trigger: $VERSION"
+        else
+          VERSION="${{ inputs.release_version }}"
+          echo "Using input version for manual trigger: $VERSION"
+        fi
+
+        # Check if version starts with 'v' and has proper format
+        if ! echo "$VERSION" | grep -qE '^v[0-9]+\.[0-9]+(\.[0-9]+)?(-alpha[0-9]*|-beta[0-9]*|-rc[0-9]*)?$'; then
+          echo "❌ Invalid version format. Expected format: vYY.MM(.PP)(-alphaN|-betaN|-rcN)"
+          echo "Examples: v25.08.0, v25.08.0-alpha1, v25.08.0-rc1"
+          exit 1
+        fi
+
+        # Extract version without 'v' prefix for filename
+        FILE_VERSION="${VERSION#v}"
+        FILENAME="infix-x86_64-${FILE_VERSION}.tar.gz"
+        RELEASE_URL="https://github.com/kernelkit/infix/releases/download/${VERSION}/${FILENAME}"
+
+        echo "✅ Version format valid"
+        echo "file_version=${FILE_VERSION}" >> $GITHUB_OUTPUT
+        echo "filename=${FILENAME}" >> $GITHUB_OUTPUT
+        echo "release_url=${RELEASE_URL}" >> $GITHUB_OUTPUT
+
+    - name: Download Infix release
+      run: |
+        RELEASE_URL="${{ steps.validate.outputs.release_url }}"
+        FILENAME="${{ steps.validate.outputs.filename }}"
+
+        echo "Downloading Infix release: $FILENAME"
+        echo "From: $RELEASE_URL"
+
+        if ! curl -L "$RELEASE_URL" -o "$FILENAME" --fail --show-error --progress-bar; then
+          echo "❌ Failed to download release file from: $RELEASE_URL"
+          echo "Please verify that the release version exists and contains the x86_64 build."
+          echo "You can check available releases at: https://github.com/kernelkit/infix/releases"
+          exit 1
+        fi
+
+        # Verify download
+        if [ -f "$FILENAME" ] && [ -s "$FILENAME" ]; then
+          FILE_SIZE=$(ls -lh "$FILENAME" | awk '{print $5}')
+          echo "✅ Successfully downloaded: $FILENAME ($FILE_SIZE)"
+        else
+          echo "❌ Failed to download release file"
+          exit 1
+        fi
+
+    - name: Create signing request
+      id: create_request
+      run: |
+        FILENAME="${{ steps.validate.outputs.filename }}"
+        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
+        RELEASE="infix-x86_64-${FILE_VERSION}"
+
+        echo "Creating signing request for $FILENAME..."
+        echo "RELEASE parameter: $RELEASE"
+
+        # Create signing request using bitSign API
+        RESPONSE=$(curl -s -X POST "https://portal.bitsign.se/api/v1/requests" \
+          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
+          -F "file=@$FILENAME" \
+          -F "key=bit42-Demo1" \
+          -F "job=Infix-x86" \
+          -F "parameters={\"RELEASE\": \"$RELEASE\"}")
+
+        echo "API Response: $RESPONSE"
+
+        # Check if request was successful
+        if echo "$RESPONSE" | jq -e '.success == true' > /dev/null; then
+          REQUEST_ID=$(echo "$RESPONSE" | jq -r '.requestId')
+          echo "✅ Request created successfully with ID: $REQUEST_ID"
+          echo "request_id=$REQUEST_ID" >> $GITHUB_OUTPUT
+        else
+          echo "❌ Failed to create signing request"
+          echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
+          exit 1
+        fi
+
+    - name: Wait for signing completion
+      id: wait_completion
+      run: |
+        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
+        echo "Waiting for signing completion for request: $REQUEST_ID"
+
+        # Poll status for up to 10 minutes (600 seconds) - longer timeout for larger files
+        MAX_WAIT=600
+        WAITED=0
+
+        while [ $WAITED -lt $MAX_WAIT ]; do
+          RESPONSE=$(curl -s -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/status" \
+            -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}")
+
+          STATUS=$(echo "$RESPONSE" | jq -r '.status')
+          echo "Current status: $STATUS (waited ${WAITED}s)"
+
+          if [ "$STATUS" = "completed" ]; then
+            echo "✅ Signing completed successfully!"
+            break
+          elif [ "$STATUS" = "failed" ]; then
+            echo "❌ Signing failed"
+            echo "$RESPONSE" | jq -r '.error // .message // "Unknown error"'
+            exit 1
+          fi
+
+          sleep 10
+          WAITED=$((WAITED + 10))
+        done
+
+        if [ $WAITED -ge $MAX_WAIT ]; then
+          echo "❌ Timeout: Signing did not complete within ${MAX_WAIT} seconds"
+          exit 1
+        fi
+
+    - name: Download signed file
+      id: download_signed
+      run: |
+        REQUEST_ID="${{ steps.create_request.outputs.request_id }}"
+        FILENAME="${{ steps.validate.outputs.filename }}"
+        FILE_VERSION="${{ steps.validate.outputs.file_version }}"
+        SIGNED_FILENAME="infix-x86_64-${FILE_VERSION}-signed.tar.gz"
+
+        echo "Downloading signed file for request: $REQUEST_ID"
+        echo "Expected signed filename: $SIGNED_FILENAME"
+
+        # Download the signed file
+        curl -X GET "https://portal.bitsign.se/api/v1/requests/$REQUEST_ID/download" \
+          -H "Authorization: Bearer ${{ secrets.BITSIGN_API_KEY }}" \
+          -o "$SIGNED_FILENAME" \
+          --fail --show-error
+
+        if [ -f "$SIGNED_FILENAME" ] && [ -s "$SIGNED_FILENAME" ]; then
+          FILE_SIZE=$(ls -lh "$SIGNED_FILENAME" | awk '{print $5}')
+          echo "Successfully downloaded signed file: $SIGNED_FILENAME ($FILE_SIZE)"
+          echo "signed_filename=$SIGNED_FILENAME" >> $GITHUB_OUTPUT
+
+          # Calculate SHA256 checksums for both files
+          ORIGINAL_SHA256=$(sha256sum "$FILENAME" | cut -d' ' -f1)
+          SIGNED_SHA256=$(sha256sum "$SIGNED_FILENAME" | cut -d' ' -f1)
+          echo "original_sha256=$ORIGINAL_SHA256" >> $GITHUB_OUTPUT
+          echo "signed_sha256=$SIGNED_SHA256" >> $GITHUB_OUTPUT
+        else
+          echo "Failed to download signed file"
+          exit 1
+        fi
+
+    - name: Upload signed artifacts
+      uses: actions/upload-artifact@v4
+      with:
+        name: signed-infix-${{ steps.validate.outputs.file_version }}
+        path: ${{ steps.download_signed.outputs.signed_filename }}
+        retention-days: 90
+
+    - name: Summary
+      run: |
+        # Determine the actual version used (could be from push or input)
+        if [ "${{ github.event_name }}" = "push" ]; then
+          ACTUAL_VERSION="v25.08.0"
+        else
+          ACTUAL_VERSION="${{ inputs.release_version }}"
+        fi
+
+        cat >> $GITHUB_STEP_SUMMARY << EOF
+        # bitSign Infix Release Signing Complete
+
+        The Infix release has been successfully signed using the bitSign API.
+
+        ## Signing Details
+
+        | Property | Value |
+        |----------|-------|
+        | 📦 **Original File** | \`${{ steps.validate.outputs.filename }}\` (\`${{ steps.download_signed.outputs.original_sha256 }}\`) |
+        | ✍️ **Signed File** | \`${{ steps.download_signed.outputs.signed_filename }}\` (\`${{ steps.download_signed.outputs.signed_sha256 }}\`) |
+        | 🔑 **Signing Key** | \`bit42-Demo1\` |
+        | ⚙️ **Job Type** | \`Infix-x86\` |
+        | 🆔 **Request ID** | \`${{ steps.create_request.outputs.request_id }}\` |
+        | 📋 **Release Version** | \`\$ACTUAL_VERSION\` |
+        | 🌐 **API Endpoint** | \`portal.bitsign.se\` |
+
+        ## Download Files
+
+        > **The signed release file is available as a workflow artifact:**
+        > **\`signed-infix-${{ steps.validate.outputs.file_version }}\`**
+        >
+        > The artifact contains the signed file: \`${{ steps.download_signed.outputs.signed_filename }}\`
+
+        ---
+
+        **Next Steps:** The signed release can now be distributed with cryptographic verification of authenticity.
+        EOF

.github/workflows/build-boot.yml

@@ -16,11 +16,13 @@ jobs:
       fail-fast: false
       matrix:
         defconfig:
-          - fireant_boot
-          - cn9130_crb_boot
           - aarch64_qemu_boot
-          - rpi4_boot
-          - mt7986_sd_boot
+          - bpi_r3_sd_boot
+          - bpi_r3_emmc_boot
+          - cn9130_crb_boot
+          - fireant_boot
+          - nanopi_r2s_boot
+          - rpi64_boot
     env:
       MAKEFLAGS: -j5
     steps:

.github/workflows/build-image.yml

@@ -1,4 +1,4 @@
-name: Create SD Card Images
+name: Create SD Card & eMMC Images
 
 on:
   workflow_dispatch:
@@ -8,9 +8,10 @@ on:
         type: choice
         required: true
         options:
-          - raspberry-pi-4
-          - banana-pi-r3
-        default: 'raspberry-pi-4'
+          - raspberrypi-rpi64
+          - bananapi-bpi-r3
+          - friendlyarm-nanopi-r2s
+        default: 'raspberrypi-rpi64'
       use_latest_release:
         description: 'Use latest release artifacts instead of workflow artifacts'
         type: boolean
@@ -52,20 +53,36 @@ jobs:
       - name: Set bootloader and target based on board
         run: |
           case "${{ inputs.board }}" in
-            raspberry-pi-4)
-              echo "BOOTLOADER=rpi4_boot" >> $GITHUB_ENV
+            raspberrypi-rpi64)
+              echo "BOOTLOADER=rpi64_boot" >> $GITHUB_ENV
               echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
-            banana-pi-r3)
-              echo "BOOTLOADER=mt7986_sd_boot" >> $GITHUB_ENV
+            bananapi-bpi-r3)
+              echo "BOOTLOADER_SD=bpi_r3_sd_boot" >> $GITHUB_ENV
+              echo "BOOTLOADER_EMMC=bpi_r3_emmc_boot" >> $GITHUB_ENV
               echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=true" >> $GITHUB_ENV
+              ;;
+            friendlyarm-nanopi-r2s)
+              echo "BOOTLOADER=nanopi_r2s_boot" >> $GITHUB_ENV
+              echo "TARGET=aarch64" >> $GITHUB_ENV
+              echo "BUILD_EMMC=false" >> $GITHUB_ENV
               ;;
             *)
               echo "Error: Unknown board ${{ inputs.board }}"
               exit 1
               ;;
           esac
-          echo "Using bootloader: $BOOTLOADER and target: $TARGET for board: ${{ inputs.board }}"
+          echo "Target: $TARGET for board: ${{ inputs.board }}"
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "Building both SD and eMMC images"
+            echo "SD Bootloader: $BOOTLOADER_SD"
+            echo "eMMC Bootloader: $BOOTLOADER_EMMC"
+          else
+            echo "Building SD image only"
+            echo "Bootloader: $BOOTLOADER"
+          fi
 
       - name: Download bootloader artifacts
         if: ${{ !inputs.use_latest_release }}
@@ -74,16 +91,41 @@ jobs:
           gh run list --workflow=build-boot.yml --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_boot_run_id
           BOOT_RUN_ID=$(cat latest_boot_run_id)
 
-          gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders for boards that support both
+            echo "Downloading SD bootloader: ${BOOTLOADER_SD}"
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_SD} --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
 
-          # Extract bootloader directly to output/images
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
+            echo "Downloading eMMC bootloader: ${BOOTLOADER_EMMC}"
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER_EMMC} --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
 
-          echo "Bootloader files extracted to output/images:"
-          ls -la output/images/
+            echo "SD bootloader files:"
+            ls -la output_sd/images/
+            echo "eMMC bootloader files:"
+            ls -la output_emmc/images/
+          else
+            # Single bootloader for boards that only support SD
+            gh run download ${BOOT_RUN_ID} --name artifact-${BOOTLOADER} --dir temp_bootloader/
+
+            # Extract bootloader directly to output/images
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            echo "Bootloader files extracted to output/images:"
+            ls -la output/images/
+          fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -94,102 +136,193 @@ jobs:
           gh run list --workflow=164295764 --branch=main --limit=1 --status=success --json databaseId --jq '.[0].databaseId' > latest_infix_run_id
           INFIX_RUN_ID=$(cat latest_infix_run_id)
 
-          gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Copy Infix artifacts to both SD and eMMC output directories
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
 
-          # Extract Infix directly to output/images
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
 
-          echo "Infix files extracted to output/images:"
-          ls -la output/images/
+            echo "Infix files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "Infix files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Single output directory for SD-only boards
+            gh run download ${INFIX_RUN_ID} --name artifact-${TARGET} --dir temp_infix/
+
+            # Extract Infix directly to output/images
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "Infix files extracted to output/images:"
+            ls -la output/images/
+          fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Download from latest releases
         if: ${{ inputs.use_latest_release }}
         run: |
-          # Download latest bootloader release
-          gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
-          cd temp_bootloader/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_bootloader/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            # Download both SD and eMMC bootloaders
+            gh release download latest-boot --pattern "*${BOOTLOADER_SD}*" --dir temp_bootloader_sd/
+            mkdir -p output_sd/images
+            cd temp_bootloader_sd/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            cd ../
+            rm -rf temp_bootloader_sd/
 
-          # Download latest Infix release
-          gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
-          cd temp_infix/
-          tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
-          cd ../
-          rm -rf temp_infix/
+            gh release download latest-boot --pattern "*${BOOTLOADER_EMMC}*" --dir temp_bootloader_emmc/
+            mkdir -p output_emmc/images
+            cd temp_bootloader_emmc/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_bootloader_emmc/
 
-          echo "All files extracted to output/images:"
-          ls -la output/images/
+            # Download Infix once and extract to both directories
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_sd/images/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output_emmc/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "SD files extracted to output_sd/images:"
+            ls -la output_sd/images/
+            echo "eMMC files extracted to output_emmc/images:"
+            ls -la output_emmc/images/
+          else
+            # Download latest bootloader release
+            gh release download latest-boot --pattern "*${BOOTLOADER}*" --dir temp_bootloader/
+            cd temp_bootloader/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_bootloader/
+
+            # Download latest Infix release
+            gh release download latest --pattern "*${TARGET}*" --dir temp_infix/
+            cd temp_infix/
+            tar -xzf *.tar.gz --strip-components=1 -C ../output/images/
+            cd ../
+            rm -rf temp_infix/
+
+            echo "All files extracted to output/images:"
+            ls -la output/images/
+          fi
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Verify extracted files
         run: |
-          echo "Files available for mkimage.sh:"
-          ls -la output/images/
-          echo ""
-          echo "File types:"
-          file output/images/* || true
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "Files available for SD image:"
+            ls -la output_sd/images/
+            echo ""
+            echo "Files available for eMMC image:"
+            ls -la output_emmc/images/
+          else
+            echo "Files available for mkimage.sh:"
+            ls -la output/images/
+            echo ""
+            echo "File types:"
+            file output/images/* || true
+          fi
 
       - name: Create SD card image
         run: |
-          export BINARIES_DIR=$PWD/output/images
+          if [ "$BUILD_EMMC" = "true" ]; then
+            export BINARIES_DIR=$PWD/output_sd/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh -t sdcard ${{ inputs.board }}
+          else
+            export BINARIES_DIR=$PWD/output/images
+            export BUILD_DIR=$PWD/build
+            export BR2_EXTERNAL_INFIX_PATH=$PWD
+            export RELEASE=""
+            export INFIX_ID="infix"
+            ./utils/mkimage.sh ${{ inputs.board }}
+          fi
+
+      - name: Create eMMC image
+        if: ${{ env.BUILD_EMMC == 'true' }}
+        run: |
+          export BINARIES_DIR=$PWD/output_emmc/images
           export BUILD_DIR=$PWD/build
           export BR2_EXTERNAL_INFIX_PATH=$PWD
           export RELEASE=""
           export INFIX_ID="infix"
+          ./utils/mkimage.sh -t emmc ${{ inputs.board }}
 
-          # Use the standardized mkimage.sh path for the selected board
-          #          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-          BOARD_SCRIPT="src/board/${{ inputs.board }}/mkimage.sh"
-
-          if [ -f "$BOARD_SCRIPT" ]; then
-            echo "Using board-specific image creation script: $BOARD_SCRIPT"
-            chmod +x "$BOARD_SCRIPT"
-            "$BOARD_SCRIPT"
-          else
-            echo "Error: Board script $BOARD_SCRIPT not found!"
-            exit 1
-          fi
-
-      - name: Verify created image
+      - name: Verify created images
         run: |
-          echo "Contents of output/images after mkimage.sh:"
-          ls -lh output/images/
+          if [ "$BUILD_EMMC" = "true" ]; then
+            echo "SD card image:"
+            ls -lh output_sd/images/*-sdcard.img* 2>/dev/null || true
+            if ls output_sd/images/*-sdcard.img 1> /dev/null 2>&1; then
+              for img in output_sd/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi
 
-          # Look for SD card image with pattern: *-sdcard.img
-          if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
-            echo "Found SD card image(s):"
-            for img in output/images/*-sdcard.img; do
-              echo "- $(basename $img)"
-              file "$img"
-              fdisk -l "$img" 2>/dev/null || true
-            done
+            echo ""
+            echo "eMMC image:"
+            ls -lh output_emmc/images/*-emmc.img* 2>/dev/null || true
+            if ls output_emmc/images/*-emmc.img 1> /dev/null 2>&1; then
+              for img in output_emmc/images/*-emmc.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null | head -20
+              done
+            fi
+
+            # Copy both images to output/images for artifact upload
+            mkdir -p output/images
+            cp output_sd/images/*-sdcard.img* output/images/ 2>/dev/null || true
+            cp output_emmc/images/*-emmc.img* output/images/ 2>/dev/null || true
           else
-            echo "No SD card image found matching pattern: *-sdcard.img"
-            echo "Available files:"
-            ls -la output/images/
-            exit 1
+            echo "Contents of output/images after mkimage.sh:"
+            ls -lh output/images/
+
+            # Look for SD card image with pattern: *-sdcard.img
+            if ls output/images/*-sdcard.img 1> /dev/null 2>&1; then
+              echo "Found SD card image(s):"
+              for img in output/images/*-sdcard.img; do
+                echo "- $(basename $img)"
+                file "$img"
+                fdisk -l "$img" 2>/dev/null || true
+              done
+            else
+              echo "No SD card image found matching pattern: *-sdcard.img"
+              echo "Available files:"
+              ls -la output/images/
+              exit 1
+            fi
           fi
 
-      - name: Upload SD card image
+      - name: Upload images as artifacts
         uses: actions/upload-artifact@v4
         with:
-          name: sdcard-image-${{ inputs.board }}-${{ env.BOOTLOADER }}
+          name: images-${{ inputs.board }}
           path: |
-            output/images/*-sdcard.img
+            output/images/*-sdcard.img*
+            output/images/*-emmc.img*
           retention-days: 30
 
       - name: Create checksums
         run: |
           cd output/images/
-          for file in *-sdcard.img; do
+          for file in *-sdcard.img *-emmc.img; do
             if [ -f "$file" ]; then
               sha256sum "$file" > "$file.sha256"
             fi
@@ -205,11 +338,28 @@ jobs:
           prerelease: true
           tag: "latest-boot"
           token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "output/images/*-sdcard.img*"
+          artifacts: "output/images/*-sdcard.img*,output/images/*-emmc.img*"
 
       - name: Generate summary
         run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          if [ "$BUILD_EMMC" = "true" ]; then
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # SD Card & eMMC Image Build Complete! 🚀
+
+          **Board:** ${{ inputs.board }}
+          **Target:** ${{ env.TARGET }}
+          **SD Bootloader:** ${{ env.BOOTLOADER_SD }}
+          **eMMC Bootloader:** ${{ env.BOOTLOADER_EMMC }}
+          **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
+
+          ## Created Images
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
+
+          ## Download
+          Both SD card and eMMC images are available as workflow artifacts above and in the latest-boot release.
+          EOF
+          else
+            cat <<EOF >> $GITHUB_STEP_SUMMARY
           # SD Card Image Build Complete! 🚀
 
           **Board:** ${{ inputs.board }}
@@ -218,8 +368,9 @@ jobs:
           **Artifact Source:** ${{ inputs.use_latest_release && 'Latest Release' || 'Latest Workflow Run' }}
 
           ## Created Images
-          $(find output/images/ -name "*.img" -o -name "*.qcow2" -o -name "*.raw" | xargs ls -lh 2>/dev/null | sed 's/^/- /' || echo "- No images found")
+          $(find output/images/ -name "*.img" -o -name "*.img.bmap" | xargs ls -lh 2>/dev/null | awk '{print "- " $9 " (" $5 ")"}' || echo "- No images found")
 
           ## Download
           The SD card image is available as a workflow artifact above.
           EOF
+          fi

.github/workflows/build-release.yml

@@ -0,0 +1,119 @@
+# Needed for make pkg-stats
+# sudo apt install python3-aiohttp
+---
+name: Build Release
+
+on:
+  workflow_call:
+    inputs:
+      version:
+        required: true
+        type: string
+      use_cache:
+        required: false
+        type: boolean
+        default: true
+
+jobs:
+  build:
+    name: Build Infix ${{ inputs.version }} [${{ matrix.target }}]
+    runs-on: [self-hosted, release]
+    strategy:
+      matrix:
+        target: [aarch64, x86_64]
+      fail-fast: false
+    steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
+      - uses: actions/checkout@v4
+        with:
+          clean: true
+          submodules: recursive
+
+      - name: Set Release Variables
+        id: vars
+        run: |
+          ver=${{ inputs.version }}
+          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          fver=${ver#v}
+          target=${{ matrix.target }}-${fver}
+          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+
+      - name: Restore Cache of dl/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-
+
+      - name: Restore Cache of .ccache/
+        if: ${{ inputs.use_cache }}
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-${{ matrix.target }}-
+            ccache-
+
+      - name: Configure & Build
+        env:
+          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
+        run: |
+          target=${{ matrix.target }}_defconfig
+          echo "Building $target ..."
+          make $target
+          make
+
+      - name: Generate SBOM from Build
+        run: |
+          # Generate manifest files in CSV format for CycloneDX
+          make legal-info
+          # Generate cpe.json for CycloneDX
+          make -s show-info > output/cpe.json
+          # Generate pkg-stats.{json,html} for humans
+          make pkg-stats
+
+      - name: Build test specification
+        run: |
+          make test-spec
+
+      - name: Prepare Artifacts
+        run: |
+          cd output/
+
+          # Collect relevant files for SBOM and CPE info. for more info, see:
+          # https://github.com/CycloneDX/cyclonedx-buildroot
+          mkdir               images/sbom
+          mv pkg-stats.*      images/sbom/
+          mv cpe.json         images/sbom/
+          mv legal-info/*.csv images/sbom/
+
+          # Remove rootfs.squashfs from release (can be extracted from rootfs.itb)
+          # Saves ~131MB per architecture. See issue #858
+          rm -f images/rootfs.squashfs
+
+          mv images ${{ steps.vars.outputs.dir }}
+          ln -s ${{ steps.vars.outputs.dir }} images
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-${{ matrix.target }}
+          path: output/*.tar.gz
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2

.github/workflows/build.yml

@@ -19,6 +19,10 @@ on:
         description: 'Repo to checkout (for spin overrides)'
         default: kernelkit/infix
         type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
 
   workflow_call:
     inputs:
@@ -32,15 +36,30 @@ on:
         required: false
         type: string
         default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
       parallel:
         required: false
         type: boolean
-        default: false
+        default: true
+      pre_build_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
   TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
   INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
 
 jobs:
   build:
@@ -59,15 +78,34 @@ jobs:
           rm -rf ./* || true
           rm -rf ./.??* || true
           ls -la ./
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
 
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
           repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - name: Run pre-build script
+        if: ${{ inputs.pre_build_script != '' }}
+        run: |
+          cat > ./pre-build.sh << 'EOF'
+          ${{ inputs.pre_build_script }}
+          EOF
+          chmod +x ./pre-build.sh
+          bash ./pre-build.sh
 
       - name: Set Build Variables
         id: vars
@@ -110,6 +148,11 @@ jobs:
         run: |
           make ${{ env.TARGET }}_defconfig
 
+      - name: Cleanup stale containers and ports
+        run: |
+          podman rm -af || true
+          pkill -9 -f rootlessport || true
+
       - name: Unit Test ${{ env.TARGET }}
         run: |
           make test-unit

.github/workflows/check-kernel-release.yml

@@ -0,0 +1,140 @@
+name: Check Kernel 6.12 Release
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+jobs:
+  check-kernel:
+    if: github.repository == 'kernelkit/infix'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Check out infix repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Fetch kernel.org and check for 6.12 release
+        id: check
+        run: |
+          set -e -o pipefail
+          # Fetch the kernel.org frontpage and extract 6.12 version
+          CURRENT_VERSION=$(curl -s https://www.kernel.org/ | grep -oP '6\.12\.\d+' | head -n1)
+
+          if [ -z "$CURRENT_VERSION" ]; then
+            echo "Failed to fetch kernel version"
+            exit 1
+          fi
+
+          echo "current_version=$CURRENT_VERSION" >> $GITHUB_OUTPUT
+          echo "Current 6.12 kernel version: $CURRENT_VERSION"
+
+          # Get the version from infix defconfig
+          INFIX_VERSION=$(grep 'BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE=' configs/aarch64_defconfig | cut -d'"' -f2)
+
+          echo "infix_version=$INFIX_VERSION" >> $GITHUB_OUTPUT
+          echo "Infix kernel version: $INFIX_VERSION"
+
+          if [ "$CURRENT_VERSION" != "$INFIX_VERSION" ]; then
+            # Check if there's already an open PR for this version
+            PR_EXISTS=$(gh pr list --state open --search "Upgrade to kernel $CURRENT_VERSION in:title" --json number --jq 'length')
+
+            if [ "$PR_EXISTS" -gt 0 ]; then
+              echo "new_release=false" >> $GITHUB_OUTPUT
+              echo "PR already exists for kernel $CURRENT_VERSION, skipping"
+            else
+              echo "new_release=true" >> $GITHUB_OUTPUT
+              echo "🎉 New 6.12 kernel released: $CURRENT_VERSION (infix version: $INFIX_VERSION)"
+            fi
+          else
+            echo "new_release=false" >> $GITHUB_OUTPUT
+            echo "No change - still at $CURRENT_VERSION"
+          fi
+        env:
+          GH_TOKEN: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+
+      - name: Generate branch name
+        if: steps.check.outputs.new_release == 'true'
+        id: branch
+        run: |
+          BRANCH_NAME="kernel-upgrade-$(uuidgen | tr '[:upper:]' '[:lower:]')"
+          echo "name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+          echo "Branch name: $BRANCH_NAME"
+
+      - name: Import GPG key
+        if: steps.check.outputs.new_release == 'true'
+        run: |
+          # Import the GPG key
+          echo "${{ secrets.AEL_BOT_GPG_PRIVATE_KEY }}" | gpg --batch --import
+
+          # Get the key ID
+          GPG_KEY_ID=$(gpg --list-secret-keys --keyid-format=long | grep '^sec' | head -1 | awk '{print $2}' | cut -d'/' -f2)
+          echo "GPG_KEY_ID=$GPG_KEY_ID" >> $GITHUB_ENV
+
+          # Configure GPG agent for non-interactive use
+          echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf
+          echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf
+          gpg-connect-agent reloadagent /bye || true
+
+      - name: Set up git credentials
+        if: steps.check.outputs.new_release == 'true'
+        run: |
+          set -e -o pipefail
+          git config --global user.email "ael-bot@users.noreply.github.com"
+          git config --global user.name "ael-bot"
+          git config --global commit.gpgsign true
+          git config --global user.signingkey ${{ env.GPG_KEY_ID }}
+
+          # Configure git to use the token for HTTPS operations
+          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "git@github.com:"
+          git config --global url."https://ael-bot:${{ secrets.KERNEL_UPDATE_TOKEN }}@github.com/".insteadOf "https://github.com/"
+
+      - name: Run kernel upgrade script
+        if: steps.check.outputs.new_release == 'true'
+        env:
+          GIT_TERMINAL_PROMPT: 0
+          BRANCH_NAME: ${{ steps.branch.outputs.name }}
+        run: |
+          set -e -o pipefail
+          ./utils/kernel-upgrade.sh linux "$BRANCH_NAME"
+
+      - name: Create pull request
+        if: steps.check.outputs.new_release == 'true'
+        uses: actions/github-script@v7
+        with:
+          github-token: ${{ secrets.KERNEL_UPDATE_TOKEN }}
+          script: |
+            const { data: pulls } = await github.rest.pulls.list({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              head: `${context.repo.owner}:kernel-upgrade`,
+              state: 'open'
+            });
+
+            if (pulls.length === 0) {
+              const { data: pr } = await github.rest.pulls.create({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                title: `Upgrade to kernel ${{ steps.check.outputs.current_version }}`,
+                head: '${{ steps.branch.outputs.name }}',
+                base: 'main',
+                body: `Automated kernel upgrade to version ${{ steps.check.outputs.current_version }}.\n\n**Previous version:** ${{ steps.check.outputs.infix_version }}\n**New version:** ${{ steps.check.outputs.current_version }}\n**Source:** https://www.kernel.org/\n\nThis PR was automatically created by the kernel release monitoring workflow.`
+              });
+
+              await github.rest.issues.addLabels({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: pr.number,
+                labels: ['ci:main']
+              });
+
+              await github.rest.pulls.requestReviewers({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                pull_number: pr.number,
+                reviewers: ['troglobit', 'wkz', 'mattiaswal']
+              });
+            }

.github/workflows/coverity.yml

@@ -69,10 +69,10 @@ jobs:
           (cd libite && ./autogen.sh && ./configure && make && sudo make install)
           make dep
 
-      - name: Check applications
+      - name: Build applications for Coverity
         run: |
           export PATH=`pwd`/coverity/bin:$PATH
-          cov-build --dir cov-int make check
+          cov-build --dir cov-int make coverity
 
       - name: Submit results to Coverity Scan
         env:

.github/workflows/docs.yml

@@ -41,6 +41,7 @@ jobs:
           pipx inject mkdocs mkdocs-callouts
           pipx inject mkdocs mike
           pipx inject mkdocs mkdocs-to-pdf
+          pipx inject mkdocs mkdocs-glightbox
           # Workaround, if pipx inject fails to install symlink
           ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
                 "$(pipx environment -V PIPX_BIN_DIR)/mike" || true

.github/workflows/generic-x86-build.yml

@@ -10,6 +10,17 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
+      - name: Free Disk Space
+        uses: jlumbroso/free-disk-space@main
+        with:
+          tool-cache: true
+          android: true
+          dotnet: true
+          haskell: true
+          large-packages: true
+          docker-images: true
+          swap-storage: false
+
       - name: Install build dependencies
         run: |
           sudo apt-get update

.github/workflows/release.yml

@@ -18,96 +18,46 @@ on:
         type: string
 
 jobs:
-  build:
+  set-version:
     if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    name: Build Infix ${{ github.ref_name }} [${{ matrix.target }}]
-    runs-on: [ self-hosted, release ]
-    strategy:
-      matrix:
-        target: [aarch64, x86_64]
-      fail-fast: false
+    runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.set-ver.outputs.version }}
     steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Release Variables
-        id: vars
+      - id: set-ver
         run: |
           if [ -n "${{ inputs.version }}" ]; then
               ver=${{ inputs.version }}
           else
               ver=${GITHUB_REF#refs/tags/}
           fi
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          fver=${ver#v}
-          target=${{ matrix.target }}-${fver}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "version=${ver}" >> $GITHUB_OUTPUT
 
-      - name: Restore Cache of dl/
-        uses: actions/cache@v4
-        with:
-          path: dl/
-          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-
-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v4
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.target }}-
-            ccache-
-
-      - name: Configure & Build
-        env:
-          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
-        run: |
-          target=${{ matrix.target }}_defconfig
-          echo "Building $target ..."
-          make $target
-          make
-
-      - name: Generate SBOM from Build
-        run: |
-          make legal-info
-
-      - name: Build test specification
-        run: |
-          make test-spec
-
-      - name: Prepare Artifacts
-        run: |
-          cd output/
-          mv images ${{ steps.vars.outputs.dir }}
-          ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-
-          mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-${{ matrix.target }}
-          path: output/*.tar.gz
-
-      - uses: actions/upload-artifact@v4
-        with:
-          name: artifact-disk-image-${{ matrix.target }}
-          path: output/images/*.qcow2
+  build:
+    needs: set-version
+    uses: ./.github/workflows/build-release.yml
+    with:
+      version: ${{ needs.set-version.outputs.version }}
+      use_cache: true
 
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
-    runs-on: [ self-hosted, release ]
+    runs-on: [self-hosted, release]
     permissions:
       contents: write
       discussions: write
     steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
       - uses: actions/checkout@v4
         with:
           submodules: 'true'
@@ -125,7 +75,7 @@ jobs:
           if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
             echo "pre=true"     >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
-          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+          elif echo $ver | grep -qE '^v[0-9]+\.[0-9]+(\.0)?$'; then
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=true"  >> $GITHUB_OUTPUT
             echo "cat=Releases" >> $GITHUB_OUTPUT
@@ -156,6 +106,9 @@ jobs:
         run: |
           awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
               |head -n -1 > release.md
+          echo "" >> release.md
+          echo "> [!TIP]" >> release.md
+          echo "> **Try Infix in GNS3!** Download the appliance from the [GNS3 Marketplace](https://gns3.com/marketplace/appliances/infix) to test Infix in a virtual network environment without hardware." >> release.md
           cat release.md
 
       - uses: ncipollo/release-action@v1
@@ -164,7 +117,7 @@ jobs:
           prerelease: ${{ steps.rel.outputs.pre }}
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
-          bodyFile:  release.md
+          bodyFile: release.md
           artifacts: "*.tar.gz*,*.qcow2*"
 
       - name: Summary

.github/workflows/test.yml

@@ -8,6 +8,10 @@ on:
         required: false
         default: kernelkit/infix
         type: string
+      infix_branch:
+        description: 'Branch/tag/commit to checkout (for spin overrides)'
+        default: ''
+        type: string
 
   workflow_call:
     inputs:
@@ -21,6 +25,11 @@ on:
         required: false
         type: string
         default: kernelkit/infix
+      infix_branch:
+        required: false
+        type: string
+        default: ''
+        description: 'Branch/tag/commit to checkout (for spin overrides). Defaults to github.ref if not specified'
       ninepm-conf:
         required: false
         type: string
@@ -29,10 +38,20 @@ on:
         required: false
         type: string
         default: 'test'
+      pre_test_script:
+        required: false
+        type: string
+        default: ''
+        description: 'Optional script to run after checkout (for spin customization)'
+    secrets:
+      CHECKOUT_TOKEN:
+        required: false
+        description: 'Token for cross-repository access'
 
 env:
   TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
   INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  INFIX_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_branch || inputs.infix_branch }}
   NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
   TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
 
@@ -41,14 +60,34 @@ jobs:
     name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
     runs-on: [self-hosted, regression]
     steps:
+      - name: Cleanup podman state
+        run: |
+          set -x
+          podman ps -a              || true
+          podman stop -a            || true
+          podman rm -a -f           || true
+          podman volume prune -f    || true
+          podman system prune -a -f || true
+          podman system migrate     || true
+
       - name: Checkout infix repo
         uses: actions/checkout@v4
         with:
           repository: ${{ env.INFIX_REPO }}
-          ref: ${{ github.ref }}
+          ref: ${{ env.INFIX_BRANCH != '' && env.INFIX_BRANCH || github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
+          token: ${{ secrets.CHECKOUT_TOKEN || github.token }}
+
+      - name: Run pre-test script
+        if: ${{ inputs.pre_test_script != '' }}
+        run: |
+          cat > ./pre-test.sh << 'EOF'
+          ${{ inputs.pre_test_script }}
+          EOF
+          chmod +x ./pre-test.sh
+          bash ./pre-test.sh
 
       - name: Set Build Variables
         id: vars
@@ -90,7 +129,8 @@ jobs:
       - name: Publish Test Result for ${{ env.TARGET }}
         # Ensure this runs even if Regression Test fails
         if: always()
-        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+        run: |
+          cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
 
       - name: Generate Test Report for ${{ env.TARGET }}
         # Ensure this runs even if Regression Test fails

.github/workflows/trigger.yml

@@ -14,29 +14,62 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  # Gate all builds through this check to prevent wasted runs.  Only run on
+  # 'labeled' events when the label is actually 'ci:main'.  Concurrency control
+  # above handles canceling the 'opened' event when 'labeled' arrives quickly
+  # after (e.g., when creating a PR with ci:main already attached). See #1154.
+  check-trigger:
+    if: |
+      startsWith(github.repository, 'kernelkit/') &&
+      (github.event_name != 'pull_request' ||
+       github.event.action != 'labeled' ||
+       github.event.label.name == 'ci:main')
+    runs-on: ubuntu-latest
+    outputs:
+      x86_64_target: ${{ steps.set-targets.outputs.x86_64_target }}
+      aarch64_target: ${{ steps.set-targets.outputs.aarch64_target }}
+    steps:
+      - run: |
+          echo "Triggering build, logging meta data ..."
+          echo "Event  : ${{ github.event_name }}"
+          echo "Action : ${{ github.event.action }}"
+          echo "Ref    : ${{ github.ref }}"
+          echo "PR     : ${{ github.event.pull_request.number }}"
+          echo "Label  : ${{ github.event.label.name }}"
+      - id: set-targets
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]] &&           \
+             ! echo '${{ toJSON(github.event.pull_request.labels.*.name) }}' \
+             | grep -q "ci:main"; then
+            echo "x86_64_target=x86_64_minimal" >> $GITHUB_OUTPUT
+            echo "aarch64_target=aarch64_minimal" >> $GITHUB_OUTPUT
+          else
+            echo "x86_64_target=x86_64" >> $GITHUB_OUTPUT
+            echo "aarch64_target=aarch64" >> $GITHUB_OUTPUT
+          fi
+
   build-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
 
   build-aarch64:
-    if: startsWith(github.repository, 'kernelkit/')
+    needs: check-trigger
     uses: ./.github/workflows/build.yml
     with:
       name: "infix"
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
+      target: ${{ needs.check-trigger.outputs.aarch64_target }}
 
   test-run-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
-    needs: build-x86_64
+    needs: [check-trigger, build-x86_64]
     uses: ./.github/workflows/test.yml
     with:
-      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+      target: ${{ needs.check-trigger.outputs.x86_64_target }}
       name: "infix"
 
   test-publish-x86_64:
-    if: startsWith(github.repository, 'kernelkit/')
+    if: ${{ github.repository_owner == 'kernelkit' && github.ref_name == 'main' }}
     needs: test-run-x86_64
     uses: ./.github/workflows/publish.yml

.github/workflows/weekly.yml

@@ -0,0 +1,68 @@
+# Weekly release build to catch flaky tests and verify clean builds.
+# Runs without caches (ccache) to ensure reproducibility. See issue #1003.
+name: Weekly Build
+
+on:
+  schedule:
+    - cron: '5 0 * * 6'  # Saturday at 00:05 UTC, same as Coverity
+  workflow_dispatch:
+
+jobs:
+  build:
+    if: github.repository == 'kernelkit/infix'
+    uses: ./.github/workflows/build-release.yml
+    with:
+      version: "latest"
+      use_cache: false
+
+  publish:
+    name: Publish Weekly Build
+    needs: build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums
+        run: |
+          for file in *.tar.gz; do
+            sha256sum $file > $file.sha256
+          done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
+
+      - uses: ncipollo/release-action@v1
+        with:
+          tag: latest
+          name: "Latest Weekly Build"
+          prerelease: true
+          makeLatest: false
+          allowUpdates: true
+          removeArtifacts: true
+          body: |
+            Automated weekly build from `${{ github.sha }}`.
+
+            This build runs without caches to catch potential flaky tests and build issues.
+            Not intended for production use - use official releases instead.
+
+            **Commit:** ${{ github.sha }}
+            **Built:** ${{ github.run_id }}
+          artifacts: "*.tar.gz*,*.qcow2*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Weekly Build Published! :package:
+
+          Latest artifacts uploaded to:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+
+          Built from commit: \`${{ github.sha }}\`
+          EOF

.gitignore

@@ -1,4 +1,5 @@
 *~
+.claude
 .gdb_history
 /.backup
 /.ccache

Config.in

@@ -1,3 +1,5 @@
+source "$BR2_EXTERNAL_INFIX_PATH/board/Config.in"
+
 menu "Branding"
 
 config INFIX_VENDOR

Makefile

@@ -16,8 +16,7 @@ bmake   = $(MAKE) -C buildroot O=$(O) $1
 all: $(config) buildroot/Makefile
 	@+$(call bmake,$@)
 
-check dep:
-	@echo "Starting local check, stage $@ ..."
+check dep coverity:
 	@make -C src $@
 
 $(config):
@@ -33,6 +32,11 @@ $(config):
 legal-info: | buildroot/Makefile
 	$(call bmake,legal-info LINUX_LICENSE_FILES=COPYING)
 
+cyclonedx: | buildroot/Makefile
+	@echo "Generating package information..."
+	@$(MAKE) --no-print-directory -C buildroot O=$(O) show-info | ./buildroot/utils/generate-cyclonedx > $(O)/cyclonedx-sbom.json
+	@echo "CycloneDX SBOM generated: $(O)/cyclonedx-sbom.json"
+
 # Workaround, see board/x86_64/board.mk
 test:
 	@+$(call bmake,$@)
@@ -40,4 +44,4 @@ test:
 buildroot/Makefile:
 	@git submodule update --init
 
-.PHONY: all check test
+.PHONY: all check coverity dep test cyclonedx

README.md

@@ -1,6 +1,6 @@
-[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![Release Badge][]][Release] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
 
-<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
+<img align="right" src="doc/logo.png" alt="Infix — Immutable.Friendly.Secure" width=480 padding=10>
 
 Turn any ARM or x86 device into a powerful, manageable network appliance
 in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
@@ -129,18 +129,33 @@ deployments.
 
 ## Technical Details
 
-Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
-for reliability you can trust:
+<a href="https://bitsign.se">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://bitsign.se/assets/badges/bitsign-badge-dark-mode.png">
+    <source media="(prefers-color-scheme: light)" srcset="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png">
+    <img alt="bitSign - Code Signing" src="https://bitsign.se/assets/badges/bitsign-badge-light-mode.png" align="right" width=150 padding=10>
+  </picture>
+</a>
+
+Built on proven open-source foundations: [Linux][0], [Buildroot][1], and
+[sysrepo][2] — for reliability you can trust:
 
 - **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
 - **YANG Configuration**: Industry-standard models with auto-generated tooling
 - **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
 - **Container Integration**: Docker support with flexible network and hardware access
 - **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
+- **Code Signing**: Releases are cryptographically signed for integrity verification
 
 Perfect for everything from resource-constrained edge devices to
 high-throughput network appliances.
 
+With the entire system modeled in YANG, scalability is no longer an
+issue, be it in development, testing, or end users deploying and
+monitoring their devices.  All knobs and dials are accessible from the
+CLI (console/SSH), or remotely using the native NETCONF or RESTCONF
+APIs.
+
 > Check the *[Latest Build][]* for bleeding-edge features.
 
 ---
@@ -152,6 +167,7 @@ high-throughput network appliances.
 
 ![Alt](https://repobeats.axiom.co/api/embed/5ce7a2a67edc923823afa0f60c327a6e8575b6e9.svg "Repobeats analytics image")
 
+[0]: https://www.kernel.org
 [1]: https://buildroot.org/ "Buildroot Homepage"
 [2]: https://www.sysrepo.org/ "Sysrepo Homepage"
 [3]: https://kernelkit.org/infix/latest/cli/introduction/
@@ -160,6 +176,8 @@ high-throughput network appliances.
 [Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
+[Release]:         https://github.com/kernelkit/infix/releases
+[Release Badge]:   https://img.shields.io/github/v/release/kernelkit/infix 
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
 [GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393

board/Config.in

@@ -0,0 +1,8 @@
+menu "Board Support"
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/riscv64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/x86_64/Config.in"
+
+endmenu

board/aarch32/Config.in

@@ -0,0 +1,5 @@
+if BR2_arm
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch32/raspberrypi-rpi2/Config.in"
+
+endif

board/aarch32/README.md

@@ -0,0 +1,7 @@
+aarch32
+=======
+
+Board Specific Documentation
+----------------------------
+
+- [Raspberry Pi 2 Model B (32-bit)](raspberrypi-rpi2/)

board/aarch32/board.mk

@@ -0,0 +1 @@
+

board/aarch32/boot.script

@@ -0,0 +1,7 @@
+blkmap get boot dev devnum
+load blkmap ${devnum} ${kernel_addr_r} /boot/zImage
+#TODO: LOAD FDT
+
+setenv bootargs "${bootargs_root} ${bootargs_rauc} ${bootargs_log}"
+
+bootz ${kernel_addr_r} ${ramdisk} ${fdt_addr}

board/aarch32/linux_defconfig

@@ -0,0 +1,395 @@
+CONFIG_SYSVIPC=y
+CONFIG_POSIX_MQUEUE=y
+CONFIG_AUDIT=y
+CONFIG_NO_HZ_IDLE=y
+CONFIG_HIGH_RES_TIMERS=y
+CONFIG_BPF_SYSCALL=y
+CONFIG_BPF_JIT=y
+CONFIG_PREEMPT=y
+CONFIG_BSD_PROCESS_ACCT=y
+CONFIG_BSD_PROCESS_ACCT_V3=y
+CONFIG_TASKSTATS=y
+CONFIG_TASK_DELAY_ACCT=y
+CONFIG_TASK_XACCT=y
+CONFIG_TASK_IO_ACCOUNTING=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_LOG_BUF_SHIFT=18
+CONFIG_MEMCG=y
+CONFIG_BLK_CGROUP=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CPUSETS=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_CGROUP_BPF=y
+CONFIG_USER_NS=y
+CONFIG_SCHED_AUTOGROUP=y
+CONFIG_BLK_DEV_INITRD=y
+CONFIG_KALLSYMS_ALL=y
+CONFIG_PROFILING=y
+CONFIG_KEXEC=y
+CONFIG_ARCH_MULTI_V6=y
+CONFIG_ARCH_MULTI_V7=y
+CONFIG_ARCH_VIRT=y
+CONFIG_ARCH_BCM=y
+CONFIG_ARCH_BCM2835=y
+CONFIG_SMP=y
+CONFIG_NR_CPUS=4
+CONFIG_CPU_FREQ=y
+CONFIG_CPU_FREQ_STAT=y
+CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE=y
+CONFIG_CPU_FREQ_GOV_POWERSAVE=y
+CONFIG_CPU_FREQ_GOV_USERSPACE=y
+CONFIG_CPU_FREQ_GOV_ONDEMAND=y
+CONFIG_CPUFREQ_DT=y
+CONFIG_ARM_RASPBERRYPI_CPUFREQ=y
+CONFIG_AEABI=y
+CONFIG_VFP=y
+CONFIG_NEON=y
+CONFIG_KERNEL_MODE_NEON=y
+# CONFIG_SUSPEND is not set
+CONFIG_PM=y
+CONFIG_JUMP_LABEL=y
+# CONFIG_GCC_PLUGINS is not set
+CONFIG_MODULES=y
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PARTITION_ADVANCED=y
+# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
+# CONFIG_COMPAT_BRK is not set
+CONFIG_KSM=y
+CONFIG_CMA=y
+CONFIG_NET=y
+CONFIG_PACKET=y
+CONFIG_XDP_SOCKETS=y
+CONFIG_XDP_SOCKETS_DIAG=y
+CONFIG_IP_MULTICAST=y
+CONFIG_IP_ADVANCED_ROUTER=y
+CONFIG_IP_MULTIPLE_TABLES=y
+CONFIG_IP_ROUTE_MULTIPATH=y
+CONFIG_NET_IPIP=m
+CONFIG_NET_IPGRE_DEMUX=m
+CONFIG_NET_IPGRE=m
+CONFIG_NET_IPGRE_BROADCAST=y
+CONFIG_IP_MROUTE=y
+CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IP_PIMSM_V1=y
+CONFIG_IP_PIMSM_V2=y
+CONFIG_SYN_COOKIES=y
+CONFIG_NET_IPVTI=m
+CONFIG_NET_FOU_IP_TUNNELS=y
+CONFIG_IPV6_SIT=m
+CONFIG_IPV6_GRE=m
+CONFIG_IPV6_MULTIPLE_TABLES=y
+CONFIG_IPV6_SUBTREES=y
+CONFIG_IPV6_MROUTE=y
+CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
+CONFIG_IPV6_PIMSM_V2=y
+CONFIG_NETWORK_PHY_TIMESTAMPING=y
+CONFIG_NETFILTER=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_NETFILTER_NETLINK_QUEUE=y
+CONFIG_NETFILTER_NETLINK_LOG=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_CONNTRACK_EVENTS=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_TABLES=y
+CONFIG_NF_TABLES_INET=y
+CONFIG_NF_TABLES_NETDEV=y
+CONFIG_NFT_CT=m
+CONFIG_NFT_CONNLIMIT=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_MASQ=m
+CONFIG_NFT_REDIR=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_TUNNEL=m
+CONFIG_NFT_QUEUE=m
+CONFIG_NFT_REJECT=m
+CONFIG_NFT_COMPAT=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_XFRM=m
+CONFIG_NFT_SOCKET=m
+CONFIG_NFT_OSF=m
+CONFIG_NFT_DUP_NETDEV=m
+CONFIG_NFT_FWD_NETDEV=m
+CONFIG_NFT_REJECT_NETDEV=m
+CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
+CONFIG_NETFILTER_XT_TARGET_LOG=m
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
+CONFIG_NETFILTER_XT_MATCH_BPF=m
+CONFIG_NETFILTER_XT_MATCH_CGROUP=m
+CONFIG_NETFILTER_XT_MATCH_COMMENT=m
+CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
+CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
+CONFIG_NETFILTER_XT_MATCH_DSCP=m
+CONFIG_NETFILTER_XT_MATCH_HELPER=m
+CONFIG_NETFILTER_XT_MATCH_LIMIT=m
+CONFIG_NETFILTER_XT_MATCH_MAC=m
+CONFIG_NETFILTER_XT_MATCH_MARK=m
+CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
+CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
+CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_FILTER=m
+CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_NAT=m
+CONFIG_IP_NF_TARGET_MASQUERADE=m
+CONFIG_IP_NF_MANGLE=m
+CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_MATCH_AH=m
+CONFIG_IP6_NF_MATCH_EUI64=m
+CONFIG_IP6_NF_MATCH_IPV6HEADER=m
+CONFIG_IP6_NF_FILTER=m
+CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_RAW=m
+CONFIG_IP6_NF_NAT=m
+CONFIG_IP6_NF_TARGET_MASQUERADE=m
+CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
+CONFIG_NFT_BRIDGE_META=m
+CONFIG_NF_CONNTRACK_BRIDGE=m
+CONFIG_BRIDGE_NF_EBTABLES=m
+CONFIG_BRIDGE_EBT_BROUTE=m
+CONFIG_BRIDGE_EBT_T_FILTER=m
+CONFIG_BRIDGE_EBT_T_NAT=m
+CONFIG_BRIDGE_EBT_802_3=m
+CONFIG_BRIDGE_EBT_ARP=m
+CONFIG_BRIDGE_EBT_IP=m
+CONFIG_BRIDGE_EBT_IP6=m
+CONFIG_BRIDGE_EBT_LIMIT=m
+CONFIG_BRIDGE_EBT_PKTTYPE=m
+CONFIG_BRIDGE_EBT_STP=m
+CONFIG_BRIDGE_EBT_VLAN=m
+CONFIG_BRIDGE_EBT_ARPREPLY=m
+CONFIG_BRIDGE_EBT_DNAT=m
+CONFIG_BRIDGE_EBT_REDIRECT=m
+CONFIG_BRIDGE_EBT_SNAT=m
+CONFIG_BRIDGE_EBT_LOG=m
+CONFIG_BRIDGE_EBT_NFLOG=m
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_VLAN_FILTERING=y
+CONFIG_BRIDGE_MRP=y
+CONFIG_BRIDGE_CFM=y
+CONFIG_NET_DSA=y
+CONFIG_VLAN_8021Q=y
+CONFIG_VLAN_8021Q_GVRP=y
+CONFIG_VLAN_8021Q_MVRP=y
+CONFIG_NET_SCHED=y
+CONFIG_NET_SCH_MQPRIO=y
+CONFIG_NET_CLS_BASIC=y
+CONFIG_NET_CLS_BPF=y
+CONFIG_NET_CLS_FLOWER=y
+CONFIG_NET_CLS_ACT=y
+CONFIG_NET_ACT_GACT=y
+CONFIG_NET_ACT_MIRRED=y
+CONFIG_NET_ACT_SKBEDIT=y
+CONFIG_DCB=y
+CONFIG_NETLINK_DIAG=y
+CONFIG_MPLS=y
+CONFIG_NET_MPLS_GSO=y
+CONFIG_MPLS_ROUTING=m
+CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_PKTGEN=y
+# CONFIG_WIRELESS is not set
+CONFIG_NET_9P=y
+CONFIG_NET_9P_VIRTIO=y
+CONFIG_LWTUNNEL=y
+CONFIG_PCI=y
+CONFIG_PCIEPORTBUS=y
+CONFIG_PCI_IOV=y
+CONFIG_PCI_AARDVARK=y
+CONFIG_PCI_HOST_GENERIC=y
+CONFIG_PCIE_ARMADA_8K=y
+CONFIG_UEVENT_HELPER=y
+CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
+CONFIG_DEVTMPFS=y
+CONFIG_DEVTMPFS_MOUNT=y
+# CONFIG_STANDALONE is not set
+CONFIG_RASPBERRYPI_FIRMWARE=y
+CONFIG_FW_CFG_SYSFS=y
+CONFIG_FW_CFG_SYSFS_CMDLINE=y
+CONFIG_OF_OVERLAY=y
+CONFIG_BLK_DEV_NULL_BLK=y
+CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_RAM=y
+CONFIG_VIRTIO_BLK=y
+CONFIG_BLK_DEV_NVME=y
+CONFIG_SRAM=y
+CONFIG_EEPROM_AT24=y
+# CONFIG_SCSI_PROC_FS is not set
+CONFIG_SCSI=y
+CONFIG_BLK_DEV_SD=y
+CONFIG_SCSI_SAS_LIBSAS=y
+CONFIG_SCSI_SAS_ATA=y
+CONFIG_SCSI_VIRTIO=y
+CONFIG_ATA=y
+CONFIG_SATA_AHCI=y
+CONFIG_SATA_MOBILE_LPM_POLICY=0
+CONFIG_SATA_AHCI_PLATFORM=y
+CONFIG_AHCI_MVEBU=y
+CONFIG_PATA_OF_PLATFORM=y
+CONFIG_MD=y
+CONFIG_BLK_DEV_DM=y
+CONFIG_DM_INIT=y
+CONFIG_DM_VERITY=y
+CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
+CONFIG_NETDEVICES=y
+CONFIG_BONDING=m
+CONFIG_DUMMY=m
+CONFIG_MACVLAN=m
+CONFIG_MACVTAP=m
+CONFIG_IPVLAN=m
+CONFIG_IPVTAP=m
+CONFIG_VXLAN=m
+CONFIG_GENEVE=m
+CONFIG_BAREUDP=m
+CONFIG_MACSEC=m
+CONFIG_TUN=m
+CONFIG_VETH=m
+CONFIG_VIRTIO_NET=y
+CONFIG_NLMON=y
+CONFIG_NET_VRF=y
+CONFIG_BCMGENET=y
+CONFIG_SMSC911X=y
+CONFIG_USB_LAN78XX=y
+CONFIG_USB_USBNET=y
+CONFIG_USB_NET_SMSC95XX=y
+CONFIG_BRCMFMAC=m
+CONFIG_ZD1211RW=m
+CONFIG_INPUT_MOUSEDEV=m
+CONFIG_INPUT_EVDEV=y
+CONFIG_INPUT_TOUCHSCREEN=y
+CONFIG_TOUCHSCREEN_EDT_FT5X06=m
+# CONFIG_LEGACY_PTYS is not set
+CONFIG_SERIAL_8250=y
+CONFIG_SERIAL_8250_CONSOLE=y
+CONFIG_SERIAL_8250_EXTENDED=y
+CONFIG_SERIAL_8250_SHARE_IRQ=y
+CONFIG_SERIAL_8250_BCM2835AUX=y
+CONFIG_SERIAL_AMBA_PL011=y
+CONFIG_SERIAL_AMBA_PL011_CONSOLE=y
+CONFIG_SERIAL_DEV_BUS=y
+CONFIG_TTY_PRINTK=y
+CONFIG_HVC_DRIVER=y
+CONFIG_VIRTIO_CONSOLE=y
+CONFIG_I2C_CHARDEV=y
+CONFIG_I2C_BCM2835=m
+CONFIG_SPI=y
+CONFIG_SPI_BCM2835=y
+CONFIG_SPI_BCM2835AUX=y
+CONFIG_GPIO_SYSFS=y
+CONFIG_SENSORS_RASPBERRYPI_HWMON=m
+CONFIG_THERMAL=y
+CONFIG_BCM2711_THERMAL=y
+CONFIG_BCM2835_THERMAL=m
+CONFIG_WATCHDOG=y
+CONFIG_BCM2835_WDT=y
+CONFIG_I6300ESB_WDT=y
+CONFIG_MFD_SYSCON=y
+CONFIG_REGULATOR=y
+CONFIG_REGULATOR_FIXED_VOLTAGE=y
+CONFIG_REGULATOR_GPIO=y
+CONFIG_MEDIA_SUPPORT=y
+CONFIG_DRM=y
+CONFIG_DRM_LOAD_EDID_FIRMWARE=y
+CONFIG_DRM_PANEL_SIMPLE=m
+CONFIG_DRM_TOSHIBA_TC358762=m
+CONFIG_DRM_V3D=m
+CONFIG_DRM_VC4=m
+CONFIG_DRM_VC4_HDMI_CEC=y
+CONFIG_DRM_SIMPLEDRM=y
+CONFIG_FB=y
+CONFIG_BACKLIGHT_CLASS_DEVICE=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_SOC=y
+CONFIG_SND_BCM2835_SOC_I2S=y
+CONFIG_HID_GENERIC=m
+CONFIG_USB=y
+CONFIG_USB_OTG=y
+CONFIG_USB_STORAGE=y
+CONFIG_USB_DWC2=y
+CONFIG_NOP_USB_XCEIV=y
+CONFIG_USB_GADGET=y
+CONFIG_USB_ETH=m
+CONFIG_USB_ETH_EEM=y
+CONFIG_USB_G_SERIAL=m
+CONFIG_MMC=y
+CONFIG_MMC_SDHCI=y
+CONFIG_MMC_SDHCI_PLTFM=y
+CONFIG_MMC_SDHCI_IPROC=y
+CONFIG_MMC_BCM2835=y
+CONFIG_NEW_LEDS=y
+CONFIG_LEDS_CLASS=y
+CONFIG_LEDS_GPIO=y
+CONFIG_LEDS_TRIGGERS=y
+CONFIG_LEDS_TRIGGER_TIMER=y
+CONFIG_LEDS_TRIGGER_ONESHOT=y
+CONFIG_LEDS_TRIGGER_HEARTBEAT=y
+CONFIG_LEDS_TRIGGER_CPU=y
+CONFIG_LEDS_TRIGGER_GPIO=y
+CONFIG_LEDS_TRIGGER_DEFAULT_ON=y
+CONFIG_LEDS_TRIGGER_TRANSIENT=y
+CONFIG_LEDS_TRIGGER_CAMERA=y
+CONFIG_DMADEVICES=y
+CONFIG_DMA_BCM2835=y
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_BALLOON=y
+CONFIG_VIRTIO_INPUT=y
+CONFIG_VIRTIO_MMIO=y
+CONFIG_STAGING=y
+CONFIG_SND_BCM2835=m
+CONFIG_VIDEO_BCM2835=m
+CONFIG_CLK_RASPBERRYPI=y
+CONFIG_MAILBOX=y
+CONFIG_BCM2835_MBOX=y
+# CONFIG_IOMMU_SUPPORT is not set
+CONFIG_RASPBERRYPI_POWER=y
+CONFIG_PWM=y
+CONFIG_PWM_BCM2835=y
+CONFIG_EXT2_FS=y
+CONFIG_EXT3_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_BTRFS_FS=y
+CONFIG_BTRFS_FS_POSIX_ACL=y
+CONFIG_FANOTIFY=y
+CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
+CONFIG_QUOTA=y
+CONFIG_FUSE_FS=y
+CONFIG_VIRTIO_FS=y
+CONFIG_OVERLAY_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_EXFAT_FS=y
+CONFIG_TMPFS=y
+CONFIG_TMPFS_POSIX_ACL=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_LZO=y
+CONFIG_SQUASHFS_XZ=y
+CONFIG_SQUASHFS_ZSTD=y
+CONFIG_9P_FS=y
+CONFIG_NLS_CODEPAGE_437=y
+CONFIG_NLS_ISO8859_1=y
+CONFIG_NLS_UTF8=y
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+# CONFIG_XZ_DEC_ARM is not set
+# CONFIG_XZ_DEC_ARMTHUMB is not set
+CONFIG_DMA_CMA=y
+CONFIG_CMA_SIZE_MBYTES=32
+CONFIG_PRINTK_TIME=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
+CONFIG_MAGIC_SYSRQ=y
+CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
+CONFIG_DETECT_HUNG_TASK=y
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_FUNCTION_TRACER=y
+# CONFIG_STRICT_DEVMEM is not set
+CONFIG_MEMTEST=y

board/aarch32/raspberrypi-rpi2/Config.in

@@ -0,0 +1,15 @@
+config BR2_PACKAGE_RASPBERRYPI_RPI2
+	bool "Raspberry Pi 2 Model B (32-bit ARMv7)"
+	depends on BR2_arm
+	select SDCARD_AUX
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	help
+	  Support for the 32-bit ARMv7 Raspberry Pi 2B single-board computer
+	  (SBC) with BCM2836 quad-core Cortex-A7 processor.
+
+	  This was the only Raspberry Pi model with the BCM2836 and the 2B
+	  actually got a BCM2837 (Cortex-A53) underclocked an w/o wifi in
+	  the v1.2 board revision.

board/aarch32/raspberrypi-rpi2/README.md

@@ -0,0 +1,96 @@
+Raspberry Pi 2 Model B
+======================
+
+The [Raspberry Pi 2 Model B][1] is a 32-bit ARM single-board computer,
+powered by the Broadcom BCM2836 quad-core Cortex-A7 processor @ 900 MHz
+with 1 GB RAM.
+
+The board features:
+
+- 4x USB 2.0 ports
+- Fast Ethernet (100 Mbps)
+- microSD card slot for storage
+- HDMI port
+- GPIO header (40-pin)
+
+> [!NOTE]
+> Revision 1.2 of the Pi 2B actually uses a BCM2837 (Cortex-A53) underclocked
+> and without WiFi, making it very similar to the Pi 3B hardware-wise but
+> running in 32-bit mode.  This revision is not supported.
+
+How to Build
+------------
+
+Since there are no pre-built images for ARM32, you need to build both Infix
+and the bootloader from source.
+
+
+1. Clone the repository
+
+        git clone https://github.com/kernelkit/infix.git
+        cd infix
+
+2. Build the bootloader (in separate tree)
+
+        make O=x-boot rpi2_boot_defconfig
+        make O=x-boot
+
+3. Build Infix (in another tree)
+
+        make O=x-arm32 aarch32_defconfig
+        make O=x-arm32
+
+4. Create the SD card image
+
+        ./utils/mkimage.sh -b x-boot -r x-arm32 raspberrypi-rpi2
+
+The resulting image can be found in `x-boot/images/infix-arm-sdcard.img`
+
+Flashing to SD Card
+-------------------
+
+[Flash the image][0] to a microSD card (at least 4 GB):
+
+```bash
+sudo dd if=x-boot/images/infix-arm-sdcard.img of=/dev/mmcblk0 \
+        bs=1M status=progress oflag=direct
+```
+
+You can also use `bmaptool`:
+
+```bash
+sudo bmaptool copy x-boot/images/infix-rpi2-sdcard.img /dev/mmcblk0
+```
+
+> [!WARNING]
+> Ensure `/dev/mmcblk0` is the correct device for your SD card and not used by
+> the host system! Use `lsblk` to verify.
+
+Booting the Board
+-----------------
+
+1. Insert the flashed SD card into the Raspberry Pi
+2. Connect an Ethernet cable (DHCP will be used to get an IP address)
+3. Power up the board using a 5V/2.5A micro-USB power supply
+
+The board will boot and obtain an IP address via DHCP on the Ethernet port.
+Find the assigned IP and SSH in with the default login credentials, user/pass:
+`admin` / `admin`.
+
+Console Port (Optional)
+-----------------------
+
+A serial console can be useful for debugging. Connect a USB-to-TTL
+serial adapter (3.3V) to GPIO pins:
+
+- GND → Pin 6, ground
+- TxD → Pin 8, GPIO 14
+- RxD → Pin 10, GPIO 15
+
+Serial settings: 115200 8N1
+
+> [!WARNING]
+> Use only 3.3V serial adapters. 5V adapters will damage your Raspberry Pi!
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://www.raspberrypi.com/products/raspberry-pi-2-model-b/

board/aarch32/raspberrypi-rpi2/barebox/env/boot/mmc

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+mkdir /mnt/primary
+mount /dev/disk0.primary /mnt/primary
+
+global.bootm.image="/mnt/primary/boot/zImage"
+global.bootm.oftree="/mnt/primary/boot/broadcom/bcm2836-rpi-2-b.dtb"
+global.linux.bootargs.base="quiet console=ttyAMA0,115200 console=tty1 rauc.slot=primary"
+global.linux.bootargs.dyn.root="root=PARTLABEL=primary rootwait ro"
+
+bootm

board/aarch32/raspberrypi-rpi2/barebox/env/config

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+# Barebox configuration for Raspberry Pi 2
+
+# Boot timeout (seconds)
+global autoboot_timeout=3
+
+# Default boot order
+global boot.default="mmc net"
+
+# Enable colored output if supported
+global allow_color=true

board/aarch32/raspberrypi-rpi2/barebox/env/init/automount

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# Automount MMC partitions
+mkdir -p /mnt/mmc
+automount /mnt/mmc 'mci0.probe=1 && mount /dev/disk0.0 /mnt/mmc'

board/aarch32/raspberrypi-rpi2/barebox/env/init/bootorder

@@ -0,0 +1,4 @@
+#!/bin/sh
+
+# Set boot order: try mmc first, then network
+global.boot.default="mmc net"

board/aarch32/raspberrypi-rpi2/barebox/extras.config

@@ -0,0 +1,17 @@
+# Minimal Barebox configuration for Raspberry Pi 2
+# Basic boot only - A/B partitioning and secure boot to be added later
+
+# Enable custom embedded environment
+CONFIG_DEFAULT_ENVIRONMENT=y
+CONFIG_DEFAULT_ENVIRONMENT_GENERIC_NEW=y
+
+# Enable GPT partition table support for hybrid partition tables
+CONFIG_PARTITION_DISK_EFI=y
+
+# Enable SquashFS support for reading rootfs
+CONFIG_FS_SQUASHFS=y
+CONFIG_FS_SQUASHFS_LZ4=y
+CONFIG_FS_SQUASHFS_LZO=y
+CONFIG_FS_SQUASHFS_XZ=y
+CONFIG_FS_SQUASHFS_ZLIB=y
+CONFIG_FS_SQUASHFS_ZSTD=y

board/aarch32/raspberrypi-rpi2/config.txt

@@ -0,0 +1,19 @@
+# Raspberry Pi bootloader (start.elf) configuration
+#
+# uart_2ndstage=1 - Enable early boot debug output from the bootloader
+#                   Useful for debugging boot failures before Barebox starts
+#                   Comment out for production to reduce boot noise
+
+[all]
+kernel=barebox-raspberry-pi-2.img
+
+disable_overscan=1
+
+enable_uart=1
+#uart_2ndstage=1
+
+[pi2]
+start_file=start.elf
+fixup_file=fixup.dat
+
+gpu_mem=100

board/aarch32/raspberrypi-rpi2/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += broadcom/bcm2836-rpi-2-b.dtb

board/aarch32/raspberrypi-rpi2/dts/broadcom/Makefile

@@ -0,0 +1 @@
+# Placeholder - dtb-y is defined in parent Makefile

board/aarch32/raspberrypi-rpi2/dts/broadcom/bcm2836-rpi-2-b.dts

@@ -0,0 +1,19 @@
+#include <arm/broadcom/bcm2836-rpi-2-b.dts>
+#include "infix.dtsi"
+
+/ {
+	/* CMA pool for GPU and video */
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		cma-reserved {
+			compatible = "shared-dma-pool";
+			size = <0x4000000>; /* 64MB */
+			alignment = <0x1000000>; /* 16MB aligned */
+			linux,cma-default;
+			reusable;
+		};
+	};
+};

board/aarch32/raspberrypi-rpi2/dts/broadcom/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/aarch32/raspberrypi-rpi2/genimage.cfg.in

@@ -0,0 +1,78 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 128M
+
+	ext4 {
+		label = "var"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
+	}
+}
+
+image #INFIX_ID##VERSION#-rpi2-sdcard.img {
+	hdimage {
+		partition-table-type = "hybrid"
+	}
+
+	partition boot {
+		partition-type = 0xc
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-type-uuid = srv
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = linux
+		bootable = "true"
+		size = 250M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-type-uuid = srv
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-type-uuid = var
+		image = "var.ext4"
+	}
+}

board/aarch32/raspberrypi-rpi2/raspberrypi-rpi2.mk

@@ -1,4 +1,5 @@
-define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
+# Raspberry Pi 2 Model B specific kernel configuration
+define RASPBERRYPI_RPI2_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
@@ -10,7 +11,6 @@ define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
 
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BRCMSTB)
 	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_MBOX,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
@@ -20,9 +20,8 @@ define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
 	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
-	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_THERMAL,m)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
-	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_IPROC)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
@@ -30,8 +29,8 @@ define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
-	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,m)
-	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY,m)
+	$(call KCONFIG_SET_OPT,CONFIG_SMSC911X,y)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
@@ -57,5 +56,6 @@ define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
 
 	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
 endef
+
 $(eval $(ix-board))
 $(eval $(generic-package))

board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/factory-config.cfg

@@ -2,6 +2,17 @@
   "ieee802-dot1ab-lldp:lldp": {
     "infix-lldp:enabled": true
   },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
   "ietf-interfaces:interfaces": {
     "interface": [
       {
@@ -25,21 +36,22 @@
         }
       },
       {
-        "name": "lan",
+        "name": "eth0",
         "type": "infix-if-type:ethernet",
         "ietf-ip:ipv4": {
-          "address": [
-            {
-              "ip": "192.168.2.1",
-              "prefix-length": 24
-            }
-          ]
-        },
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "wan",
-        "type": "infix-if-type:ethernet"
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "netmask"},
+              {"id": "broadcast"},
+              {"id": "router"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "ntp-server"},
+              {"id": "vendor-class", "value": "Raspberry Pi 2 Model B"}
+            ]
+          }
+        }
       }
     ]
   },
@@ -48,9 +60,9 @@
       "asymmetric-key": [
         {
           "name": "genkey",
-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key-format": "infix-crypto-types:ssh-public-key-format",
           "public-key": "",
-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "private-key-format": "infix-crypto-types:rsa-private-key-format",
           "cleartext-private-key": "",
           "certificates": {}
         }
@@ -92,7 +104,7 @@
         ],
         "rule": [
           {
-            "name":  "deny-password-read",
+            "name": "deny-password-read",
             "module-name": "ietf-system",
             "path": "/ietf-system:system/authentication/user/password",
             "access-operations": "*",
@@ -131,7 +143,7 @@
     }
   },
   "ietf-system:system": {
-    "hostname": "r2s",
+    "hostname": "rpi-%m",
     "ntp": {
       "enabled": true,
       "server": [
@@ -140,7 +152,7 @@
           "udp": {
             "address": "pool.ntp.org"
           },
-	  "iburst": true
+          "iburst": true
         }
       ]
     },
@@ -155,38 +167,8 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
-      {
-        "if-name": "wan",
-        "option": [
-          {
-            "name": "broadcast"
-          },
-          {
-            "name": "dns"
-          },
-          {
-            "name": "domain"
-          },
-          {
-            "name": "hostname"
-          },
-          {
-            "name": "ntpsrv"
-          },
-          {
-            "name": "router"
-          },
-          {
-            "name": "subnet"
-          }
-        ]
-      }
-    ]
-  },
   "infix-meta:meta": {
-    "infix-meta:version": "1.2"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -202,5 +184,23 @@
     "restconf": {
       "enabled": true
     }
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
   }
 }

board/aarch32/raspberrypi-rpi2/rootfs/usr/share/product/raspberrypi,2-model-b/etc/product/interface-quirks.json

@@ -0,0 +1,8 @@
+{
+    "eth0": {
+	"phy-detached-when-down": true
+    },
+    "@ethtool:driver=smsc95xx": {
+        "broken-flow-control": true
+    }
+}

board/aarch32/raspberrypi-rpi2/uboot/extras.config

@@ -0,0 +1,13 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set
+
+# Increase early malloc heap to handle DTB with embedded scripts
+CONFIG_SYS_MALLOC_F_LEN=0x2000
+
+# Compression support needed for SquashFS
+CONFIG_LZ4=y
+CONFIG_LZMA=y
+CONFIG_CMD_LZMADEC=y
+CONFIG_CMD_UNLZ4=y
+CONFIG_CMD_UNZIP=y

board/aarch32/raspberrypi-rpi2/uboot/rpi-env.dtso

@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+&{/} {
+	config {
+		environment {
+			vendor = "infix";
+			preboot = "run ixpreboot";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			boot_targets = "mmc0";
+			ethprime = "eth0";
+			bootcmd = "run ixboot";
+
+			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+			ixfactory     = /incbin/("scripts/ixfactory.sh");
+
+			ixboot      = /incbin/("scripts/ixboot.sh");
+			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
+			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
+			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
+		};
+	};
+};

board/aarch64/Config.in

@@ -0,0 +1,13 @@
+if BR2_aarch64
+
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/alder-alder/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/bananapi-bpi-r3/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/freescale-imx8mp-evk/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/friendlyarm-nanopi-r2s/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-cn9130-crb/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/marvell-espressobin/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/microchip-sparx5-pcb135/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/raspberrypi-rpi64/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/board/aarch64/styx-dcp-sc-28p/Config.in"
+
+endif

board/aarch64/README.md

@@ -8,4 +8,4 @@ Board Specific Documentation
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
-- [Raspberry Pi 4 b](raspberry-pi-4/)
+- [Raspberry Pi 64-bit](raspberry-pi64/)

board/aarch64/banana-pi-r3/README.md

@@ -1,27 +0,0 @@
-# Banana Pi R3
-
-## Support level
-Full support for all Infix enabled features including switched ethernet ports, WiFi,
-and SFP interfaces. The board includes comprehensive hardware support for
-MediaTek MT7986 SoC features.
-
-### Hardware features
-The Banana Pi R3 is a high-performance networking board featuring:
-- MediaTek MT7986 ARM Cortex-A53 quad-core processor
-- 4x Gigabit LAN ports (lan1-lan4)
-- 1x Gigabit WAN port
-- 2x SFP ports (sfp1, sfp2) for fiber connectivity
-- Dual WiFi interfaces (wifi0 for 2.4GHz, wifi1 for 5GHz)
-- USB support
-- SD card boot support
-
-### Network configuration
-The board comes preconfigured with:
-- 4 switched LAN ports for internal networking
-- Dedicated WAN port with DHCP client enabled
-- SFP ports for high-speed fiber connections
-- Dual WiFi interfaces for wireless connectivity
-
-### Pre-built images
-SD card image: [infix-bpi-r3-sdcard.img](https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img)
-

board/aarch64/bananapi-bpi-r3/Config.in

@@ -1,4 +1,4 @@
-config BR2_PACKAGE_BANANA_PI_R3
+config BR2_PACKAGE_BANANAPI_BPI_R3
 	bool "Banana Pi R3"
 	depends on BR2_aarch64
 	select BR2_PACKAGE_FEATURE_WIFI

board/aarch64/bananapi-bpi-r3/README.md

@@ -0,0 +1,229 @@
+# Banana Pi BPI-R3
+
+<img src="bananapi-bpi-r3.webp" alt="The board" width=800 padding=10>
+
+## Overview
+
+The Banana Pi R3 is a high-performance networking board with full Infix
+support for all enabled features including switched Ethernet ports, WiFi,
+and SFP interfaces.
+
+### Hardware Features
+
+- MediaTek MT7986 ARM Cortex-A53 quad-core processor @ 2.0 GHz
+- 2 GB DDR4 RAM
+- 8 GB eMMC storage + microSD card slot
+- 5x Gigabit Ethernet ports (4x LAN, 1x WAN)
+- 2x SFP cages for fiber connectivity (1G/2.5G)
+- Dual-band WiFi (2.4 GHz + 5 GHz)
+- USB 3.0 port
+- Mini PCIe slot
+
+### Default Network Configuration
+
+Infix comes preconfigured with:
+
+- **LAN ports** (lan1-lan4): Bridged for internal networking
+- **WAN port**: DHCP client enabled for internet connectivity
+- **SFP ports** (sfp1, sfp2): Available for configuration
+- **WiFi interfaces** (wifi0, wifi1): Available for configuration
+
+## Getting Started
+
+### Quick Start with SD Card
+
+The easiest way to get started is using an SD card:
+
+1. **Download the SD card image:** [infix-bpi-r3-sdcard.img][2]
+2. **Flash the image to an SD card:** see [this guide][0]
+3. **Set boot switches:**
+   - Set DIP switches to **0000** (SD card boot mode)
+   - Switch positions are on the underside of the board near the SD slot
+4. **Boot the board:**
+   - Insert the SD card
+   - Connect power
+   - Connect to LAN port or console (115200 8N1)
+   - Default login: `admin` / `admin`
+
+### Boot Switch Reference
+
+The BPI-R3 has a 4-position DIP switch that controls boot media:
+
+<img align="right" src="bootstrap-switch.webp" alt="DIP switches" width=200 padding=10>
+
+| Position | Mode        | Description                           |
+|----------|-------------|---------------------------------------|
+| 0000     | SD card     | Boot from microSD card (recommended)  |
+| 0110     | eMMC        | Boot from internal eMMC storage       |
+| 1010     | SPI NAND    | Boot from SPI NAND (advanced users)   |
+
+> [!NOTE]
+> Switch position is read from left to right: "0" = OFF, "1" = ON.  
+> When the DIP switch is in the "UP" position it is OFF(0).
+
+## Advanced: Installing to eMMC
+
+For production deployments or better performance, you can install Infix
+to the internal eMMC storage. This is more complex but provides faster
+boot times and eliminates the external SD card.
+
+### Why Use eMMC?
+
+**Advantages:**
+
+- Faster boot and better performance
+- No external SD card to manage
+- More robust for industrial/embedded deployments
+
+**Disadvantages:**
+
+- More complex installation process
+- Requires intermediate NAND boot step
+- Harder to recover from errors
+
+### Prerequisites
+
+- FTDI USB-to-serial cable (3.3V) for console access
+- microSD card with Infix (for initial boot)
+- USB flash drive (FAT32 formatted)
+- Downloaded files (see below)
+
+### Required Files
+
+Download and place these files on a FAT32-formatted USB drive:
+
+1. **Intermediate NAND bootloader** (from Frank-W's U-Boot):
+   - [bpi-r3_spim-nand_bl2.img][5] (BL2 loader)
+   - [bpi-r3_spim-nand_fip.bin][6] (FIP image)
+2. **Infix eMMC image:**
+   - [infix-bpi-r3-emmc.img][3] (Complete system image)
+3. **eMMC bootloader** (extracted from):
+   - [bpi-r3-emmc-boot-2025.01-latest.tar.gz][4]
+   - Extract `bl2.img` from the tarball to your USB drive
+
+> [!WARNING]
+> The following process involves multiple boot mode changes.  Take your
+> time verify each step carefully.
+
+### Installation Steps
+
+#### Step 1: Boot from SD card
+
+1. Set boot switches to **0000** (SD card mode)
+2. Insert SD card with Infix
+3. Power on and break into U-Boot (press Ctrl-C during boot)
+
+#### Step 2: Flash intermediate NAND bootloader
+
+This step installs a temporary bootloader to NAND that will help us
+flash the eMMC. From the U-Boot prompt:
+
+```
+usb start
+mtd erase spi-nand0
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_bl2.img
+mtd write spi-nand0 0x50000000 0x0 0x100000
+fatload usb 0:1 0x50000000 bpi-r3_spim-nand_fip.bin
+mtd write spi-nand0 0x50000000 0x380000 0x200000
+```
+
+#### Step 3: Boot from NAND
+
+1. Power off the board
+2. Set boot switches to **1010** (NAND mode)
+3. Power on - you should boot into U-Boot again
+
+#### Step 4: Write Infix image to eMMC
+
+From the U-Boot prompt:
+
+```
+usb start
+fatload usb 0:1 0x50000000 infix-bpi-r3-emmc.img
+setexpr blocks ${filesize} / 0x200
+mmc write 0x50000000 0x0 ${blocks}
+```
+
+This writes the complete Infix system (partitions, rootfs, etc.) to eMMC.
+
+#### Step 5: Configure eMMC boot
+
+Now configure the eMMC boot partition and write the bootloader:
+
+```
+mmc partconf 0 1 1 1
+mmc erase 0x0 0x400
+fatload usb 0:1 0x50000000 bl2.img
+mmc write 0x50000000 0x0 0x400
+mmc partconf 0 1 1 0
+```
+
+#### Step 6: Boot from eMMC
+
+1. Power off the board
+2. Set boot switches to **0110** (eMMC mode)
+3. Remove SD card (optional, but recommended to verify eMMC boot)
+4. Power on
+
+Your BPI-R3 should now boot Infix from internal eMMC storage!
+
+## Troubleshooting
+
+### Board won't boot
+
+- Verify boot switch positions (check twice!)
+- Ensure power supply provides adequate current (12V/2A recommended)
+- Try booting from SD card with switches at **0000**
+
+### Can't break into U-Boot
+
+- Ensure serial console is connected properly (115200 8N1, 3.3V)
+- Press Ctrl-C immediately when you see boot messages
+- Try power cycling and pressing Ctrl-C repeatedly
+
+### eMMC boot fails after installation
+
+- Boot from NAND (**1010**) and verify eMMC image was written
+- Check USB drive contents - ensure all files are present
+- Re-run Step 5 (eMMC boot configuration)
+
+### Reverting to SD card
+
+Simply set boot switches back to **0000** and boot from SD card. The
+eMMC installation does not affect SD card functionality.
+
+## Additional Resources
+
+- [Infix Documentation][1]
+- [Official BPI-R3 Wiki][7]
+- [Release Downloads][8]
+
+## Building Custom Images
+
+See the main Infix documentation for building from source. To build both
+SD card and eMMC images locally:
+
+```bash
+# Build bootloaders for both SD and eMMC
+make x-bpi-r3-sd-boot
+make x-bpi-r3-emmc-boot
+
+# Build main system
+make aarch64
+
+# Create SD card image
+./utils/mkimage.sh -od bananapi-bpi-r3
+
+# Create eMMC image
+./utils/mkimage.sh -odt emmc bananapi-bpi-r3
+```
+
+[0]: https://kernelkit.org/posts/flashing-sdcard/
+[1]: https://kernelkit.org/infix/latest/
+[2]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-sdcard.img
+[3]: https://github.com/kernelkit/infix/releases/download/latest-boot/infix-bpi-r3-emmc.img
+[4]: https://github.com/kernelkit/infix/releases/download/latest-boot/bpi-r3-emmc-boot-2025.01-latest.tar.gz
+[5]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_bl2.img
+[6]: https://github.com/frank-w/u-boot/releases/download/CI-BUILD-2025-10-bpi-2025.10-2025-10-13_1032/bpi-r3_spim-nand_fip.bin
+[7]: https://wiki.banana-pi.org/Banana_Pi_BPI-R3
+[8]: https://github.com/kernelkit/infix/releases/tag/latest-boot

board/aarch64/bananapi-bpi-r3/bananapi-bpi-r3.mk

@@ -1,8 +1,4 @@
-GENIMAGE_CFG="$(BUILD_DIR)/genimage.cfg"
-GENIMAGE_TMP="$(BUILD_DIR)/genimage.tmp"
-BOARD_DIR="$(BR2_EXTERNAL_INFIX_PATH)/src/board/banana-pi-r3"
-
-define BANANA_PI_R3_LINUX_CONFIG_FIXUPS
+define BANANAPI_BPI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_MEDIATEK)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_MACH_MT7986)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_MT7986)
@@ -28,7 +24,7 @@ define BANANA_PI_R3_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_SET_OPT,CONFIG_USB_XHCI_MTK,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_TPHY,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PHY_MTK_XSPHY,m)
-	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_GPIO,y)
 	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_MT6380,m)
 	$(call KCONFIG_SET_OPT,CONFIG_PWM_MEDIATEK,m)
 	$(call KCONFIG_SET_OPT,CONFIG_SENSORS_PWM_FAN,m)

board/aarch64/bananapi-bpi-r3/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += mediatek/mt7986a-bananapi-bpi-r3-sd.dtb mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dts

@@ -0,0 +1,2 @@
+#include "mt7986a-bananapi-bpi-r3.dtsi"
+#include "mt7986a-bananapi-bpi-r3-emmc.dtsi"

board/aarch64/bananapi-bpi-r3/dts/mediatek/mt7986a-bananapi-bpi-r3-emmc.dtsi

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: (GPL-2.0 OR MIT)
+/*
+ * Copyright (C) 2021 MediaTek Inc.
+ * Author: Sam.Shih <sam.shih@mediatek.com>
+ */
+
+/*
+This is copied from linux where it is an overlay, unfortunatly it is not
+possible to use dtbo in sysboot unless present in syslinux.conf
+*/
+&{/soc/mmc@11230000} {
+        bus-width = <8>;
+        max-frequency = <200000000>;
+        cap-mmc-highspeed;
+        mmc-hs200-1_8v;
+        mmc-hs400-1_8v;
+        hs400-ds-delay = <0x14014>;
+        non-removable;
+        no-sd;
+        no-sdio;
+        status = "okay";
+};

board/aarch64/bananapi-bpi-r3/genimage.cfg.in

@@ -1,24 +1,30 @@
-
 image cfg.ext4 {
         empty = true
         temporary = true
         size = 128M
         ext4 {
                 label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
         }
 }
 
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
 image var.ext4 {
         empty = true
         temporary = true
-        size = 1G
+        size = 128M
         ext4 {
                 label = "var"
                 use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
         }
 }
 
-image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
+image #INFIX_ID##VERSION#-bpi-r3-#TARGET#.img {
         hdimage {
                 partition-table-type = "gpt"
 
@@ -27,19 +33,19 @@ image #INFIX_ID##VERSION#-bpi-r3-sdcard.img {
 	partition bl2 {
 		  image = "bl2.img"
 		  offset = 1024s   # 0x80000 = sector 1024
-		  size = 4M       # 0x400000
+		  size = 4M        # 0x400000
 		  bootable = true
-    }
+	}
 
-    # Factory/calibration data (sectors 9216-13311)
-    partition factory {
-        offset = 4608K  # 0x480000
-        size = 2M       # 0x200000
-    }
+	# Factory/calibration data (sectors 9216-13311)
+	partition factory {
+		offset = 4608K  # 0x480000
+		size = 2M       # 0x200000
+	}
 
-# FIP partition - BL31 + U-Boot (sectors 13312-17407)
+	# FIP partition - BL31 + U-Boot (sectors 13312-17407)
         partition fip {
-	 #       partition-type = 0x83  # Linux filesystem
+#		partition-type = 0x83  # Linux filesystem
                 image = "fip.bin"
                 offset = 13312s
                 size = 4096s

board/aarch64/bananapi-bpi-r3/rootfs/usr/share/product/bananapi,bpi-r3/etc/factory-config.cfg

@@ -0,0 +1,344 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      },
+      {
+        "class": "infix-hardware:usb",
+        "name": "USB2",
+        "state": {
+          "admin-state": "unlocked"
+        }
+      }
+    ]
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
+      },
+      {
+        "name": "lan1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan3",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lan4",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
+      },
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "sfp1",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "sfp2",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv6": {}
+      },
+      {
+        "name": "wan",
+        "type": "infix-if-type:ethernet",
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "Banana Pi BPI-R3"}
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
+            ]
+          }
+        }
+      },
+      {
+        "name": "wifi0",
+        "type": "infix-if-type:wifi"
+      },
+      {
+        "name": "wifi1",
+        "type": "infix-if-type:wifi"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+        "asymmetric-keys": {
+            "asymmetric-key": [
+                {
+                    "name": "genkey",
+                    "public-key-format": "infix-crypto-types:ssh-public-key-format",
+                    "public-key": "",
+                    "private-key-format": "infix-crypto-types:rsa-private-key-format",
+                    "cleartext-private-key": "",
+                    "certificates": {}
+                }
+            ]
+        }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name": "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "bpi-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
+  },
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
+      {
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
+        ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+	"action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "version": "1.6"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:ssh": {
+    "enabled": true,
+    "hostkey": [
+      "genkey"
+    ],
+    "listen": [
+      {
+        "name": "ipv4",
+        "address": "0.0.0.0",
+        "port": 22
+      },
+      {
+        "name": "ipv6",
+        "address": "::",
+        "port": 22
+      }
+    ]
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
+

board/aarch64/bananapi-bpi-r3/uboot/emmc-extras.config

@@ -0,0 +1,3 @@
+CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi mt7986-emmc-env.dtsi"
+BR2_TARGET_ARM_TRUSTED_FIRMWARE_ADDITIONAL_VARIABLES="BOOT_DEVICE=emmc DRAM_USE_DDR4=1 USE_MKIMAGE=1  MKIMAGE=$(HOST_DIR)/bin/mkimage"
+CONFIG_SUPPORT_EMMC_BOOT=y

board/aarch64/bananapi-bpi-r3/uboot/extras.config

@@ -0,0 +1,33 @@
+CONFIG_AUTOBOOT=y
+CONFIG_BOOTDELAY=2
+# CONFIG_MMC_PCI is not set
+CONFIG_ENV_IS_NOWHERE=y
+# CONFIG_ENV_IS_IN_MMC is not set
+CONFIG_USB=y
+CONFIG_USB_XHCI_HCD=y
+CONFIG_USB_XHCI_MTK=y
+CONFIG_USB_MTU3=y
+CONFIG_PHY=y
+CONFIG_PHY_MTK_TPHY=y
+
+CONFIG_MTK_SPIM=y
+CONFIG_SPI=y
+CONFIG_DM_SPI=y
+CONFIG_SPI_FLASH=y
+CONFIG_DM_SPI_FLASH=y
+CONFIG_SPI_FLASH_MTD=y
+CONFIG_SPI_FLASH_MACRONIX=y
+CONFIG_SPI_FLASH_WINBOND=y
+CONFIG_SPI_FLASH_GIGADEVICE=y
+CONFIG_MTD=y
+CONFIG_DM_MTD=y
+CONFIG_MTD_PARTITIONS=y
+CONFIG_MTD_SPI_NAND=y
+CONFIG_MTK_SPIM=y
+CONFIG_MTK_SNOR=y
+
+CONFIG_CMD_SF=y
+CONFIG_CMD_USB=y
+CONFIG_CMD_MTD=y
+CONFIG_CMD_MTDPARTS=y
+CONFIG_CMD_DM=y

board/aarch64/bananapi-bpi-r3/uboot/mt7986-emmc-env.dtsi

@@ -0,0 +1,5 @@
+#include <mt7986-env.dtsi>
+
+&env {
+      fdtfile = "mediatek/mt7986a-bananapi-bpi-r3-emmc.dtb";
+};

board/aarch64/board.mk

@@ -1,3 +1,4 @@
+include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/*/*.mk))
 
 .PHONY: board-enable-qemu-uboot
 board-enable-qemu-uboot:
@@ -19,13 +20,6 @@ board-enable-qemu-uboot:
 			'$$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config' \
 		--enable TARGET_UBOOT_FORMAT_DTB
 
-.PHONY: board-enable-sparx-fit
-board-enable-sparx-fit:
-	@$(call IXMSG,"Enabling SparX-5i compatible FIT options")
-	@BR2_PREFIX= ./utils/config --file $(BR2_CONFIG) \
-	 	--enable FIT_IMAGE \
-	 	--set-str FIT_KERNEL_LOAD_ADDR "0x7 0x00000000"
-
 .PHONY: board-sparx-flash-uboot
 board-sparx-flash-uboot: $(BINARIES_DIR)/u-boot.bin
 	@grep -q 'BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"' $(BR2_CONFIG) || \

board/aarch64/friendlyarm-nanopi-r2s/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_FRIENDLYARM_NANOPI_R2S
+	bool "FriendlyElec NanoPi R2S"
+	depends on BR2_aarch64
+	select SDCARD_AUX
+	select BR2_PACKAGE_INPUT_EVENT_DAEMON
+	select BR2_PACKAGE_LINUX_FIRMWARE_RTL_815X
+	help
+	  FriendlyElec NanoPi R2S is a compact router board based on
+	  the Rockchip RK3328 SoC with dual Gigabit Ethernet ports.

board/aarch64/friendlyarm-nanopi-r2s/LICENSE

@@ -0,0 +1,13 @@
+Copyright (c) 2025 The KernelKit Authors
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted, provided that the above
+copyright notice and this permission notice appear in all copies.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

board/aarch64/friendlyarm-nanopi-r2s/dts/Makefile

@@ -0,0 +1 @@
+dtb-y += rockchip/rk3328-nanopi-r2s.dtb

board/aarch64/friendlyarm-nanopi-r2s/dts/rockchip/infix.dtsi

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Common Infix OS defaults
+ */
+
+/ {
+	chosen {
+		infix {
+			/* Default admin user password: 'admin' */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+		};
+	};
+};

board/aarch64/friendlyarm-nanopi-r2s/dts/rockchip/rk3328-nanopi-r2s.dts

@@ -0,0 +1,23 @@
+#include <arm64/rockchip/rk3328-nanopi-r2s.dts>
+#include "infix.dtsi"
+
+&rtl8153 {
+	/*
+	 * Fix port number: device is on port 1, not port 2
+	 *
+	 * The kernel's usb_of_get_connect_type() function checks for child
+	 * nodes with a 'reg' property matching the physical port number to
+	 * determine if a USB port is "hard-wired" (internal) vs external.
+	 * With authorized_default=2, only hard-wired ports are automatically
+	 * authorized. The RTL8153 shows up as device 3-1 (hub 3, port 1), so
+	 * reg must be <1> for the kernel to mark it as USB_PORT_CONNECT_TYPE_HARD_WIRED
+	 * and authorize it automatically at boot.
+	 */
+	reg = <1>;
+};
+
+&{/chosen/infix} {
+	/* Expose only the external USB 2.0 port for user management */
+	usb-ports = <&usb_host0_ehci>;
+	usb-port-names = "USB";
+};

board/aarch64/friendlyarm-nanopi-r2s/friendlyarm-nanopi-r2s.mk

@@ -0,0 +1,78 @@
+define FRIENDLYARM_NANOPI_R2S_LINUX_CONFIG_FIXUPS
+	# Rockchip RK3328 SoC
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IOMMU)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PM_DOMAINS)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_IODOMAIN)
+
+	# PHY drivers
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_EMMC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_INNO_USB2)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_ROCKCHIP_TYPEC)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_USB,m)
+	$(call KCONFIG_SET_OPT,CONFIG_PHY_ROCKCHIP_PCIE,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ROCKCHIP_PHY)
+
+	# Clocks and Power Management
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RK3328)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_PWM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PWM_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_GPIO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REGULATOR_RK808)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CHARGER_RK817)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_RK805)
+
+	# I2C Controller
+	$(call KCONFIG_ENABLE_OPT,CONFIG_I2C_RK3X)
+
+	# I2C/SPI/MFD
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_I2C)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MFD_RK8XX_SPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SPI_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_RK805_PWRKEY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RTC_DRV_RK808)
+
+	# MMC/Storage
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_DW_ROCKCHIP)
+
+	# PCIe
+	$(call KCONFIG_SET_OPT,CONFIG_PCIE_ROCKCHIP_HOST,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PCIE_ROCKCHIP_DW_HOST)
+
+	# Thermal and ADC
+	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_THERMAL,m)
+	$(call KCONFIG_SET_OPT,CONFIG_ROCKCHIP_SARADC,m)
+
+	# Crypto
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CRYPTO_DEV_ROCKCHIP)
+
+	# NVMEM
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_EFUSE,m)
+	$(call KCONFIG_SET_OPT,CONFIG_NVMEM_ROCKCHIP_OTP,m)
+
+	# Network: STMMAC Ethernet (WAN port - RK3328 GMAC with RTL8211E PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_STMICRO)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_ETH)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_STMMAC_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DWMAC_ROCKCHIP)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+
+	# Network: USB Ethernet (LAN port - RTL8153 via USB 3.0)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_NET_DRIVERS,m)
+	$(call KCONFIG_SET_OPT,CONFIG_USB_RTL8152,m)
+
+	# USB 3.0 xHCI Controller (required for RTL8153 LAN port)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_XHCI_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
+
+	# USB 2.0 Host
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_HCD_PLATFORM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_EHCI_ROOT_HUB_TT)
+endef
+
+$(eval $(ix-board))
+$(eval $(generic-package))

board/aarch64/friendlyarm-nanopi-r2s/genimage.cfg.in

@@ -5,21 +5,28 @@ image cfg.ext4 {
 
 	ext4 {
 		label = "cfg"
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
 	}
 }
 
+# The /var partition will be expanded automatically at first boot
+# to use the full size of the SD-card or eMMC media.
 image var.ext4 {
 	empty = true
 	temporary = true
-	size = 512M
+	size = 128M
 
 	ext4 {
 		label = "var"
-		use-mke2fs = true
+                use-mke2fs = true
+                features = "uninit_bg"
+                extraargs = "-m 0 -i 4096"
 	}
 }
 
-image sdcard.img {
+image #INFIX_ID##VERSION#-nanopi-r2s-sdcard.img {
 	hdimage {
 		partition-table-type = "gpt"
 	}

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/factory-config.cfg

@@ -5,8 +5,8 @@
   "ietf-hardware:hardware": {
     "component": [
       {
-        "name": "USB",
         "class": "infix-hardware:usb",
+        "name": "USB",
         "state": {
           "admin-state": "unlocked"
         }
@@ -16,24 +16,24 @@
   "ietf-interfaces:interfaces": {
     "interface": [
       {
-        "name": "lan1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "name": "br0",
+        "type": "infix-if-type:bridge",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "192.168.0.1",
+              "prefix-length": 24
+            }
+          ]
+        }
       },
       {
-        "name": "lan2",
+        "name": "lan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "lan3",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "lan4",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
+        "ietf-ip:ipv6": {},
+        "infix-interfaces:bridge-port": {
+          "bridge": "br0"
+        }
       },
       {
         "name": "lo",
@@ -55,28 +55,33 @@
           ]
         }
       },
-      {
-        "name": "sfp1",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "sfp2",
-        "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
       {
         "name": "wan",
         "type": "infix-if-type:ethernet",
-        "ietf-ip:ipv6": {}
-      },
-      {
-        "name": "wifi0",
-        "type": "infix-if-type:wifi"
-      },
-      {
-        "name": "wifi1",
-        "type": "infix-if-type:wifi"
+        "ietf-ip:ipv4": {
+          "infix-dhcp-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "broadcast"},
+              {"id": "domain"},
+              {"id": "hostname"},
+              {"id": "dns-server"},
+              {"id": "router"},
+              {"id": "netmask"},
+              {"id": "vendor-class", "value": "NanoPi R2S"}
+            ]
+          }
+        },
+        "ietf-ip:ipv6": {
+          "infix-dhcpv6-client:dhcp": {
+            "option": [
+              {"id": "ntp-server"},
+              {"id": "client-fqdn"},
+              {"id": "domain-search"},
+              {"id": "dns-server"}
+            ]
+          }
+        }
       }
     ]
   },
@@ -168,7 +173,17 @@
     }
   },
   "ietf-system:system": {
-    "hostname": "infix-00-00-00",
+    "hostname": "r2s-%m",
+    "ntp": {
+      "server": [
+        {
+          "name": "default",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
     "authentication": {
       "user": [
         {
@@ -180,38 +195,68 @@
     },
     "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCBPUyDigJQgSW1tdXRhYmxlLkZyaWVuZGx5LlNlY3VyZQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQub3JnCictJy0tLSctJwo="
   },
-  "infix-dhcp-client:dhcp-client": {
-    "client-if": [
+  "infix-dhcp-server:dhcp-server": {
+    "option": [
       {
-        "if-name": "wan",
-        "option": [
-          {
-            "id": "ntp-server"
-          },
-          {
-            "id": "broadcast"
-          },
-          {
-            "id": "domain"
-          },
-          {
-            "id": "hostname"
-          },
-          {
-            "id": "dns-server"
-          },
-          {
-            "id": "router"
-          },
-          {
-            "id": "netmask"
-          }
+        "id": "ntp-server",
+        "address": "auto"
+      },
+      {
+        "id": "dns-server",
+        "address": "auto"
+      },
+      {
+        "id": "router",
+        "address": "auto"
+      }
+    ],
+    "subnet": [
+      {
+        "subnet": "192.168.0.0/24",
+        "pool": {
+          "start-address": "192.168.0.100",
+          "end-address": "192.168.0.250"
+        }
+      }
+    ]
+  },
+  "infix-firewall:firewall": {
+    "default": "wan",
+    "zone": [
+      {
+        "name": "lan",
+        "action": "accept",
+        "interface": [
+          "br0"
         ]
+      },
+      {
+        "name": "wan",
+        "action": "drop",
+        "interface": [
+          "wan"
+        ],
+        "service": [
+          "dhcpv6-client"
+        ]
+      }
+    ],
+    "policy": [
+      {
+        "name": "lan-to-wan",
+	"action": "accept",
+        "ingress": [
+          "lan"
+        ],
+        "egress": [
+          "wan"
+        ],
+        "masquerade": true
       }
     ]
   },
   "infix-meta:meta": {
-    "version": "1.5"
+    "version": "1.6"
   },
   "infix-services:mdns": {
     "enabled": true
@@ -247,4 +292,3 @@
     }
   }
 }
-

board/aarch64/friendlyarm-nanopi-r2s/rootfs/usr/share/product/friendlyarm,nanopi-r2s/etc/product/init.d/S01-trigger-udev.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+udevadm control --reload-rules
+udevadm trigger --subsystem-match=net --action=add