mech: Play around with a native yang model

2026-07-25 18:23:01 +02:00 · 2023-03-27 10:02:27 +02:00
470 changed files with 9538 additions and 29146 deletions
@@ -2,15 +2,16 @@ Contributing to Infix
 =====================

 We welcome any and all help in the form of bug reports, fixes, patches
-to add new features -- *preferably as GitHub pull requests*.
+to add new features -- *preferably as GitHub pull requests*.  Other
+methods are of course also possible: emailing the [maintainers][] a
+patch or even a raw file, a feature request or an alert of a problem.

-If you are unsure of what to do, or how to implement an idea or bug fix,
-open an issue with `"[RFC]: Unsure if this is a bug ... ?"`, or use the
-[GitHub discussions forum](https://github.com/orgs/kernelkit/discussions).
-Talking about code and problems first is often the best way to get started
-before submitting a pull request.
+If you are unsure of what to do, or how to implement an idea or bugfix,
+open an issue with `"[RFC: Unsure if this is a bug ... ?"`, or use the
+GitHub discussions forum, so we can discuss it.  Talking about the code
+first is the best way to get started before submitting a pull request.

-When submitting a bug report, patch, or pull request, please start by
+Either way, when sending an email, patch, or pull request, start by
 stating the version the change is made against, what it does, and why.

 Please take care to ensure you follow the project coding style and the
@@ -71,6 +72,7 @@ The *"maintainers have the right and responsibility to remove, edit,
 or reject comments, commits, code, wiki edits, issues, and other
 contributions that are not aligned to this Code of Conduct."*

+[1]:        ../doc/MAINTAINERS
 [KNF]:      https://en.wikipedia.org/wiki/Kernel_Normal_Form
 [gitbook]:  https://git-scm.com/book/ch5-2.html
 [conduct]:  CODE-OF-CONDUCT.md
@@ -1 +0,0 @@
-Paid support and development provided by Addiva Elektronik <https://addiva.se>
@@ -1,78 +1,61 @@
 name: Bob the Builder

+# Consider switching to 'on: workflow_dispatch' when activity increases.
 on:
+  push:
+    branches:
+      - '*'
  pull_request:
    branches:
-      - main
-    types:
-      - closed
-  workflow_dispatch:
+      - '*'

 jobs:
  build:
-    if: ${{github.ref_name == 'main' && github.event_name == 'push'}} || github.event_name == 'workflow_dispatch'
-    name: Build ${{ matrix.platform }} ${{ matrix.variant }}
+    name: Build ${{ matrix.platform }}
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
+        platform: [aarch64, amd64]
      fail-fast: false
    steps:
      - uses: actions/checkout@v3
      - name: Set Build Variables
        id: vars
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}
-          fi
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+          echo "dir=infix-${{ matrix.platform }}"        >> $GITHUB_OUTPUT
+          echo "tgz=infix-${{ matrix.platform }}.tar.gz" >> $GITHUB_OUTPUT
      - name: Restore Cache of dl/
        uses: actions/cache@v3
        with:
          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ matrix.platform }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
            dl-${{ matrix.platform }}-
            dl-
      - name: Restore Cache of .ccache/
        uses: actions/cache@v3
        with:
-          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          path: .buildroot-ccache/
+          key: ccache-${{ matrix.board }}-os-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
-            ccache-${{ matrix.platform }}-
-            ccache-
+            ccache-${{ matrix.board }}-os-
+            ccache-${{ matrix.board }}-
+            ccache--os-
      - name: Configure & Build
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
-          echo "Buildring $target ..."
-          make $target
+          make ${{ matrix.platform }}_defconfig
          make
      - name: Prepare Artifact
        run: |
          cd output
          mv images ${{ steps.vars.outputs.dir }}
-          ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-      - name: Test
-        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
-        run: |
-          make test-qeneth
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          ls -l
+          ls -l ${{ steps.vars.outputs.dir }}
      - uses: actions/upload-artifact@v3
        with:
          path: output/${{ steps.vars.outputs.tgz }}
  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
    needs: build
    runs-on: ubuntu-latest
@@ -1,64 +0,0 @@
-name: Reggie Regression
-
-on:
-  push:
-    branches:
-      - '*'
-  pull_request:
-    branches:
-      - '*'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    name: Regression Testing
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set Build Variables
-        id: vars
-        run: |
-          target=x86_64-minimal
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-      - name: Restore Cache of dl/
-        uses: actions/cache@v3
-        with:
-          path: dl/
-          key: dl-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/heads/master', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-x86_64-netconf-
-            dl-x86_64-
-            dl-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
-        with:
-          path: .ccache/
-          key: ccache-x86_64-netconf-${{ hashFiles('.git/modules/buildroot/refs/head/master', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-x86_64-netconf-
-            ccache-x86_64-
-            ccache-
-      - name: Configure Minimal NETCONF
-        run: |
-          make x86_64_minimal_defconfig
-      - name: Build
-        run: |
-          make
-      - name: Prepare Artifact
-        run: |
-          cd output
-          mv images ${{ steps.vars.outputs.dir }}
-          ln -s ${{ steps.vars.outputs.dir }} images
-          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
-      - name: Upload Artifact
-        uses: actions/upload-artifact@v3
-        with:
-          path: output/${{ steps.vars.outputs.tgz }}
-      - name: Regression Test
-        run: |
-          make test-qeneth
@@ -1,100 +0,0 @@
-name: Release General
-
-on:
-  push:
-    tags:
-      - 'v[0-9]*.*'
-
-jobs:
-  build:
-    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}-${{ matrix.variant }}]
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
-      fail-fast: false
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set Release Variables
-        id: build
-        run: |
-          ver=${GITHUB_REF#refs/tags/v}
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
-          if echo $ver | grep -qE '[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
-            echo "pre=true"  >> $GITHUB_OUTPUT
-          else
-            echo "pre=false" >> $GITHUB_OUTPUT
-          fi
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}-${ver}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}-${ver}
-          fi
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-      - name: Restore Cache of dl/
-        uses: actions/cache@v3
-        with:
-          path: dl/
-          key: dl-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
-          restore-keys: |
-            dl-${{ matrix.platform }}-${{ matrix.variant }}-
-            dl-${{ matrix.platform }}-
-            dl-
-      - name: Restore Cache of .ccache/
-        uses: actions/cache@v3
-        with:
-          path: .ccache/
-          key: ccache-${{ matrix.platform }}-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
-          restore-keys: |
-            ccache-${{ matrix.platform }}-${{ matrix.variant }}-
-            ccache-${{ matrix.platform }}-
-            ccache-
-      - name: Configure & Build
-        env:
-          INFIX_RELEASE: ${{ steps.build.outputs.ver }}
-        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
-          echo "Buildring $target ..."
-          make $target
-          make
-      - name: Prepare Artifact
-        run: |
-          cd output
-          mv images ${{ steps.build.outputs.dir }}
-          ln -s ${{ steps.build.outputs.dir }} images
-          tar chfz ${{ steps.build.outputs.tgz }} ${{ steps.build.outputs.dir }}
-      - uses: actions/upload-artifact@v3
-        with:
-          path: output/${{ steps.build.outputs.tgz }}
-  release:
-    name: Release Infix ${{ github.ref_name }}
-    needs: build
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/download-artifact@v3
-      - name: Extract ChangeLog entry ...
-        run: |
-          awk '/-----*/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
-              |head -n -1 > release.md
-          cat release.md
-      - uses: ncipollo/release-action@v1
-        with:
-          name: Infix ${{ github.ref_name }}
-          prerelease: ${{ needs.build.outputs.pre }}
-          bodyFile:  release.md
-          artifacts: artifact/*
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Infix ${{ github.ref_name }} Released! :rocket:
-          
-          For the public download links of this release, please see:
-           <https://github.com/kernelkit/infix/releases/tag/${{ github.ref_name }}>
-          EOF
@@ -1,26 +0,0 @@
-# To enable automatic sync of your Infix fork every day, or on dispatch,
-# set the repoistory or organisation variable (not secret):
-#
-#     SYNC_FORK = 'true'
-#
-# See https://docs.github.com/en/actions/learn-github-actions/variables
-name: Synchronize your fork of Infix with upstream
-
-on:
-  schedule:
-    - cron: 42 2 * * *
-  workflow_dispatch:
-
-jobs:
-  sync_fork:
-    if: ${{github.repository_owner != 'kernelkit' && vars.SYNC_FORK == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: TobKed/github-forks-sync-action@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          upstream_repository: KernelKit/infix
-          upstream_branch: main
-          target_branch: main
-          force: true
-          tags: true
@@ -1,9 +1,6 @@
 *~
 .gdb_history
-/.backup
 /.ccache
 /dl
 /output*
-/x-*
-/test/.venv
 /local.mk
@@ -1,9 +1,3 @@
 [submodule "buildroot"]
 	path = buildroot
-	url = ../buildroot.git
-[submodule "9pm"]
-	path = 9pm
-	url = ../9pm
-[submodule "qeneth"]
-	path = qeneth
-	url = ../qeneth.git
+	url = https://github.com/buildroot/buildroot.git
@@ -1,35 +1,13 @@
-# For /etc/os-release, uses CondtionArchitechture= from systemd.unit(5)
-config INFIX_ARCH
-	string
-	default "arm"     if BR2_arm
-	default "arm64"   if BR2_aarch64
-	default "mips64"  if BR2_mips64
-	default "riscv64" if BR2_riscv
-	default "x86_64"  if BR2_x86_64
-
-# For /etc/os-release, VARIANT & VARIANT_ID used, e.g., in mnt script
-choice
-	prompt "Select variant/flavor"
-	default INFIX_VARIANT_NETCONF
-
-config INFIX_VARIANT_NETCONF
-	bool "NETCONF"
-	help
-	  Managed NETCONF mode, /etc is a ramdisk, all configuration is
-	  generated by sysrepo plugins using NETCONF (xml) or RESTCONF.
-
-config INFIX_VARIANT_CLASSIC
-	bool "Classic /etc mode"
-	help
-	  User managed mode, read-write configuration files in /etc that
-	  is saved across reboots.
-
-endchoice
-
 menu "Packages"

 source "$BR2_EXTERNAL_INFIX_PATH/package/Config.in"

 endmenu

+menu "QEMU Virtualization"
+
+source "$BR2_EXTERNAL_INFIX_PATH/qemu/Config.in"
+
+endmenu
+
 source "$BR2_EXTERNAL_INFIX_PATH/board/common/Config.in"
@@ -1,47 +1,96 @@
-<img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480>
-<details><summary><b>Documentation</b></summary>
+<img align="right" src="doc/text3134.png" alt="Infix Linux Networking Made Easy">

- - **Infix In-Depth**
-   - [Infix Variants](doc/variant.md)
-   - [Boot Procedure](doc/boot.md)
-   - [Containers in Infix](doc/container.md)
-   - [Developer's Guide](doc/developers-guide.md)
-   - [Discover Your Device](doc/discovery.md)
-   - [Virtual Environments](doc/virtual.md)
-   - [Origin & Licensing](doc/license.md)
- **CLI Topics**
-   - [Introduction to the CLI](doc/cli/introduction.md)
-   - [CLI User's Guide](doc/cli/tutorial.md)
-   - [Quick Overview](doc/cli/quick.md)
+Infix is an embedded Linux Network Operating System (NOS) based on
+[Buildroot][1], [Finit][2], [ifupdown-ng][3], and [Clixon][6].
+Providing an easy-to-maintain and easy-to-port Open Source base for
+networked equipment.

-</details>
+See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
+page for out pre-built images.  The *Latest Build* has the bleeding edge
+images, if possible we recommend using a versioned release.

-Infix is a Linux Network Operating System (NOS) based on [Buildroot][1],
-and [sysrepo][2].  A powerful mix that ease porting to different
-platforms, simplify long-term maintenance, and provide made-easy
-management using NETCONF[^1].
+> Login with user 'root', no password by default on plain builds.  See
+> the online `help` command for an introduction to the system.

-Infix can run on many different types of architectures and boards, much
-thanks to Linux and Buildroot.  Currently the focus is on 64-bit ARM
-devices, optionally with switching fabric supported by Linux switchdev.
-The [following boards](board/aarch64/README.md) are fully supported:

- - Marvell CN9130 CRB
- - Marvell EspressoBIN
- - Microchip SparX-5i PCB135 (eMMC)
+Hardware
+--------

-An x86_64 build is also available, primarily intended for development
-and testing, but can also be used for evaluation and demo purposes.  For
-more information, see: [Infix in Virtual Environments](doc/virtual.md).
+### aarch64

-> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
-> page for our pre-built images.  The *Latest Build* has the bleeding
-> edge images, if possible we recommend using a versioned release.
->
-> For *customer specific builds* of Infix, see your product repository.
+By default, Infix builds with support for the following boards (you
+may enable additional boards in the config, of course):

-[^1]: or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>, for
-    mode information, see [Infix Variants](doc/variant.md).
+- Marvell CN9130 CRB
+- Marvell EspressoBIN
+- Microchip SparX-5i PCB135 (eMMC)

+See the aarch64 specific [documentation](board/aarch64/README.md) for more
+information.
+
+### amd64
+
+Primarily intended to be run under [QEMU][] for development & test as
+well as evaluation, demo and [training][] purposes, e.g. using [GNS3][]
+or [Qeneth][7].
+
+
+QEMU
+----
+
+A virtualized instance can easily be launched from a Linux system, with
+Qemu installed, by issuing `make run`.
+
+Some settings, e.g. networking, can be configured via `make menuconfig`
+under `External options -> QEMU virtualization`.
+
+
+GNS3
+----
+
+Download the [latest build][0] of amd64, unpack in a dedicated directory
+and use ["Import Appliance"][9] to install the `.gns3a` file into GNS3.
+Infix will show up in the "Router" category, it has 10 interfaces
+available by default for use as switch ports or routing.
+
+
+Origin & Licensing
+------------------
+
+Infix is entirely built on Open Source components (packages).  Most of
+them, as well as the build system with its helper scripts and tools, is
+from [Buiildroot][1], which is distributed under the terms of the GNU
+General Public License (GPL).  See the file COPYING for details.
+
+Some files in Buildroot contain a different license statement.  Those
+files are licensed under the license contained in the file itself.
+
+Buildroot and Infix also bundle patch files, which are applied to the
+sources of the various packages.  Those patches are not covered by the
+license of Buildroot or Infix.  Instead, they are covered by the license
+of the software to which the patches are applied.  When said software is
+available under multiple licenses, the patches are only provided under
+the publicly accessible licenses.
+
+Infix releases include the license information covering all Open Source
+packages.  This is extracted automatically at build time using the tool
+`make legal-info`.  Any proprietary software built on top of Infix, or
+Buildroot, would need separate auditing to ensure it does not link with
+any GPL[^1] licensed library.
+
+[^1]: Infix image builds use GNU libc (GLIBC) which is covered by the
+	[LGPL][4].  The LGPL *does allow* proprietary software, as long as
+	said software is linking dynamically, [not statically][5], to GLIBC.
+
+[0]: https://github.com/kernelkit/infix/releases/tag/latest
 [1]: https://buildroot.org/
-[2]: https://www.sysrepo.org/
+[2]: https://github.com/troglobit/finit
+[3]: https://github.com/ifupdown-ng/ifupdown-ng
+[4]: https://en.wikipedia.org/wiki/GNU_Lesser_General_Public_License
+[5]: https://lwn.net/Articles/117972/
+[6]: https://github.com/clicon/clixon
+[7]: https://github.com/wkz/qeneth
+[9]: https://docs.gns3.com/docs/using-gns3/beginners/import-gns3-appliance/
+[QEMU]: https://www.qemu.org/
+[GNS3]: https://gns3.com/
+[training]: https://addiva-elektronik.github.io/
@@ -1,51 +0,0 @@
-/ {
-	config {
-		environment {
-			/* After the MMC driver has enabled bus power,
-			 * the controller seems to sometimes detect a
-			 * card removal state , which causes it to
-			 * disable power again. This hack re-enables the
-			 * bus power in those cases.
-			 */
-			bootcmd = "
-setexpr.b pwrctl *0xf2780029
-setexpr pwrctl ${pwrctl} \"|\" 1
-mw.b 0xf2780029 ${pwrctl}
-
-run ixboot
-";
-			boot_targets = "mmc1";
-			ethprime = "eth1";
-
-			/* Uncomment this if you're debugging U-Boot
-			 *
-			 * This will allow you to break out of the
-                         * normal boot flow and into the interactive
-                         * console.
-			 *
-			 * To upgrade U-Boot itself, simply set the
-                         * `bootfile` variable to the path of
-                         * `flash-image.bin` on your TFTP server, then
-                         * issue `run ixupgradeboot`.
-			 */
-/* 			bootdelay = "2"; */
-/* 			ixupgradeboot = " */
-/* dhcp */
-/* setexpr fileblks ${filesize} + 0x1ff */
-/* setexpr fileblks ${fileblks} / 0x200 */
-
-/* mmc dev 1 */
-/* part start mmc 1 boot bootstart */
-/* part size  mmc 1 boot bootsize */
-
-
-/* mmc erase ${bootstart} ${bootsize} */
-/* mmc write ${fileaddr} ${bootstart} ${fileblks} */
-/* "; */
-		};
-	};
-};
-
-/* &cp0_eth0 { */
-/* 	phy-mode = "10gbase-r"; */
-/* }; */
@@ -1,4 +0,0 @@
-CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi cn9130-crb-env.dtsi"
-
-CONFIG_ENV_IS_NOWHERE=y
-# CONFIG_ENV_IS_IN_MMC is not set
@@ -26,7 +26,6 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_CGROUP_BPF=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -68,32 +67,28 @@ CONFIG_CMA=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
-CONFIG_XDP_SOCKETS=y
-CONFIG_XDP_SOCKETS_DIAG=y
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
 CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
+CONFIG_IP_PNP=y
+CONFIG_IP_PNP_DHCP=y
+CONFIG_IP_PNP_BOOTP=y
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=y
 CONFIG_NET_IPGRE_BROADCAST=y
 CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_NET_IPVTI=m
-CONFIG_NET_FOU_IP_TUNNELS=y
-CONFIG_IPV6_SIT=m
-CONFIG_IPV6_GRE=m
+CONFIG_NET_IPVTI=y
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_SUBTREES=y
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-CONFIG_NETWORK_PHY_TIMESTAMPING=y
 CONFIG_NETFILTER=y
 CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
@@ -103,80 +98,17 @@ CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
-CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_CT=m
-CONFIG_NFT_CONNLIMIT=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_REJECT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NFT_XFRM=m
-CONFIG_NFT_SOCKET=m
-CONFIG_NFT_OSF=m
-CONFIG_NFT_DUP_NETDEV=m
-CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_REJECT_NETDEV=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CGROUP=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
 CONFIG_IP_NF_MANGLE=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
-CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NFT_BRIDGE_META=m
-CONFIG_NF_CONNTRACK_BRIDGE=m
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_IP6=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_NFLOG=m
-CONFIG_BPFILTER=y
+CONFIG_NF_LOG_IPV6=m
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -185,22 +117,9 @@ CONFIG_NET_DSA=y
 CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
-CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
-CONFIG_NET_CLS_BPF=y
-CONFIG_NET_CLS_FLOWER=y
-CONFIG_NETLINK_DIAG=y
-CONFIG_MPLS=y
-CONFIG_NET_MPLS_GSO=y
-CONFIG_MPLS_ROUTING=m
-CONFIG_MPLS_IPTUNNEL=m
-CONFIG_NET_PKTGEN=y
-# CONFIG_WIRELESS is not set
+CONFIG_NET_L3_MASTER_DEV=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
-CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -222,6 +141,7 @@ CONFIG_MTD_SPI_NOR=y
 CONFIG_OF_OVERLAY=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_NVME=y
@@ -244,21 +164,21 @@ CONFIG_DM_INIT=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
-CONFIG_DUMMY=m
-CONFIG_NET_TEAM=m
-CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
-CONFIG_NET_TEAM_MODE_LOADBALANCE=m
-CONFIG_MACVLAN=m
-CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
-CONFIG_IPVTAP=m
-CONFIG_VXLAN=m
-CONFIG_GENEVE=m
-CONFIG_BAREUDP=m
-CONFIG_MACSEC=m
-CONFIG_TUN=m
-CONFIG_VETH=m
+CONFIG_BONDING=y
+CONFIG_DUMMY=y
+CONFIG_NET_TEAM=y
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
+CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_MACVLAN=y
+CONFIG_MACVTAP=y
+CONFIG_IPVLAN=y
+CONFIG_IPVTAP=y
+CONFIG_VXLAN=y
+CONFIG_GENEVE=y
+CONFIG_BAREUDP=y
+CONFIG_MACSEC=y
+CONFIG_TUN=y
+CONFIG_VETH=y
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
@@ -392,7 +312,6 @@ CONFIG_SENSORS_SPARX5=y
 CONFIG_SENSORS_JC42=y
 CONFIG_SENSORS_LM90=m
 CONFIG_SENSORS_INA2XX=m
-CONFIG_CPU_THERMAL=y
 CONFIG_THERMAL_EMULATION=y
 CONFIG_ARMADA_THERMAL=y
 CONFIG_WATCHDOG=y
@@ -503,9 +422,6 @@ CONFIG_MUX_MMIO=y
 CONFIG_EXT2_FS=y
 CONFIG_EXT3_FS=y
 CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS=y
-CONFIG_BTRFS_FS=y
-CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_FANOTIFY=y
 CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y
 CONFIG_QUOTA=y
@@ -1,4 +1,3 @@
 label Infix (aarch64)
 	kernel /boot/Image
-	fdtdir /boot
 	append ${bootargs_root} ${bootargs_rauc} ${bootargs_log}
@@ -1,10 +1,9 @@
 [system]
 compatible=infix-aarch64
 bootloader=uboot
-statusfile=/mnt/aux/rauc.status
+statusfile=/var/lib/rauc/status
 mountprefix=/var/lib/rauc/mnt
 bundle-formats=-plain
-max-bundle-download-size=1073741824

 [keyring]
 directory=/etc/rauc/keys
@@ -18,5 +17,5 @@ device=/dev/disk/by-partlabel/secondary
 bootname=secondary

 [slot.net.0]
-device=/dev/ram0
+device=/dev/ram
 bootname=net
@@ -0,0 +1,29 @@
+set timeout="1"
+
+set default="primary"
+set log="loglevel=4"
+
+load_env ORDER DEBUG
+
+for slot in $ORDER; do
+    set default="$slot"
+    break
+done
+
+if [ "$DEBUG" ]; then
+    set log="debug"
+fi
+
+submenu "primary" "$log" {
+	set slot="$1"
+	set append="$2"
+	set root=(hd0,gpt3)
+	source /boot/grub/grub.cfg
+}
+
+submenu "secondary" "$log"  {
+	set slot="$1"
+	set append="$2"
+	set root=(hd0,gpt4)
+	source /boot/grub/grub.cfg
+}
@@ -1,10 +1,8 @@
 # GRUB Environment Block
 # WARNING: Do not edit this file by tools other than grub-editenv!!!
-ORDER=primary secondary net
+ORDER=primary secondary
 primary_OK=1
 secondary_OK=1
-net_OK=1
 primary_TRY=0
 secondary_TRY=0
-net_TRY=0
-#########################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
+################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################################
@@ -25,7 +25,6 @@ CONFIG_CPUSETS=y
 CONFIG_CGROUP_DEVICE=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_CGROUP_PERF=y
-CONFIG_CGROUP_BPF=y
 CONFIG_USER_NS=y
 CONFIG_SCHED_AUTOGROUP=y
 CONFIG_BLK_DEV_INITRD=y
@@ -39,32 +38,25 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_NET=y
 CONFIG_PACKET=y
 CONFIG_UNIX=y
-CONFIG_XDP_SOCKETS=y
-CONFIG_XDP_SOCKETS_DIAG=y
 CONFIG_INET=y
 CONFIG_IP_MULTICAST=y
 CONFIG_IP_ADVANCED_ROUTER=y
 CONFIG_IP_MULTIPLE_TABLES=y
 CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_NET_IPIP=m
-CONFIG_NET_IPGRE_DEMUX=m
-CONFIG_NET_IPGRE=m
+CONFIG_NET_IPIP=y
+CONFIG_NET_IPGRE_DEMUX=y
+CONFIG_NET_IPGRE=y
 CONFIG_NET_IPGRE_BROADCAST=y
 CONFIG_IP_MROUTE=y
 CONFIG_IP_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IP_PIMSM_V1=y
 CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_NET_IPVTI=m
-CONFIG_NET_FOU_IP_TUNNELS=y
-CONFIG_IPV6_SIT=m
-CONFIG_IPV6_GRE=m
+CONFIG_NET_IPVTI=y
 CONFIG_IPV6_MULTIPLE_TABLES=y
 CONFIG_IPV6_SUBTREES=y
 CONFIG_IPV6_MROUTE=y
 CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y
 CONFIG_IPV6_PIMSM_V2=y
-CONFIG_NETWORK_PHY_TIMESTAMPING=y
 CONFIG_NETFILTER=y
 CONFIG_BRIDGE_NETFILTER=y
 CONFIG_NETFILTER_NETLINK_QUEUE=y
@@ -74,80 +66,17 @@ CONFIG_NF_CONNTRACK_EVENTS=y
 CONFIG_NF_CONNTRACK_FTP=y
 CONFIG_NF_TABLES=y
 CONFIG_NF_TABLES_INET=y
-CONFIG_NF_TABLES_NETDEV=y
-CONFIG_NFT_CT=m
-CONFIG_NFT_CONNLIMIT=m
-CONFIG_NFT_LOG=m
-CONFIG_NFT_LIMIT=m
-CONFIG_NFT_MASQ=m
-CONFIG_NFT_REDIR=m
-CONFIG_NFT_NAT=m
-CONFIG_NFT_TUNNEL=m
-CONFIG_NFT_OBJREF=m
-CONFIG_NFT_QUEUE=m
-CONFIG_NFT_REJECT=m
-CONFIG_NFT_COMPAT=m
-CONFIG_NFT_HASH=m
-CONFIG_NFT_XFRM=m
-CONFIG_NFT_SOCKET=m
-CONFIG_NFT_OSF=m
-CONFIG_NFT_DUP_NETDEV=m
-CONFIG_NFT_FWD_NETDEV=m
-CONFIG_NFT_REJECT_NETDEV=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_LOG=m
 CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=m
-CONFIG_NETFILTER_XT_MATCH_BPF=m
-CONFIG_NETFILTER_XT_MATCH_CGROUP=m
-CONFIG_NETFILTER_XT_MATCH_COMMENT=m
-CONFIG_NETFILTER_XT_MATCH_CONNLABEL=m
-CONFIG_NETFILTER_XT_MATCH_CONNMARK=m
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=m
-CONFIG_NETFILTER_XT_MATCH_DSCP=m
-CONFIG_NETFILTER_XT_MATCH_HELPER=m
-CONFIG_NETFILTER_XT_MATCH_LIMIT=m
-CONFIG_NETFILTER_XT_MATCH_MAC=m
-CONFIG_NETFILTER_XT_MATCH_MARK=m
-CONFIG_NETFILTER_XT_MATCH_MULTIPORT=m
-CONFIG_NETFILTER_XT_MATCH_PHYSDEV=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
 CONFIG_IP_NF_NAT=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
 CONFIG_IP_NF_MANGLE=m
-CONFIG_IP6_NF_IPTABLES=m
-CONFIG_IP6_NF_MATCH_AH=m
-CONFIG_IP6_NF_MATCH_EUI64=m
-CONFIG_IP6_NF_MATCH_IPV6HEADER=m
-CONFIG_IP6_NF_FILTER=m
-CONFIG_IP6_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_RAW=m
-CONFIG_IP6_NF_NAT=m
-CONFIG_IP6_NF_TARGET_MASQUERADE=m
-CONFIG_IP6_NF_TARGET_NPT=m
-CONFIG_NF_TABLES_BRIDGE=m
-CONFIG_NFT_BRIDGE_META=m
-CONFIG_NF_CONNTRACK_BRIDGE=m
-CONFIG_BRIDGE_NF_EBTABLES=m
-CONFIG_BRIDGE_EBT_BROUTE=m
-CONFIG_BRIDGE_EBT_T_FILTER=m
-CONFIG_BRIDGE_EBT_T_NAT=m
-CONFIG_BRIDGE_EBT_802_3=m
-CONFIG_BRIDGE_EBT_ARP=m
-CONFIG_BRIDGE_EBT_IP=m
-CONFIG_BRIDGE_EBT_IP6=m
-CONFIG_BRIDGE_EBT_LIMIT=m
-CONFIG_BRIDGE_EBT_PKTTYPE=m
-CONFIG_BRIDGE_EBT_STP=m
-CONFIG_BRIDGE_EBT_VLAN=m
-CONFIG_BRIDGE_EBT_ARPREPLY=m
-CONFIG_BRIDGE_EBT_DNAT=m
-CONFIG_BRIDGE_EBT_REDIRECT=m
-CONFIG_BRIDGE_EBT_SNAT=m
-CONFIG_BRIDGE_EBT_LOG=m
-CONFIG_BRIDGE_EBT_NFLOG=m
-CONFIG_BPFILTER=y
+CONFIG_NF_LOG_IPV6=m
 CONFIG_BRIDGE=y
 CONFIG_BRIDGE_VLAN_FILTERING=y
 CONFIG_BRIDGE_MRP=y
@@ -155,22 +84,8 @@ CONFIG_BRIDGE_CFM=y
 CONFIG_VLAN_8021Q=y
 CONFIG_VLAN_8021Q_GVRP=y
 CONFIG_VLAN_8021Q_MVRP=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_SCH_CBQ=y
-CONFIG_NET_CLS_BASIC=y
-CONFIG_NET_CLS_TCINDEX=y
-CONFIG_NET_CLS_BPF=y
-CONFIG_NET_CLS_FLOWER=y
-CONFIG_NETLINK_DIAG=y
-CONFIG_MPLS=y
-CONFIG_NET_MPLS_GSO=y
-CONFIG_MPLS_ROUTING=m
-CONFIG_MPLS_IPTUNNEL=m
-CONFIG_NET_PKTGEN=y
-# CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
-CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
@@ -180,6 +95,7 @@ CONFIG_FW_CFG_SYSFS=y
 CONFIG_FW_CFG_SYSFS_CMDLINE=y
 CONFIG_BLK_DEV_NULL_BLK=y
 CONFIG_BLK_DEV_LOOP=y
+CONFIG_BLK_DEV_NBD=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_VIRTIO_BLK=y
 CONFIG_BLK_DEV_SD=y
@@ -192,21 +108,21 @@ CONFIG_BLK_DEV_DM=y
 CONFIG_DM_VERITY=y
 CONFIG_DM_VERITY_VERIFY_ROOTHASH_SIG=y
 CONFIG_NETDEVICES=y
-CONFIG_BONDING=m
-CONFIG_DUMMY=m
-CONFIG_NET_TEAM=m
-CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
-CONFIG_NET_TEAM_MODE_LOADBALANCE=m
-CONFIG_MACVLAN=m
-CONFIG_MACVTAP=m
-CONFIG_IPVLAN=m
-CONFIG_IPVTAP=m
-CONFIG_VXLAN=m
-CONFIG_GENEVE=m
-CONFIG_BAREUDP=m
-CONFIG_MACSEC=m
-CONFIG_TUN=m
-CONFIG_VETH=m
+CONFIG_BONDING=y
+CONFIG_DUMMY=y
+CONFIG_NET_TEAM=y
+CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=y
+CONFIG_NET_TEAM_MODE_LOADBALANCE=y
+CONFIG_MACVLAN=y
+CONFIG_MACVTAP=y
+CONFIG_IPVLAN=y
+CONFIG_IPVTAP=y
+CONFIG_VXLAN=y
+CONFIG_GENEVE=y
+CONFIG_BAREUDP=y
+CONFIG_MACSEC=y
+CONFIG_TUN=y
+CONFIG_VETH=y
 CONFIG_VIRTIO_NET=y
 CONFIG_NLMON=y
 CONFIG_NET_VRF=y
@@ -219,26 +135,30 @@ CONFIG_SERIAL_8250=y
 CONFIG_SERIAL_8250_CONSOLE=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM_VIRTIO=m
-CONFIG_I2C=y
 CONFIG_WATCHDOG=y
 CONFIG_WATCHDOG_SYSFS=y
 CONFIG_SOFT_WATCHDOG=y
 CONFIG_I6300ESB_WDT=y
+CONFIG_DRM=y
+CONFIG_DRM_QXL=y
+CONFIG_DRM_VIRTIO_GPU=y
+CONFIG_DRM_BOCHS=y
+CONFIG_SOUND=y
+CONFIG_SND=y
+CONFIG_SND_HDA_INTEL=y
+CONFIG_SND_HDA_GENERIC=y
 CONFIG_USB=y
 CONFIG_USB_XHCI_HCD=y
 CONFIG_USB_EHCI_HCD=y
 CONFIG_USB_UHCI_HCD=y
 CONFIG_USB_STORAGE=y
 CONFIG_RTC_CLASS=y
-CONFIG_SYNC_FILE=y
 CONFIG_VIRTIO_PCI=y
 CONFIG_VIRTIO_BALLOON=y
 CONFIG_VIRTIO_INPUT=y
 CONFIG_VIRTIO_MMIO=y
 CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y
 CONFIG_EXT4_FS=y
-CONFIG_BTRFS_FS=y
-CONFIG_BTRFS_FS_POSIX_ACL=y
 CONFIG_AUTOFS4_FS=y
 CONFIG_FUSE_FS=y
 CONFIG_VIRTIO_FS=y
@@ -253,8 +173,7 @@ CONFIG_SQUASHFS_ZSTD=y
 CONFIG_9P_FS=y
 CONFIG_NLS_CODEPAGE_437=y
 CONFIG_NLS_ISO8859_1=y
-CONFIG_CRYPTO_GCM=y
-CONFIG_CRYPTO_AES=y
+CONFIG_CRYPTO_SHA256=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
@@ -0,0 +1,3 @@
+menuentry "Infix" --id infix {
+	linux /boot/bzImage root=PARTLABEL=$slot rauc.slot=$slot console=ttyS0 $append nokaslr
+}
@@ -2,10 +2,9 @@
 compatible=infix-x86_64
 bootloader=grub
 grubenv=/mnt/aux/grub/grubenv
-statusfile=/mnt/aux/rauc.status
+statusfile=/var/lib/rauc/status
 mountprefix=/var/lib/rauc/mnt
 bundle-formats=-plain
-max-bundle-download-size=1073741824

 [keyring]
 directory=/etc/rauc/keys
@@ -17,7 +16,3 @@ bootname=primary
 [slot.rootfs.1]
 device=/dev/disk/by-partlabel/secondary
 bootname=secondary
-
-[slot.net.0]
-device=/dev/ram0
-bootname=net
@@ -1,8 +0,0 @@
-#!/bin/sh
-. "$BR2_CONFIG"
-
-# Prevent regen of host key at every boot, /etc is saved across reboots
-if [ -L "$TARGET_DIR/etc/dropbear" ]; then
-	rm    "$TARGET_DIR/etc/dropbear"
-	mkdir "$TARGET_DIR/etc/dropbear"
-fi
@@ -1,3 +0,0 @@
-#!/bin/sh
-pdmenu
-clear
@@ -1,18 +0,0 @@
-# System-wide .bashrc file for interactive bash(1) shells.
-
-# If not running interactively, don't do anything
-[ -z "$PS1" ] && return
-
-# Reevaluate for each line, in case hostname changes
-function prompt_command
-{
-    PS1="\u@$(hostname):\w\$ "
-}
-export PROMPT_COMMAND=prompt_command
-
-# check the window size after each command and, if necessary,
-# update the values of LINES and COLUMNS.
-shopt -s checkwinsize
-
-# Disble built-ins
-enable -n help
@@ -1 +0,0 @@
-run [S] /lib/infix/swup --
@@ -1,62 +0,0 @@
-#!/bin/sh
-# Factory default:
-#  1) all switch ports in VLAN 1 of br0
-#  2) no switch ports => DHCP on eth0
-#  3) no eth0
-
-create_bridge()
-{
-    nm=$1
-    shift
-    ports=$@
-
-    touch "/etc/network/interfaces.d/$nm"
-    for port in $ports; do
-	cat <<-EOF >>"/etc/network/interfaces.d/$nm"
-		iface $port
-		    bridge-access 1
-		    post-up ip link set $port group port
-		EOF
-    done
-    cat <<-EOF >> "/etc/network/interfaces.d/$nm"
-
-	auto $nm
-	iface $nm
-	    bridge-ports $ports
-	    bridge-vlan-aware yes
-	    bridge-stp on
-	    bridge-vids 1
-
-	auto vlan1
-	iface vlan1 inet dhcp
-	    vlan-id 1
-	    vlan-raw-device $nm
-	    post-up ip link set vlan1 group iface
-	EOF
-    ip link set vlan1 group iface
-}
-
-# Check if already set up
-[ -z "$(ls -A /etc/network/interfaces.d/)" ] || exit 0
-
-# Check for custom hostname from Qemu/Qeneth
-nm=$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)
-if [ -n "$nm" ]; then
-    hostnm "$nm"
-fi
-
-# need to check for 'length > 0' because ip command
-# outputs empty json objects for non-port group ifs
-ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
-if [ -n "$ports" ]; then
-    create_bridge br0 $ports
-else
-    ifaces=$(ip -json addr show  |jq -r '.[] | select(.link_type=="ether").ifname')
-    for iface in $ifaces; do
-	cat  <<-EOF > "/etc/network/interfaces.d/$iface"
-		auto $iface
-		iface $iface inet dhcp
-		    pre-up ip link set $iface group iface
-		EOF
-    done
-fi
@@ -1,10 +1,7 @@
-menuconfig SIGN_ENABLED
-	bool "Image Signing"
-	default y
+comment "Image Signing"

 choice
 	prompt "Signing key source"
-	depends on SIGN_ENABLED
 	default SIGN_SRC_DIR

 config SIGN_SRC_DIR
@@ -17,9 +14,10 @@ endchoice

 config SIGN_KEY
 	string "Signing key"
-	depends on SIGN_ENABLED
 	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR

+comment "Additional Artifacts"
+
 menuconfig DISK_IMAGE
 	bool "Disk image"
 	help
@@ -31,73 +29,18 @@ menuconfig DISK_IMAGE
 	  - Creating a GNS3 appliance
 	  - Developing/debugging issues in the boot process in QEMU

-menuconfig DISK_IMAGE_SIZE
+config DISK_IMAGE_SIZE
 	string "Image size"
 	depends on DISK_IMAGE
 	default "512M"
 	help
-	  Create a disk image of this size.  A K/M/G suffix may be used
-	  to multiply by powers of 1024.  Suffixes like KB/MB/GB may be
-	  used to multiply by powers of 1000.  The image will be split
-	  proportionally to fit the two rootfs, a kernel, a writable
-	  /cfg and /var partiotions.
+	  Create a disk image of this size. Suffixes like K/M/G may be
+	  used to multiply by powers of 1024. Suffixes like KB/MB/GB may
+	  be used to multiply by powers of 1000.

 	  Minimum supported size is 512M.

-choice
-	prompt "Bootloader"
-	depends on DISK_IMAGE
-	default DISK_IMAGE_BOOT_EFI if BR2_x86_64
-	default DISK_IMAGE_BOOT_NONE
-
-config DISK_IMAGE_BOOT_NONE
-	bool "None"
-	help
-	  Do not create any bootloader partition in the disk image.
-
-config DISK_IMAGE_BOOT_EFI
-	bool "EFI"
-	help
-	  Create a boot partition from a directory containing an EFI
-	  boot application, e.g. GRUB.
-
-config DISK_IMAGE_BOOT_BIN
-	bool "Binary"
-	help
-	  Create a boot partition from a raw image containing the boot
-	  application, e.g. U-Boot.
-
-endchoice
-
-config DISK_IMAGE_BOOT_DATA
-	string "Bootloader data"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default "${BINARIES_DIR}/efi-part/EFI" if BR2_x86_64
-	help
-	  Path to the directory or file holding the bootloader data.
-
-config DISK_IMAGE_BOOT_OFFSET
-	hex "Bootloader offset"
-	depends on DISK_IMAGE
-	depends on DISK_IMAGE_BOOT_EFI || DISK_IMAGE_BOOT_BIN
-	default 0x8000
-	help
-	  Offset at which the bootloader partition is placed. Remember
-	  to make sure that the GPT still fits at the start of the
-	  image.
-
-config DISK_IMAGE_RELEASE_URL
-	string "Infix URL"
-	depends on DISK_IMAGE
-	depends on !BR2_TARGET_ROOTFS_SQUASHFS
-	default "https://github.com/kernelkit/infix/releases/download/latest/infix-${BR2_ARCH}.tar.gz"
-	help
-	  In situations where Infix itself is not being built, but a
-	  disk image is, i.e. when building a bootloader: place this
-	  Infix release in the primary and secondary partitions.
-
-menuconfig GNS3_APPLIANCE
+config GNS3_APPLIANCE
 	bool "GNS3 Appliance"
 	select DISK_IMAGE
 	default y if BR2_x86_64
@@ -105,22 +48,6 @@ menuconfig GNS3_APPLIANCE
 	  Create a GNS3 appliance description that, together with the
 	  disk image, can be imported into GNS3.

-config GNS3_APPLIANCE_RAM
-	int "Reserved RAM (MiB)"
-	depends on GNS3_APPLIANCE
-	default "192"
-	help
-	  Amount of host RAM reserved for an appliance instance.
-
-	  Minimum supported size is 192M.
-
-config GNS3_APPLIANCE_IFNUM
-	int "Number of interfaces"
-	depends on GNS3_APPLIANCE
-	default "1"
-	help
-	  Number of Ethernet interfaces to create for an appliance instance.
-
 menuconfig FIT_IMAGE
 	bool "Traditional FIT image"
 	help
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.0
-# Fri Jul  7 17:59:34 2023
+# Busybox version: 1.35.0
+# Mon Dec 12 13:47:01 2022
 #
 CONFIG_HAVE_DOT_CONFIG=y

@@ -93,9 +93,6 @@ CONFIG_FEATURE_BUFFERS_USE_MALLOC=y
 # CONFIG_FEATURE_BUFFERS_GO_IN_BSS is not set
 CONFIG_PASSWORD_MINLEN=6
 CONFIG_MD5_SMALL=1
-CONFIG_SHA1_SMALL=3
-CONFIG_SHA1_HWACCEL=y
-CONFIG_SHA256_HWACCEL=y
 CONFIG_SHA3_SMALL=1
 CONFIG_FEATURE_NON_POSIX_CP=y
 # CONFIG_FEATURE_VERBOSE_CP_MESSAGE is not set
@@ -126,9 +123,6 @@ CONFIG_LAST_SUPPORTED_WCHAR=0
 # CONFIG_UNICODE_BIDI_SUPPORT is not set
 # CONFIG_UNICODE_NEUTRAL_TABLE is not set
 # CONFIG_UNICODE_PRESERVE_BROKEN is not set
-# CONFIG_LOOP_CONFIGURE is not set
-# CONFIG_NO_LOOP_CONFIGURE is not set
-CONFIG_TRY_LOOP_CONFIGURE=y

 #
 # Applets
@@ -344,7 +338,6 @@ CONFIG_FEATURE_TR_CLASSES=y
 CONFIG_FEATURE_TR_EQUIV=y
 CONFIG_TRUE=y
 CONFIG_TRUNCATE=y
-CONFIG_TSORT=y
 CONFIG_TTY=y
 CONFIG_UNAME=y
 CONFIG_UNAME_OSNAME="GNU/Linux"
@@ -533,13 +526,13 @@ CONFIG_USE_BB_CRYPT_SHA=y
 CONFIG_ADDGROUP=y
 CONFIG_FEATURE_ADDUSER_TO_GROUP=y
 CONFIG_ADDUSER=y
-CONFIG_FEATURE_CHECK_NAMES=y
+# CONFIG_FEATURE_CHECK_NAMES is not set
 CONFIG_LAST_ID=60000
 CONFIG_FIRST_SYSTEM_ID=100
 CONFIG_LAST_SYSTEM_ID=999
 # CONFIG_CHPASSWD is not set
 CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="md5"
-CONFIG_CRYPTPW=y
+# CONFIG_CRYPTPW is not set
 CONFIG_MKPASSWD=y
 CONFIG_DELUSER=y
 CONFIG_DELGROUP=y
@@ -838,12 +831,10 @@ CONFIG_READAHEAD=y
 CONFIG_RFKILL=y
 CONFIG_RUNLEVEL=y
 CONFIG_RX=y
-CONFIG_SEEDRNG=y
 CONFIG_SETFATTR=y
 CONFIG_SETSERIAL=y
 CONFIG_STRINGS=y
 CONFIG_TIME=y
-CONFIG_TREE=y
 CONFIG_TS=y
 CONFIG_TTYSIZE=y
 CONFIG_UBIATTACH=y
@@ -1016,7 +1007,6 @@ CONFIG_UDHCPC=y
 CONFIG_FEATURE_UDHCPC_ARPING=y
 CONFIG_FEATURE_UDHCPC_SANITIZEOPT=y
 CONFIG_UDHCPC_DEFAULT_SCRIPT="/usr/share/udhcpc/default.script"
-CONFIG_UDHCPC6_DEFAULT_SCRIPT="/usr/share/udhcpc/default6.script"
 CONFIG_UDHCPC6=y
 CONFIG_FEATURE_UDHCPC6_RFC3646=y
 CONFIG_FEATURE_UDHCPC6_RFC4704=y
@@ -1151,7 +1141,6 @@ CONFIG_ASH_IDLE_TIMEOUT=y
 CONFIG_ASH_ECHO=y
 CONFIG_ASH_PRINTF=y
 CONFIG_ASH_TEST=y
-CONFIG_ASH_SLEEP=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
@@ -17,6 +17,7 @@ size2int()

 dimension()
 {
+
    if [ $total -ge $((4 << G)) ]; then
 	bootsize=$(( 8 << M))
 	auxsize=$((  8 << M))
@@ -30,14 +31,14 @@ dimension()
 	cfgsize=$((256 << M))
 	# var is at least ~1.75G
    elif [ $total -ge $((1 << G)) ]; then
-	bootsize=$(( 8 << M))
-	auxsize=$((  8 << M))
+	bootsize=$(( 4 << M))
+	auxsize=$((  4 << M))
 	imgsize=$((256 << M))
 	cfgsize=$(( 64 << M))
 	# var is at least ~0.5G
    elif [ $total -ge $((512 << M)) ]; then
-	bootsize=$(( 8 << M))
-	auxsize=$((  8 << M))
+	bootsize=$(( 4 << M))
+	auxsize=$((  4 << M))
 	imgsize=$((192 << M))
 	cfgsize=$(( 16 << M))
 	# var is at least ~100M
@@ -80,7 +81,7 @@ probeboot()

 genboot()
 {
-    if [ -d "$bootdata" ]; then
+    if [ -d $BINARIES_DIR/efi-part/EFI ]; then
 	bootimg=$(cat <<EOF
 image efi-part.vfat {
 	size = $bootsize
@@ -102,17 +103,6 @@ EOF
 EOF
 		  )

-    elif [ -f "$bootdata" ]; then
-	bootpart=$(cat <<EOF
-	partition boot {
-		offset = $bootoffs
-		partition-type-uuid = U
-		bootable = true
-		image = $bootdata
-		size = $bootsize
-	}
-EOF
-		   )
    fi
 }

@@ -121,22 +111,15 @@ root=$BUILD_DIR/genimage.root
 tmp=$BUILD_DIR/genimage.tmp

 total=$((512 << M))
-bootoffs=$((32 << K))
-bootdata=
+bootoffs=
 bootimg=
 bootpart=

-while getopts "a:b:B:s:" opt; do
+while getopts "a:s:" opt; do
    case ${opt} in
 	a)
 	    arch=$OPTARG
 	    ;;
-	b)
-	    bootdata=$OPTARG
-	    ;;
-	B)
-	    bootoffs=$(($OPTARG))
-	    ;;
 	s)
 	    total=$(size2int $OPTARG)
 	    ;;
@@ -175,28 +158,27 @@ awk \
 mkdir -p $root/aux
 cp -f $BINARIES_DIR/rootfs.itbh $root/aux/primary.itbh
 cp -f $BINARIES_DIR/rootfs.itbh $root/aux/secondary.itbh
-cp -f $BINARIES_DIR/rauc.status $root/aux/rauc.status

 case "$arch" in
    aarch64)
-	mkenvimage -s 0x4000 -o "$root/aux/uboot.env" \
-		   "$BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt"
+	mkenvimage -s 0x4000 -o $root/aux/uboot.env \
+		   $BR2_EXTERNAL_INFIX_PATH/board/common/uboot/aux-env.txt
 	;;
    x86_64)
-	mkdir -p "$root/aux/grub"
-	cp -f "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grub.cfg" \
-	      "$BR2_EXTERNAL_INFIX_PATH/board/$arch/grubenv"  \
-	      "$root/aux/grub/"
+	mkdir -p $root/aux/grub
+	cp -f $BR2_EXTERNAL_INFIX_PATH/board/amd64/grub.cfg \
+	      $BR2_EXTERNAL_INFIX_PATH/board/amd64/grubenv  \
+	   $root/aux/grub/
 	;;
    *)
 	;;
 esac

-rm -rf "$tmp"
+rm -rf $tmp

 genimage \
-    --rootpath "$root" \
-    --tmppath  "$tmp" \
-    --inputpath "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
-    --config "$root/genimage.cfg"
+    --rootpath $root \
+    --tmppath  $tmp \
+    --inputpath $BINARIES_DIR \
+    --outputpath $BINARIES_DIR \
+    --config $root/genimage.cfg
@@ -18,22 +18,12 @@ load_cfg()
 load_cfg
 [ "$FIT_IMAGE" = "y" ] || exit 0

-work=$BUILD_DIR/fit-image-local
+work=$(pwd)/build/fit-image-local
 dtbs=$(find $BINARIES_DIR -name '*.dtb')
 kernel=$(find $BINARIES_DIR -name '*Image' | head -n1)
 squash=$BINARIES_DIR/rootfs.squashfs

 mkdir -p $work
-gzip <$kernel >$work/Image.gz
-kernel=$work/Image.gz
-
-rm -rf $work/rootfs
-unsquashfs -f -d $work/rootfs $squash
-rm -f $work/rootfs/boot/*Image
-
-squash=$work/rootfs-no-kernel.squashfs
-rm -f $squash
-mksquashfs $work/rootfs $squash

 # mkimage will only align images to 4 bytes, but U-Boot will leave
 # both DTB and ramdisk in place when starting the kernel. So we pad
@@ -89,7 +79,7 @@ cat <<EOF >$work/infix.its
 			arch = "$FIT_ARCH";
 			os = "linux";
 $(cat $work/kernel-load.itsi)
-			compression = "gzip";
+			compression = "none";
 			data = /incbin/("$kernel");
 		};

@@ -1,16 +1,8 @@
 #!/bin/sh

-if [ -n "$INFIX_RELEASE" ]; then
-    rel="-${INFIX_RELEASE}"
-fi
-
-NM="${1:-custom}${rel}"
-RAM=${2:-512}
-IFNUM=${3:-1}
-
-cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
+cat <<EOF >"$BINARIES_DIR/infix.gns3a"
 {
-    "name": "$NM",
+    "name": "infix",
    "category": "router",
    "description": "Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling.",
    "vendor_name": "KernelKit",
@@ -20,13 +12,13 @@ cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
    "status": "stable",
    "maintainer": "KernelKit",
    "maintainer_email": "kernelkit@googlegroups.com",
-    "usage": "Default console login is 'root', no password.  For remote login, default user/pass: admin/admin also works.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
+    "usage": "Default login is 'root', no password.\n\nType 'help' for an overview of commands and relevant configuration files.\n\nThe /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
    "port_name_format": "eth{0}",
    "linked_clone": true,
    "qemu": {
        "adapter_type": "virtio-net-pci",
-        "adapters": ${IFNUM},
-        "ram": ${RAM},
+        "adapters": 10,
+        "ram": 512,
        "cpus": 1,
        "hda_disk_interface": "virtio",
        "arch": "x86_64",
@@ -1,35 +0,0 @@
-#!/bin/sh
-
-set -e
-
-# Bootstrap a RAUC status file showing the newly created image
-# installed to both the primary and secondary slots. This then bundled
-# in the aux partition in mkdisk.sh, so that RAUC (on the target) can
-# always report the installed versions.
-rauc info --no-verify --output-format=shell $1 >/tmp/rauc-$$.info
-. /tmp/rauc-$$.info
-rm /tmp/rauc-$$.info
-tstamp=$(date -u +%FT%TZ)
-cat <<EOF
-[slot.rootfs.0]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-
-[slot.rootfs.1]
-bundle.compatible=$RAUC_MF_COMPATIBLE
-bundle.version=$RAUC_MF_VERSION
-status=ok
-sha256=$RAUC_IMAGE_DIGEST_0
-size=$RAUC_IMAGE_SIZE_0
-installed.timestamp=$tstamp
-installed.count=1
-activated.timestamp=$tstamp
-activated.count=1
-EOF
@@ -4,9 +4,8 @@ set -e

 GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)

-name=$1
-arch=$2
-sign=$3
+arch=$1
+sign=$2

 crt=$(ls $sign/*.crt)
 key=$(ls $sign/*.key)
@@ -39,7 +38,7 @@ filename=rootfs.img
 hooks=post-install
 EOF

-rm -f $BINARIES_DIR/$name.pkg
+rm -f $BINARIES_DIR/infix-$arch.pkg

 rauc --cert=$crt --key=$key \
-    bundle $work $BINARIES_DIR/$name.pkg
+    bundle $work $BINARIES_DIR/infix-$arch.pkg
@@ -1,58 +1,21 @@
 #!/bin/sh
-# shellcheck disable=SC1090,SC1091
-. "$BR2_CONFIG" 2>/dev/null
-. "$TARGET_DIR/usr/lib/os-release"

-if [ -n "${ID_LIKE}" ]; then
-    ID="${ID} ${ID_LIKE}"
-fi
-
-GIT_VERSION=$(git -C "$BR2_EXTERNAL_INFIX_PATH" describe --always --dirty --tags)
+GIT_VERSION=$(git -C $BR2_EXTERNAL_INFIX_PATH describe --always --dirty --tags)

 # This is a symlink to /usr/lib/os-release, so we remove this to keep
 # original Buildroot information.
-rm -f "$TARGET_DIR/etc/os-release"
+rm "$TARGET_DIR/etc/os-release"
 {
-    echo "NAME=\"Infix\""
-    echo "VERSION=${GIT_VERSION}"
-    echo "ID=infix"
-    echo "ID_LIKE=\"${ID}\""
-    echo "VERSION_ID=${GIT_VERSION}"
-    echo "BUILD_ID=\"${NAME} ${VERSION}\""
-    echo "PRETTY_NAME=\"Infix by KernelKit\""
-    if [ "$INFIX_VARIANT_NETCONF" = "y" ]; then
-	echo "VARIANT=\"Managed NETCONF\""
-	echo "VARIANT_ID=netconf"
-    else
-	echo "VARIANT=\"Classic, writable /etc\""
-	echo "VARIANT_ID=classic"
-    fi
-    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
-    echo "HOME_URL=https://github.com/KernelKit"
+	echo "NAME=\"Infix\""
+	echo "VERSION=${GIT_VERSION}"
+	echo "ID=infix"
+	echo "VERSION_ID=${GIT_VERSION}"
+	echo "PRETTY_NAME=\"Infix by KernelKit\""
+	echo "HOME_URL=https://github.com/KernelKit"
 } > "$TARGET_DIR/etc/os-release"

-
 echo "Infix by KernelKit $GIT_VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"

-# Allow pdmenu (setup) and bash to be login shells, bash is added
-# automatically when selected in menuyconfig, but not when BusyBox
-# provides a symlink (for ash).  The /bin/{true,false} are old UNIX
-# beart means of disabling a user.
+# Allow pdmenu (setup) to be a login shell
 grep -qsE '^/usr/bin/pdmenu$$' "$TARGET_DIR/etc/shells" \
        || echo "/usr/bin/pdmenu" >> "$TARGET_DIR/etc/shells"
-grep -qsE '^/bin/bash$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/bash" >> "$TARGET_DIR/etc/shells"
-grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/true" >> "$TARGET_DIR/etc/shells"
-grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
-
-# Menuconfig support for modifying Qemu args in release tarballs
-cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-sed "s/default QEMU_aarch64/default QEMU_$BR2_ARCH/" \
-    < "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in" \
-    > "$BINARIES_DIR/Config.in"
-rm -f "$BINARIES_DIR/qemu.cfg"
-CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
@@ -1,59 +1,29 @@
 #!/bin/sh
+
 common=$(dirname "$(readlink -f "$0")")
 . $common/lib.sh

-load_cfg BR2_ARCH
-load_cfg BR2_DEFCONFIG
 load_cfg BR2_EXTERNAL_INFIX_PATH
-load_cfg BR2_TARGET_ROOTFS
-NAME=infix-$(basename "$BR2_DEFCONFIG" _defconfig | tr _ - | sed 's/x86-64/x86_64/')

-ver()
-{
-    if [ -n "$INFIX_RELEASE" ]; then
-	printf -- "-%s" "$INFIX_RELEASE"
-	return
-    fi
-}
+load_cfg BR2_ARCH
+load_cfg SIGN_KEY

-load_cfg SIGN_ENABLED
-if [ "$SIGN_ENABLED" = "y" ]; then
-    load_cfg BR2_ARCH
-    load_cfg SIGN_KEY
+ixmsg "Signing SquashFS Image"
+$common/sign.sh $BR2_ARCH $SIGN_KEY

-    ixmsg "Signing SquashFS Image"
-    $common/sign.sh $BR2_ARCH $SIGN_KEY
-
-    ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $BR2_ARCH $SIGN_KEY
-fi
+ixmsg "Creating RAUC Update Bundle"
+$common/mkrauc.sh $BR2_ARCH $SIGN_KEY

 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
    ixmsg "Creating Disk Image"
-
-    bootcfg=
-    if [ "$DISK_IMAGE_BOOT_DATA" ]; then
-	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
-    fi
-
-    if [ "$BR2_TARGET_ROOTFS_SQUASHFS" != "y" ] && \
-       [ ! -f "$BINARIES_DIR/rootfs.squashfs" ]; then
-	ixmsg "  Injecting $DISK_IMAGE_RELEASE_URL"
-	archive="$BINARIES_DIR/$(basename $DISK_IMAGE_RELEASE_URL)"
-	[ -f "$archive" ] || wget -O"$archive" "$DISK_IMAGE_RELEASE_URL"
-	tar -xa --strip-components=1 -C "$BINARIES_DIR" -f "$archive"
-    fi
-    $common/mkrauc-status.sh "$BINARIES_DIR/${NAME}.pkg" >"$BINARIES_DIR/rauc.status"
-    $common/mkdisk.sh -a $BR2_ARCH -s $DISK_IMAGE_SIZE $bootcfg
+    $common/mkdisk.sh -a $BR2_ARCH
 fi

 load_cfg GNS3_APPLIANCE
 if [ "$GNS3_APPLIANCE" = "y" ]; then
-    load_cfg GNS3_APPLIANCE_RAM
-    load_cfg GNS3_APPLIANCE_IFNUM
-    ixmsg "Creating GNS3 Appliance, $GNS3_APPLIANCE_RAM MiB with $GNS3_APPLIANCE_IFNUM ports"
-    $common/mkgns3a.sh $NAME $GNS3_APPLIANCE_RAM $GNS3_APPLIANCE_IFNUM
+    ixmsg "Creating GNS3 Appliance"
+    $common/mkgns3a.sh
 fi

 load_cfg FIT_IMAGE
@@ -61,15 +31,3 @@ if [ "$FIT_IMAGE" = "y" ]; then
    ixmsg "Creating Traditional FIT Image"
    $common/mkfit.sh
 fi
-
-if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
-    if [ -z "${NAME##*minimal*}" ]; then
-	NAME=$(echo "$NAME" | sed 's/-minimal//')
-    fi
-
-    rel=$(ver)
-    ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
-    if [ -n "$rel" ]; then
-	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
-    fi
-fi
@@ -1,326 +0,0 @@
-#!/bin/sh
-# This script can be used to start an Infix OS image in Qemu.  It reads
-# either a .config, generated from Config.in, or qemu.cfg from a release
-# tarball, for the required configuration data.
-#
-# Debian/Ubuntu users can change the configuration post-release, install
-# the kconfig-frontends package:
-#
-#    sudo apt install kconfig-frontends
-#
-# and then call this script with:
-#
-#    ./qemu.sh -c
-#
-# To bring up a menuconfig dialog.  Select `Exit` and save the changes.
-# For more help, see:_
-#
-#    ./qemu.sh -h
-#
-
-# Local variables
-prognm=$(basename "$0")
-
-usage()
-{
-    echo "usage: $prognm [opts]"
-    echo
-    echo " -c    Run menuconfig to change Qemu settings"
-    echo " -h    This help text"
-    echo
-    echo "Note: 'kconfig-frontends' package (Debian/Ubuntu) must be installed"
-    echo "      for -c to work: sudo apt install kconfig-frontents"
-
-    exit 1
-}
-
-die()
-{
-    echo "$@" >&2
-    exit 1
-}
-
-load_qemucfg()
-{
-    local tmp=$(mktemp -p /tmp)
-
-    grep ^CONFIG_QEMU_ $1 >$tmp
-    .  $tmp
-    rm $tmp
-
-    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
-    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
-
-    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
-
-    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
-	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
-}
-
-loader_args()
-{
-    if [ "$CONFIG_QEMU_BIOS" ]; then
-	echo -n "-bios $CONFIG_QEMU_BIOS "
-    elif [ "$CONFIG_QEMU_KERNEL" ]; then
-	echo -n "-kernel $CONFIG_QEMU_KERNEL "
-    fi
-}
-
-append_args()
-{
-    if [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
-	echo -n "console=hvc0 "
-    elif [ "$CONFIG_QEMU_x86_64" ]; then
-	echo -n "console=ttyS0 "
-    elif [ "$CONFIG_QEMU_aarch64" ]; then
-	echo -n "console=ttyAMA0 "
-    else
-	die "Unknown console"
-    fi
-
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	# Size of initrd, rounded up to nearest kb
-	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
-	echo -n "root=/dev/ram0 ramdisk_size=${size} "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "root=PARTLABEL=primary "
-    fi
-
-    if [ "$V" != "1" ]; then
-	echo -n "quiet "
-    else
-	echo -n "debug "
-    fi
-
-    echo -n "${QEMU_APPEND} ${QEMU_EXTRA_APPEND} "
-}
-
-rootfs_args()
-{
-    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
-	echo -n "-initrd $CONFIG_QEMU_ROOTFS "
-    elif [ "$CONFIG_QEMU_ROOTFS_MMC" = "y" ]; then
-	echo -n "-device sdhci-pci "
-	echo -n "-device sd-card,drive=mmc "
-	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
-    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS,if=virtio,format=raw,bus=0,unit=0 "
-    fi
-}
-
-serial_args()
-{
-    echo -n "-display none "
-    echo -n "-device virtio-serial "
-
-    echo -n "-chardev stdio,id=console0,mux=on "
-    echo -n "-mon chardev=console0 "
-
-    if [ "$CONFIG_QEMU_CONSOLE_VIRTIO" ]; then
-	echo -n "-device virtconsole,nr=0,name=console,chardev=console0 "
-    elif [ "$CONFIG_QEMU_CONSOLE_SERIAL" ]; then
-	echo -n "-serial chardev:console0 "
-    else
-	die "Unknown console"
-    fi
-
-    echo -n "-chardev socket,id=gdbserver,path=gdbserver.sock,server=on,wait=off "
-    echo -n "-device virtconsole,nr=1,name=gdbserver,chardev=gdbserver "
-}
-
-rw_args()
-{
-    [ "$CONFIG_QEMU_RW" ] || return
-
-    if ! [ -f "$CONFIG_QEMU_RW" ]; then
-	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
-	mkfs.ext4 -L cfg "$CONFIG_QEMU_RW" >/dev/null 2>&1
-    fi
-
-    echo -n "-drive file=$CONFIG_QEMU_RW,if=virtio,format=raw,bus=0,unit=1 "
-
-    if [ "$CONFIG_QEMU_RW_VAR_OPT" ]; then
-	if ! [ -f "$CONFIG_QEMU_RW_VAR" ]; then
-	    dd if=/dev/zero of="$CONFIG_QEMU_RW_VAR" bs=256M count=1 >/dev/null 2>&1
-	    mkfs.ext4 -L var "$CONFIG_QEMU_RW_VAR" >/dev/null 2>&1
-	fi
-
-	echo -n "-drive file=$CONFIG_QEMU_RW_VAR,if=virtio,format=raw,bus=0,unit=2 "
-    fi
-}
-
-host_args()
-{
-    [ "$CONFIG_QEMU_HOST" ] || return
-
-    echo -n "-virtfs local,path=$CONFIG_QEMU_HOST,security_model=none,writeout=immediate,mount_tag=hostfs "
-}
-
-net_dev_args()
-{
-    local name="e$1"
-    local mac=$(printf "02:00:00:00:00:%02x" $1)
-
-    echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
-    echo "$name	$mac" >>"$mactab"
-}
-
-net_args()
-{
-    # Infix will pick up this file via fwcfg and install it to /etc
-    mactab=$(dirname "$CONFIG_QEMU_ROOTFS")/mactab
-    :> "$mactab"
-    echo -n "-fw_cfg name=opt/mactab,file=$mactab "
-
-    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e0,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
-	net_dev_args 0
-    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 0 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
-	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
-	    net_dev_args $i
-	done
-    elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
-	local useropts=
-	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
-
-	echo -n "-netdev user,id=e0${useropts} "
-	net_dev_args 0
-    else
-	echo -n "-nic none"
-    fi
-}
-
-wdt_args()
-{
-    echo -n "-device i6300esb -rtc clock=host"
-}
-
-run_qemu()
-{
-    local qemu
-    read qemu <<EOF
-	$CONFIG_QEMU_MACHINE \
-	  $(loader_args) \
-	  $(rootfs_args) \
-	  $(serial_args) \
-	  $(rw_args) \
-	  $(host_args) \
-	  $(net_args) \
-	  $(wdt_args) \
-	  $CONFIG_QEMU_EXTRA
-EOF
-
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
-	$qemu -append "$(append_args)" "$@"
-    else
-	$qemu "$@"
-    fi
-}
-
-dtb_args()
-{
-    [ "$CONFIG_QEMU_LOADER_UBOOT" ] || return
-
-    if [ "$CONFIG_QEMU_DTB_EXTEND" ]; then
-	# On the current architecture, QEMU will generate an internal
-	# DT based on the system configuration.
-
-	# So we extract a copy of that
-	run_qemu -M dumpdtb=qemu.dtb >/dev/null 2>&1
-
-	# Extend it with the environment and signing information in
-	# u-boot.dtb.
-	echo "qemu.dtb u-boot.dtb" | \
-	    xargs -n 1 dtc -I dtb -O dts | \
-	    { echo "/dts-v1/;"; sed  -e 's:/dts-v[0-9]\+/;::'; } | \
-	    dtc >qemu-extended.dtb 2>/dev/null
-
-	# And use the combined result to start the instance
-	echo -n "-dtb qemu-extended.dtb "
-    else
-	# Otherwise we just use the unmodified one
-	echo -n "-dtb u-boot.dtb "
-    fi
-}
-
-generate_dot()
-{
-    [ "$CONFIG_QEMU_NET_TAP" = "y" ] || return
-
-    hostports="<qtap0> qtap0"
-    targetports="<e0> e0"
-    edges="host:qtap0 -- target:e0 [kind=mgmt];"
-    for tap in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
-	hostports="$hostports | <qtap$tap> qtap$tap "
-	targetports="$targetports | <e$tap> e$tap "
-	edges="$edges host:qtap$tap -- target:e$tap;"
-    done
-    cat >qemu.dot <<EOF
-graph "qemu" {
-	layout="neato";
-	overlap="false";
-	esep="+20";
-
-        node [shape=record, fontname="monospace"];
-	edge [color="cornflowerblue", penwidth="2"];
-
-	host [
-	    label="host | { $hostports }"
-	    pos="0,0!",
-
-	    kind="controller",
-	];
-
-        target [
-	    label="{ $targetports } | target",
-	    pos="10,0!",
-
-	    kind="infix",
-	];
-
-	$edges
-}
-EOF
-}
-
-menuconfig()
-{
-    grep -q QEMU_MACHINE Config.in || die "$prognm: must be run from the output/images directory"
-    command -v kconfig-mconf >/dev/null || die "$prognm: cannot find kconfig-mconf for menuconfig"
-    exec kconfig-mconf Config.in
-}
-
-cd $(dirname $(readlink -f "$0"))
-
-while [ "$1" != "" ]; do
-    case $1 in
-	-c)
-	    menuconfig
-	    ;;
-	-h)
-	    usage
-	    ;;
-	*)
-	    break
-    esac
-    shift
-done
-
-if [ -f .config ]; then
-    # Customized settings from 'qemu.sh -c'
-    load_qemucfg .config
-else
-    # Shipped defaults from release tarball
-    load_qemucfg qemu.cfg
-fi
-
-generate_dot
-
-echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-line=$(stty -g)
-stty raw
-run_qemu $(dtb_args)
-stty "$line"
-
@@ -0,0 +1,116 @@
+#!/bin/sh
+#set -x
+
+mode=/mnt/cfg/infix/.use_etc
+boot=/tmp/.boot_mode
+if [ -f $boot ]; then
+    current=$(cat $boot)
+else
+    current="unknown"
+fi
+m=on
+n=off
+p=off
+
+select_mode()
+{
+    if [ -f $mode ]; then
+	m=off
+	if grep -qi profinet $boot; then
+	    n=off
+	    p=on
+	else
+	    n=on
+	    p=off
+	fi
+    fi
+
+    exec 3>&1
+    selection=$(dialog --erase-on-exit --no-tags \
+		    --hline "Arrow keys + space to select, enter to confirm" \
+		    --backtitle "Select Operating Mode" \
+		    --title "Select Operating Mode" \
+		    --radiolist "System currently runs in: $current mode" 13 60 1 \
+		    "1" "Managed NETCONF, XML datastore" "$m" \
+		    "2" "Native Linux, /etc datastore"   "$n" \
+		    "3" "PROFINET, /etc variant"         "$p" \
+		    2>&1 1>&3)
+    exit_status=$?
+    exec 3>&-
+    case $exit_status in
+	1)			# cancel
+	    exit 0
+	    ;;
+	255)			# escape
+	    exit 1
+	    ;;
+    esac
+}
+
+usage()
+{
+    cat <<EOF
+usage:
+  chom [-h] [etc | netconf]
+
+options:
+  -h            Show this help text
+
+arguments:
+  etc           Change to Linux native mode, /etc
+  netconf       Change to NETCONF mode, XML
+  profinet      Change to PROFINET mode, /etc variant
+
+EOF
+}
+
+case $1 in
+    -h)
+	usage
+	exit 0
+	;;
+    net* | xml)
+	selection=1
+	;;
+    nat* | etc*)
+	selection=2
+	;;
+    profinet)
+	selection=3
+	;;
+    *)
+	;;
+esac
+
+if [ -z "$selection" ]; then
+    use_dialog=1
+    select_mode
+fi
+
+case $selection in
+    1)
+	rm -f $mode 2>/dev/null
+	grep -qi netconf $boot 2>/dev/null && exit 0
+	result="Manageed NETCONF"
+	;;
+    2)
+	echo "native /etc" > $mode
+	grep -qi native $boot  2>/dev/null && exit 0
+	result="Native Linux, /etc"
+	;;
+    3)
+	echo "PROFINET" > $mode
+	grep -qi profinet $boot  2>/dev/null && exit 0
+	result="PROFINET"
+	;;
+esac
+
+if [ -n "$use_dialog" ]; then
+    dialog --erase-on-exit --cr-wrap --title "Activate Mode Change?" --yesno "\n   Reboot to $result mode now?" 8 50
+    if [ $? -eq 0 ]; then
+	reboot
+    fi
+fi
+
+echo "Remember to reboot later to activate the change."
+exit 0
@@ -215,10 +215,10 @@ system()
 {
 	h1 "SYSTEM INFORMATION"
 	echo "System Name        : $(uname -n)"
-	echo "System Variant     : $VARIANT"
+	echo "System Boot Mode   : $(cat /tmp/.boot_mode)"
 	echo "System Description : $PRETTY_NAME"
 	echo "System Contact     : $HOME_URL"
-	echo "System Timezone    : $(cat /etc/timezone)"
+	echo "System Timezone    : $TZ"
 	echo "System Type        : $NAME"
 	echo "System Version     : $(cat /etc/version)"
 	echo "System Arch        : $(uname -m)"
@@ -3,13 +3,9 @@
 # If not running interactively, don't do anything
 [ -z "$PS1" ] && return

-# Reevaluate for each line, in case hostname changes
-function prompt_command
-{
-    PS1="\u@$(hostname):\w\$ "
-}
-export PROMPT_COMMAND=prompt_command
-
 # check the window size after each command and, if necessary,
 # update the values of LINES and COLUMNS.
 shopt -s checkwinsize
+
+# Disble built-ins
+enable -n help
@@ -1,141 +0,0 @@
-_cond()
-{
-    initctl -pt cond dump |  awk '{print $4}' | sed 's/<\(.*\)>/\1/'
-}
-
-_ident()
-{
-    if [ -n "$1" ]; then
-	initctl ident | grep -q $1
-    else
-	initctl ident
-    fi
-}
-
-_svc()
-{
-    initctl ls -pt | grep $1 | sed "s/.*\/\(.*\)/\1/g" | sort -u
-}
-
-_enabled()
-{
-    echo "$(_svc enabled)"
-}
-
-_available()
-{
-    all=$(mktemp)
-    ena=$(mktemp)
-    echo "$(_svc available)" >$all
-    echo "$(_svc enabled)"   >$ena
-    grep -v -f $ena $all
-    rm $all $ena
-}
-
-# Determine first non-option word. Usually the command
-_firstword() {
-	local firstword i
-
-	firstword=
-	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
-		if [[ ${COMP_WORDS[i]} != -* ]]; then
-			firstword=${COMP_WORDS[i]}
-			break
-		fi
-	done
-
-	echo $firstword
-}
-
-# Determine last non-option word. Uusally a sub-command
-_lastword() {
-	local lastword i
-
-	lastword=
-	for ((i = 1; i < ${#COMP_WORDS[@]}; ++i)); do
-		if [[ ${COMP_WORDS[i]} != -* ]] && [[ -n ${COMP_WORDS[i]} ]] && [[ ${COMP_WORDS[i]} != $cur ]]; then
-			lastword=${COMP_WORDS[i]}
-		fi
-	done
-
-	echo $lastword
-}
-
-_initctl()
-{
-    local cur command
-
-    cur=${COMP_WORDS[COMP_CWORD]}
-    prev="${COMP_WORDS[COMP_CWORD-1]}"
-    firstword=$(_firstword)
-    lastword=$(_lastword)
-
-    commands="status cond debug help kill ls log version  list enable	\
-	      disable touch show cat edit create delete reload start	\
-	      stop restart signal cgroup ps top plugins runlevel reboot	\
-	      halt poweroff suspend utmp"
-    cond_cmds="set get clear status dump"
-    cond_types="hook net pid service task usr"
-    signals="int term hup stop tstp cont usr1 usr2 pwr"
-    options="-b --batch				\
-	     -c --create			\
-	     -d --debug				\
-	     -f --force				\
-	     -h --help				\
-	     -j --json				\
-	     -n --noerr				\
-	     -1 --once				\
-	     -p --plain				\
-	     -q --quiet				\
-	     -t --no-heading			\
-	     -v --verbose			\
-	     -V --version"
-
-    case "${firstword}" in
-	enable)
-	    COMPREPLY=($(compgen -W "$(_available)" -- $cur))
-	    ;;
-	disable|touch)
-	    COMPREPLY=($(compgen -W "$(_enabled)" -- $cur))
-	    ;;
-	show|cat|edit|delete)
-	    COMPREPLY=($(compgen -W "$(_svc .)" -- $cur))
-	    ;;
-	start|stop|restart|log|status)
-	    COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
-	    ;;
-	signal|kill)
-	    if $(_ident "${prev}"); then
-		COMPREPLY=($(compgen -W "$signals" -- $cur))
-	    else
-		COMPREPLY=($(compgen -W "$(_ident)" -- $cur))
-	    fi
-	    ;;
-	cond)
-	    case "${lastword}" in
-		set|clear)
-		    compopt -o nospace
-		    COMPREPLY=($(compgen -W "usr/" -- $cur))
-		    ;;
-		get)
-		    COMPREPLY=($(compgen -W "$(_cond)" -- $cur))
-		    ;;
-		dump)
-		    COMPREPLY=($(compgen -W "$cond_types" -- $cur))
-		    ;;
-		*)
-		    COMPREPLY=($(compgen -W "$cond_cmds" -- $cur))
-		    ;;
-	    esac
-	    ;;
-	*)
-	    COMPREPLY=($(compgen -W "$commands" -- $cur))
-	    ;;
-    esac
-
-    if [[ $cur == -* ]]; then
-	COMPREPLY=($(compgen -W "$options" -- $cur))
-    fi
-}
-
-complete -F _initctl initctl
@@ -1,77 +0,0 @@
-# For more information on this configuration file, see containers-registries.conf(5).
-#
-# NOTE: RISK OF USING UNQUALIFIED IMAGE NAMES
-# We recommend always using fully qualified image names including the registry
-# server (full dns name), namespace, image name, and tag
-# (e.g., registry.redhat.io/ubi8/ubi:latest). Pulling by digest (i.e.,
-# quay.io/repository/name@digest) further eliminates the ambiguity of tags.
-# When using short names, there is always an inherent risk that the image being
-# pulled could be spoofed. For example, a user wants to pull an image named
-# `foobar` from a registry and expects it to come from myregistry.com. If
-# myregistry.com is not first in the search list, an attacker could place a
-# different `foobar` image at a registry earlier in the search list. The user
-# would accidentally pull and run the attacker's image and code rather than the
-# intended content. We recommend only adding registries which are completely
-# trusted (i.e., registries which don't allow unknown or anonymous users to
-# create accounts with arbitrary names). This will prevent an image from being
-# spoofed, squatted or otherwise made insecure.  If it is necessary to use one
-# of these registries, it should be added at the end of the list.
-#
-# # An array of host[:port] registries to try when pulling an unqualified image, in order.
-# unqualified-search-registries = ["example.com"]
-#
-# [[registry]]
-# # The "prefix" field is used to choose the relevant [[registry]] TOML table;
-# # (only) the TOML table with the longest match for the input image name
-# # (taking into account namespace/repo/tag/digest separators) is used.
-# # 
-# # The prefix can also be of the form: *.example.com for wildcard subdomain
-# # matching.
-# #
-# # If the prefix field is missing, it defaults to be the same as the "location" field.
-# prefix = "example.com/foo"
-#
-# # If true, unencrypted HTTP as well as TLS connections with untrusted
-# # certificates are allowed.
-# insecure = false
-#
-# # If true, pulling images with matching names is forbidden.
-# blocked = false
-#
-# # The physical location of the "prefix"-rooted namespace.
-# #
-# # By default, this is equal to "prefix" (in which case "prefix" can be omitted
-# # and the [[registry]] TOML table can only specify "location").
-# #
-# # Example: Given
-# #   prefix = "example.com/foo"
-# #   location = "internal-registry-for-example.net/bar"
-# # requests for the image example.com/foo/myimage:latest will actually work with the
-# # internal-registry-for-example.net/bar/myimage:latest image.
-#
-# # The location can be empty iff prefix is in a
-# # wildcarded format: "*.example.com". In this case, the input reference will
-# # be used as-is without any rewrite.
-# location = internal-registry-for-example.com/bar"
-#
-# # (Possibly-partial) mirrors for the "prefix"-rooted namespace.
-# #
-# # The mirrors are attempted in the specified order; the first one that can be
-# # contacted and contains the image will be used (and if none of the mirrors contains the image,
-# # the primary location specified by the "registry.location" field, or using the unmodified
-# # user-specified reference, is tried last).
-# #
-# # Each TOML table in the "mirror" array can contain the following fields, with the same semantics
-# # as if specified in the [[registry]] TOML table directly:
-# # - location
-# # - insecure
-# [[registry.mirror]]
-# location = "example-mirror-0.local/mirror-for-foo"
-# [[registry.mirror]]
-# location = "example-mirror-1.local/mirrors/foo"
-# insecure = true
-# # Given the above, a pull of example.com/foo/image:latest will try:
-# # 1. example-mirror-0.local/mirror-for-foo/image:latest
-# # 2. example-mirror-1.local/mirrors/foo/image:latest
-# # 3. internal-registry-for-example.net/bar/image:latest
-# # in order, and use the first one that exists.
@@ -1,78 +0,0 @@
-[aliases]
-  # almalinux
-  "almalinux" = "docker.io/library/almalinux"
-  "almalinux-minimal" = "docker.io/library/almalinux-minimal"
-  # centos
-  "centos" = "quay.io/centos/centos"
-  # containers
-  "skopeo" = "quay.io/skopeo/stable"
-  "buildah" = "quay.io/buildah/stable"
-  "podman" = "quay.io/podman/stable"
-  # docker
-  "alpine" = "docker.io/library/alpine"
-  "docker" = "docker.io/library/docker"
-  "registry" = "docker.io/library/registry"
-  "hello-world" = "docker.io/library/hello-world"
-  "swarm" = "docker.io/library/swarm"
-  # Fedora
-  "fedora-minimal" = "registry.fedoraproject.org/fedora-minimal"
-  "fedora" = "registry.fedoraproject.org/fedora"
-  # openSUSE
-  "opensuse/tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
-  "opensuse/tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
-  "opensuse/tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
-  "opensuse/leap" = "registry.opensuse.org/opensuse/leap"
-  "opensuse/busybox" = "registry.opensuse.org/opensuse/busybox"
-  "tumbleweed" = "registry.opensuse.org/opensuse/tumbleweed"
-  "tumbleweed-dnf" = "registry.opensuse.org/opensuse/tumbleweed-dnf"
-  "tumbleweed-microdnf" = "registry.opensuse.org/opensuse/tumbleweed-microdnf"
-  "leap" = "registry.opensuse.org/opensuse/leap"
-  "leap-dnf" = "registry.opensuse.org/opensuse/leap-dnf"
-  "leap-microdnf" = "registry.opensuse.org/opensuse/leap-microdnf"
-  "tw-busybox" = "registry.opensuse.org/opensuse/busybox"
-  # SUSE
-  "suse/sle15" = "registry.suse.com/suse/sle15"
-  "suse/sles12sp5" = "registry.suse.com/suse/sles12sp5"
-  "suse/sles12sp4" = "registry.suse.com/suse/sles12sp4"
-  "suse/sles12sp3" = "registry.suse.com/suse/sles12sp3"
-  "sle15" = "registry.suse.com/suse/sle15"
-  "sles12sp5" = "registry.suse.com/suse/sles12sp5"
-  "sles12sp4" = "registry.suse.com/suse/sles12sp4"
-  "sles12sp3" = "registry.suse.com/suse/sles12sp3"
-  # Red Hat Enterprise Linux
-  "rhel" = "registry.access.redhat.com/rhel"
-  "rhel6" = "registry.access.redhat.com/rhel6"
-  "rhel7" = "registry.access.redhat.com/rhel7"
-  "ubi7" = "registry.access.redhat.com/ubi7"
-  "ubi7-init" = "registry.access.redhat.com/ubi7-init"
-  "ubi7-minimal" = "registry.access.redhat.com/ubi7-minimal"
-  "ubi8" = "registry.access.redhat.com/ubi8"
-  "ubi8-minimal" = "registry.access.redhat.com/ubi8-minimal"
-  "ubi8-init" = "registry.access.redhat.com/ubi8-init"
-  "ubi8-micro" = "registry.access.redhat.com/ubi8-micro"
-  "ubi8/ubi" = "registry.access.redhat.com/ubi8/ubi"
-  "ubi8/ubi-minimal" = "registry.access.redhat.com/ubi8-minimal"
-  "ubi8/ubi-init" = "registry.access.redhat.com/ubi8-init"
-  "ubi8/ubi-micro" = "registry.access.redhat.com/ubi8-micro"
-  # Rocky Linux
-  "rockylinux" = "docker.io/library/rockylinux"
-  # Debian
-  "debian" = "docker.io/library/debian"
-  # Kali Linux
-  "kali-bleeding-edge" = "docker.io/kalilinux/kali-bleeding-edge"
-  "kali-dev" = "docker.io/kalilinux/kali-dev"
-  "kali-experimental" = "docker.io/kalilinux/kali-experimental"
-  "kali-last-release" = "docker.io/kalilinux/kali-last-release"
-  "kali-rolling" = "docker.io/kalilinux/kali-rolling"
-  # Ubuntu
-  "ubuntu" = "docker.io/library/ubuntu"
-  # Oracle Linux
-  "oraclelinux" = "container-registry.oracle.com/os/oraclelinux"
-  # busybox
-  "busybox" = "docker.io/library/busybox"
-  # php
-  "php" = "docker.io/library/php"
-  # python
-  "python" = "docker.io/library/python"
-  # node
-  "node" = "docker.io/library/node"
@@ -1,14 +0,0 @@
-# dnsmasq is the system resolver, the file /etc/resolv.conf is
-# managed by openresolv.  DHCP lease, VPN tunnel establishment,
-# and similar events feed servers and configuration to dnsmasq.
-domain-needed
-#interface=lo
-listen-address=127.0.0.1
-enable-dbus
-
-# Generated by openresolv
-resolv-file=/var/lib/misc/resolv.conf
-
-# Include all files in a directory which end in .conf
-conf-dir=/etc/dnsmasq.d/,*.conf
-
@@ -1,2 +1,2 @@
-run [S] /lib/infix/sysctl-sync-ip-conf --
 run [S] /lib/infix/nameif -- Probing network interfaces
+run if:<!boot/netconf> [S] /lib/infix/swup --
@@ -1 +0,0 @@
-service [2345789] log:prio:user.notice rauc service -- Software update service
@@ -1 +0,0 @@
-../available/rauc.conf
@@ -0,0 +1 @@
+../available/sshd.conf
@@ -11,6 +11,9 @@ sysfs		/sys		sysfs		defaults		0	0
 debugfs	/sys/kernel/debug	debugfs		nofail			0	0
 cfgfs		/config		configfs	nofail,noauto		0	0

+# Optional host share when running in Qemu
+hostfs		/host		9p		nofail,cache=none,msize=16384	0	0
+
 # The chosen backing storage for the overlays placed on /cfg, /etc,
 # /home, /root, and /var, are determined dynamically by /lib/infix/mnt
 # depending on the available devices.
@@ -1,3 +1,2 @@
 1 port
 2 iface
-3 internal
@@ -1,2 +0,0 @@
-options bonding max_bonds=0
-
@@ -1,2 +0,0 @@
-options dummy numdummies=0
-
@@ -60,7 +60,8 @@ menu:system:System:System Settings
 	exec:_Enable service:edit:initctl enable ~Enter name of service (filename) to enable:~
 	exec:_Disable service:edit:initctl disable ~Enter name of service (filename) to disable:~
 	nop
-	exec:_Factory Reset::yorn "Factory reset device (reboots), are you sure?" factory -y
+	exec:_Change Operating Mode::chom
+	exec:_Factory Reset::yorn "Reboot and factory reset device, are you sure?" factory -y
 	nop
 	exit:_Main menu..

@@ -4,8 +4,6 @@ alias ll='ls -alF'
 alias ls='ls --color=auto'

 export EDITOR=/usr/bin/edit
-export VISUAL=/usr/bin/edit
-export LESS="-P %f (press h for help or q to quit)"
 alias vim='vi'
 alias view='vi -R'
 alias emacs='mg'
@@ -17,5 +15,5 @@ alias ipb='ip -br'
 alias ipaddr='ip addr'
 alias iplink='ip link'
 alias bridge='bridge --color=auto'
-
-alias docker=podman
+alias setup='pdmenu; clear'
+alias cli='clixon_cli'
@@ -1,10 +0,0 @@
-# dnsmasq is the system resolver
-name_servers="127.0.0.1"
-
-resolv_conf=/etc/resolv.conf
-resolv_conf_options="edns0 trust-ad"
-
-# dnsmasq specific settings and list of
-# nameservers in non-standard locations
-dnsmasq_conf=/etc/dnsmasq.d/resolvconf.conf
-dnsmasq_resolv=/var/lib/misc/resolv.conf
@@ -1 +0,0 @@
-lo
@@ -1,361 +0,0 @@
-# Network services, Internet style
-#
-# Updated from https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml .
-#
-# New ports will be added on request if they have been officially assigned
-# by IANA and used in the real-world or are needed by a debian package.
-# If you need a huge list of used numbers please install the nmap package.
-
-tcpmux		1/tcp				# TCP port service multiplexer
-echo		7/tcp
-echo		7/udp
-discard		9/tcp		sink null
-discard		9/udp		sink null
-systat		11/tcp		users
-daytime		13/tcp
-daytime		13/udp
-netstat		15/tcp
-qotd		17/tcp		quote
-chargen		19/tcp		ttytst source
-chargen		19/udp		ttytst source
-ftp-data	20/tcp
-ftp		21/tcp
-fsp		21/udp		fspd
-ssh		22/tcp				# SSH Remote Login Protocol
-telnet		23/tcp
-smtp		25/tcp		mail
-time		37/tcp		timserver
-time		37/udp		timserver
-whois		43/tcp		nicname
-tacacs		49/tcp				# Login Host Protocol (TACACS)
-tacacs		49/udp
-domain		53/tcp				# Domain Name Server
-domain		53/udp
-bootps		67/udp
-bootpc		68/udp
-tftp		69/udp
-gopher		70/tcp				# Internet Gopher
-finger		79/tcp
-http		80/tcp		www		# WorldWideWeb HTTP
-kerberos	88/tcp		kerberos5 krb5 kerberos-sec	# Kerberos v5
-kerberos	88/udp		kerberos5 krb5 kerberos-sec	# Kerberos v5
-iso-tsap	102/tcp		tsap		# part of ISODE
-acr-nema	104/tcp		dicom		# Digital Imag. & Comm. 300
-pop3		110/tcp		pop-3		# POP version 3
-sunrpc		111/tcp		portmapper	# RPC 4.0 portmapper
-sunrpc		111/udp		portmapper
-auth		113/tcp		authentication tap ident
-nntp		119/tcp		readnews untp	# USENET News Transfer Protocol
-ntp		123/udp				# Network Time Protocol
-epmap		135/tcp		loc-srv		# DCE endpoint resolution
-netbios-ns	137/udp				# NETBIOS Name Service
-netbios-dgm	138/udp				# NETBIOS Datagram Service
-netbios-ssn	139/tcp				# NETBIOS session service
-imap2		143/tcp		imap		# Interim Mail Access P 2 and 4
-snmp		161/tcp				# Simple Net Mgmt Protocol
-snmp		161/udp
-snmp-trap	162/tcp		snmptrap	# Traps for SNMP
-snmp-trap	162/udp		snmptrap
-cmip-man	163/tcp				# ISO mgmt over IP (CMOT)
-cmip-man	163/udp
-cmip-agent	164/tcp
-cmip-agent	164/udp
-mailq		174/tcp			# Mailer transport queue for Zmailer
-xdmcp		177/udp			# X Display Manager Control Protocol
-bgp		179/tcp				# Border Gateway Protocol
-smux		199/tcp				# SNMP Unix Multiplexer
-qmtp		209/tcp				# Quick Mail Transfer Protocol
-z3950		210/tcp		wais		# NISO Z39.50 database
-ipx		213/udp				# IPX [RFC1234]
-ptp-event	319/udp
-ptp-general	320/udp
-pawserv		345/tcp				# Perf Analysis Workbench
-zserv		346/tcp				# Zebra server
-rpc2portmap	369/tcp
-rpc2portmap	369/udp				# Coda portmapper
-codaauth2	370/tcp
-codaauth2	370/udp				# Coda authentication server
-clearcase	371/udp		Clearcase
-ldap		389/tcp			# Lightweight Directory Access Protocol
-ldap		389/udp
-svrloc		427/tcp				# Server Location
-svrloc		427/udp
-https		443/tcp				# http protocol over TLS/SSL
-https		443/udp				# HTTP/3
-snpp		444/tcp				# Simple Network Paging Protocol
-microsoft-ds	445/tcp				# Microsoft Naked CIFS
-kpasswd		464/tcp
-kpasswd		464/udp
-submissions	465/tcp		ssmtp smtps urd # Submission over TLS [RFC8314]
-saft		487/tcp			# Simple Asynchronous File Transfer
-isakmp		500/udp				# IPSEC key management
-rtsp		554/tcp			# Real Time Stream Control Protocol
-rtsp		554/udp
-nqs		607/tcp				# Network Queuing system
-asf-rmcp	623/udp		# ASF Remote Management and Control Protocol
-qmqp		628/tcp
-ipp		631/tcp				# Internet Printing Protocol
-ldp		646/tcp				# Label Distribution Protocol
-ldp		646/udp
-#
-# UNIX specific services
-#
-exec		512/tcp
-biff		512/udp		comsat
-login		513/tcp
-who		513/udp		whod
-shell		514/tcp		cmd syslog	# no passwords used
-syslog		514/udp
-printer		515/tcp		spooler		# line printer spooler
-talk		517/udp
-ntalk		518/udp
-route		520/udp		router routed	# RIP
-gdomap		538/tcp				# GNUstep distributed objects
-gdomap		538/udp
-uucp		540/tcp		uucpd		# uucp daemon
-klogin		543/tcp				# Kerberized `rlogin' (v5)
-kshell		544/tcp		krcmd		# Kerberized `rsh' (v5)
-dhcpv6-client	546/udp
-dhcpv6-server	547/udp
-afpovertcp	548/tcp				# AFP over TCP
-nntps		563/tcp		snntp		# NNTP over SSL
-submission	587/tcp				# Submission [RFC4409]
-ldaps		636/tcp				# LDAP over SSL
-ldaps		636/udp
-tinc		655/tcp				# tinc control port
-tinc		655/udp
-silc		706/tcp
-kerberos-adm	749/tcp				# Kerberos `kadmin' (v5)
-#
-domain-s	853/tcp				# DNS over TLS [RFC7858]
-domain-s	853/udp				# DNS over DTLS [RFC8094]
-rsync		873/tcp
-ftps-data	989/tcp				# FTP over SSL (data)
-ftps		990/tcp
-telnets		992/tcp				# Telnet over SSL
-imaps		993/tcp				# IMAP over SSL
-pop3s		995/tcp				# POP-3 over SSL
-#
-# From ``Assigned Numbers'':
-#
-#> The Registered Ports are not controlled by the IANA and on most systems
-#> can be used by ordinary user processes or programs executed by ordinary
-#> users.
-#
-#> Ports are used in the TCP [45,106] to name the ends of logical
-#> connections which carry long term conversations.  For the purpose of
-#> providing services to unknown callers, a service contact port is
-#> defined.  This list specifies the port used by the server process as its
-#> contact port.  While the IANA can not control uses of these ports it
-#> does register or list uses of these ports as a convienence to the
-#> community.
-#
-socks		1080/tcp			# socks proxy server
-proofd		1093/tcp
-rootd		1094/tcp
-openvpn		1194/tcp
-openvpn		1194/udp
-rmiregistry	1099/tcp			# Java RMI Registry
-lotusnote	1352/tcp	lotusnotes	# Lotus Note
-ms-sql-s	1433/tcp			# Microsoft SQL Server
-ms-sql-m	1434/udp			# Microsoft SQL Monitor
-ingreslock	1524/tcp
-datametrics	1645/tcp	old-radius
-datametrics	1645/udp	old-radius
-sa-msg-port	1646/tcp	old-radacct
-sa-msg-port	1646/udp	old-radacct
-kermit		1649/tcp
-groupwise	1677/tcp
-l2f		1701/udp	l2tp
-radius		1812/tcp
-radius		1812/udp
-radius-acct	1813/tcp	radacct		# Radius Accounting
-radius-acct	1813/udp	radacct
-cisco-sccp	2000/tcp			# Cisco SCCP
-nfs		2049/tcp			# Network File System
-nfs		2049/udp			# Network File System
-gnunet		2086/tcp
-gnunet		2086/udp
-rtcm-sc104	2101/tcp			# RTCM SC-104 IANA 1/29/99
-rtcm-sc104	2101/udp
-gsigatekeeper	2119/tcp
-gris		2135/tcp		# Grid Resource Information Server
-cvspserver	2401/tcp			# CVS client/server operations
-venus		2430/tcp			# codacon port
-venus		2430/udp			# Venus callback/wbc interface
-venus-se	2431/tcp			# tcp side effects
-venus-se	2431/udp			# udp sftp side effect
-codasrv		2432/tcp			# not used
-codasrv		2432/udp			# server port
-codasrv-se	2433/tcp			# tcp side effects
-codasrv-se	2433/udp			# udp sftp side effect
-mon		2583/tcp			# MON traps
-mon		2583/udp
-dict		2628/tcp			# Dictionary server
-f5-globalsite	2792/tcp
-gsiftp		2811/tcp
-gpsd		2947/tcp
-gds-db		3050/tcp	gds_db		# InterBase server
-icpv2		3130/udp	icp		# Internet Cache Protocol
-isns		3205/tcp			# iSNS Server Port
-isns		3205/udp			# iSNS Server Port
-iscsi-target	3260/tcp
-mysql		3306/tcp
-ms-wbt-server	3389/tcp
-nut		3493/tcp			# Network UPS Tools
-nut		3493/udp
-distcc		3632/tcp			# distributed compiler
-daap		3689/tcp			# Digital Audio Access Protocol
-svn		3690/tcp	subversion	# Subversion protocol
-suucp		4031/tcp			# UUCP over SSL
-sysrqd		4094/tcp			# sysrq daemon
-sieve		4190/tcp			# ManageSieve Protocol
-epmd		4369/tcp			# Erlang Port Mapper Daemon
-remctl		4373/tcp		# Remote Authenticated Command Service
-f5-iquery	4353/tcp			# F5 iQuery
-ntske		4460/tcp	# Network Time Security Key Establishment
-ipsec-nat-t	4500/udp			# IPsec NAT-Traversal [RFC3947]
-iax		4569/udp			# Inter-Asterisk eXchange
-mtn		4691/tcp			# monotone Netsync Protocol
-radmin-port	4899/tcp			# RAdmin Port
-sip		5060/tcp			# Session Initiation Protocol
-sip		5060/udp
-sip-tls		5061/tcp
-sip-tls		5061/udp
-xmpp-client	5222/tcp	jabber-client	# Jabber Client Connection
-xmpp-server	5269/tcp	jabber-server	# Jabber Server Connection
-cfengine	5308/tcp
-mdns		5353/udp			# Multicast DNS
-postgresql	5432/tcp	postgres	# PostgreSQL Database
-freeciv		5556/tcp	rptp		# Freeciv gameplay
-amqps		5671/tcp			# AMQP protocol over TLS/SSL
-amqp		5672/tcp
-amqp		5672/sctp
-x11		6000/tcp	x11-0		# X Window System
-x11-1		6001/tcp
-x11-2		6002/tcp
-x11-3		6003/tcp
-x11-4		6004/tcp
-x11-5		6005/tcp
-x11-6		6006/tcp
-x11-7		6007/tcp
-gnutella-svc	6346/tcp			# gnutella
-gnutella-svc	6346/udp
-gnutella-rtr	6347/tcp			# gnutella
-gnutella-rtr	6347/udp
-redis		6379/tcp
-sge-qmaster	6444/tcp	sge_qmaster	# Grid Engine Qmaster Service
-sge-execd	6445/tcp	sge_execd	# Grid Engine Execution Service
-mysql-proxy	6446/tcp			# MySQL Proxy
-babel		6696/udp			# Babel Routing Protocol
-ircs-u		6697/tcp		# Internet Relay Chat via TLS/SSL
-bbs		7000/tcp
-afs3-fileserver 7000/udp
-afs3-callback	7001/udp			# callbacks to cache managers
-afs3-prserver	7002/udp			# users & groups database
-afs3-vlserver	7003/udp			# volume location database
-afs3-kaserver	7004/udp			# AFS/Kerberos authentication
-afs3-volser	7005/udp			# volume managment server
-afs3-bos	7007/udp			# basic overseer process
-afs3-update	7008/udp			# server-to-server updater
-afs3-rmtsys	7009/udp			# remote cache manager service
-font-service	7100/tcp	xfs		# X Font Service
-http-alt	8080/tcp	webcache	# WWW caching service
-puppet		8140/tcp			# The Puppet master service
-bacula-dir	9101/tcp			# Bacula Director
-bacula-fd	9102/tcp			# Bacula File Daemon
-bacula-sd	9103/tcp			# Bacula Storage Daemon
-xmms2		9667/tcp	# Cross-platform Music Multiplexing System
-nbd		10809/tcp			# Linux Network Block Device
-zabbix-agent	10050/tcp			# Zabbix Agent
-zabbix-trapper	10051/tcp			# Zabbix Trapper
-amanda		10080/tcp			# amanda backup services
-dicom		11112/tcp
-hkp		11371/tcp			# OpenPGP HTTP Keyserver
-db-lsp		17500/tcp			# Dropbox LanSync Protocol
-dcap		22125/tcp			# dCache Access Protocol
-gsidcap		22128/tcp			# GSI dCache Access Protocol
-wnn6		22273/tcp			# wnn6
-
-#
-# Datagram Delivery Protocol services
-#
-rtmp		1/ddp			# Routing Table Maintenance Protocol
-nbp		2/ddp			# Name Binding Protocol
-echo		4/ddp			# AppleTalk Echo Protocol
-zip		6/ddp			# Zone Information Protocol
-
-#=========================================================================
-# The remaining port numbers are not as allocated by IANA.
-#=========================================================================
-
-# Kerberos (Project Athena/MIT) services
-kerberos4	750/udp		kerberos-iv kdc	# Kerberos (server)
-kerberos4	750/tcp		kerberos-iv kdc
-kerberos-master	751/udp		kerberos_master	# Kerberos authentication
-kerberos-master	751/tcp
-passwd-server	752/udp		passwd_server	# Kerberos passwd server
-krb-prop	754/tcp		krb_prop krb5_prop hprop # Kerberos slave propagation
-zephyr-srv	2102/udp			# Zephyr server
-zephyr-clt	2103/udp			# Zephyr serv-hm connection
-zephyr-hm	2104/udp			# Zephyr hostmanager
-iprop		2121/tcp			# incremental propagation
-supfilesrv	871/tcp			# Software Upgrade Protocol server
-supfiledbg	1127/tcp		# Software Upgrade Protocol debugging
-
-#
-# Services added for the Debian GNU/Linux distribution
-#
-poppassd	106/tcp				# Eudora
-moira-db	775/tcp		moira_db	# Moira database
-moira-update	777/tcp		moira_update	# Moira update protocol
-moira-ureg	779/udp		moira_ureg	# Moira user registration
-spamd		783/tcp				# spamassassin daemon
-skkserv		1178/tcp			# skk jisho server port
-predict		1210/udp			# predict -- satellite tracking
-rmtcfg		1236/tcp			# Gracilis Packeten remote config server
-xtel		1313/tcp			# french minitel
-xtelw		1314/tcp			# french minitel
-zebrasrv	2600/tcp			# zebra service
-zebra		2601/tcp			# zebra vty
-ripd		2602/tcp			# ripd vty (zebra)
-ripngd		2603/tcp			# ripngd vty (zebra)
-ospfd		2604/tcp			# ospfd vty (zebra)
-bgpd		2605/tcp			# bgpd vty (zebra)
-ospf6d		2606/tcp			# ospf6d vty (zebra)
-ospfapi		2607/tcp			# OSPF-API
-isisd		2608/tcp			# ISISd vty (zebra)
-fax		4557/tcp			# FAX transmission service (old)
-hylafax		4559/tcp			# HylaFAX client-server protocol (new)
-munin		4949/tcp	lrrd		# Munin
-rplay		5555/udp			# RPlay audio service
-nrpe		5666/tcp			# Nagios Remote Plugin Executor
-nsca		5667/tcp			# Nagios Agent - NSCA
-canna		5680/tcp			# cannaserver
-syslog-tls	6514/tcp			# Syslog over TLS [RFC5425]
-sane-port	6566/tcp	sane saned	# SANE network scanner daemon
-ircd		6667/tcp			# Internet Relay Chat
-zope-ftp	8021/tcp			# zope management by ftp
-tproxy		8081/tcp			# Transparent Proxy
-omniorb		8088/tcp			# OmniORB
-clc-build-daemon 8990/tcp			# Common lisp build daemon
-xinetd		9098/tcp
-git		9418/tcp			# Git Version Control System
-zope		9673/tcp			# zope server
-webmin		10000/tcp
-kamanda		10081/tcp			# amanda backup services (Kerberos)
-amandaidx	10082/tcp			# amanda backup services
-amidxtape	10083/tcp			# amanda backup services
-sgi-cmsd	17001/udp		# Cluster membership services daemon
-sgi-crsd	17002/udp
-sgi-gcd		17003/udp			# SGI Group membership daemon
-sgi-cad		17004/tcp			# Cluster Admin daemon
-binkp		24554/tcp			# binkp fidonet protocol
-asp		27374/tcp			# Address Search Protocol
-asp		27374/udp
-csync2		30865/tcp			# cluster synchronization tool
-dircproxy	57000/tcp			# Detachable IRC Proxy
-tfido		60177/tcp			# fidonet EMSI over telnet
-fido		60179/tcp			# fidonet EMSI over TCP
-
-# Local services
@@ -1 +1 @@
-Subsystem cli /usr/bin/klish
+Subsystem cli /usr/bin/clixon_cli
@@ -1,4 +0,0 @@
-# https://addiva-elektronik.github.io/2023/03/29/bridge-firewalling/
-net.bridge.bridge-nf-call-ip6tables = 0
-net.bridge.bridge-nf-call-iptables  = 0
-net.bridge.bridge-nf-call-arptables = 0
@@ -1,2 +0,0 @@
-net.ipv4.ip_forward=1
-net.ipv6.conf.all.forwarding=1
@@ -1,2 +0,0 @@
-net.core.fb_tunnels_only_for_init_net=2
-net.core.rmem_max=1000000
@@ -0,0 +1 @@
+local7.*		-/var/log/profinet.log
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# This is an unmanaged node, leave /etc as-is
+/lib/infix/use-etc && exit 0
+
+# This is a managed node, ignore all default configuration ...
+# ... except for some core services
+reserved()
+{
+    for svc in clixon getty lldpd nginx sysklogd; do
+	[ "$1" = "${svc}.conf" ] && return 0
+    done
+
+    return 1
+}
+
+for file in /etc/finit.d/enabled/*.conf; do
+    reserved "$(basename "$file")" && continue
+    rm "$file"
+done
@@ -1,11 +1,12 @@
 #!/bin/sh
+
 # Called from /etc/fstab to ensure we have something writable mounted
 # at /cfg, /etc, /home, /root, and /var.
 #
 # /mnt/cfg is used to store device modifications made to /etc, /home,
 # /root.
 #
-# /mnt/var is used as the backing store for /var.  If /mnt/var isn't
+# /mnt/var is used as the backins store for /var. If /mnt/var is not
 # available, /mnt/cfg will still be be used to persist /var/lib.
 #
 # If a disk partiion with the corresponding label ("cfg"/"var") is
@@ -13,7 +14,6 @@
 # directories. Otherwise fall back to a tmpfs based RAM disk. This
 # effectively brings up the system with the default configuration, but
 # obviously any subsequent configuration is ephemeral.
-. /etc/os-release

 set -e

@@ -32,21 +32,6 @@ mount_rw()
    return 1
 }

-# Bind mount /var or /var/lib to ensure applications like podman can set
-# up overlay mounts for containers.  Overlays cannot sit on top of other
-# overlays.  We always copy the contents of /var or /var/lib from the
-# rootfs to get updates, e.g., new packages added in an upgrade.
-mount_bind()
-{
-    src="$1"
-    dst="$2"
-
-    mkdir -p "$src"
-    cp -af "$dst/." "$src/" ||:
-
-    mount -o bind "$src" "$dst"
-}
-
 # mkdir -p -m 0755 only applies to the deepest directory
 # shellcheck disable=SC2174
 mount_overlay()
@@ -79,11 +64,7 @@ if ! mount_rw var >/dev/null 2>&1; then
    logger $opt -p user.warn -t "$nm" \
 	   "No persistent storage found for /var, only /var/lib is persisted."
    varsrc=/mnt/tmp
-    vlibsrc=/mnt/cfg/vlib
-else
-    mount_bind "$varsrc" /var
-    varsrc=
-    vlibsrc=
+    vlibsrc=/mnt/cfg
 fi

 cfgsrc=/mnt/cfg
@@ -107,8 +88,7 @@ else
 	sync
    fi

-    # Check build: NETCONF or Classic
-    if [ "$VARIANT_ID" != "netconf" ]; then
+    if /lib/infix/use-etc; then
 	etcsrc=/mnt/cfg
    fi

@@ -121,9 +101,9 @@ mount_overlay cfg  $cfgsrc /cfg
 mount_overlay etc  $etcsrc /etc
 mount_overlay home $cfgsrc /home
 mount_overlay root $cfgsrc /root
+mount_overlay var  $varsrc /var

-[ "$varsrc" ]  && mount_overlay var "$varsrc"  /var
-[ "$vlibsrc" ] && mount_bind        "$vlibsrc" /var/lib
+[ "$vlibsrc" ] && mount_overlay vlib "$vlibsrc" /var/lib

 # Keep transient configs in a ramdisk and symlink out to /cfg for
 # startup.
@@ -25,7 +25,7 @@ for netif in /sys/class/net/*; do

 	dsa="dsa$num"
 	logger -k -p user.notice -t "$ident" "Found DSA interface, renaming $iface -> $dsa"
-	ip link set dev "$iface" name $dsa group internal
+	ip link set dev "$iface" name $dsa
 	num=$((num + 1))
 done

@@ -35,5 +35,12 @@ for iface in $ports; do
 	ip link set "$iface" group port
 done

+# Testing, e.g., using /etc/mactab may use TAP devices to create
+# emulated switch ports, make sure to mark them as well
+ports=$(ip -json link | jq -r '.[].ifname | match("^e[[:digit:]]+").string')
+for iface in $ports; do
+	ip link set "$iface" group port
+done
+
 # At least loopback in iface group
 ip link set lo group iface
@@ -0,0 +1,19 @@
+#!/bin/sh
+set -e
+
+FACTORY=/mnt/tmp/infix/db/factory_db
+
+# TODO: Maybe copy in a proper factory config from
+# /usr/share/vendor/<hardware-id>_db or similar.
+# Right now we generate one from probed data.
+cat <<EOF >$FACTORY
+<config>
+<restconf xmlns="http://clicon.org/restconf">
+   <enable>true</enable>
+   <auth-type>none</auth-type>
+   <fcgi-socket>/run/clixon/restconf.sock</fcgi-socket>
+</restconf>
+</config>
+EOF
+
+[ -f /cfg/startup_db ] || cp "$FACTORY" /cfg/startup_db
@@ -0,0 +1,38 @@
+#!/bin/sh
+# Only runs in native /etc and PROFINET nodes.
+
+if initctl cond get boot/profinet; then
+    initctl enable snmpd
+    initctl disable lldpd
+fi
+
+# Factory default: all switch ports in VLAN 1 of br0
+# need to check for 'length > 0' because ip command
+# outputs empty json objects for non-port group ifs
+ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
+[ -f /etc/network/interfaces.d/br0 ] || [ -z "$ports" ] && exit 0
+
+touch /etc/network/interfaces.d/br0
+for port in $ports; do
+    cat <<-EOF >>/etc/network/interfaces.d/br0
+		iface $port
+		    bridge-access 1
+		    post-up ip link set $port group port
+	EOF
+done
+cat <<-EOF >>/etc/network/interfaces.d/br0
+
+	auto br0
+	iface br0
+	    bridge-ports $ports
+	    bridge-vlan-aware yes
+	    bridge-stp on
+	    bridge-vids 1
+
+	auto vlan1
+	iface vlan1 inet dhcp
+	    vlan-id 1
+	    vlan-raw-device br0
+	    post-up ip link set vlan1 group iface
+EOF
+ip link set vlan1 group iface
@@ -1,17 +0,0 @@
-#!/bin/sh
-
-# When changing default IPv4/6 settings, this does not apply to
-# existing interfaces. This syncs the default settings to all known
-# interfaces at boot, such that physical interfaces will start from
-# the same point as virtual ones.
-tmp=$(mktemp)
-
-sysctl net.ipv4.conf.default  >$tmp
-sysctl net.ipv6.conf.default >>$tmp
-
-for iface in $(ip -j link show | jq -r .[].ifname); do
-    sed -e "s/.default./.${iface}./g" $tmp | sysctl -p -
-done
-
-rm $tmp
-
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+if [ -f /mnt/cfg/infix/.use_etc ]; then
+    exit 0
+fi
+
+# Finit's condition system may not yet be bootstrapped when this script
+# is called, e.g., when /etc/fstab is parsed, so we have to manually
+# check for the boot/etc condition.
+awk '
+    $0 == "finit.cond" {
+	cond=1;
+	next;
+    }
+    cond == 1 {
+	use_etc = index($0, "etc") != 0;
+    }
+    END {
+    	exit(use_etc ? 0 : 1);
+    }
+' /proc/1/cmdline
@@ -0,0 +1,26 @@
+#!/bin/sh
+# Override boot mode based on user input from setup tool
+
+set_cond()
+{
+    mkdir -p /run/finit/cond/boot
+    ln -s /run/finit/cond/reconf "/run/finit/cond/boot/$1"
+}
+
+# Report to the setup and show tools the current boot mode
+if /lib/infix/use-etc; then
+    if [ -f /mnt/cfg/infix/.use_etc ]; then
+	cat /mnt/cfg/infix/.use_etc > /tmp/.boot_mode
+	if grep -qi profinet /mnt/cfg/infix/.use_etc; then
+	    set_cond profinet
+	else
+	    set_cond etc
+	fi
+    else
+	echo "native /etc"  > /tmp/.boot_mode
+	set_cond etc
+    fi
+else
+    echo "NETCONF" > /tmp/.boot_mode
+    set_cond netconf
+fi
@@ -1,181 +0,0 @@
-#!/bin/sh
-
-set -e
-
-inform()
-{
-    local level="$1"
-    shift
-
-    logger -p "daemon.$level" -t dagger -c $LOGGER_STDOUT "$@"
-}
-
-abort()
-{
-    inform err "Aborting: $*"
-    exit 1
-}
-
-generate_order()
-{
-    [ -f "$1/bottom-up-order" ] && [ -f "$1/top-down-order" ] && return
-
-    # The bottom-up order corresponds to a DFS through the DAG, with
-    # duplicates removed
-    find -L "$1/dag" -depth -mindepth 1 -exec basename {} \; \
-	| awk '!seen[$0]++' \
-	      >"$1/bottom-up-order"
-
-    # The reverse is a valid top-down order
-    sed '1!G;h;$!d' "$1/bottom-up-order" >"$1/top-down-order"
-}
-
-action_exec()
-{
-    local actdir="$2/action/$1"
-    local orderfile="$actdir/order"
-    local code=0
-
-    generate_order "$2"
-
-    if [ ! -r "$orderfile" ]; then
-	orderfile="$2/bottom-up-order"
-	inform warn "No order defined for $actdir, falling back to bottom-up"
-    fi
-
-    local order=$(cat "$orderfile")
-
-    [ -d "$actdir/@pre"  ] && order="@pre $order"
-    [ -d "$actdir/@post" ] && order="$order @post"
-
-    for node in $order; do
-	for work in $(find "$actdir/$node" -type f -executable 2>/dev/null | sort); do
-	    $work >>"$work.log" 2>&1 || code=$?
-	    echo "[exit:$code]" >>"$work.log"
-
-	    [ $code -eq 0 ] || abort "$work failed with exitcode $code"
-	done
-    done
-}
-
-do_exec()
-{
-    local action="$1"
-    local current=
-
-    current=$([ -f "$basedir/current" ] && cat "$basedir/current")
-    [ "$current" ] && [ -d "$basedir/$current" ] \
-	|| abort "Current generation does not exist"
-
-    action_exec "$1" "$basedir/$current"
-}
-
-do_abandon()
-{
-    local next=
-
-    next=$([ -f "$basedir/next" ] && cat "$basedir/next" || true)
-    [ "$next" ] && [ -d "$basedir/$next" ] \
-	|| abort "Next generation does not exist"
-
-    mv "$basedir/$next" "$basedir/$next-ABANDONED-$(date +%F-%T)"
-    rm "$basedir/next"
-    inform info "Abandoned generation $next"
-}
-
-do_evolve()
-{
-    local current=
-    local next=
-
-    current=$([ -f "$basedir/current" ] && cat "$basedir/current" || true)
-    [ ! "$current" ] || [ -d "$basedir/$current" ] \
-	|| abort "Current generation does not exist"
-
-    next=$([ -f "$basedir/next" ] && cat "$basedir/next" || true)
-    [ "$next" ] && [ -d "$basedir/$next" ] \
-	|| abort "Next generation does not exist"
-
-    [ "$current" ] && action_exec exit "$basedir/$current"
-
-    action_exec init "$basedir/$next"
-
-    mv "$basedir/next" "$basedir/current"
-    inform info "Evolved to generation $next"
-}
-
-usage()
-{
-    cat <<EOF
-usage: dagger [-d] [-C <root>] <command> [<args>]
-
-Directed Acyclic Graph Generational Execution Runner
-
-Global options:
-
-  -d
-    In addition to the system log, also log messages to stderr.
-
-  -C <root>
-    Instead of the current working directory, use <root> as the dagger
-    root directory.
-
-Commands:
-
-  abandon
-    Abandon a prepared, but not yet applied, next generation.
-
-  evolve
-    Run the exit action of the current generation, followed by the
-    init action of the next generation.
-
-  exec <action>
-    Run the specified action of the current generation.
-
-  help
-    Show this message.
-
-EOF
-}
-
-basedir=$(pwd)
-
-# Global options
-while getopts "dC:" opt; do
-    case $opt in
-	d)
-	    LOGGER_STDOUT=-s
-	    ;;
-	C)
-	    basedir=$OPTARG
-	    ;;
-	*)
-	    usage && exit 1
-    esac
-done
-shift $((OPTIND - 1))
-
-if [ $# -lt 1 ]; then
-    usage && exit 1
-fi
-
-cmd=$1
-shift
-
-case $cmd in
-    "help")
-	usage && exit 0
-	;;
-    "abandon")
-	do_abandon
-	;;
-    "evolve")
-	do_evolve
-	;;
-    "exec")
-	do_exec "$@"
-	;;
-
-    *)
-	usage && exit 1
-esac
@@ -1 +1 @@
-mg
+nano
@@ -1 +1 @@
-mg
+nano
@@ -3,17 +3,11 @@ CONFIG_DEVICE_TREE_INCLUDES="infix-env.dtsi infix-key.dtsi"

 CONFIG_ENV_IMPORT_FDT=y

-CONFIG_RSA=y
-CONFIG_RSA_VERIFY=y
-
 CONFIG_FIT=y
 CONFIG_FIT_SIGNATURE=y
 CONFIG_BLKMAP=y

-CONFIG_NET_RANDOM_ETHADDR=y
-
 CONFIG_DISTRO_DEFAULTS=y
-CONFIG_CMD_SETEXPR=y
 CONFIG_CMD_SETEXPR_FMT=y

 CONFIG_MMC=y
@@ -2,11 +2,9 @@ for tgt in "${boot_targets}"; do
    if test "${tgt}" = "mmc0"; then
 	setenv devtype "mmc"
 	setenv devnum 0
-	mmc dev 0
    elif test "${tgt}" = "mmc1"; then
 	setenv devtype "mmc"
 	setenv devnum 1
-	mmc dev 1
    else
 	setenv devtype "${tgt}"
 	setenv devnum 0
@@ -5,7 +5,7 @@ if test "${slot}" = "primary"; then
    run ixprepblk
 elif test "${slot}" = "secondary"; then
    run ixprepblk
-elif test "${slot}" = "net"; then
+elif test "${slot}" = "dhcp"; then
    run ixprepdhcp
 fi

@@ -10,7 +10,7 @@ if load ${devtype} ${devnum}:${auxpart} ${ramdisk_addr_r} /${slot}.itbh; then

 	if part start ${devtype} ${devnum} ${slot} devoffs; then
 	    if ${devtype} read ${sqaddr} ${devoffs} ${sqblkcnt}; then
-		setenv bootargs_root "root=PARTLABEL=${slot} rootwait"
+		setenv bootargs_root "root=PARTLABEL=${slot}"
 		setenv prepared ok
 	    fi
 	fi
@@ -0,0 +1,3 @@
+clicon   -1 clicon   -1 *      - -             wheel Clixon backend
+factory  -1 wheel    -1 =reset - /sbin/factory - Reset to factory defaults
+www-data -1 www-data -1 *      - -             clicon www-data
@@ -1,13 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1090
-. "$BR2_CONFIG" 2>/dev/null
-
-# Drop Buildroot default symlink to /tmp
-if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
-	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
-	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
-fi
-
-# Allow clish (symlink to /usr/bin/klish) to be a login shell
-grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -1 +0,0 @@
-../usr/bin/klish
@@ -1,13 +0,0 @@
-{
-  "ietf-system:system": {
-    "authentication": {
-      "user": [
-        {
-          "name": "admin",
-          "password": "$6$bKPp6xu45L1cmp70$fcwDhGZct4q8LxwPASf9iVHyWqnklcdjeYi/SupLo1K9nb.aAQUz48.3qTcW38XL6gQzfHyGoyeDG2orjPUwm1",
-	  "infix-system:shell": "infix-shell-type:clish"
-        }
-      ]
-    }
-  }
-}
@@ -1,68 +0,0 @@
-{
-    "ietf-netconf-acm:nacm": {
-	"groups": {
-	    "group": [
-		{
-		    "name": "admin",
-		    "user-name": [
-			"admin"
-		    ]
-		}
-	    ]
-	},
-	"rule-list": [
-	    {
-		"name": "guest-acl",
-		"group": [
-		    "guest"
-		],
-		"rule": [
-		    {
-			"name": "deny-ncm",
-			"module-name": "ietf-netconf-monitoring",
-			"access-operations": "*",
-			"action": "deny",
-			"comment": "Disallow guests access to any NETCONF monitoring information."
-		    }
-		]
-	    },
-	    {
-		"name": "limited-acl",
-		"group": [
-		    "limited"
-		],
-		"rule": [
-		    {
-			"name": "permit-ncm",
-			"module-name": "ietf-netconf-monitoring",
-			"access-operations": "read",
-			"action": "permit",
-			"comment": "Allow read access to the NETCONF monitoring information."
-		    },
-		    {
-			"name": "permit-exec",
-			"module-name": "*",
-			"access-operations": "exec",
-			"action": "permit",
-			"comment": "Allow invocation of the supported server operations."
-		    }
-		]
-	    },
-	    {
-		"name": "admin-acl",
-		"group": [
-		    "admin"
-		],
-		"rule": [
-		    {
-			"name": "permit-all",
-			"module-name": "*",
-			"access-operations": "*",
-			"action": "permit",
-			"comment": "Allow 'admin' group complete access to all operations and data."
-		    }
-		]
-	    }
-	]
-    }
-}
@@ -1,34 +0,0 @@
-{
-    "ietf-netconf-server:netconf-server": {
-	"listen": {
-	    "endpoint": [
-		{
-		    "name": "default-ssh",
-		    "ssh": {
-			"tcp-server-parameters": {
-			    "local-address": "::"
-			},
-			"ssh-server-parameters": {
-                            "server-identity": {
-				"host-key": [
-                                    {
-					"name": "default-key",
-					"public-key": {
-					    "keystore-reference": "genkey"
-					}
-				    }
-				]
-                            },
-			    "client-authentication": {
-				"supported-authentication-methods": {
-				    "publickey": [null],
-				    "passsword": [null]
-				}
-			    }
-			}
-		    }
-		}
-	    ]
-	}
-    }
-}
@@ -1,14 +0,0 @@
-{
-    "ietf-system:system": {
-	"hostname": "infix"
-    },
-    "ieee802-dot1ab-lldp:lldp": {
-	"infix-lldp:enabled": true
-    },
-    "infix-services:mdns": {
-	"enabled": true
-    },
-    "infix-services:ssdp": {
-	"enabled": true
-    }
-}
@@ -1 +0,0 @@
-alias cli='clish'
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`Paid support and development provided by Addiva Elektronik <https://addiva.se>`
				`@@ -1 +0,0 @@`
				`service [2345789] log:prio:user.notice rauc service -- Software update service`