Final ChangeLog update for v24.04.1

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
doc: update build deps, bison needed new uboot-tools
2026-07-22 01:13:00 +02:00 · 2024-05-03 17:06:15 +02:00 · 2024-05-03 17:03:03 +02:00 · 2024-05-03 15:33:00 +02:00 · 2024-05-03 15:33:00 +02:00 · 2024-05-03 15:33:00 +02:00
395 changed files with 16035 additions and 11561 deletions
@@ -8,43 +8,32 @@ on:

 jobs:
  build:
-    name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-    runs-on: ubuntu-latest
+    name: Build Infix ${{ matrix.platform }}
+    runs-on: [ self-hosted, latest ]
    strategy:
      matrix:
        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - name: Maintenance
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Build Variables
        id: vars
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}
-          fi
+          target=${{ matrix.platform }}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          if [ "$target" = x86_64 ]; then
-              echo "out=$PWD/output"      >> $GITHUB_OUTPUT
-          else
-              echo "out=/mnt/x-$target"   >> $GITHUB_OUTPUT
-          fi
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.variant }}-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -53,39 +42,35 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
+
      - name: Configure & Build
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
+          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
-          sudo mkdir ${{ steps.vars.outputs.out }}
-          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
-          export O=${{ steps.vars.outputs.out }}
          make $target
          make
+
      - name: Prepare Artifact
        run: |
-          cd ${{ steps.vars.outputs.out }}
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
      - name: Test
-        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
+        if: matrix.platform == 'x86_64'
        run: |
-          export O=${{ steps.vars.outputs.out }}
-          make test-qeneth
+          make test
      - uses: actions/upload-artifact@v4
        with:
-          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
+          path: output/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.platform }}
+
  release:
    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
    needs: build
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, latest ]
    permissions:
      contents: write
    steps:
@@ -93,6 +78,7 @@ jobs:
        with:
          pattern: "artifact-*"
          merge-multiple: true
+
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -103,6 +89,7 @@ jobs:
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "*.tar.gz"
+
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -24,6 +24,7 @@ jobs:
               --post-data "token=$TOKEN&project=${PROJECT_NAME}&md5=1" \
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+
      - uses: actions/cache@v4
        id: cache
        with:
@@ -33,6 +34,7 @@ jobs:
            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
            ${{ runner.os }}-coverity-
            ${{ runner.os }}-coverity
+
      - name: Download Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -47,12 +49,14 @@ jobs:
          fi
          mkdir coverity
          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
+
      - name: Install dependencies
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libaugeas-dev libglib2.0-dev libpcre2-dev      \
                       libuev-dev libite-dev
+
      - name: Build dependencies
        run: |
          git clone https://github.com/CESNET/libyang.git
@@ -62,10 +66,12 @@ jobs:
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
          make dep
+
      - name: Check applications
        run: |
          export PATH=`pwd`/coverity/bin:$PATH
          cov-build --dir cov-int make check
+
      - name: Submit results to Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -78,6 +84,7 @@ jobs:
            --form version=$(git rev-parse HEAD) \
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${PROJECT_NAME}
+
      - name: Upload build.log
        uses: actions/upload-artifact@v4
        with:
@@ -16,18 +16,24 @@ concurrency:
 jobs:
  build:
    name: Regression Testing
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, regression ]
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: 'true'
+
+      - name: Clean up cruft ...
+        run: |
+          ./test/env -c
+
      - name: Set Build Variables
        id: vars
        run: |
          target=x86_64
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -36,6 +42,7 @@ jobs:
          restore-keys: |
            dl-netconf-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -44,19 +51,22 @@ jobs:
          restore-keys: |
            ccache-x86_64-
            ccache-
+
      - name: Configure NETCONF
        run: |
          make x86_64_defconfig

      - name: Unit Test
-        run: make test-unit
+        run: |
+          make test-unit

      - name: Build
        run: |
          make
+
      - name: Prepare Artifact
        run: |
-          cd output
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
@@ -66,7 +76,8 @@ jobs:
          path: output/${{ steps.vars.outputs.tgz }}

      - name: Regression Test
-        run: make test-qeneth
+        run: |
+          make test

      - name: Publish Test Result
        # Ensure this runs even if Regression Test fails
@@ -20,20 +20,17 @@ on:
 jobs:
  build:
    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}-${{ matrix.variant }}]
-    runs-on: ubuntu-latest
+    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}]
+    runs-on: [ self-hosted, release ]
    strategy:
      matrix:
        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - name: Maintenance
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Release Variables
        id: vars
        run: |
@@ -44,22 +41,18 @@ jobs:
          fi
          echo "ver=${ver}" >> $GITHUB_OUTPUT
          fver=${ver#v}
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}-${fver}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}-${fver}
-          fi
+          target=${{ matrix.platform }}-${fver}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "out=/mnt/x-$target"       >> $GITHUB_OUTPUT
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.variant }}-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -68,78 +61,93 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
+
      - name: Configure & Build
        env:
          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
+          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
-          sudo mkdir ${{ steps.vars.outputs.out }}
-          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
-          export O=${{ steps.vars.outputs.out }}
          make $target
          make
-      - name: Prepare Artifact
+
+      - name: Generate SBOM from Build
        run: |
-          cd ${{ steps.vars.outputs.out }}
+          make legal-info
+
+      - name: Prepare Artifacts
+        run: |
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
+          mv legal-info legal-info-$target
+          tar chfz legal-info-$target.tar.gz legal-info-$target
+
      - uses: actions/upload-artifact@v4
        with:
-          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
+          name: artifact-${{ matrix.platform }}
+          path: output/*.tar.gz
+
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, release ]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Release Variables
+        id: rel
        run: |
          if [ -n "${{ inputs.version }}" ]; then
              ver=${{ inputs.version }}
          else
              ver=${GITHUB_REF#refs/tags/}
          fi
-          echo "ver=${ver}" >> $GITHUB_OUTPUT
+          echo "ver=${ver}"     >> $GITHUB_OUTPUT
          if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
-            echo "pre=true"  >> $GITHUB_OUTPUT
-          else
-            echo "pre=false" >> $GITHUB_OUTPUT
-          fi
-          if echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "pre=true"     >> $GITHUB_OUTPUT
+            echo "latest=false" >> $GITHUB_OUTPUT
+          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
+            echo "pre=false"    >> $GITHUB_OUTPUT
            echo "latest=true"  >> $GITHUB_OUTPUT
          else
+            echo "pre=false"    >> $GITHUB_OUTPUT
            echo "latest=false" >> $GITHUB_OUTPUT
          fi
+          echo "pre=${{ steps.rel.outputs.pre }}"
+          echo "latest=${{ steps.rel.outputs.latest }}"
+
      - uses: actions/download-artifact@v4
        with:
          pattern: "artifact-*"
          merge-multiple: true
+
      - name: Create checksums ...
        run: |
          for file in *.tar.gz; do
              sha256sum $file > $file.sha256
          done
+
      - name: Extract ChangeLog entry ...
        run: |
          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
              |head -n -1 > release.md
          cat release.md
+
      - uses: ncipollo/release-action@v1
        with:
          name: Infix ${{ github.ref_name }}
-          prerelease: ${{ steps.release.outputs.pre }}
-          makeLatest: ${{ steps.release.outputs.latest }}
+          prerelease: ${{ steps.rel.outputs.pre }}
+          makeLatest: ${{ steps.rel.outputs.latest }}
          bodyFile:  release.md
          artifacts: "*.tar.gz*"
+
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -112,25 +112,6 @@ config INFIX_ARCH
 	default "riscv64" if BR2_riscv
 	default "x86_64"  if BR2_x86_64

-# For /etc/os-release, VARIANT & VARIANT_ID used, e.g., in mnt script
-choice
-	prompt "Select variant/flavor"
-	default INFIX_VARIANT_NETCONF
-
-config INFIX_VARIANT_NETCONF
-	bool "NETCONF"
-	help
-	  Managed NETCONF mode, /etc is a ramdisk, all configuration is
-	  generated by sysrepo plugins using NETCONF (xml) or RESTCONF.
-
-config INFIX_VARIANT_CLASSIC
-	bool "Classic /etc mode"
-	help
-	  User managed mode, read-write configuration files in /etc that
-	  is saved across reboots.
-
-endchoice
-
 menu "Packages"

 source "$BR2_EXTERNAL_INFIX_PATH/package/Config.in"
@@ -25,6 +25,9 @@ $(config):
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

+legal-info: | buildroot/Makefile
+	$(call bmake,legal-info LINUX_LICENSE_FILES=COPYING)
+
 # Workaround, see board/x86_64/board.mk
 test:
 	@+$(call bmake,$@)
@@ -1,29 +1,16 @@
-[![License Badge][]][License] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
-<details><summary><b>Documentation</b></summary>
-
- - **Infix In-Depth**
-   - [Infix Variants](doc/variant.md)
-   - [Boot Procedure](doc/boot.md)
-   - [Containers in Infix](doc/container.md)
-   - [Developer's Guide](doc/developers-guide.md)
-   - [Discover Your Device](doc/discovery.md)
-   - [Virtual Environments](doc/virtual.md)
-   - [Origin & Licensing](doc/license.md)
- **CLI Topics**
-   - [Introduction to the CLI](doc/cli/introduction.md)
-   - [CLI User's Guide](doc/cli/tutorial.md)
-   - [Quick Overview](doc/cli/quick.md)
-
-</details>

 Infix is a free, Linux based, immutable Network Operating System (NOS)
 built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
 porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF[^1] or the built-in [command
-line interface (CLI)][3] from a console or SSH login.  *Click the
-foldout (▶ Example CLI Session) below for an example.*
+provide made-easy management using NETCONF[^1] or the built-in command
+line interface (CLI) from a console or SSH login.
+
+> Click the **▶ Example CLI Session** foldout below for an example, or
+> head on over to the [Infix Documentation](doc/README.md) for more
+> information on how to set up the system.

 Although primarily focused on switches and routers, the core values
 may be appealing for other use-cases as well:
@@ -118,8 +105,7 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.

-[^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>,
-    for more information, see [Infix Variants](doc/variant.md).
+[^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>

 [^2]: An immutable operating system is one with read-only file systems,
    atomic updates, rollbacks, declarative configuration, and workload
@@ -132,6 +118,8 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 [3]: doc/cli/introduction.md
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
+[GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
+[GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393
 [Coverity Status]: https://scan.coverity.com/projects/29393/badge.svg
 [discord-badge]:   https://img.shields.io/discord/1182652155618918411.svg?logo=discord
@@ -354,6 +354,7 @@
 #define XSWP(_n, _label, _mac_offs, _phy) \
 			port@_n { \
 				SWP_COMMON(_n, _label, _mac_offs, "usxgmii", _phy); \
+				managed = "in-band-status"; \
 			}

 #define GSWP(_n, _label, _mac_offs, _phy) \
@@ -6,3 +6,7 @@
 		compatible = "marvell,cp115-standalone-pinctrl";
 	};
 };
+
+&cp0_xmdio {
+	clock-names = "gop_clk", "mg_clk", "mg_core_clk", "axi_clk";
+};
@@ -0,0 +1,76 @@
+#ifndef _STYX_MPP_H
+#define _STYX_MPP_H
+
+#define SFP0_TX_DISABLE(X) X( "mpp0", cp0_gpio1,  0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP1_TX_DISABLE(X) X( "mpp1", cp0_gpio1,  1, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP2_TX_DISABLE(X) X( "mpp2", cp0_gpio1,  2, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP3_TX_DISABLE(X) X( "mpp3", cp0_gpio1,  3, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP0_RS0(X)        X( "mpp4", cp0_gpio1,  4, GPIO_ACTIVE_HIGH)
+#define SFP1_RS0(X)        X( "mpp5", cp0_gpio1,  5, GPIO_ACTIVE_HIGH)
+#define SFP2_RS0(X)        X( "mpp6", cp0_gpio1,  6, GPIO_ACTIVE_HIGH)
+#define SFP3_RS0(X)        X( "mpp7", cp0_gpio1,  7, GPIO_ACTIVE_HIGH)
+#define SFP0_RS1(X)        X( "mpp8", cp0_gpio1,  8, GPIO_ACTIVE_HIGH)
+#define SFP1_RS1(X)        X( "mpp9", cp0_gpio1,  9, GPIO_ACTIVE_HIGH)
+#define SFP2_RS1(X)        X("mpp10", cp0_gpio1, 10, GPIO_ACTIVE_HIGH)
+#define SFP3_RS1(X)        X("mpp11", cp0_gpio1, 11, GPIO_ACTIVE_HIGH)
+/* mpp12: Unused */
+#define CP_SPI1_MISO(X)    X("mpp13", none, 0, 0)
+#define CP_SPI1_CS0(X)     X("mpp14", none, 0, 0)
+#define CP_SPI1_MOSI(X)    X("mpp15", none, 0, 0)
+#define CP_SPI1_SCK(X)     X("mpp16", none, 0, 0)
+/* mpp17: Unused */
+/* mpp18: Unused */
+/* mpp19: Unused */
+/* mpp20: Unused */
+/* mpp21: Unused */
+/* mpp22: Unused */
+/* mpp23: Unused */
+/* mpp24: Unused */
+/* mpp25: Unused */
+/* mpp26: Unused */
+#define SFP0_RX_LOS(X)     X("mpp27", cp0_gpio1, 27, GPIO_ACTIVE_HIGH)
+#define SFP1_RX_LOS(X)     X("mpp28", cp0_gpio1, 28, GPIO_ACTIVE_HIGH)
+#define SFP2_RX_LOS(X)     X("mpp29", cp0_gpio1, 29, GPIO_ACTIVE_HIGH)
+#define SFP3_RX_LOS(X)     X("mpp30", cp0_gpio1, 30, GPIO_ACTIVE_HIGH)
+#define SFP0_TX_FAULT(X)   X("mpp31", cp0_gpio1, 31, GPIO_ACTIVE_HIGH)
+#define SFP1_TX_FAULT(X)   X("mpp32", cp0_gpio2,  0, GPIO_ACTIVE_HIGH)
+#define SFP2_TX_FAULT(X)   X("mpp33", cp0_gpio2,  1, GPIO_ACTIVE_HIGH)
+#define SFP3_TX_FAULT(X)   X("mpp34", cp0_gpio2,  2, GPIO_ACTIVE_HIGH)
+#define CP_I2C1_SDA(X)     X("mpp35", none, 0, 0)
+#define CP_I2C1_SCK(X)     X("mpp36", none, 0, 0)
+#define CP_I2C0_SCK(X)     X("mpp37", none, 0, 0)
+#define CP_I2C0_SDA(X)     X("mpp38", none, 0, 0)
+/* mpp39: Unused */
+#define CP_SMI_MDIO(X)     X("mpp40",   none, 0, 0)
+#define CP_SMI_MDC(X)      X("mpp41",   none, 0, 0)
+/* mpp42: Unused */
+/* mpp43: Unused */
+/* mpp44: Unused */
+/* mpp45: Unused */
+/* mpp46: Unused */
+#define CP_UA1_TXD(X)      X("mpp47", none, 0, 0)
+/* mpp48: Unused */
+#define SW1_RESETn(X)      X("mpp49", cp0_gpio2, 17, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW2_RESETn(X)      X("mpp50", cp0_gpio2, 18, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW3_RESETn(X)      X("mpp51", cp0_gpio2, 19, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+/* mpp52: Unused */
+#define CP_UA1_RXD(X)      X("mpp53", none, 0, 0)
+#define SFP0_MOD_ABS(X)    X("mpp54", cp0_gpio2, 22, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP1_MOD_ABS(X)    X("mpp55", cp0_gpio2, 23, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP2_MOD_ABS(X)    X("mpp56", cp0_gpio2, 24, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP3_MOD_ABS(X)    X("mpp57", cp0_gpio2, 25, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW1_INTn(X)        X("mpp58", cp0_gpio2, 26, IRQ_TYPE_LEVEL_LOW)
+#define SW2_INTn(X)        X("mpp59", cp0_gpio2, 27, IRQ_TYPE_LEVEL_LOW)
+#define SW3_INTn(X)        X("mpp60", cp0_gpio2, 28, IRQ_TYPE_LEVEL_LOW)
+/* mpp61: Unused */
+#define DDR_TEN(X)         X("mpp62", cp0_gpio2, 30, GPIO_ACTIVE_HIGH)
+
+/* Macros to extract MPP info in different formats */
+#define MPP_ID(_mpp, _chip, _no, _flags) _mpp
+#define MPP_GPIO_CHIP(_mpp, _chip, _no, _flags) _chip
+
+#define MPP_GPIO_REF(_mpp, _chip, _no, _flags) <&_chip _no (_flags)>
+#define MPP_GPIO_REF_NO_CHIP(_mpp, _chip, _no, _flags) <_no (_flags)>
+#define MPP_IRQ_REF(_mpp, _chip, _no, _flags) <&_chip _no (_flags)>
+
+#endif	/* _STYX_MPP_H */
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2023 Addiva Elektronik AB
+ *
+ * Device tree for Styx board
+ */
+
+#include "styx.dtsi"
@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2023 Addiva Elektronik AB
+ *
+ * Device tree for Styx board
+ */
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "../marvell/cn9130-patched.dtsi"
+
+#include "styx-mpp.h"
+
+/ {
+	model = "Styx";
+	compatible = "styx,styx",
+		"marvell,armada-ap807-quad",
+		"marvell,armada-ap807";
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+
+		infix {
+			/* "admin" */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			vpds = <&vpd>;
+		};
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x0 0x0 0x80000000>;
+	};
+};
+
+
+/* UART0 (Console) */
+
+&uart0 {
+	status = "okay";
+};
+
+
+/* UART1 (Auxiliary) */
+
+&cp0_pinctrl {
+	cp0_uart1_pins: cp0-uart1-pins {
+		marvell,pins = CP_UA1_RXD(MPP_ID), CP_UA1_TXD(MPP_ID);
+		marvell,function = "uart1";
+	};
+};
+
+&cp0_uart1 {
+	/* TODO: Figure out how to enable this without affecting
+         * /chosen/stdout-path
+	 */
+	status = "disabled";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart1_pins>;
+};
+
+
+/* GPIO */
+
+&cp0_gpio1 {
+	status = "okay";
+};
+
+&cp0_gpio2 {
+	status = "okay";
+};
+
+
+/* I2C0 (EEPROM) */
+
+&cp0_pinctrl {
+	cp0_i2c0_pins: cp0-i2c0-pins {
+		marvell,pins = CP_I2C0_SCK(MPP_ID), CP_I2C0_SDA(MPP_ID);
+		marvell,function = "i2c0";
+	};
+};
+
+&cp0_i2c0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_i2c0_pins>;
+
+	vpd: eeprom@50 {
+		compatible = "atmel,24c256";
+                reg = <0x50>;
+
+		infix,board = "cpu";
+		infix,trusted;
+
+		nvmem-layout {
+			compatible = "onie,tlv-layout";
+
+			base_mac: mac-address {
+				#nvmem-cell-cells = <1>;
+			};
+		};
+	};
+
+	spd: eeprom@53 {
+		compatible = "spd";
+                reg = <0x53>;
+	};
+
+	eeprom@57 {
+		compatible = "atmel,24c256";
+                reg = <0x57>;
+	};
+};
+
+
+/* I2C1 (Mux) */
+
+&cp0_pinctrl {
+	cp0_i2c1_pins: cp0-i2c1-pins {
+		marvell,pins = CP_I2C1_SCK(MPP_ID), CP_I2C1_SDA(MPP_ID);
+		marvell,function = "i2c1";
+	};
+};
+
+&cp0_i2c1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_i2c1_pins>;
+
+	i2cmux@77 {
+		compatible = "nxp,pca9548";
+		#address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x77>;
+
+		i2c_sfp0: i2c@0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0>;
+		};
+
+		i2c_sfp1: i2c@1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <1>;
+		};
+
+		i2c_sfp2: i2c@2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <2>;
+		};
+
+		i2c_sfp3: i2c@3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <3>;
+		};
+	};
+};
+
+
+/* SPI1 (Boot FLASH) */
+
+&cp0_pinctrl {
+	cp0_spi1_pins: cp0-spi-pins-0 {
+		marvell,pins = \
+			CP_SPI1_MISO(MPP_ID), CP_SPI1_CS0(MPP_ID), \
+			CP_SPI1_MOSI(MPP_ID), CP_SPI1_SCK(MPP_ID);
+		marvell,function = "spi1";
+	};
+};
+
+&cp0_spi1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_spi1_pins>;
+
+	/* Boot flash */
+	spi-flash@0 {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		compatible = "jedec,spi-nor", "spi-flash";
+		reg = <0x0>;
+		spi-max-frequency = <90000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			boot0@0 {
+				label = "boot0";
+				reg = <0x0 0x200000>;
+			};
+
+			boot1@200000 {
+				label = "boot1";
+				reg = <0x200000 0x200000>;
+			};
+		};
+	};
+};
+
+
+/* AP SDHCI (eMMC) */
+
+&ap_sdhci0 {
+	status = "okay";
+	bus-width = <8>;
+	mmc-ddr-1_8v;
+	mmc-hs400-1_8v;
+};
+
+
+&cp0_crypto {
+	status = "okay";
+};
+
+&cp0_ethernet {
+	status = "okay";
+};
+
+
+/* ETH1 (Connection to BMC) */
+
+&cp0_eth2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	phys = <&cp0_comphy5 2>;
+	managed = "in-band-status";
+
+	nvmem-cells = <&base_mac 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+
+/* ETH0 (DSA connection to switch tree) */
+
+&cp0_eth0 {
+	status = "okay";
+	phy-mode = "10gbase-r";
+	phys = <&cp0_comphy2 0>;
+	managed = "in-band-status";
+
+	nvmem-cells = <&base_mac 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+
+/* MDIO (Switch Tree) */
+
+&cp0_pinctrl {
+	cp0_mdio_pins: cp0-mdio-pins-0 {
+		marvell,pins = CP_SMI_MDIO(MPP_ID), CP_SMI_MDC(MPP_ID);
+		marvell,function = "ge";
+	};
+};
+
+#define SWP_LED(_func) \
+	leds { \
+		#address-cells = <1>; \
+		#size-cells = <0>; \
+		\
+		led@0 { \
+			reg = <0>; \
+			function = _func; \
+			color = <LED_COLOR_ID_GREEN>; \
+			default-state = "keep"; \
+		}; \
+		led@1 { \
+			reg = <1>; \
+			function = _func; \
+			color = <LED_COLOR_ID_YELLOW>; \
+			default-state = "off"; \
+		}; \
+	}
+
+#define XSWP(_n, _label, _mac_offs, _sfp) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		label = _label; \
+		nvmem-cells = <&base_mac _mac_offs>; \
+		nvmem-cell-names = "mac-address"; \
+		phy-mode = "10gbase-r"; \
+		managed = "in-band-status"; \
+		sfp = <&_sfp>; \
+		SWP_LED("sfp"); \
+	}
+
+#define GSWP(_n, _label, _mac_offs, _phy) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		label = _label; \
+		nvmem-cells = <&base_mac _mac_offs>; \
+		nvmem-cell-names = "mac-address"; \
+		phy-mode = "gmii"; \
+		phy-handle = <&_phy>; \
+		SWP_LED("tp"); \
+	}
+
+#define GPHY(_n) \
+	ethernet-phy@_n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		reg = <_n>; \
+		eee-broken-100tx; \
+		eee-broken-1000t; \
+	}
+
+&cp0_mdio {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_mdio_pins>;
+
+	sw3: switch@6 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <6>;
+
+		reset-gpios = SW3_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW3_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@9 {
+				reg = <0x9>;
+				label = "cpu";
+				ethernet = <&cp0_eth0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			sw3p10: port@a {
+				reg = <0xa>;
+				link = <&sw2p10 &sw1p0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			/* Can't use XSWP macro as port 0 does not have
+			 * any LEDs attached to it. LEDs for port 10 seem
+			 * to be wired to the corresponding SFP cage. Maybe
+			 * we can apply a static workaround by binding port
+			 * 10's green LED to "Special LED 1", so we can at
+			 * least see link/act.
+			 */
+			port@0 {
+				reg = <0>;
+				label = "e16";
+				nvmem-cells = <&base_mac 16>;
+				nvmem-cell-names = "mac-address";
+				phy-mode = "10gbase-r";
+				managed = "in-band-status";
+				sfp = <&sfp3>;
+			};
+
+			GSWP(1,  "e22", 22, sw3phy1);
+			GSWP(2,  "e21", 21, sw3phy2);
+			GSWP(3,  "e24", 24, sw3phy3);
+			GSWP(4,  "e23", 23, sw3phy4);
+			GSWP(5,  "e26", 26, sw3phy5);
+			GSWP(6,  "e25", 25, sw3phy6);
+			GSWP(7,  "e28", 28, sw3phy7);
+			GSWP(8,  "e27", 27, sw3phy8);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw3phy1: GPHY(1);
+			sw3phy2: GPHY(2);
+			sw3phy3: GPHY(3);
+			sw3phy4: GPHY(4);
+			sw3phy5: GPHY(5);
+			sw3phy6: GPHY(6);
+			sw3phy7: GPHY(7);
+			sw3phy8: GPHY(8);
+		};
+	};
+
+	sw2: switch@4 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <4>;
+
+		reset-gpios = SW2_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW2_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 1>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw2p0: port@0 {
+				reg = <0x0>;
+				link = <&sw1p0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			sw2p10: port@a {
+				reg = <0xa>;
+				link = <&sw3p10>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+
+			GSWP(1, "e10", 10, sw2phy1);
+			GSWP(2,  "e9",  9, sw2phy2);
+			GSWP(3, "e12", 12, sw2phy3);
+			GSWP(4, "e11", 11, sw2phy4);
+			GSWP(5, "e18", 18, sw2phy5);
+			GSWP(6, "e17", 17, sw2phy6);
+			GSWP(7, "e20", 20, sw2phy7);
+			GSWP(8, "e19", 19, sw2phy8);
+			XSWP(9, "e15", 15, sfp2);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw2phy1: GPHY(1);
+			sw2phy2: GPHY(2);
+			sw2phy3: GPHY(3);
+			sw2phy4: GPHY(4);
+			sw2phy5: GPHY(5);
+			sw2phy6: GPHY(6);
+			sw2phy7: GPHY(7);
+			sw2phy8: GPHY(8);
+		};
+	};
+
+	sw1: switch@2 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <2>;
+
+		reset-gpios = SW1_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW1_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 2>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw1p0: port@0 {
+				reg = <0x0>;
+				link = <&sw2p0 &sw3p10>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			GSWP(1,  "e2",  2, sw1phy1);
+			GSWP(2,  "e1",  1, sw1phy2);
+			GSWP(3,  "e4",  4, sw1phy3);
+			GSWP(4,  "e3",  3, sw1phy4);
+			GSWP(5,  "e6",  6, sw1phy5);
+			GSWP(6,  "e5",  5, sw1phy6);
+			GSWP(7,  "e8",  8, sw1phy7);
+			GSWP(8,  "e7",  7, sw1phy8);
+			XSWP(9, "e14", 14, sfp1);
+			XSWP(a, "e13", 13, sfp0);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw1phy1: GPHY(1);
+			sw1phy2: GPHY(2);
+			sw1phy3: GPHY(3);
+			sw1phy4: GPHY(4);
+			sw1phy5: GPHY(5);
+			sw1phy6: GPHY(6);
+			sw1phy7: GPHY(7);
+			sw1phy8: GPHY(8);
+		};
+	};
+};
+
+/ {
+	sfp0: sfp@0 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp0>;
+		mod-def0-gpios = SFP0_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP0_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP0_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP0_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP0_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP0_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp1: sfp@1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp1>;
+		mod-def0-gpios = SFP1_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP1_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP1_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP1_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP1_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP1_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp2: sfp@2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp2>;
+		mod-def0-gpios = SFP2_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP2_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP2_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP2_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP2_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP2_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp3: sfp@3 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp3>;
+		mod-def0-gpios = SFP3_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP3_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP3_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP3_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP3_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP3_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+};
+
@@ -178,6 +178,7 @@ CONFIG_NET_SCHED=y
 CONFIG_NET_CLS_BASIC=y
 CONFIG_NET_CLS_BPF=y
 CONFIG_NET_CLS_FLOWER=y
+CONFIG_DCB=y
 CONFIG_NETLINK_DIAG=y
 CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=y
@@ -1,13 +0,0 @@
-#!/bin/sh
-. "$BR2_CONFIG"
-
-# Prevent regen of host key at every boot, /etc is saved across reboots
-if [ -L "$TARGET_DIR/etc/dropbear" ]; then
-	rm    "$TARGET_DIR/etc/dropbear"
-	mkdir "$TARGET_DIR/etc/dropbear"
-fi
-
-# Classic builds don't have D-Bus
-if [ -f "$TARGET_DIR/etc/dnsmasq.conf" ]; then
-    sed -i '/enable-dbus/d' "$TARGET_DIR/etc/dnsmasq.conf"
-fi
@@ -1,684 +0,0 @@
-#!/bin/sh
-# COLUMS and ROWS should be set on the console, if not, use fallback
-if [ -z "$COLUMNS" ]; then
-	if command -v tput; then
-		COLUMNS=$(tput cols)
-	else
-		COLUMNS=80
-	fi
-fi
-
-h1()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR" | tr '[:lower:]' '[:upper:]'
-		echo "$STR" | sed 's/./=/g'
-	else
-		printf "\033[7m%-${COLUMNS}s\033[0m" "$STR"
-	fi
-}
-
-h2()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR"
-		echo "$STR" | sed 's/./-/g'
-	else
-		printf "\033[1m%-${COLUMNS}s\033[0m" "$STR"
-	fi
-}
-
-ul()
-{
-	if [ -n "$plain" ]; then
-		echo "__${*}__"
-	else
-		printf "\033[54%s\033[0m" "$*"
-	fi
-}
-
-em()
-{
-	if [ -n "$plain" ]; then
-		echo "**${*}**"
-	else
-		printf "\033[5m%s\033[0m" "$*"
-	fi
-}
-
-overview()
-{
-	cat <<EOF
-$(h1 "Help System            Press 'Q' to quit | Arrow keys and PgUp/PgDn to scroll")
-
-$(h2 "See Also")
-  help edit            Tutorial on VI and Mg editors
-  help net             Network set up introduction
-  setup                User friendly setup and diagnostic tool
-
-$(h2 "General Syntax")
-  cmd [optional arg]   E.g., use 'date -h' to get help for date command
-
-$(h2 "File system")
-  pwd | ls | cd        Show directory, contents, or change directory
-  cat file             Show file contents
-  vi  | mg [file]      Edit file with the VI or Micro Emacs editor
-
-$(h2 "Services")
-  initctl list         Lists all configurable services (svc's)
-  initctl enable svc   Enable a service 'svc'
-  initctl reload       Reload init process' state, start/stop svc's
-  initctl start svc    Start a stopped service 'svc'
-  initctl stop svc     Stop 'svc'
-  initctl restart svc  Restart a running 'svc'
-  initctl status [svc] Display running status of all services, or one 'svc'
-
-$(h2 "Tools")
-  setup                User friendly setup and diagnostic tool
-  date    [-h]         Display current time, or sets the system date
-  factory              Factory reset the device (on the next boot)
-  hwclock [-h]         Query or set the hardware clock (RTC)
-  logout | Ctrl-D      Log out from TTY
-  mdio | mvls          Low-level MDIO access, also for Marvell switch status
-  tail -F file         Continuously read from a file Useful for monitoring the
-                       health of services, see 'ls /var/log/' for log files
-  less [file]          Pagers provding easily scrollable content (q quits) >
-  more [file]            > e.g., 'cat very-long-file | less'
-  most [file]            > e.g., 'cat very-long-file | most'
-  passwd               Change user password
-  pwgen                Password generator
-  reboot               Restart the device
-  reset                Reset the shell prompt if it gets garbled
-
-$(h2 "Network Tools")
-  ethtool    [-h]      Ethernet stats, and low-level MAC/PHY settings
-  traceroute [-h]      Trace the route ip packets follow going to a host
-  tcpdump    [-h]      Display network packet headers in real-time
-  arping     [-h]      Ping hosts by ARP requests/replies
-  fping      [-h]      Send ICMP ECHO_REQUEST packets to multiple hosts
-  ping       [-h]      Send ICMP ECHO_REQUEST packets to a network host
-  lynx URL   [-h]      The text mode web browser
-  netcalc    [-h]      Calculate IP network settings from a IP address
-  netcat     [-h]      NetCat - TCP/IP swiss army knife (alias: nc)
-  socat      [-h]      Multipurpose socket relay program
-  ttyd       [-h]      Sharing a terminal over the web
-
-  ifconfig   [--help]  See/Reconfigure available network interfaces
-  route      [--help]  Edit the kernel's routing tables
-
-  ifup | ifdown IFACE  Bring up/down interfaces in /etc/network/interfaces
-
-  ip [link|addr]       Manage available network interfaces
-  ip [rule|route]      Manage routing tables
-  bridge [link|vlan]   Manage bridge ports and VLANs
-
-  scp                  Securely copy a file to a remote host file system
-  tftp                 Copy a file to/from a remote host
-  ftpput               Store a local file on a remote machine via FTP
-  ftpget               Retrieve a remote file via FTP
-  wget                 Get a file using HTTP or FTP from a remote host
-
-$(h2 "Overview Commands")
-  df -h                List disk usage (in human readable format)
-  free                 List memory usage
-  ps                   List running processes
-  show [arg]           Show system status, see 'show help' for more info
-  top                  Displays CPU usage and top list of running tasks
-
-$(h2 "Interesting Files")
-  /etc/default/svc     Command line args for service 'svc' (see above)
-  /etc/rc.local        Local setup, runs after all services have started
-  /etc/network/        Directory of networking setup, see 'help net'
-
-$(h2 "Example Commands")
-  cd   /tmp; wget ftp://192.168.55.43/file && cat file
-  cd   /var/log; tftp -p -l messages 192.168.55.43
-  cat  /proc/net/arp
-  edit /etc/network/interfaces
-
-$(h2 "See Also")
-  help edit            Tutorial on VI and Mg editors
-  help net             Network set up introduction
-  setup                User friendly setup and diagnostic tool
-EOF
-}
-
-vi()
-{
-	cat <<EOF
-$(h1 "Visual Editor (vi)")
-Vi is the de facto standard editor in UNIX systems.  It comes with two modes:
-
-  - $(em "Command mode (default):") administrative tasks such as saving files,
-    executing commands, moving the cursor, cutting and pasting lines or words,
-    as well as finding and replacing.  $(em "Return to command mode with Esc")
-
-  - $(em "Insert mode:") Everything that's typed in this mode is interpreted as
-    input and placed in the file.
-
-$(h2 "Navigation commands")
-
-  h - move the cursor one character to the left
-  j - move the cursor down one character
-  k - mode the cursor up one character
-  l - move the cursor right one character
-  b - move to beginning of word, or previous word
-  w - move to next word
-  0 - move to beginning of line
-  $ - move to end of line
- :0 - move to beginning of file
-  G - move to end of file
-
-$(h2 "Editing commands")
-
-  u - undo last operation
-  x - delete the character the cursor is on
- cw - change word, from position of cursor
- dw - delete to end of word
- dd - delete the line the character is on
-  p - paste (line, word, or char) after cursor
-  P - paste (line, word, or char) before cursor
-
-$(h2 "Saving and quit commands")
-
-  :w            - save the current file
-  :w filename   - save a copy of the file named filename
-  :w!           - try to save the file, even if it is read only
-  :wq           - save and quit vi
-  ZZ            - save and quit vi
-  :wq!          - try to save the file if it is read only, quit if successful
-  :wq filename  - save a copy of the file named filename and quit
-  :wq! filename - save a copy of the file named filename and quit,
-                  override read only permissions if possible
-  :q            - quit vi
-  :q!           - quit vi even if the file has unsaved changes
-
-$(h2 "Enter insert mode")
-
-  a - append new text after the cursor
-  i - insert text before the cursor
-  o - open a new line below the cursor
-  O - open a new line above the cursor
-
-> Return to command mode with Esc
-
-EOF
-}
-
-emacs()
-{
-	cat <<EOF
-$(h1 "Micro Emacs (mg)")
-Mg is a bit more user-friendly than vi.  It has the same familiar interface
-as Notepad, but with slightly different keybindings.
-
-$(h2 "Introduction")
-
-Most commands involve using the Control ("Ctrl") or the Meta ("Alt") key.
-The following conventions are used in the online help:
-
-  C-<chr>   means hold down the Control key while typing the character <chr>
-  M-<chr>   means hold down the Alt key while typing the character <chr>
-
-If you don't have a Meta/Alt key, you can use Esc instead.  Press and release
-the Esc key and then type <chr>. This is equivalent to M-<chr>.
-
-$(h2 "Navigation")
-
-Though arrow keys, Home/End, and PgUp/PgDn usually work, using Mg over serial
-console can sometimes cause these keys to be mismapped by terminal program.
-
-  C-f          Move forward one character (can also use right arrow key)
-  C-b          Move backward one character (can also use left arrow key)
-  C-p          Move up one line (can also use up arrow key)
-  C-n          Move down one line (can also use down arrow key)
-  M-f          Move forward one word
-  M-b          Move backward one word
-  C-a          Move to beginning of line (can also use Home key)
-  C-e          Move to end of line (can also use End key)
-  C-v          Move forward one page (can also use PgDn/Page Down key)
-  M-v          Move backward one page (can also use PgUp/Page Up key)
-  M-<          Move to beginning of file
-  M->          Move to end of file
-  C-x g        Move to line number
-
-$(h2 "Editing")
-
-All edit commands that kill (cut) text is placed in a kill ring (clipboard).
-Note: when marking text, there is no visual mark.
-
-  C-_          Undo, also C-x u
-  M-%          Replace word/string in file, from cursor position
-  M-q          Reformat paragraph (set fill column with C-x f)
-  C-s          Search forward (type C-s again to find next)
-  C-r          Reversed search
-  C-Space      Set beginning of mark (beginning of selected text)
-  C-x C-x      Jump back and forth between mark and cursor position
-  C-x h        Mark whole buffer
-  C-w          Wipe (cut) region from mark to cursor position
-  M-w          Copy region from mark to cursor position
-  C-y          Yank (paste) text from kill ring
-  C-k          Kill (cut) to end of line
-  M-Backspace  Kill (delete) previous word
-  M-d          Kill (delete) next word
-  C-d          Delete character to the right
-  C-o          Open new line at cursor
-
-$(h2 "General Commands")
-
-  C-g          Abort current command
-  C-l          Recenter buffer on current line
-  C-h b        List all keybindings
-  M-!          Run shell command, output in new buffer
-  C-z          Suspend Mg, return to shell, use 'fg' to get back
-  C-x C-f      Open file
-  C-x C-i      Insert file at cursor position
-  C-x C-s      Save file
-  C-x s        Save file (interactive)
-  C-x k        Kill (close) file
-  C-x C-b      List open buffers (files)
-  C-x b        Switch to another buffer
-  C-x C-c      Exit
-
-$(h2 "Window Commands")
-
-  C-x 0        Unsplit, keep other window
-  C-x 1        Unsplit, keep this window
-  C-x 2        Split window in two
-  C-x o        Go to other window
-  C-x p        Go to previous window
-  C-x n        Go to next window
-  C-x ^        Enlarge this split
-
-EOF
-}
-
-editor()
-{
-	case $1 in
-		vi)
-			vi
-			;;
-		ed* | em* | mg)
-			emacs
-			;;
-		*)
-			vi
-			emacs
-			cat <<EOF
-$(h1 "Summary")
-Use Mg or GNU Nano if you are a beginner.  The system is set up to so you can
-use the 'edit' command, which will start GNU Nano:
-
-    edit /etc/rc.local                   # Starts GNU Nano
-
-EOF
-			;;
-	esac
-}
-
-networking()
-{
-	cat <<EOF
-$(h1 "Networking")
-This section details how to set up everything from basic to advanced networking.
-Topics covered include:
-
- - Static vs Dynamic Addresses
- - VLAN Interfaces
- - Bridging Interfaces
- - Link Aggregation (bonding)
- - Persistent Configuration
-
-Please note, the terms 'port' and 'interface' may be used interchangably in
-the following text (and elsewher online as well).  Usually the term 'port' is
-reserved for Ethernet links attached to a switch or bridge, while the term
-'interface' more generically refers to the physical interface in a system.
-
-
-$(h2 "Static vs Dynamic Addresses")
-
-An IPv4 address consists of four "octets" separated by periods.  A static IPv4
-address can look like this:
-
-    192.168.1.42
-
-However, for networking to function properly, a device usually needs a netmask,
-default route, NTP server, and at least one DNS address.  Setting all these up
-statically is a lot of work to maintain, in particular with many devices.
-
-For both IPv4 and IPv6 there is an alternative called DHCP.  It is a dynamic
-protocol where a server on request from a client device hands out a "lease" of
-an IP address, as well as lot of other network parameters, including but not
-limited to the ones already mentioned.  A client device can give hints to the
-server, e.g., its hostname, MAC address (default), or other client identifier.
-It is up to the server to honor these hints or not, but it is very common to
-set up the server to honor the client's hostname and automatically update the
-central name server (DNS) when the client is online.
-
-        |  There are many other interesting aspects to DHCP not covered here.
-        |  For instance, DHCP relay servers (proxies), that can be used to
-        |  forward DHCP requests from very large networks to a central server.
-        |  Some relay "agents" even support something called Option 82, which
-        |  when running on a simple switch, can attach port and relay info to
-        |  the client's DHCP request -- allowing the server to assign an IP
-        |  address per port, even on remote switches (with a relay agent).
-
-When your interface is setup with DHCP, use the 'ifconfig' or 'ip addr' tools
-to see which address you got, if needed (see next section).
-
-In cases when the DHCP client cannot find a DHCP server, and thus not obtain a
-lesae, the system falls back to set a link-local address (169.254.*.*).  This
-can be disabled by editing the file /etc/dhcpcd.conf, adding:
-
-    noipv4ll
-
-A link-local address is however very useful, in particular in combination with
-mDNS to discover and access a device you do not know, or do not want to know,
-the IP address to.  See more in the next section.
-
-
-$(h2 "DNS and mDNS")
-
-Managing a central DNS is both painful and time consuming, most networks, and
-in particular industrial, therefore only set up a DNS for static servers and
-resources.  Leaving end devices, switches, and in many cases even routers,
-without a human-friendly name on the network.  This have misled many to think
-that they need to know the IP address, and often opt for static addresses on
-equipment.  Meaning many devices out-of-the-box have a static address set that
-need to be manually changed before the device is deployed on the network.
-
-A less time consuming, and human-friendly, way is to enable mDNS (multicast
-DNS).  With this protocol the device notifies all neighbors on the same LAN
-of how to reach it:
-
-    "Hello everyone, my address is 169.254.47.11, you can call me device.local"
-
-Any other device that also has mDNS enabled can then automaticall update a
-local database of name-to-address mappings.  Usually the name sent out is
-the device's hostname.  (It is up to the device manufacturer to set a useful
-default hostname, i.e., model-01-02-03, where the suffix is the last octets
-of the base MAC address, from the product label on the case.)
-
-As you can see, in combination with a link-local address (previous section)
-mDNS is a very attractive combination that greatly simplify device management.
-
-Tools:
-
-    avahi-browse -a
-    ping foo.local
-
-mDNS, or more correctly mDNS-SD, is also used for *Service Discovery*.  E.g.,
-a printer can publish IPP records with meta data on the printer type and model
-or donwload URL for drivers.  Switches and routers usually publish how they
-can be reached: HTTP/HTTPS and SSH.
-
-mDNS is supported in this product and should be enabled by default.  To
-verify that it works, in Windows, macOS, or Linux, open your web browser
-and point it to <https://hostname-01-02-03.local>.  This is the hostname
-and three last octets of the device's base MAC address.  You can also use
-mDNS browsers or command line tools like mdns-scan
-
-
-$(h2 "VLAN Interfaces")
-
-A VLAN interface in Linux is an "upper" interface, e.g., 'eth0.1'.  It is
-where you set an IP address and interact with th rest of the world.  The
-base/raw/lower interface, here 'eth0', is the physical interface on which
-Ethernet packets ingress and egress with a VLAN tag.  To create 'eth0.1':
-
-    ip link add eth0.1 link eth0 vlan id 1
-
-In Linux a VLAN interface is a "stackable" entity.  Many VLAN interfaces
-can be built on top of each other.  When injecting a packet on the top
-most interface, the kernel adds the corresponding VLAN "tag" when the
-packet goes down the order of stacked interfaces, and then finally hits
-the physical interface and proceeds to egress onto the media.
-
-    ip link add eth0.1.2 link eth0.1 vlan id 2
-
-Injecting a packet on 'eth0.1.2' creates a double-tagged VLAN frame when
-the packet egresses 'eth0'.  The outermost tag has VID 1 and the inner
-VID is 2.
-
-VLAN interfaces can be used for many things, here we will focus on their
-use as upper interface on a bridge.
-
-
-$(h2 "Bridging Interfaces")
-
-A bridge is the correct name for a switch.  In the context of this text,
-however, we will use the term to refer to the Linux bridge module in the
-kernel, which implements an advanced software switch.  The Linux bridge
-supports "offloading" many switching functions to an underlying switching
-chipset, when available.  This greatly simplifies managing that switch since
-the same tools one use to manage the bridge will, by extension, also be used
-to manage the switch.
-
-To create a bridge in Linux:
-
-    ip link add br0 type bridge
-
-To add three ports (interfaces) to the bridge we use:
-
-    ip link set eth0 master br0
-    ip link set eth1 master br0
-    ip link set eth2 master br0
-
-Bring all ports and the bridge 'up' and you have a working switch!  Any frame
-injected on eth0 (from the outside) can be switched to either of eth1, eth2,
-*or* br0.  As soon as the bridge has learned where end devices are connected,
-none of the other ports will see the traffic -- like a regular switch.
-
-Note: these ports should not (cannot) have any IP address.  Instead, any IP
-      address is set on 'br0'.  To disable IPv6 link-local address, set the
-      /proc/sys/net/ipv6/conf/eth0/disable_ipv6 sysctl file to '1'.
-
-
-$(h2 "Bridging and VLANs")
-
-A VLAN-aware bridge works the same way, only with VLAN separation taken into
-account.  All communication, as well as MAC address learning, is limited to
-ports in the same VLAN.  The syntax is slightly different and requires a few
-more steps:
-
-    ip link add br0 type bridge vlan_filtering 1
-    ip link set eth0 master br0
-    ip link set eth1 master br0
-    ip link set eth2 master br0
-    ip link set eth3 master br0
-
-To assign ports to different VLANs, and make sure they are regular "access"
-ports (untagged).  We assign eth0 and eth1 to VLAN 1 and the others to VLAN 2:
-
-    bridge vlan add vid 1 dev eth0 pvid untagged
-    bridge vlan add vid 1 dev eth1 pvid untagged
-    bridge vlan add vid 2 dev eth2 pvid untagged
-    bridge vlan add vid 2 dev eth3 pvid untagged
-
-Here's the twist, to be able to reach the bridge (switch) itself from each
-VLAN, we need to ensure the bridge itself is a tagged member of each VLAN:
-
-    bridge vlan add vid 1 dev br0 self
-    bridge vlan add vid 2 dev br0 self
-
-This way we can add VLAN interfaces on top of br0, which we in turn can set
-a static or dynamic IP address on:
-
-    ip link add vlan1 link br0 type vlan id 1
-    ip link add vlan2 link br0 type vlan id 2
-
-The resulting stack of interfaces look like this:
-
-                         :
-                vlan1    :     vlan2       Layer-3 :: IP Networking
-                    \\    :    /            _________________________
-                  .-------------.
-                  |     br0     |          Layer-2 :: Switching
-                  '-------------'          _________________________
-                  /   |  :  |   \\
-              eth0 eth1  :  eth2 eth3      Layer-1 :: Link layer
-                         :
-
-
-$(h2 "Persistent Configuration")
-
-A simple end device can get by with the following in /etc/network/interfaces:
-
-    auto lo
-    iface lo inet loopback
-
-    auto eth0
-    iface eth0 inet dhcp
-
-This brings up both the loopback (required for UNIX networking to function),
-and the (presumed only) Ethernet interface.  The loopback gets its standard
-address, 127.0.0.1, and eth0 will request its IP address using DHCP.
-
-To set up the bridge example (above), is actually quite a lot easier than
-using the command line ip and bridge tools.  Create the file 'bridge':
-
-    edit /etc/network/interfaces.d/bridge
-
-Paste in the following content:
-
-    iface e0
-        bridge-access 1
-    iface e1
-        bridge-access 1
-    iface e2
-        bridge-access 2
-    iface e3
-        bridge-access 2
-
-    auto br0
-    iface br0
-        bridge-ports e0 e1 e2 e3 
-        bridge-vlan-aware yes
-        bridge-stp on
-        bridge-vids 1 2
-
-    auto vlan1
-    iface vlan1 inet dhcp
-        vlan-id 1
-        vlan-raw-device br0
-
-    auto vlan2
-    iface vlan2 inet static
-        vlan-id 2
-        vlan-raw-device br0
-        address 192.168.2.1/24
-
-Notice how 'vlan1' only has a DHCP and 'vlan2' uses a static address.  It is
-possible to combine the two if needed.  Use 'inet dhcp' and add an 'address'
-statement to the iface stanza.
-
-
-$(h2 "Port Classification")
-
-The bundled 'show' script is a very handy tool.  It use several tricks to make
-information about the system more accessible.  On switching capable hardware
-products, switch ports are identified early at system bootstrap and placed in
-the 'port' group.  See 'ip link' output:
-
-    ...
-    4: e0: <BROADCAST,MULTICAST> master br0 state UP $(em "group port")
-           link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
-    ...
-
-When running in Qemu or other hardware it may be useful to manually classify
-certain interfaces as ports.  This can be achieved in many ways, here we show
-two.  First /etc/mactab, which is read at boot to rename interfaces according
-their matching MAC address, one interface per line:
-
-    e0    52:54:00:12:34:56
-    e1    52:54:00:12:34:57
-    e2    52:54:00:12:34:58
-    e3    52:54:00:12:34:59
-
-Another way is to add something like this to /etc/rc.local:
-
-    for port in eth0 eth1 eth3 eth4; do
-        ip link set \$port group port
-    done
-
-
-$(h2 "Interesting Files")
-
- - /etc/dhcpcd.conf             General DHCP and ZeroConf (LL) settings
- - /etc/network/interfaces      The original, useful for small setups
- - /etc/network/interfaces.d/*  Snippets, useful for non-trivial setups
- - /etc/mactab                  Rename interfaces: 'NAME16CHARS WHITESPACE MAC'
- - /etc/sysctl.conf             Interface and TCP/IP settings, e.g., routing
- - /etc/sysctl.d/*              Snippets, useful for per-subsystem settings
-
-
-$(h1 "Summary")
-All persistent networking is set up in /etc/network/interfaces using the
-program ifupdown-ng.  The tools to reconfigure networking at runtime are:
-
-   ifup   [-a] [IFACES]
-   ifdown [-a] [IFACES]
-
-When changing the configuration at runtime you usually have to bring the
-affected interfaces down (ifdown e0 e1 e2 e3), if they were set up with
-/etc/network/interfaces before.  Then do the change, and bring it all up
-again.
-
-Both tools understand dependencies between interfaces, so when a 'ifup -a'
-command is received it brings up all interfaces: adding links to br0 before
-adding VLANs, the vlan1 and vlan2 interfaces on top so it of it all.  Then
-finally it can start the DHCP client on vlan1 and set the static IP address
-on vlan2.
-
-       $(em ">>> Be careful with these tools when logged in remotely! <<<")
-
-EOF
-}
-
-topic()
-{
-	topic=$1
-	[ -n "$1" ] && shift
-
-	case $topic in
-	ed*)
-		# shellcheck disable=SC2068
-		editor $*
-		;;
-	net*)
-		networking
-		;;
-	*)
-		overview
-		;;
-	esac
-}
-
-if [ "$1" = "-p" ]; then
-	shift
-	pager="cat"
-	plain="yes"
-else
-	if command -v most; then
-		pager=most
-	elif command -v less; then
-		pager="less -R"
-	elif command -v more; then
-		pager="more"
-	else
-		pager="cat"
-	fi
-fi
-
-if [ -t 1 ] ; then
-	fn=$(mktemp /tmp/system-help.XXXXXX)
-	# shellcheck disable=SC2086,SC2068
-	topic $@ >"$fn"
-	$pager "$fn"
-	rm "$fn"
-else
-	topic "$*"
-fi
@@ -1,16 +0,0 @@
-#!/bin/sh
-# Changes hostname in /etc/hostname and /etc/hosts
-
-current=$(cat /etc/hostname)
-newname=$1
-
-[ -n "$newname" ] || exit 1
-
-sed -i "s/$current/$newname/" /etc/hosts
-sed -i "s/$current/$newname/" /etc/hostname
-
-hostname $newname
-
-initctl touch sysklogd
-initctl touch dnsmasq
-initctl reload
@@ -1,3 +0,0 @@
-#!/bin/sh
-pdmenu
-clear
@@ -1,327 +0,0 @@
-#!/bin/sh
-# Displays basic information about the system
-# shellcheck disable=SC2048,SC2086
-. /etc/os-release
-
-bopt="-c"
-opt="-br"
-all=""
-plain=""
-
-TTY=$(resize)
-eval "$TTY"
-
-# COLUMS and ROWS should be set on the console, if not, use fallback
-if [ -z "$COLUMNS" ]; then
-	if command -v tput; then
-		COLUMNS=$(tput cols)
-	else
-		COLUMNS=80
-	fi
-fi
-
-h1()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR" | tr '[:lower:]' '[:upper:]'
-	else
-		printf "\033[7m%-${COLUMNS}s\033[0m\n" "$STR"
-	fi
-}
-
-h2()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR"
-		echo "$STR" | sed 's/./-/g'
-	else
-		printf "\033[1m%-${COLUMNS}s\033[0m\n" "$STR"
-	fi
-}
-
-dm()
-{
-	if [ -n "$plain" ]; then
-		echo "${*}"
-	else
-		printf "\033[2m%s\033[0m\n" "$*"
-	fi
-}
-
-ul()
-{
-	if [ -n "$plain" ]; then
-		printf "__%s__" "$*"
-	else
-		printf "\033[4%s\033[0m" "$*"
-	fi
-}
-
-em()
-{
-	if [ -n "$plain" ]; then
-		printf "**%s**" "$*"
-	else
-		printf "\033[5m%s\033[0m" "$*"
-	fi
-}
-
-usage()
-{
-	cat <<EOF
-usage:
-  show [opt] cmd
-
-options:
-  -a            Show all, of something
-  -f            Show full output, not brief port/iface listings
-  -h            Show this help text
-  -n            Show output without any footer
-  -p            Show plain output, no bells or whistles
-
-commands:
-  port PORT     Show port configuration and link information
-  ports         Show ports available for bridging
-  vlans         Show port groups in bridge
-  ifaces        Show interfaces and their addresses
-  fdb           Show forwarding database (unicast)
-  mdb           Show multicast forwarding database
-  ip route      Show routing table
-  log [FILE]    Show latest entries from syslog, or other FILE
-  rmon PORT     Show RMON counters for PORT (when applicable)
-  system        Show OS details
-  version       Show OS verson
-EOF
-}
-
-# Usage 1: show port eth0
-# Usage 2: show port
-# Usage 3: show ports
-#
-# The first show ethtool output for 'eth0' (in this case).  The latter
-# two are the same, showing a summary of all interfaces classified as
-# access ports.
-ports()
-{
-	if [ $# -gt 0 ] && [ -e "/sys/class/net/$1" ]; then
-		for port in $*; do
-			ethtool "$port"
-		done
-		return
-	fi
-
-	h1 "PORT             STATE          MAC ADDRESS        FLAGS"
-	if grep -q port /etc/iproute2/group && [ -z "$all" ]; then
-		ip $opt link show group port
-	else
-		ip $opt link show
-	fi
-
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "Use: '[ip|bridge] --help' and '[ip|bridge] link help' for more details."
-	fi
-}
-
-vlans()
-{
-	h1 "INTERFACE         VLAN  FLAGS"
-	bridge $bopt vlan show |tail +2 | awk 'NF { iface=$1; vid=$2; printf("%-16s  %4d  ", iface, vid); for (i=3; i <= NF; i++) printf("%s ", $i); printf("\n"); }'
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'bridge --help' and 'bridge vlan help' for more details."
-	fi
-}
-
-ifaces()
-{
-	h1 "INTERFACE        STATE          ADDRESS"
-	if [ -n "$all" ]; then
-		ip $opt addr show
-        elif grep -q iface /etc/iproute2/group; then
-                ip $opt addr show group iface
-	else
-		ip $opt addr show |awk '{ if ($1 !~ /eth[0-9]*/ && $1 !~ /.*@NONE/) { print }}'
-	fi
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'ip --help' and 'ip address help' for more details."
-	fi
-}
-
-log()
-{
-	if [ -n "$1" ] && [ -r "/var/log/$1" ]; then
-		fn="/var/log/$1"
-	else
-		fn="/var/log/syslog"
-	fi
-	if [ -n "$all" ]; then
-		cat $fn
-	else
-		tail -$LINES $fn
-	fi
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'tail -25 /log/FILE', 'tail -F /log/FILE' to continuously monitor files."
-	fi
-}
-
-rmon()
-{
-	if [ -z "$*" ]; then
-		echo "Missing argument, see 'show port' for available interfaces"
-		exit 1
-	fi
-	for port in $*; do
-		ethtool -S "$port"
-	done
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'ethtool --help' for more details."
-	fi
-}
-
-rstp()
-{
-	mstpctl showbridge
-	echo "br0 port info"
-	mstpctl showport br0
-}
-
-fdb()
-{
-	bridge $bopt fdb show
-}
-
-mdb()
-{
-	bridge $bopt mdb show
-}
-
-routes()
-{
-	ip $opt route show
-}
-
-igmp()
-{
-	querierctl $@
-}
-
-system()
-{
-	h1 "SYSTEM INFORMATION"
-	echo "System Name        : $(uname -n)"
-	echo "System Variant     : $VARIANT"
-	echo "System Description : $PRETTY_NAME"
-	echo "System Contact     : $HOME_URL"
-	echo "System Timezone    : $(cat /etc/timezone)"
-	echo "System Type        : $NAME"
-	echo "System Version     : $(cat /etc/version)"
-	echo "System Arch        : $(uname -m)"
-	echo "Kernel Version     : $(uname -sr)"
-}
-
-version()
-{
-	cat /etc/version
-}
-
-while [ "$1" != "" ]; do
-	case $1 in
-		-a)
-			all=1
-			;;
-		-f)
-			opt=""
-			if [ -n "$plain" ]; then
-				opt="-color=never"
-				bopt="-color=never"
-			fi
-			;;
-		-n)
-			nofoot="yes"
-			;;
-		-p)
-			plain="yes"
-			opt="$opt -color=never"
-			bopt="$bopt -color=never"
-			;;
-		-h)
-			usage
-			exit 0
-			;;
-		*)
-			break
-	esac
-	shift
-done
-
-cmd=$1
-if [ -n "$cmd" ]; then
-	shift
-fi
-
-case $cmd in
-	help)
-		usage
-		;;
-	port*)
-		ports $*
-		;;
-	vlan*)
-		vlans
-		;;
-	fdb)
-		fdb
-		;;
-	mdb)
-		mdb
-		;;
-	if*)
-		ifaces
-		;;
-	ip)
-		cmd=$1
-		shift
-		case $cmd in
-			addr*)
-				ifaces
-				;;
-			route*)
-				routes
-				;;
-			igmp*)
-				igmp $*
-				;;
-			*)
-				usage
-				;;
-		esac
-		;;
-	log)
-		log $1
-		;;
-	rmon)
-		rmon $*
-		;;
-	route*)
-		routes
-		;;
-	span*)
-		rstp
-		;;
-	sys*)
-		system
-		;;
-	ver*)
-		version
-		;;
-	*)
-		usage
-		exit 1
-		;;
-esac
@@ -1,55 +0,0 @@
-#!/bin/sh
-#set -x
-
-usage()
-{
-    cat <<EOF
-usage:
-  yorn [-h] ["Do you want to run command?" command]
-
-options:
-  -h            Show this help text
-  -p            Show plain output, no bells or whistles
-
-Displays the yes-or-no question and runs command on yes.
-EOF
-}
-
-if [ -z "$1" ]; then
-    usage
-    exit 1
-fi
-
-case $1 in
-    -h)
-	usage
-	exit 0
-	;;
-    -p)
-	plain=1
-	shift
-	;;
-    *)
-	;;
-esac
-
-question=$1
-shift
-command=$*
-if [ -z "$command" ]; then
-    usage
-    exit 1
-fi
-
-if [ -z "$plain" ]; then
-    if dialog --erase-on-exit --colors --defaultno --yesno "\Zb$question\ZB" 0 0; then
-	yorn=y
-    fi
-else
-    # shellcheck disable=SC2162,SC3045
-    read -n 1 -p "$question (y/N): " yorn
-fi
-
-if [ "$yorn" = "y" ] || [ "$yorn" = "Y" ]; then
-    $command
-fi
@@ -1,18 +0,0 @@
-# System-wide .bashrc file for interactive bash(1) shells.
-
-# If not running interactively, don't do anything
-[ -z "$PS1" ] && return
-
-# Reevaluate for each line, in case hostname changes
-function prompt_command
-{
-    PS1="\u@$(hostname):\w\$ "
-}
-export PROMPT_COMMAND=prompt_command
-
-# check the window size after each command and, if necessary,
-# update the values of LINES and COLUMNS.
-shopt -s checkwinsize
-
-# Disble built-ins
-enable -n help
@@ -1,51 +0,0 @@
-# Infix's configuration for dhcpcd.
-# See dhcpcd.conf(5) for details.
-
-# Allow users of this group to interact with dhcpcd via the control socket.
-#controlgroup wheel
-
-# Inform the DHCP server of our hostname for DDNS.
-#hostname
-
-# Use the hardware address of the interface for the Client ID.
-#clientid
-# or
-# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
-# Some non-RFC compliant DHCP servers do not reply with this set.
-# In this case, comment out duid and enable clientid above.
-duid
-
-# Persist interface configuration when dhcpcd exits.
-persistent
-
-# vendorclassid is set to blank to avoid sending the default of
-# dhcpcd-<version>:<os>:<machine>:<platform>
-vendorclassid
-
-# A list of options to request from the DHCP server.
-option domain_name_servers, domain_name, domain_search
-option classless_static_routes
-# Respect the network MTU. This is applied to DHCP routes.
-option interface_mtu
-
-# Request a hostname from the network
-option host_name
-
-# Most distributions have NTP support.
-#option ntp_servers
-
-# Rapid commit support.
-# Safe to enable by default because it requires the equivalent option set
-# on the server to actually work.
-option rapid_commit
-
-# A ServerID is required by RFC2131.
-require dhcp_server_identifier
-
-# Generate SLAAC address using the Hardware Address of the interface
-#slaac hwaddr
-# OR generate Stable Private IPv6 Addresses based from the DUID
-slaac private
-
-# Background immediately, do not wait for DHCP lease (speed up boot process)
-background
@@ -1,144 +0,0 @@
-#
-# Run-time configuration file for dialog
-#
-# Automatically generated by "dialog --create-rc <file>"
-#
-#
-# Types of values:
-#
-# Number     -  <number>
-# String     -  "string"
-# Boolean    -  <ON|OFF>
-# Attribute  -  (foreground,background,highlight?,underline?,reverse?)
-
-# Set aspect-ration.
-aspect = 0
-
-# Set separator (for multiple widgets output).
-separate_widget = ""
-
-# Set tab-length (for textbox tab-conversion).
-tab_len = 0
-
-# Make tab-traversal for checklist, etc., include the list.
-visit_items = OFF
-
-# Shadow dialog boxes? This also turns on color.
-use_shadow = ON
-
-# Turn color support ON or OFF
-use_colors = ON
-
-# Screen color
-screen_color = (WHITE,BLUE,OFF)
-
-# Shadow color
-shadow_color = (BLACK,BLACK,OFF)
-
-# Dialog box color
-dialog_color = (BLACK,CYAN,OFF)
-
-# Dialog box title color
-title_color = (BLACK,CYAN,ON)
-
-# Dialog box border color
-border_color = dialog_color
-
-# Active button color
-button_active_color = (CYAN,BLACK,ON)
-
-# Inactive button color
-button_inactive_color = dialog_color
-
-# Active button key color
-button_key_active_color = (WHITE,BLACK,ON)
-
-# Inactive button key color
-button_key_inactive_color = (WHITE,CYAN,ON)
-
-# Active button label color
-button_label_active_color = button_active_color
-
-# Inactive button label color
-button_label_inactive_color = dialog_color
-
-# Input box color
-inputbox_color = (BLACK,CYAN,OFF)
-
-# Input box border color
-inputbox_border_color = inputbox_color
-
-# Search box color
-searchbox_color = inputbox_color
-
-# Search box title color
-searchbox_title_color = (BLUE,WHITE,ON)
-
-# Search box border color
-searchbox_border_color = (WHITE,WHITE,ON)
-
-# File position indicator color
-position_indicator_color = searchbox_title_color
-
-# Menu box color
-menubox_color = dialog_color
-
-# Menu box border color
-menubox_border_color = dialog_color
-
-# Item color
-item_color = inputbox_color
-
-# Selected item color
-item_selected_color = button_key_active_color
-
-# Tag color
-tag_color = button_inactive_color
-
-# Selected tag color
-tag_selected_color = (CYAN,BLACK,OFF)
-
-# Tag key color
-tag_key_color = button_key_inactive_color
-
-# Selected tag key color
-tag_key_selected_color = (WHITE,BLACK,ON)
-
-# Check box color
-check_color = inputbox_color
-
-# Selected check box color
-check_selected_color = button_key_active_color
-
-# Up arrow color
-uarrow_color = (GREEN,WHITE,ON)
-
-# Down arrow color
-darrow_color = uarrow_color
-
-# Item help-text color
-itemhelp_color = (WHITE,BLACK,OFF)
-
-# Active form text color
-form_active_text_color = button_key_active_color
-
-# Form text color
-form_text_color = (WHITE,CYAN,ON)
-
-# Readonly form item color
-form_item_readonly_color = (CYAN,WHITE,ON)
-
-# Dialog box gauge color
-gauge_color = searchbox_title_color
-
-# Dialog box border2 color
-border2_color = dialog_color
-
-# Input box border2 color
-inputbox_border2_color = inputbox_color
-
-# Search box border2 color
-searchbox_border2_color = inputbox_color
-
-# Menu box border2 color
-menubox_border2_color = dialog_color
@@ -1 +0,0 @@
-run [S] /libexec/infix/swup --
@@ -1,112 +0,0 @@
-# NetBox mdev.conf based on https://github.com/slashbeast/mdev-like-a-boss/
-
-# Syntax:
-# [-]devicename_regex user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-# [-]$ENVVAR=regex    user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-# [-]@maj,min[-min2]  user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-#
-# [-]: do not stop on this match, continue reading mdev.conf
-# =: move, >: move and create a symlink
-# !: do not create device node
-# @|$|*: run cmd if $ACTION=remove, @cmd if $ACTION=add, *cmd in all cases
-
-# support module loading on hotplug
-$MODALIAS=.*    root:root 660 @modprobe -b "$MODALIAS"
-
-# null may already exist; therefore ownership has to be changed with command
-null        root:root 666 @chmod 666 $MDEV
-zero        root:root 666
-full        root:root 666
-random      root:root 444
-urandom     root:root 444
-hwrandom    root:root 444
-grsec       root:root 660
-
-# Kernel-based Virtual Machine.
-#kvm     root:kvm 660
-
-# vhost-net, to be used with kvm.
-#vhost-net   root:kvm 660
-
-kmem        root:root 640
-mem         root:root 640
-port        root:root 640
-# console may already exist; therefore ownership has to be changed with command
-console     root:tty 600 @chmod 600 $MDEV
-ptmx        root:tty 666
-pty.*       root:tty 660
-
-# Typical devices
-tty         root:tty 666
-tty[0-9]*   root:tty 660
-vcsa*[0-9]* root:tty 660
-ttyS[0-9]*  root:dialout 660
-
-# block devices
-ram([0-9]*)        root:disk 660 >rd/%1
-loop([0-9]+)       root:disk 660 >loop/%1
-sr[0-9]*           root:cdrom 660 @ln -sf $MDEV cdrom
-fd[0-9]*           root:floppy 660
-#SUBSYSTEM=block;.* root:disk 660 */libexec/infix/storage-device
-
-# Run settle-nics every time new NIC appear.
-# If you don't want to auto-populate /etc/mactab with NICs,
-# run 'settle-nis' without '--write-mactab' param.
-#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/libexec/infix/settle-nics --write-mactab
-
-net/tun[0-9]*   root:netdev 660
-net/tap[0-9]*   root:root 600
-
-# alsa sound devices and audio stuff
-#SUBSYSTEM=sound;.*  root:audio 660 @/libexec/infix/sound-control
-
-adsp        root:audio 660 >sound/
-audio       root:audio 660 >sound/
-dsp         root:audio 660 >sound/
-mixer       root:audio 660 >sound/
-sequencer.* root:audio 660 >sound/
-
-
-# raid controllers
-cciss!(.*)  root:disk 660 =cciss/%1
-ida!(.*)    root:disk 660 =ida/%1
-rd!(.*)     root:disk 660 =rd/%1
-
-
-fuse        root:root 666
-
-card[0-9]   root:video 660 =dri/
-
-agpgart     root:root 660 >misc/
-psaux       root:root 660 >misc/
-rtc         root:root 664 >misc/
-
-# input stuff
-SUBSYSTEM=input;.* root:plugdev 660
-
-# v4l stuff
-vbi[0-9]    root:video 660 >v4l/
-video[0-9]  root:video 660 >v4l/
-
-# dvb stuff
-dvb.*       root:video 660
-
-# drm etc
-dri/.*      root:video 660
-
-# Don't create old usbdev* devices.
-usbdev[0-9].[0-9]* root:root 660 !
-
-# Stop creating x:x:x:x which looks like /dev/dm-*
-[0-9]+\:[0-9]+\:[0-9]+\:[0-9]+ root:root 660 !
-
-# /dev/cpu support.
-microcode       root:root 600 =cpu/
-cpu([0-9]+)     root:root 600 =cpu/%1/cpuid
-msr([0-9]+)     root:root 600 =cpu/%1/msr
-
-# Populate /dev/bus/usb.
-#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */libexec/infix/dev-bus-usb
-
-# Catch-all other devices, Right now useful only for debuging.
-#.* root:root 660 */libexec/infix/catch-all
@@ -1 +0,0 @@
-[2m[1mNote:[0m[2m use help, show, and setup commands to set up and diagnose the system.[0m
@@ -1,6 +0,0 @@
-# interfaces(5) file used by ifup(8) and ifdown(8)
-auto lo
-iface lo inet loopback
-
-source-directory /etc/network/interfaces.d
-
@@ -1,75 +0,0 @@
-#!/usr/bin/pdmenu
-
-title:Setup & Diagnostics
-
-color:desktop:blue:blue
-color:title:blue:white
-color:base:blue:white
-
-menu:main:Main Menu:Use arrow keys, Enter, Escape, and Q to navigate
-	show:_System Settings..::system
-	show:_Network Settings..::network
-	show:_Tools..::tools
-	nop
-	exec:Show _fdb:truncate:show -p fdb
-	exec:Show _mdb:truncate:show -p mdb
-	exec:Show _ports:truncate:show -p ports
-	exec:Show _vlans:truncate:show -p  vlans
-	exec:Show _interfaces:truncate:show -p iface
-	exec:Show _routes:truncate:show -p route
-	nop
-	exec:Show _online users:truncate:w
-	exec:Show _CPU Load::top
-	nop
-	show:_Help..::help
-	exit:_Quit
-
-menu:help:Help:Help Menu
-	exec:Introduction:truncate:/bin/help -p
-	exec:Editors:truncate:/bin/help -p edit
-	exec:Networking:truncate:/bin/help -p net
-	nop
-	exit:_Main menu..
-
-menu:network:Network:Network Settings
-	exec:Show all _links:truncated:ip -br link
-	exec:Show all _addresses:truncated:ip -br address
-	exec:Show managed _interfaces:truncated:ifparse --all
-	nop
-	exec:Take _interface down:edit:ifdown ~Enter name of interface to take down:~
-	exec:Take _interface up:edit:ifup ~Enter name of interface to take up:~
-	nop
-	exec:Edit _dhcpcd.conf::edit /etc/dhcpcd.conf
-	exec:Edit _dnsmasq.conf::edit /etc/dnsmasq.conf
-	exec:Edit _interfaces::edit /etc/network/interfaces
-	exec:Edit _mactab::edit /etc/mactab
-	exec:Edit _sysctl.conf::edit /etc/sysctl.conf
-	nop
-	exit:_Main menu..
-
-menu:system:System:System Settings
-	exec:List _log files:truncate:ls -l /var/log
-	exec:Show _log file:edit,truncate:show -p -a log ~Show logfile, Enter for syslog:syslog~
-	exec:Change _hostname:edit:hostnm ~Enter new hostname \[-a-zA-Z0-9\]:~
-	exec:Change your _password::passwd
-	exec:Edit _rc.local::edit /etc/rc.local
-	nop
-	exec:_Show State of Services:truncate:initctl -p
-	exec:_Reload services:truncate:initctl reload;sleep 2;initctl -p
-	exec:Show _available services:truncate:initctl -p ls
-	exec:_Enable service:edit:initctl enable ~Enter name of service (filename) to enable:~
-	exec:_Disable service:edit:initctl disable ~Enter name of service (filename) to disable:~
-	nop
-	exec:_Factory Reset::yorn "Factory reset device (reboots), are you sure?" factory -y
-	nop
-	exit:_Main menu..
-
-menu:tools:Tools:Tools
-	exec:_Ping:edit,pause:ping ~Enter address (IP or name) to ping:~
-	exec:_Shell Prompt::/bin/bash --login
-	exec:_SSH:edit,pause:ssh ~Enter [username@]address (IP or name) to SSH to:~
-	exec:_Telnet:edit,pause:telnet ~Enter address (IP or name) to telnet to:~
-	exec:_Traceroute:edit,pause:mtr ~Enter address (IP or name) to traceroute to:~
-	exec:Browse _WWW:edit,pause:lynx ~Enter URL to browse:~
-	nop
-	exit:_Main menu..
@@ -1,19 +0,0 @@
-#!/bin/sh
-# This file is run at the very end of runlevel S (bootstrap)
-#
-# Note: 1) not all initctl commands are allowed here
-#       2) to enable IP forwarding, use /etc/sysctl.conf, or /etc/sysctl.d/
-#       3) ensure the script calls `exit 0` at the end
-#
-
-# Uncomment to classify all interfaces starting with 'eth' as ports.
-#for port in $(ip -br link |awk '/eth/{print $1}'); do
-#	ip link set $port group port
-#done
-
-# Uncomment to enable IP masquerading (NAT) of all traffic egressing
-# the WAN interface, here eth0.  E.g., if you are a router for your
-# LAN on eth1.
-#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-
-exit 0
@@ -1,62 +0,0 @@
-#!/bin/sh
-# Factory default:
-#  1) all switch ports in VLAN 1 of br0
-#  2) no switch ports => DHCP on eth0
-#  3) no eth0
-
-create_bridge()
-{
-    nm=$1
-    shift
-    ports=$@
-
-    touch "/etc/network/interfaces.d/$nm"
-    for port in $ports; do
-	cat <<-EOF >>"/etc/network/interfaces.d/$nm"
-		iface $port
-		    bridge-access 1
-		    post-up ip link set $port group port
-		EOF
-    done
-    cat <<-EOF >> "/etc/network/interfaces.d/$nm"
-
-	auto $nm
-	iface $nm
-	    bridge-ports $ports
-	    bridge-vlan-aware yes
-	    bridge-stp on
-	    bridge-vids 1
-
-	auto vlan1
-	iface vlan1 inet dhcp
-	    vlan-id 1
-	    vlan-raw-device $nm
-	    post-up ip link set vlan1 group iface
-	EOF
-    ip link set vlan1 group iface
-}
-
-# Check if already set up
-[ -z "$(ls -A /etc/network/interfaces.d/)" ] || exit 0
-
-# Check for custom hostname from Qemu/Qeneth
-nm=$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)
-if [ -n "$nm" ]; then
-    hostnm "$nm"
-fi
-
-# need to check for 'length > 0' because ip command
-# outputs empty json objects for non-port group ifs
-ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
-if [ -n "$ports" ]; then
-    create_bridge br0 $ports
-else
-    ifaces=$(ip -json addr show  |jq -r '.[] | select(.link_type=="ether").ifname')
-    for iface in $ifaces; do
-	cat  <<-EOF > "/etc/network/interfaces.d/$iface"
-		auto $iface
-		iface $iface inet dhcp
-		    pre-up ip link set $iface group iface
-		EOF
-    done
-fi
@@ -1,6 +0,0 @@
-#!/bin/sh
-# Probe for various types of harware features
-
-if dmesg |grep -q QEMU || test -d /sys/module/qemu_fw_cfg; then
-    initctl -nbq cond set qemu
-fi
@@ -18,7 +18,27 @@ endchoice
 config SIGN_KEY
 	string "Signing key"
 	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+
+menuconfig TRUSTED_KEYS
+	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
+	help
+	 Keys that will be accepted for this image
+
+
+config TRUSTED_KEYS_DEVELOPMENT
+	bool "Development key"
+	depends on TRUSTED_KEYS
+
+config TRUSTED_KEYS_DEVELOPMENT_PATH
+	string
+	depends on TRUSTED_KEYS_DEVELOPMENT
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+
+config TRUSTED_KEYS_EXTRA_PATH
+	string "Path to extra keys to include in image"
+	depends on TRUSTED_KEYS

 menuconfig DISK_IMAGE
 	bool "Disk image"
@@ -140,4 +160,3 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
-
@@ -1,11 +1,13 @@
 ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

+TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
+	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
+
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
 endif
@@ -44,16 +44,19 @@ image @DISKIMG@ {
 	partition aux {
 		offset = @AUXOFFS@
 		image = "aux.ext4"
+		partition-uuid = @AUXUUID@
 	}

 	partition primary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
+		partition-uuid = @PRIMARYUUID@
 	}

 	partition secondary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
+		partition-uuid = @SECONDARYUUID@
 	}

 	partition cfg {
@@ -1,7 +1,8 @@
 #!/bin/sh
-
 set -e

+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+
 K=10
 M=20
 G=30
@@ -157,6 +158,9 @@ genboot
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
+   	  -vauxuuid=$AUX_UUID \
+	  -vprimaryuuid=$PRIMARY_UUID \
+          -vsecondaryuuid=$SECONDARY_UUID \
 	  -vtotal=$total \
 	  -vauxsize=$auxsize -vauxoffs=$auxoffs \
 	  -vimgsize=$imgsize \
@@ -174,6 +178,10 @@ awk \
 		sub(/@DISKIMG@/, diskimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
+		sub(/@AUXUUID@/, auxuuid);
+		sub(/@PRIMARYUUID@/, primaryuuid);
+		sub(/@SECONDARYUUID@/, secondaryuuid);
+
 	  }1' \
 	      < $common/genimage.cfg.in >$root/genimage.cfg

@@ -60,7 +60,7 @@ cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
    "status": "stable",
    "maintainer": "$VENDOR_NAME",
    "maintainer_email": "${SUPPORT_URL#mailto:}",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
    "port_name_format": "eth{0}",
    "linked_clone": true,
    "qemu": {
@@ -1,5 +1,6 @@
 #!/bin/sh
 # shellcheck disable=SC1090,SC1091
+common=$(dirname "$(readlink -f "$0")")
 . "$BR2_CONFIG" 2>/dev/null
 . "$TARGET_DIR/usr/lib/os-release"

@@ -31,6 +32,7 @@ rm -f "$TARGET_DIR/etc/os-release"
    echo "ID=$INFIX_ID"
    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
    echo "ID_LIKE=\"${ID}\""
+    echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
    echo "VERSION=\"${VERSION}\""
    echo "VERSION_ID=${VERSION}"
    echo "BUILD_ID=\"${GIT_VERSION}\""
@@ -40,13 +42,6 @@ rm -f "$TARGET_DIR/etc/os-release"
    if [ -n "$INFIX_RELEASE" ]; then
 	echo "IMAGE_VERSION=\"$INFIX_RELEASE\""
    fi
-    if [ "$INFIX_VARIANT_NETCONF" = "y" ]; then
-	echo "VARIANT=\"Managed NETCONF\""
-	echo "VARIANT_ID=netconf"
-    else
-	echo "VARIANT=\"Classic, writable /etc\""
-	echo "VARIANT_ID=classic"
-    fi
    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
    echo "HOME_URL=$INFIX_HOME"
    if [ -n "$INFIX_VENDOR" ]; then
@@ -68,6 +63,12 @@ rm -f "$TARGET_DIR/etc/os-release"

 echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"

+# Drop Buildroot default symlink to /tmp
+if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
+	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
+	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
+fi
+
 # Allow pdmenu (setup) and bash to be login shells, bash is added
 # automatically when selected in menuyconfig, but not when BusyBox
 # provides a symlink (for ash).  The /bin/{true,false} are old UNIX
@@ -80,3 +81,7 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/true" >> "$TARGET_DIR/etc/shells"
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
+
+# Allow clish (symlink to /usr/bin/klish) to be a login shell
+grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
+        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -54,17 +54,16 @@ choice

 config QEMU_CONSOLE_VIRTIO
     bool "Virtio (hvc0)"
-     depends on QEMU_LOADER_KERNEL

 config QEMU_CONSOLE_SERIAL
     bool "Serial (ttyS0/ttyAMA0)"
-
+     depends on !QEMU_LOADER_OVMF
 endchoice

 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt -cpu cortex-a72"   if QEMU_aarch64
-	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host" if QEMU_x86_64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
+	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
 	  want to tweak it, or change the acceleration.
@@ -77,9 +76,9 @@ config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
 	default "384M"
 	help
-	  The default, 384 MiB, works for most configurations, even less for
-	  the Infix Classic builds.  However, if you get kernel panic with:
-	  "System is deadlocked on memory", try increasing this one.
+	  The default, 384 MiB, works for most configurations.  However,
+	  if you get kernel panic with: "System is deadlocked on memory",
+	  try increasing this one.

 config QEMU_KERNEL
 	string
@@ -117,7 +117,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS,if=virtio,format=raw,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
    fi
 }

@@ -148,14 +148,20 @@ usb_args()
 	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
 	mkfs.vfat $USBSTICK >/dev/null 2>&1
    fi
-    echo -n "-drive if=none,id=usbstick,format=raw,file=${USBSTICK} "
+    echo -n "-drive if=none,id=usbstick,format=raw,file=$USBSTICK "
    echo -n "-usb "
    echo -n "-device usb-ehci,id=ehci "
    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
 }
 rw_args()
 {
-    [ "$CONFIG_QEMU_RW" ] || return
+    [ "$CONFIG_QEMU_RW" ] ||  return
+
+    if ! [ -f "aux.ext4" ]; then
+	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
+	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
+    fi
+    echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "

    if ! [ -f "$CONFIG_QEMU_RW" ]; then
 	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
@@ -198,10 +204,10 @@ net_args()
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e0,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
-	net_dev_args 0
+	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
+	net_dev_args 1
    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 0 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
 	    net_dev_args $i
 	done
@@ -209,8 +215,8 @@ net_args()
 	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"

-	echo -n "-netdev user,id=e0${useropts} "
-	net_dev_args 0
+	echo -n "-netdev user,id=e1${useropts} "
+	net_dev_args 1
    else
 	echo -n "-nic none"
    fi
@@ -251,6 +257,9 @@ wdt_args()

 run_qemu()
 {
+    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	 qemu-img create -f qcow2 -o backing_file=$CONFIG_QEMU_ROOTFS -F raw $CONFIG_QEMU_ROOTFS.qcow2 > /dev/null
+    fi
    local qemu
    read qemu <<EOF
 	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
@@ -43,7 +43,7 @@ if [ -x /bin/ip -o -x /sbin/ip ] ; then
        BIND)
            ip addr flush dev "$2" label "$2:avahi"
            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
-            ip route add default dev "$2" metric "$METRIC" scope link ||:
+            ip route add default dev "$2" metric "$METRIC" scope link proto zeroconf ||:
            ;;

        CONFLICT|UNBIND|STOP)
@@ -2,8 +2,12 @@
 # managed by openresolv.  DHCP lease, VPN tunnel establishment,
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
-#interface=lo
-listen-address=127.0.0.1
+
+# Only listen to loopback (local system)
+interface=lo
+bind-dynamic
+#listen-address=127.0.0.1,::1
+
 enable-dbus

 # Generated by openresolv
@@ -1 +1,2 @@
 set COLORTERM=yes
+rlimit soft core infinity
@@ -0,0 +1 @@
+task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -0,0 +1 @@
+service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
@@ -0,0 +1 @@
+../available/mkcert.conf
@@ -19,4 +19,4 @@ LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/libexec/infix/mnt# /cfg		helper		none				0	0
+/libexec/infix/mnt# /cfg	helper		none				0	0
@@ -0,0 +1 @@
+configure ports dsa0 lldp status disabled
@@ -0,0 +1,6 @@
+# Sourced by mkcert at boot
+country=SE
+state=Vastmanland
+city=Vasteras
+org=KernelKit
+unit=Infix
@@ -1,4 +1,4 @@
 .-------.
 |  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.github.io
-'-'---'-'
+'-'---'-'
@@ -0,0 +1,27 @@
+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    server_name  _;
+    include      ssl.conf;
+
+    #error_page  404              /404.html;
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+	root   html;
+    }
+
+    location / {
+	root   html;
+	index  index.html index.htm;
+    }
+}
@@ -0,0 +1,18 @@
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    server_name  network.local;
+    include      ssl.conf;
+
+    location / {
+	proxy_pass http://127.0.0.1:8000;
+	proxy_http_version 1.1;
+	proxy_set_header Upgrade $http_upgrade;
+	proxy_set_header Connection 'upgrade';
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+	proxy_redirect off;
+    }
+}
@@ -0,0 +1,19 @@
+server {
+    listen       7681 ssl;
+    listen       [::]:7681 ssl;
+    server_name  _;
+
+    include      ssl.conf;
+
+    location / {
+	proxy_http_version  1.1;
+	proxy_set_header    Host $host;
+	proxy_set_header    X-Real-IP $remote_addr;
+	proxy_set_header    X-Forwarded-Proto $scheme;
+	proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header    Upgrade $http_upgrade;
+	proxy_set_header    Connection "upgrade";
+	proxy_pass          http://127.0.0.1:8001;
+	proxy_redirect      off;
+    }
+}
@@ -0,0 +1 @@
+../available/default.conf
@@ -0,0 +1,24 @@
+user  www-data www-data;
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/enabled/*.conf;
+
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
+}
@@ -0,0 +1,9 @@
+ssl_certificate      /etc/ssl/certs/self-signed.crt;
+ssl_certificate_key  /etc/ssl/private/self-signed.key;
+
+ssl_protocols        TLSv1.3 TLSv1.2;
+ssl_ciphers          HIGH:!aNULL:!MD5;
+ssl_prefer_server_ciphers  on;
+
+ssl_session_cache    shared:SSL:1m;
+ssl_session_timeout  5m;
@@ -0,0 +1,3 @@
+AUX_UUID="78460f84-de84-4fe7-89bd-4c1f433b2230"
+PRIMARY_UUID="107ae911-a97b-4380-975c-7ce1a2dde1e0"
+SECONDARY_UUID="352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02"
@@ -0,0 +1 @@
+kernel.core_pattern=/var/crash/core-%e
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+KEY=/cfg/ssl/private/self-signed.key
+CRT=/cfg/ssl/certs/self-signed.crt
+
+country=US
+state=California
+city=Berkeley
+org="Acme, Inc."
+unit=Second
+
+if [ -f /etc/mkcert.conf ]; then
+     . /etc/mkcert.conf
+fi
+
+if [ -z "$cn" ]; then
+    cn=$1
+    if [ -z "$cn" ]; then
+	cn=$(hostname).local
+    fi
+fi
+
+generate()
+{
+    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
+    chmod 700 /cfg/ssl/private
+
+    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+	    --organisation-unit "$unit" --common-name "$cn" \
+	    --out-certificate $CRT --out-key $KEY
+}
+
+CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
+if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
+    generate "$cn"
+fi
+
+cp "${KEY}" "/etc/ssl/private/"
+cp "${CRT}" "/etc/ssl/certs/"
+initctl cond set mkcert
+
+exit 0
@@ -126,11 +126,6 @@ if ! mount_rw cfg >/dev/null 2>&1; then
    # Even if /mnt/var isn't available, if /mnt/cfg isn't either, then
    # there's no point in overlaying one ramdisk on top of another.
    vlibsrc=
-else
-    # Classic Infix has read-write /etc across boots
-    if [ "$VARIANT_ID" != "netconf" ]; then
-	etcsrc=/mnt/cfg
-    fi
 fi

 if check_factory; then
@@ -3,12 +3,13 @@
 import importlib.machinery
 import json
 import os
+import shutil
 import struct
 import subprocess
 import sys

 onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
-
+SYSTEM_JSON   = "/run/system.json"
 KKIT_IANA_PEM = 61046

 class DTSystem:
@@ -83,7 +84,7 @@ class DTSystem:
        }

    def infix_usb_devices(self, out):
-        names=self.infix.str_array("usb-port-names")
+        names=self.infix.str_array("usb-port-names", ())
        phs=self.__get_phandle_array("usb-ports")
        data=dict(zip(names,phs))
        if data != {}:
@@ -233,8 +234,36 @@ def vpd_inject(out, vpds):
            out["factory-password-hash"] = pwhash
            break

+def qemu_base_mac():
+    """Find MAC address of first non-loopback interface, subtract with 1"""
+    base_path = '/sys/class/net'
+    interfaces = []
+
+    for iface in os.listdir(base_path):
+        if iface == 'lo':
+            continue
+        try:
+            # pylint: disable=invalid-name
+            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
+                mac = f.read().strip()
+            interfaces.append((mac, iface))
+        except FileNotFoundError:
+            continue
+
+    if interfaces:
+        interfaces.sort()
+        mac  = interfaces[0][0]
+        mac  = int(mac.replace(':', ''), 16)
+        mac -= 1
+        mac %= 1 << 48
+        mac  = ':'.join(f"{(mac >> 8 * i) & 0xff:02x}" for i in range(5, -1, -1))
+        return mac
+
+    return None
+
 def probe_qemusystem(out):
-    ADMINHASH = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
+    """Probe Qemu based test systems and 'make run'"""
+    admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"

    qsys = QEMUSystem()
    vpds = qsys.vpds()
@@ -244,6 +273,7 @@ def probe_qemusystem(out):
    for (attr, default) in (
            ("vendor", "QEMU"),
            ("product-name", "VM"),
+            ("mac-address", qemu_base_mac()),
    ):
        if not out[attr]:
            out[attr] = default
@@ -252,13 +282,14 @@ def probe_qemusystem(out):
       not out["vpd"]["product"]["available"]:
        # Virtual instance without VPD emulation, fallback to
        # admin/admin
-        out["factory-password-hash"] = ADMINHASH
+        out["factory-password-hash"] = admin_hash

    # Let others react to the fact that we are running in QEMU
-    subprocess.run("initctl -nbq cond set qemu".split())
+    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
    return 0

 def probe_dtsystem(out):
+    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
    vpds = dtsys.infix_vpds()
    dtsys.infix_usb_devices(out)
@@ -296,11 +327,15 @@ def main():
        return err

    if not out["factory-password-hash"]:
-        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\nNO FACTORY PASSWORD FOUND\033[0m\n\n")
+        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
+                         "NO FACTORY PASSWORD FOUND\033[0m\n\n")
        err = 1

-    json.dump(out, open("/run/system.json", "w"))
-    os.chmod("/run/system.json", 0o444)
+    os.umask(0o337)
+    # pylint: disable=invalid-name
+    with open(SYSTEM_JSON, "w", encoding="ascii") as f:
+        json.dump(out, f)
+    shutil.chown(SYSTEM_JSON, user="root", group="wheel")
    return err

 if __name__ == "__main__":
@@ -1,14 +1,15 @@
 #!/bin/sh
-
 set -e

+. /etc/partion-uuid
+
 disk=$1
 bootoffs=$2

 bootsize=8M
 auxsize=8M

-total=$(awk -vdisk="$(basename $disk)" '$4 == disk { print($3 / 1024); }' /proc/partitions)
+total=$(awk -vdisk="$(basename $disk)" '$4 == disk { print(int($3 / 1024)); }' /proc/partitions)
 if [ "$total" -ge 4096 ]; then
    imgsize=1024M
    cfgsize=512M
@@ -29,9 +30,9 @@ fi
 sgdisk \
    -o \
    -n1:${bootoffs}:+${bootsize} -t1:8301 -c1:boot \
-    -n2::+${auxsize} -t2:8301 -c2:aux \
-    -n3::+${imgsize} -t3:8300 -c3:primary \
-    -n4::+${imgsize} -t4:8300 -c4:secondary \
+    -n2::+${auxsize} -t2:8301 -c2:aux -u2:${AUX_UUID}\
+    -n3::+${imgsize} -t3:8300 -c3:primary -u3:${PRIMARY_UUID} \
+    -n4::+${imgsize} -t4:8300 -c4:secondary -u4:${SECONDARY_UUID}\
    -n5::+${cfgsize} -t5:8302 -c5:cfg \
    -n6::            -t6:8310 -c6:var \
    -p \
@@ -103,8 +103,8 @@ create()
 	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
    fi

-    args="$args --cgroup-parent=containers"
-    args="$args --restart=$restart --systemd=false --tz=local $privileged --replace --quiet"
+    args="$args --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --restart=$restart --systemd=false --tz=local $privileged"
    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
    pidfn=/run/container:${name}.pid

@@ -125,10 +125,11 @@ create()
 	    args="$args --dns-search=$domain"
 	done
    else
-	network="--net none"
+	args="$args --network=none"
    fi

    # shellcheck disable=SC2048
+    log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
 	[ -n "$quiet" ] || log "Successfully created container $name from $image"
 	rm -f "/run/containers/env/${name}.env"
@@ -216,6 +217,20 @@ netwrm()
    done
 }

+# Schedule restart of (any) container using network $1 to activate network changes
+netrestart()
+{
+    net=$1
+
+    for c in $(podman ps $all --format "{{.Names}}"); do
+	for n in $(podman inspect "$c" |jq -r '.[].NetworkSettings.Networks | keys[]'); do
+	    if [ "$n" = "$net" ]; then
+		initctl -nbq touch "container@$c"
+	    fi
+	done
+    done
+}
+
 usage()
 {
 	cat <<EOF
@@ -226,6 +241,8 @@ options:
  -a, --all                Show all, of something
      --dns NAMESERVER     Set nameserver(s) when creating a container
      --dns-search LIST    Set host lookup search list when creating container
+      --cap-add CAP        Add capability to unprivileged container
+      --cap-drop CAP       Drop capability, for privileged containter
  -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
  -d, --detach             Detach a container started with 'run IMG [CMD]'
  -e, --env FILE           Environment variables when creating container
@@ -259,7 +276,7 @@ commands:
  list    [image | oci]    List names (only) of containers, images, or OCI archives
  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
  remove   IMAGE           Remove an (unused) container image
-  restart [NAME]           Restart a crashed container
+  restart [network] NAME   Restart a (crashed) container or container(s) using network
  run      NAME [CMD]      Run a container interactively, with an optional command
  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
  shell                    Start a shell inside a container
@@ -276,6 +293,14 @@ while [ "$1" != "" ]; do
 	-a | --all)
 	    all="-a"
 	    ;;
+	--cap-add)
+	    shift
+	    caps="$caps --cap-add=$1"
+	    ;;
+	--cap-drop)
+	    shift
+	    caps="$caps --cap-drop=$1"
+	    ;;
 	-c | --creds)
 	    shift
 	    creds="-u $1"
@@ -541,8 +566,24 @@ case $cmd in
 	if [ -n "$name" ]; then
 	    wrap "$name" restart
 	elif [ -n "$1" ]; then
-	    stop  "$1"
-	    start "$1"
+	    cmd=$1
+	    name=$2
+	    if [ "$cmd" = "network" ] && [ -n "$name" ]; then
+		netrestart "$name"
+	    else
+		name=$1
+		stop "$name"
+		timeout=20
+		while running "$name"; do
+		    _=$((timeoute -= 1))
+		    if [ $timeout -le 0 ]; then
+			log "Timeout waiting for container $1 to stop before restarting it."
+			exit 1
+		    fi
+		    sleep 1
+		done
+		start "$name"
+	    fi
 	else
 	    usage
 	    exit 1
@@ -567,8 +608,14 @@ case $cmd in
 	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
 	    exit 1;
 	fi
-	podman stop "$1"
-	podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	if echo "$img" | grep -Eq '^localhost/'; then
+	    # Likely an OCI archive, or local directory, assume user has updated image.
+	    file=$(awk '{s=$NF} END{print s}' "/var/lib/containers/active/${1}.sh")
+	    echo "Upgrading container ${1} with local archive: $file ..."
+	else
+	    podman stop "$1"
+	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	fi
 	"/var/lib/containers/active/${1}.sh" || (echo "Failed recreating container $1"; exit 1)
 	;;
    volume)
@@ -1,26 +1,27 @@
-# This is a bit awkward. If you know about a more straight forward way
-# of doing this, please simplify.
-#
-# U-Boot needs the public part of the signing key to be preprocessed
-# and then inserted into its control DT. mkimage(1) can perform this
-# conversion, but only as a side-effect of building/signing an FIT
-# image. Since we might not always be doing that, e.g. when only
-# building a hardware specific bootloader, we build a dummy FIT just
-# to get the key information into a DTB, which we then convert back to
-# a .dtsi and install in the U-Boot build tree. This will then be
-# built in to the final U-Boot image's control DT via the
-# CONFIG_DEVICE_TREE_INCLUDES option (see extras.config).
+define uboot-add-pubkey
+	$(call IXMSG,"Installing trusted key $1")
+	$(HOST_DIR)/bin/fdt_add_pubkey \
+		-a sha256,rsa$(shell \
+			openssl x509 -text -noout -in $1 | \
+			grep 'Public-Key: ' | \
+			sed -e 's/.*(\(.*\) bit)/\1/') \
+		-k $(dir $1) \
+		-n $(notdir $(basename $1)) \
+		-r image \
+		$2
+endef
+
+# U-Boot has its own public key format which has to be stored in its
+# control DT. So we collect all of the trusted keys, convert them to
+# the required format, and write the result to infix-key.dtb in the
+# U-Boot build tree. This will then be built in to the final U-Boot
+# image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
+# extras.config).
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	@$(call IXMSG,"Installing Infix signing key ($(SIGN_KEY))")
 	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
-	$(HOST_DIR)/bin/mkimage \
-		-k $(SIGN_KEY) \
-		-f $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/key-dummy.its \
-		-K $(@D)/infix-key.dtb \
-		$(if $(SIGN_SRC_PKCS11),-N pkcs11) \
-		-r \
-		$(@D)/key-dummy.itb
-	rm $(@D)/key-dummy.itb
+	$(foreach key, \
+		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
+		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
 	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
@@ -1,3 +1,5 @@
 # Allow users in wheel group to reboot and perform a factory reset
 /sbin/initctl f 4750 root wheel  - - - - -
 /sbin/factory f 4750 root wheel  - - - - -
+
+/var/lib/avahi-autoipd  d 0755 avahi avahi - - - - -
@@ -1,13 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1090
-. "$BR2_CONFIG" 2>/dev/null
-
-# Drop Buildroot default symlink to /tmp
-if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
-	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
-	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
-fi
-
-# Allow clish (symlink to /usr/bin/klish) to be a login shell
-grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -1,88 +0,0 @@
-#!/bin/sh
-
-# This file is part of avahi.
-#
-# avahi is free software; you can redistribute it and/or modify it
-# under the terms of the GNU Lesser General Public License as
-# published by the Free Software Foundation; either version 2 of the
-# License, or (at your option) any later version.
-#
-# avahi is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
-# License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with avahi; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
-# USA.
-
-set -e
-
-# Command line arguments:
-#   $1 event that happened:
-#          BIND:     Successfully claimed address
-#          CONFLICT: An IP address conflict happened
-#          UNBIND:   The IP address is no longer needed
-#          STOP:     The daemon is terminating
-#   $2 interface name
-#   $3 IP adddress
-
-PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
-
-# Use a different metric for each interface, so that we can set
-# identical routes to multiple interfaces.
-
-METRIC=$((1000 + `cat "/sys/class/net/$2/ifindex" 2>/dev/null || echo 0`))
-
-if [ -x /bin/ip -o -x /sbin/ip ] ; then
-
-    # We have the Linux ip tool from the iproute package
-
-    case "$1" in
-        BIND)
-            ip addr flush dev "$2" label "$2:avahi"
-            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
-            ip route add default dev "$2" metric "$METRIC" scope link proto 17 ||:
-            ;;
-
-        CONFLICT|UNBIND|STOP)
-            ip route del default dev "$2" metric "$METRIC" scope link ||:
-            ip addr del "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2"
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
-    esac
-
-elif [ -x /bin/ifconfig -o -x /sbin/ifconfig ] ; then
-
-    # We have the old ifconfig tool
-
-    case "$1" in
-        BIND)
-            ifconfig "$2:avahi" inet "$3" netmask 255.255.0.0 broadcast 169.254.255.255 up
-            route add default dev "$2:avahi" metric "$METRIC" ||:
-            ;;
-
-        CONFLICT|STOP|UNBIND)
-            route del default dev "$2:avahi" metric "$METRIC" ||:
-            ifconfig "$2:avahi" down
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
-    esac
-
-else
-
-    echo "No network configuration tool found." >&2
-    exit 1
-
-fi
-
-exit 0
@@ -1 +0,0 @@
-/var/lib/avahi-autoipd  d 0755 avahi avahi - - - - -
@@ -1,18 +1,16 @@
 test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
-UNIT_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml
 INFIX_TESTS ?= $(test-dir)/case/all.yaml

 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
-	-p $(BINARIES_DIR)/infix-x86_64.pkg \
+	-f $(BINARIES_DIR)/infix-x86_64-disk.img \
+	-f $(BINARIES_DIR)/OVMF.fd \
+        -p $(BINARIES_DIR)/infix-x86_64.pkg \
 	$(1) $(2)

 test-env-qeneth = $(call test-env,-q $(test-dir)/virt/quad,$(1))
 test-env-run    = $(call test-env,-C -t $(BINARIES_DIR)/qemu.dot,$(1))

-test-unit:
-	$(test-dir)/env $(test-dir)/9pm/9pm.py $(UNIT_TESTS)
-
 test test-qeneth:
 	$(call test-env-qeneth,\
 		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
@@ -33,4 +31,4 @@ test-run-play: | ~/.infix-test-venv
 ~/.infix-test-venv:
 	$(test-dir)/docker/init-venv.sh $(test-dir)/docker/pip-requirements.txt

-.PHONY: test-unit test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
+.PHONY: test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
@@ -1 +1,6 @@
-set prefix=(hd0,gpt2)/grub
+search -l aux --set=aux
+search -l primary --set=primary
+search -l secondary --set=secondary
+
+set prefix=($aux)/grub
+configfile ($aux)/grub/grub.cfg
@@ -33,17 +33,24 @@ else
    set log="loglevel=4"
 fi

+# From board/common/rootfs/etc/partition-uuid
+search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
+search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
+
+export primary
+export secondary
+
 submenu "primary" "$log" {
    set slot="$1"
-    set append="console=ttyS0 root=PARTLABEL=$slot $2"
-    set root=(hd0,gpt3)
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
+    set root="($primary)"
    source /boot/grub/grub.cfg
 }

 submenu "secondary" "$log"  {
    set slot="$1"
-    set append="console=ttyS0 root=PARTLABEL=$slot $2"
-    set root=(hd0,gpt4)
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
+    set root="($secondary)"
    source /boot/grub/grub.cfg
 }

@@ -56,7 +63,7 @@ submenu "net" "$log"  {
 	set root=(initrd)

 	set slot="$1"
-	set append="console=ttyS0 root=/dev/ram0 ramdisk_size=65536 $2"
+	set append="console=ttyS0 console=hvc0 qroot=/dev/ram0 ramdisk_size=65536 $2"
 	source /boot/grub/grub.cfg
    else
 	if [ -z "$net_efinet0_dhcp_next_server" ]; then
@@ -1,120 +0,0 @@
-BR2_aarch64=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
-BR2_GENERATE_LOCALE="en_US en_CA"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
-BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
-BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
-BR2_PACKAGE_STRACE=y
-BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_MDIO_TOOLS=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_DHCPCD=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_DROPBEAR=y
-BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
-BR2_PACKAGE_DROPBEAR_WTMP=y
-BR2_PACKAGE_DROPBEAR_LASTLOG=y
-BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MTR=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_VARIANT_CLASSIC=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_SULOGIN=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
-BR2_PACKAGE_TETRIS=y
@@ -12,24 +12,25 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/styx marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
 BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -53,6 +54,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -79,6 +81,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -91,6 +96,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -123,6 +129,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -135,14 +142,19 @@ BR2_PACKAGE_IITO=y
 BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 BR2_PACKAGE_LIBINPUT=y
 DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -13,21 +13,22 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh support/scripts/genimage.sh"
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/linux_defconfig"
@@ -63,6 +64,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -91,6 +93,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -103,6 +108,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -152,6 +158,7 @@ INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -164,13 +171,16 @@ BR2_PACKAGE_IITO=y
 BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 BR2_PACKAGE_LIBINPUT=y
 # SIGN_ENABLED is not set
 # GNS3_APPLIANCE is not set
@@ -1,121 +0,0 @@
-BR2_x86_64=y
-BR2_x86_corei7=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
-BR2_GENERATE_LOCALE="en_US en_CA"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_DHCPCD=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_DROPBEAR=y
-BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
-BR2_PACKAGE_DROPBEAR_WTMP=y
-BR2_PACKAGE_DROPBEAR_LASTLOG=y
-BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MTR=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_EDK2=y
-BR2_TARGET_GRUB2=y
-BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
-BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
-BR2_TARGET_GRUB2_INSTALL_TOOLS=y
-BR2_PACKAGE_HOST_DOSFSTOOLS=y
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_VARIANT_CLASSIC=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_SULOGIN=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
-BR2_PACKAGE_TETRIS=y
-DISK_IMAGE_BOOT_BIN=y
@@ -11,20 +11,21 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -48,6 +49,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -74,6 +76,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -86,6 +91,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -105,7 +111,7 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback cat search"
 BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
@@ -126,6 +132,7 @@ INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
@@ -138,12 +145,17 @@ BR2_PACKAGE_IITO=y
 BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
+BR2_PACKAGE_LANDING=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -4,6 +4,171 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.04.1][] - 2024-05-03
+-------------------------
+
+### Changes
+- Default web landing page refactored into a Buildroot package to make
+  it possible to overload from customer repos.
+- Enable DCB support in aarch64 kernel (for EtherType prio override)
+- Topology mapper improvements, including option for deterministic
+  reproduction of logical to physical mappings
+- New version of `gencert` tool, for self signed HTTPS certificates.
+  This allows dropping dependency on building a host rust toolchain
+- Issue #374: add timestamps to dagger .log files
+
+### Fixes
+- Add missing LICENSE hash for factory reset tool
+- Fix #424: regression, root user can log in without password
+
+
+[v24.04.0][] - 2024-04-30
+-------------------------
+
+**News:** this release marks the first major upgrade of the underlying
+Buildroot to the latest LTS release, v2024.02.  This caused a few small
+regressions in the release cycle, all known issues have been addressed.
+
+Also worth highlighting, as of this release the Infix Classic variant
+has been dropped.  It was the legacy Infix with manual configuration of
+the system using a persistent `/etc`.  May be resurrected later as a
+separate project.  Going forward Infix' focus is entirely on NETCONF.
+
+Finally, the YANG Status section has been dropped for this release, the
+idea is to generate supported features from the models and include in
+future releases.
+
+### Changes
+- Bump the base Buildroot version to v2024.02 LTS
+- Bump the base Linux kernel version to 6.6 LTS
+- Drop Classic variant to reduce overhead, simplify build & release
+  processes, and focus on NETCONF for Arm64 and Amd64 platforms
+- Add hostname restrictions to ietf-system, and infix-dhcp-client
+  models.  Max 64 characters on Linux systems
+- Add mDNS CNAME (alias) advertisement, e.g., infix.local in addition to
+  the default infix-c0-ff-ee.local.  Note: this is build-specific and
+  does not change if system hostname is changed
+- Add mDNS browser web application, https://network.local that shows all
+  mDNS devices on the LAN.  The network.local mDNS name is also a CNAME,
+  so with multiple Infix devices, only one will act as the mDNS browser
+- Add temporary landing page to web server for https://infix.local
+- Add web console using ttyd, https://infix.local:7681
+- Add support for disabling web services using CLI
+- The bridge model now has built-in validation of port memberships,
+  i.e., a port must be a bridge member to be used in VLAN filtering
+- The bridge model only permits the bridge itself to be a tagged
+  member of VLANs -- meaning, the only way to set an IP address on
+  such bridges is to use a VLAN interface on top
+- A VLAN filtering bridge now validates that no IP address has been
+  set.  Use a VLAN interface on top for that (see above)
+- Restructure documentation, let first page in doc/ be table of contents
+- Scripting Infix, new document on how to script Infix from remote,
+  e.g., for production or from a container
+- Introduction, update documentation now that the `admin` user's default
+  login shell is `/bin/bash`
+- System documentation, first outline of how to change hostname, add
+  users, add system administrator users, changing login banner, change
+  the system default editor, and more
+- Network documentation, add section on VETH pairs
+- Container documentation:
+  - CLI prompts have been updated to match the examples used in other
+    parts of the User Guide
+  - Default route example for static container interfaces
+  - How to upgrade a container image
+- As a follow-up to port speed/duplex/autoneg support added in v24.02,
+  this release ensures flow-control is always disabled on all Ethernet
+  ports, as described in the IEEE Ethernet interfaces YANG model
+- Add support for core dumps, saving them in `/var/crash`, max one dump
+  per process, for use with future support tarballs
+- Add support for multicast snooping, both IPv4 (IGMP) and IPv6 (MLD) in
+  bridge setups, including offloading to switchdev
+- Add support for acting as passive (proxy) or active IGMP querier
+- Add support for static multicast filters, MAC, IPv4 and IPv6 groups
+  are supported -- multicast snooping must be enabled
+- Include Buildroot `legal-info` in releases, i.e., licenses, sources
+  with patches, as well as csv files for packages and toolchain
+- Drop `shell` command from CLI to allow confining users
+- The CLI `copy` command now allows absolute paths
+- Local resolver, `dnsmasq`, had port 53 visible from external `nmap`
+  scans, even though it dropped non-local requests, it now only binds to
+  the loopback interface reduce number of externally visible ports
+- Kernel log messages, of severity error or higher, now log directly to
+  the console.  This may cause some annoyance but has been enabled to
+  ease debugging, in particular issues where the system crashes before
+  the syslog daemon has flushed logs to disk.  (Logs are still saved to
+  log files as well.)
+- Issue #325: Add support for multiple administrator users by opening
+  up basic NETCONF ACM support.  See documentation for details
+  - Any user can be added to the `admin` NACM group
+  - Any user *not* in the `admin` group is not allowed to have a login
+    shell other than the CLI (or disabled).  POSIX shell, e.g., Bash is
+	reserved for system administrators
+- Issue #327: Remove IPv6LL from bridge port interfaces
+- Issue #358: translate YANG model's LOWER-LAYER-DOWN -> LINK-DOWN in
+  CLI `show interfaces` command
+- Issue #360: document factory-config, startup-config, and the various
+  failure modes in the system
+- Issue #361: document how a privileged container can break out of its
+  confinement and run host commands, e.g., call `sysrepocfg`
+- Issue #365: add limited support for container capabilities, e.g., to
+  enable `CAP_NET_RAW` to allow containers to use `ping`.  This allows
+  users to avoid enabling privileged mode
+- Issue #367: setting date/time over NETCONF now saves system time also
+  to the RTC, which otherwise is only saved on reboot or power-down
+- Issue #369: Remove limitation that the routing instance must be
+  named 'default'
+
+### Fixes
+- confd: Fix memory leak when operating on candidate configuration
+- probe: Fix crash on systems without USB
+- Reduced syslog errors for accesses no non-existing xpaths
+- Fix bogus warning about not properly updating `/etc/motd` in new
+  `motd-banner` setting, introduced in v24.02.0
+- infix-routing model: the `enable` configuration setting for OSPF, in
+  `default-route-advertise` has been obsoleted and replaced by `enabled`
+- Fix #328: when setting up a VLAN filtering bridge, the PVID for bridge
+  ports defaulted to 1, making it impossible to set up "tagged-only"
+  ports which drop ingressing untagged traffic
+- Fix #329: VLAN inference for interfaces named `eth0.1`, i.e., VID 1 on
+  lower-layer-if `eth0`.  Only affects automatic inference in the CLI,
+  entering the values manually (CLI/NETCONF) not affected by this bug
+- Fix #331: inconsistent naming of 'enabled' in infix-routing.yang
+- Fix #349: minor changes to `bridge-port` settings, like setting `pvid`
+  when you forget it, did not take without a reboot
+- Fix #353: impossible to remove bridge port with `no bridge-port`
+- Fix #358: MAC address no longer shown for bridge interfaces in CLI
+  `show interfaces` command
+- Fix #365: not possible to run `ping` from container
+- Fix #366: static routes from container host interfaces do not work.
+  Documentation updated with an example
+- Fix #368: upgrading `oci-archive:/` images fail because system thinks
+  the image can be pulled from a localhost registry.  Documentation has
+  also been updated, describing various methods and how to upgrade them
+- Fix #370: despite the documentation stating containers must explicitly
+  declare `network` settings, Infix v23.02 had a late regression that
+  reverted back to the podman default: network behind a CNI bridge
+  (firewalled and NAT:ed, hidden from the rest of the network)
+- Fix #375: k8s-logger, used for containers, does not exit properly and
+  causes 100% CPU load when container stop or are restarted.  Also in
+  this issue: handle ip/route additions to container networks at runtime
+- Fix #384: segfault in helper function when disabling the DHCP client
+  using `no dhcp-client` from the CLI
+- Fix #391 Creating VLAN interface in the CLI with "edit interface vlanN"
+  does not set VLAN id to N.
+- Fix #404: `lldpd` should be disabled on internal interface `dsa0`
+- Fix #406: an overly restrictive `when` expression in the bridge YANG
+  model prevented users from adding VLAN interfaces as bridge ports.
+  E.g., creating interface `eth0.10` and adding that to `br0`
+- Fix #412: after starting up with DHCP client enabled on any interface
+  `set dhcp-client enabled false` does not bite at runtime
+- Fix #414: spelling error in `infix-hardware.yang`, leaf node `coutry`
+- Fix #415: `startup-config` owned by `root` user and group instead of
+  `admin`.  The file ownership is now adjusted on every boot
+- Fix #416: `admin` user cannot perform a factory reset with RPC using
+  `sysrepocfg` tool over SSH
+- Fix bogus syslog warning about not updating `/etc/motd` properly
+
+
 [v24.02.0][] - 2024-03-01
 -------------------------

@@ -438,11 +603,11 @@ Currently supported models:
 - Replace `ietf-if-vlan-encapsulation` YANG model with the native
  `infix-if-vlan` model.  This fits better with Linux VLAN interfaces and
  simplifies the syntax greatly.  For details, see PR #179
-  
+
        admin@example:/config/interfaces/interface/eth0.10/> set vlan id 10 lower-layer-if eth0

 - The following new NETCONF interface operational counters have been added:
-  
+
 | **YANG**                    | **Linux / Ethtool**               |
 |-----------------------------|-----------------------------------|
 | `out-frames`                | `FramesTransmittedOK`             |
@@ -480,7 +645,7 @@ Currently supported models:

 - Fix #106: confd: drop deviation `ietf-system:timezone-utc-offset`
 - Fix #151: Operational status broken in v23.09
- Fix #159: Hacky generation of `/etc/resolv.conf` at boot 
+- Fix #159: Hacky generation of `/etc/resolv.conf` at boot
 - Fix #162: VLAN interface without encapsulation is accepted by YANG model


@@ -696,7 +861,9 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.04.0...HEAD
+[v24.04.1]:   https://github.com/kernelkit/infix/compare/v24.04.0...v24.04.1
+[v24.04.0]:   https://github.com/kernelkit/infix/compare/v24.02.0...v24.04.0
 [v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
 [v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
 [v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
@@ -1 +0,0 @@
-variant.md
@@ -0,0 +1,35 @@
+
+Welcome to Infix, your friendly Network Operating System!  On these
+pages you can find both user and developer documentation.
+
+> Topics on configuring the system include CLI examples, every setting
+> is also possible to perform using NETCONF.  In fact, the Infix test
+> system solely relies on NETCONF for configuring network topologies.
+
+The CLI documentation is also available from inside the CLI itself using
+the `help` command.
+
+- **CLI Topics**
+   - [Introduction to the CLI](cli/introduction.md)
+   - [CLI User's Guide](cli/tutorial.md)
+   - [Quick Overview](cli/quick.md)
+ - **Infix User Guide**
+   - [Introduction](introduction.md)
+   - [System Configuration](system.md)
+   - [Network Configuration](networking.md)
+ - **Infix In-Depth**
+   - [Boot Procedure](boot.md)
+   - [Branding & Releases](branding.md)
+   - [Containers in Infix](container.md)
+   - [Find Your Device on the Network](discovery.md)
+   - [Hardware Info & Status](hardware.md)
+   - [Scripting Infix](scripting.md)
+   - [Virtual Environments](virtual.md)
+   - [Vital Product Data (VPD)](vpd.md)
+   - [YANG to Ethtool Mapping](eth-counters.md)
+   - [Origin & Licensing](license.md)
+ - **Developer Topics**
+   - [Developer's Guide](developers-guide.md)
+   - [Developing with Infix](override-package.md)
+   - [Regression Testing with Infamy](testing.md)
+
@@ -331,8 +331,6 @@ rollbacks when upgrading to a new version.

 Non-volatile storage of the system configuration and user data.
 Concretely, user data is everything stored under `/root` and `/home`.
-Depending on the operating mode, the configuration is either the NETCONF
-databases from `/cfg`, or the contents of `/etc` in classic mode.


 ### `var` - Variable Data
@@ -12,17 +12,18 @@ short guide intends to help you with that.
 ## Key Concepts

 The two modes in the CLI are the admin-exec and the configure context.
-When logging in to the system, be it from console or SSH, you land in
-admin-exec.  Here you can inspect the system status and do operations
-to debug networking issues, e.g. ping.  You can also enter configure
-context by typing: `configure`
+
+When logging in to the system, be it from console or SSH, you first have
+a stopover in a UNIX shell, usually Bash.  Type `cli` to enter the CLI
+and finally land in admin-exec.  Here you can inspect system status and
+do operations to debug networking issues, e.g. ping.  You can also enter
+configure context by typing: `configure`

 The system has several datastores (or files):

 - `factory-config` consists of a set of default configurations, some
   static and others generated per-device, e.g., a unique hostname and
-   number of ports/interfaces.   This file is generated at boot, if it
-   does not exist, i.e., only on first boot or after factory reset.
+   number of ports/interfaces.   This file is generated at boot.
 - `startup-config` is created from `factory-config` at boot if it does
   not exist.  It is loaded as the system configuration on each boot.
 - `running-config` is what is actively running on the system.  If no
@@ -66,5 +66,5 @@ admin@host:/config/system/> set text-editor <TAB>
 emacs	nano	vi
 admin@host:/config/system/> set text-editor nano
 admin@host:/config/system/> leave
-admin@example:/> 
+admin@host:/>
 ```
@@ -5,6 +5,8 @@ Containers in Infix
 * [Caution](#caution)
 * [Getting Started](#getting-started)
  * [Examples](#examples)
+* [Container Images](#container-images)
+* [Upgrading a Container Image](#upgrading-a-container-image)
 * [Networking and Containers](#networking-and-containers)
  * [Container Bridge](#container-bridge)
  * [Container Host Interface](#container-host-interface)
@@ -13,10 +15,10 @@ Containers in Infix
  * [Content Mounts](#content-mounts)
 * [Example Containers](#example-containers)
  * [System Container](#system-container)
-  * [Application Container: nftables](#application-container--nftables)
-  * [Application Container: ntpd](#application-container--ntpd)
-* [Upgrading a Container Image](#upgradeing-a-container-image)
-
+  * [Application Container: nftables](#application-container-nftables)
+  * [Application Container: ntpd](#application-container-ntpd)
+* [Advanced](#advanced)
+  * [Running Host Commands From Container](#running-host-commands-from-container)

 Introduction
 ------------
@@ -42,20 +44,24 @@ container networking in podman.
 Caution
 -------

-A word of warning, containers can run on your system in privileged mode,
-as `root`.  This gives them full access to devices on your system.  But
-even when though unprivileged containers are fenced from the host with
-Linux namespaces, and resource limited using Linux cgroups, which scope
-container applications from seeing and accessing the complete system,
-there is no guarantee that an application cannot ever break out of this
-confinement.
+A word of warning.  Containers can run on your system in privileged
+mode, as `root`, giving them full access to devices on your system.
+Even though containers are fenced from the host with Linux namespaces,
+resource limited using cgroups, and normally run with capped privileges,
+a privileged container is relatively easy to break out of.  A trivial
+example is given in the [Advanced](#advanced) section of this document.
+
+We recommend avoiding privileged containers, if possible (they do have
+valid use-cases) and instead use [capabilities](#capabilities).
+
+Remember:

 - If the system is compromised, containers can be used to easily
   install malicious software in your system and over the network
 - Your system is as secure as anything you run in the container
 - If you run containers, there is no security guarantee of any kind
 - Running 3rd party container images on your system could open a
-   security hole/attack vector/attack surface
+   security hole/attack vector/surface
 - An expert with knowledge how to build exploits will be able to
   jailbreak/elevate to root even if best practices are followed

@@ -101,28 +107,187 @@ application to run.

 Classic Hello World:

-    admin@example-c0-ff-ee:/> container run docker://hello-world
+    admin@example:/> container run docker://hello-world

 Persistent web server using nginx, sharing the host's network:

-    admin@example-c0-ff-ee:/> configure
-    admin@example-c0-ff-ee:/config> edit container web
-    admin@example-c0-ff-ee:/config/container/web> set image docker://nginx:alpine
-    admin@example-c0-ff-ee:/config/container/web> set publish 80:80
-    admin@example-c0-ff-ee:/config/container/web> set network host
-    admin@example-c0-ff-ee:/config/container/web> leave
-    admin@example-c0-ff-ee:/> show container
+    admin@example:/> configure
+    admin@example:/config> edit container web
+    admin@example:/config/container/web> set image docker://nginx:alpine
+    admin@example:/config/container/web> set publish 80:80
+    admin@example:/config/container/web> set network host
+    admin@example:/config/container/web> leave
+    admin@example:/> show container

 Exit to the shell and verify the service with curl, or try to attach
 to your device's IP address using your browser:

-    admin@example-c0-ff-ee:~$ curl http://localhost
+    admin@example:~$ curl http://localhost

 or connect to port 80 of your running Infix system with a browser.  See
 the following sections for how to add more interfaces and manage your
 container at runtime.


+Container Images
+----------------
+
+The underlying `podman` project support importing and fetching images in
+a variety of ways, the most common ones are also supported by Infix.  In
+this section we present how to use them and in the next section we show
+how to upgrade to a newer base image.
+
+The CLI help shows:
+
+    admin@example:/config/container/system/> help image
+    NAME
+        image <string>
+
+    DESCRIPTION
+        Docker image for the container: [transport]name[:tag|@digest]
+
+        quay.io/username/myimage     -- Pull myimage:latest
+        docker://busybox             -- Pull busybox:latest from Docker Hub
+        docker://ghcr.io/usr/img     -- Pull img:latest from GitHub packages
+        dir:/media/usb/myimage:1.1   -- Use myimage v1.1 from USB media
+        docker-archive:/tmp/archive  -- Use archive:latest from tarball
+        oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
+                                        May be in .tar or .tar.gz format
+
+        Note: if a remote repository cannot be reached, the creation of the
+              container will be put on a queue that retries pull every time
+              there is a route change in the host's system.
+
+> **Note::** the built-in help system in the CLI is generated from the
+> YANG model, so the same information is also available for remote
+> NETCONF users.
+
+The two most common variants are `docker://` and `oci-archive:/`.
+
+The former requires a working Docker registry and the latter operates on
+a plain OCI archive.  Infix does not come with a built-in registry, so
+the `docker://` option is best used with external services, which in
+turn require [networking][0] to be up.  In a deployment phase the
+easiest may be to set up a single interface on your host system with
+DHCP client.
+
+The default method is `docker://`, so when setting the `image` for your
+container, you can omit the `docker://` prefix.  You can also use the
+admin-exec command `container pull docker://...`, and when configuring a
+container `podman` will check first if it has the image before trying to
+download anything.  (See also the upgrade section, below.)
+
+The `oci-archive:/` is interesting since many users may not have, or do
+not want to, publish their images in a registry.  Use the Docker [OCI
+exporter][5] or any other tool that supports generating [OCI Image][3]
+format.  Infix supports loading both `.tar` or `.tar.gz` formats.
+
+Here we show a simple example of fetching an OCI image to the system,
+but many others exist, tools like `wget`, `curl`, and `scp` come to
+mind.
+
+**Shell OCI Example:**
+
+    admin@example:~$ cd /var/tmp/
+    admin@example:/var/tmp$ sudo wget https://github.com/kernelkit/curiOS/releases/download/edge/curios-oci-amd64.tar.gz
+    Connecting to github.com (140.82.121.3:443)
+    wget: note: TLS certificate validation not implemented
+    Connecting to objects.githubusercontent.com (185.199.109.133:443)
+    saving to 'curios-oci-amd64.tar.gz'
+    curios-oci-amd64.tar 100% |*********************************| 7091k  0:00:00 ETA
+    'curios-oci-amd64.tar.gz' saved
+    admin@example:/var/tmp$ ll
+    total 7104
+    drwxr-xr-x    3 root     root          4096 Mar 27 14:22 ./
+    drwxr-xr-x   14 root     root          4096 Mar 27 11:57 ../
+    -rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
+    drwx------    6 frr      frr           4096 Mar 27 11:57 frr/
+
+Importing the image into podman can be done either from the CLI
+admin-exec context ...
+
+    admin@example:/var/tmp$ cli
+    admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge
+
+> By assigning The `name curios:edge` is the tag you give the imported
+> (raw) archive which you can then reference in your container image
+> configuration: `set image curios:edge`.
+
+... or by giving the container configuration the full path to the OCI
+archive, which helps greatly with container upgrades (see below):
+
+    admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz
+
+
+Upgrading a Container Image
+---------------------------
+
+> **Note:** the default writable layer is lost when upgrading the image
+> Use named volumes for directories with writable content you wish to
+> keep over an upgrade.
+
+All container configurations are locked to the image hash at the time of
+first download, not just ones that use an `:edge` or `:latest` tag.  An
+upgrade of containers using versioned images is more obvious -- update
+the configuration to use the new `image:tag` -- the latter is a bit
+trickier.  Either remove the configuration and recreate it (leave/apply
+the changes between), or use the admin-exec level command:
+
+    admin@example:/> container upgrade NAME
+
+Where `NAME` is the name of your container.  This command stops the
+container, does `container pull IMAGE`, and then recreates it with the
+new image.  Upgraded containers are automatically restarted.
+
+**Example using registry:**
+
+	admin@example:/> container upgrade system
+	system
+	Trying to pull ghcr.io/kernelkit/curios:edge...
+	Getting image source signatures
+	Copying blob 07bfba95fe93 done
+	Copying config 0cb6059c0f done
+	Writing manifest to image destination
+	Storing signatures
+	0cb6059c0f4111650ddbc7dbc4880c64ab8180d4bdbb7269c08034defc348f17
+	system: not running.
+	59618cc3c84bef341c1f5251a62be1592e459cc990f0b8864bc0f5be70e60719
+
+An OCI archive image can be upgraded in a similar manner, the first step
+is of course to get the new archive onto the system (see above), and
+then, provided the `oci-archive:/path/to/archive` format is used, call
+the upgrade command as
+
+	admin@example:/> container upgrade system
+	Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
+	7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52
+
+
+Capabilities
+-------------
+
+An unprivileged container works for almost all use-cases, but there are
+occasions where they are too restricted and users being looking for the
+`privileged` flag.  Capabilities offers a middle ground.
+
+For example, a system container from which `ping` does not work:
+
+	admin@example:/config/container/system/> edit capabilities
+	admin@example:/config/container/system/capabilities/> set add net_raw
+	admin@example:/config/container/system/capabilities/> end
+	admin@infix-00-00-00:/config/container/system/> show
+	...
+	capabilities {
+	  add net_raw;
+	}
+	...
+
+Infix supports a subset of all [capabilities][6] that are relevant for
+containers.  Please note, that this is and advanced topic and will
+require time and analysis of your container application to figure out
+which capabilities you need.
+
+
 Networking and Containers
 -------------------------

@@ -130,100 +295,151 @@ By default, unlike other systems, persistent[^1] containers have no
 networking enabled.  All network access has to be set up explicitly.
 Currently two types of of container networks are supported:

- - `cni-host`: one end of a VETH pair, or a physical Ethernet port
- - `cni-bridge`: an IP masquerading bridge
+ - `host`: one end of a VETH pair, or a physical Ethernet port
+ - `bridge`: an IP masquerading bridge

+> For more information on VETH pairs, see the [Networking Guide][0].

-### CNI Bridge
+### Container Bridge

-All interface configuration is done in configure context.  Let's start
-by creating an IP masquerading bridge, a common default for containers:
+A container bridge is what most container setups use and users want.
+The difference from a regular bridge is that the container runtime fully
+manages them -- connecting containers automatically with VETH pairs and
+setting up firewall rules between the host and other containers, as well
+as managing port forwarding.  This transparent background management is
+what makes container use seem to be so simple.

-    admin@example-c0-ff-ee:/> configure
-    admin@example-c0-ff-ee:/config> edit interface docker0
-    admin@example-c0-ff-ee:/config/interface/docker0/> set type bridge
-    admin@example-c0-ff-ee:/config/interface/docker0/> set container-network type cni-bridge
-    admin@example-c0-ff-ee:/config/interface/docker0/> leave
+All interface configuration is done in configure context.

-We have to declare the interface type, and then also declare it as a
-container network, ensuring the interface cannot be used by the system
-for any other purpose.  E.g., a `cni-host` interface is supposed to be
-used by a container, by declaring it as such we can guarantee that it
-would never accidentally be added as a bridge or lag port.  Hence, to
-move an interface currently set as a `bridge-port` it must be removed
-from the bridge before being given to a container.
+    admin@example:/> configure
+    admin@example:/config> edit interface docker0
+    admin@example:/config/interface/docker0/> set container-network
+    admin@example:/config/interface/docker0/> leave

-The default subnet for a `cni-bridge` is 172.17.0.0/16, the bridge will
-take the `.1` address and hand out the rest of the range to containers
+There is more to this story.  When using the CLI, and sticking to common
+interface nomenclature, Infix helps you with some of the boring stuff.
+E.g., creating a new interface with a name like `brN` or `dockerN`
+automatically *infers* the interface types, which you would otherwise
+have to set manually:
+
+    admin@example:/config/interface/docker0/> set type bridge
+    admin@example:/config/interface/docker0/> set container-network type bridge
+
+> **Note:** when doing the same operation over NETCONF there is no
+> inference, so all the "magic" settings needs to be defined.  This
+> makes the CLI very useful for first setup and then extracting the
+> resulting XML from the shell using the `cfg -X` command.
+
+We have to declare the interface as a container network, ensuring the
+interface cannot be used by the system for any other purpose.  E.g., a
+container `host` interface is supposed to be used by a container, by
+declaring it as such we can guarantee that it would never accidentally
+be added as a bridge or lag port.  Hence, to move an interface currently
+set as a `bridge-port` it must be removed from the bridge before being
+given to a container.
+
+The default subnet for a container `bridge` is 172.17.0.0/16, the bridge
+takes the `.1` address and hand out the rest of the range to containers
 in a round-robin like fashion.  A container with this `network` get an
 automatically created VETH pair connection to the bridge and a lot of
 other networking parameters (DNS, default route) are set up.

-Some of the defaults of a `cni-bridge` can be changed, e.g., instead of
-`set container-network type cni-bridge`, above, do:
+Some of the defaults of a container `bridge` can be changed, e.g.,
+instead of `set container-network type bridge`, above, do:

-    admin@example-c0-ff-ee:/config/interface/docker0/> edit container-network
-    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> set type cni-bridge
-    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
-    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
-    admin@example-c0-ff-ee:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
-    admin@example-c0-ff-ee:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
-	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
-	admin@example-c0-ff-ee:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
-	admin@example-c0-ff-ee:/config/interface/docker0/container-network/> end
-    admin@example-c0-ff-ee:/config/interface/docker0/> leave
+    admin@example:/config/interface/docker0/> edit container-network
+    admin@example:/config/interface/docker0/container-network/> set type bridge
+    admin@example:/config/interface/docker0/container-network/> edit subnet 192.168.0.0/16
+    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> set gateway 192.168.255.254
+    admin@example:/config/interface/docker0/container-network/subnet/192.168.0.0/16/> end
+    admin@example:/config/interface/docker0/container-network/> edit route 10.0.10.0/24
+	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> set gateway 192.168.10.254
+	admin@example:/config/interface/docker0/container-network/route/10.0.10.0/24/> end
+	admin@example:/config/interface/docker0/container-network/> end
+    admin@example:/config/interface/docker0/> leave

-Other network settings, like DNS and domain, use built-in defaults in
-CNI, but can be overridden from each container.  Other common settings
-per container is the IP address and name of the network interface inside
-the container.  The default, after each stop/start cycle, or reboot of
-the host, is to name the interfaces `eth0`, `eth1`, in the order they
-are given in the `network` list, and to give the container the next
-address in a `cni-bridge`.  Below an example of a system container calls
-`set network interface docker0`, here we show how to set options for
-that network:
+Other network settings, like DNS and domain, use built-in defaults, but
+can be overridden from each container.  Other common settings per
+container is the IP address and name of the network interface inside the
+container.  The default, after each stop/start cycle, or reboot of the
+host, is to name the interfaces `eth0`, `eth1`, in the order they are
+given in the `network` list, and to give the container the next address
+in a `bridge`.  Below an example of a system container calls `set
+network interface docker0`, here we show how to set options for that
+network:

-    admin@example-c0-ff-ee:/config/container/ntpd/> edit network docker0 
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> 
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option 
-    <string>  Options for CNI bridges.
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> help option 
+    admin@example:/config/container/ntpd/> edit network docker0 
+    admin@example:/config/container/ntpd/network/docker0/> 
+    admin@example:/config/container/ntpd/network/docker0/> set option 
+    <string>  Options for masquerading container bridges.
+    admin@example:/config/container/ntpd/network/docker0/> help option 
    NAME
            option <string>
    
    DESCRIPTION
-            Options for CNI bridges.
-            Example: ip=1.2.3.4 to request a specific IP, both IPv4 and IPv6.
-            interface_name=foo0 name to set interface name inside container.
+            Options for masquerading container bridges.
+
+            Example: ip=1.2.3.4            -- request a specific IP (IPv4 or IPv6)
+                     mac=00:01:02:c0:ff:ee -- set fixed MAC address in container
+                     interface_name=foo0   -- set interface name inside container
    
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> set option interface_name=wan
-    admin@example-c0-ff-ee:/config/container/ntpd/network/docker0/> leave
+    admin@example:/config/container/ntpd/network/docker0/> set option ip=172.17.0.2
+    admin@example:/config/container/ntpd/network/docker0/> set option interface_name=wan
+    admin@example:/config/container/ntpd/network/docker0/> leave


-### CNI Host
+### Container Host Interface

 Another common use-case is to move a network interface into the network
-namespace of a container.  Which the CNI bridge network does behind the
-scenes with one end of the automatically created VETH pair.  This works
-with regular Ethernet interfaces as well, but here we will use a VETH
-pair as an example along with a regular bridge (where other Ethernet
-interfaces may live as well).
+namespace of a container.  Which the container bridge network type does
+behind the scenes with one end of the automatically created VETH pair.
+This works with regular Ethernet interfaces as well, but here we will
+use a VETH pair as an example along with a regular bridge (where other
+Ethernet interfaces may live as well).

-    admin@example-c0-ff-ee:/config/> edit interface veth0
-    admin@example-c0-ff-ee:/config/interface/veth0/> set veth peer ntpd
-    admin@example-c0-ff-ee:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
-    admin@example-c0-ff-ee:/config/interface/veth0/> end
-    admin@example-c0-ff-ee:/config/> edit interface ntpd
-    admin@example-c0-ff-ee:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
-    admin@example-c0-ff-ee:/config/interface/ntpd/> set container-network
+    admin@example:/config/> edit interface veth0
+    admin@example:/config/interface/veth0/> set veth peer ntpd
+    admin@example:/config/interface/veth0/> set ipv4 address 192.168.0.1 prefix-length 24
+    admin@example:/config/interface/veth0/> end
+    admin@example:/config/> edit interface ntpd
+    admin@example:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
+    admin@example:/config/interface/ntpd/> set container-network

 This is a routed setup, where we reserve 192.168.0.0/24 for the network
 between the host and the `ntpd` container.  A perhaps more common case
 is to put `veth0` as a port in a bridge with other physical ports.  The
 point of the routed case is that port forwarding from the container in
 this case is limited to a single interface, not *all interfaces* as is
-the default in the CNI Bridge setup.
+the default in the masquerading container bridge setup.
+
+When a container has multiple host interfaces it can often be useful to
+have a default route installed.  This can be added from the host with a
+`0.0.0.0/0` route on one of the interfaces.  The following is an example
+when adding a second VETH pair to the container:
+
+    admin@example:/config/> edit interface veth1a
+    admin@example:/config/interface/veth1a/> set veth peer veth1b
+    admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24
+    admin@example:/config/interface/veth1a/> set container-network route 0.0.0.0/0 gateway 192.168.1.1
+    admin@example:/config/interface/veth1a/> show
+    type veth;
+	container-network {
+	  type host;
+	  route 0.0.0.0/0 {
+		gateway 192.168.1.1;
+	  }
+	}
+	veth {
+	  peer veth1b;
+	}
+    admin@example:/config/interface/veth1a/> end
+    admin@example:/config/> set interface veth1b bridge-port bridge br0
+
+Please note, container network routes require the base interface also
+have a static IP address set.  Setting only the route, but no address,
+means the route is skipped.
+
+> The LAN bridge (br0) in this example has IP address 192.168.1.1.


 ### Host Networking
@@ -245,16 +461,16 @@ It is possible to mount files, directories, and even files matching a
 glob, into a container.  This gives precise control over the container's
 file system:

-    admin@example-c0-ff-ee:/config/container/system/> edit mount leds
-    admin@example-c0-ff-ee:/config/container/system/mount/leds> set source /sys/class/leds
-    admin@example-c0-ff-ee:/config/container/system/mount/leds> set target /sys/class/leds
-    admin@example-c0-ff-ee:/config/container/system/mount/leds> end
-    admin@example-c0-ff-ee:/config/container/system/>
+    admin@example:/config/container/system/> edit mount leds
+    admin@example:/config/container/system/mount/leds> set source /sys/class/leds
+    admin@example:/config/container/system/mount/leds> set target /sys/class/leds
+    admin@example:/config/container/system/mount/leds> end
+    admin@example:/config/container/system/>

 Sometimes *volumes* are a better fit.  A volume is an automatically
 created read-writable entity that follows the life of your container.

-    admin@example-c0-ff-ee:/config/container/ntpd/> set volume varlib target /var/lib
+    admin@example:/config/container/ntpd/> set volume varlib target /var/lib

 Volumes survive reboots and upgrading of the base image, unlike the
 persistent writable layer you get by default, which does not survive
@@ -275,12 +491,12 @@ very useful when deploying similar systems at multiple sites.  When the
 host loads its `startup-config` (or even `factory-config`) a temporary
 file is created using the decoded base64 data from the `content` node.

-    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntpd.conf
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set content
+    admin@example:/config/container/ntpd/> edit mount ntpd.conf
+    admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
    ... interactive editor starts up ...
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntpd.conf> end
-    admin@example-c0-ff-ee:/config/container/ntpd/>
+    admin@example:/config/container/ntpd/mount/ntpd.conf> set target /etc/ntpd.conf
+    admin@example:/config/container/ntpd/mount/ntpd.conf> end
+    admin@example:/config/container/ntpd/>

 The editor is a small [Emacs clone called Mg][2], see the built-in help
 text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
@@ -290,6 +506,9 @@ the contents are base64 encoded and stored in the candidate datastore.
 > restarted, changes made by the container are not preserved, or saved
 > back to the host's startup-config even if the read-only option is off.

+Infix has three different text editors available.  For more information,
+see [CLI Text Editor](cli/text-editor.md).
+

 Example Containers
 ------------------
@@ -300,12 +519,12 @@ Let's try out what we've learned by setting up a system container, a
 container providing multiple services, using the `docker0` interface
 we created previously:

-    admin@example-c0-ff-ee:/> configure
-    admin@example-c0-ff-ee:/config> edit container system
-    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
-    admin@example-c0-ff-ee:/config/container/system/> set network interface docker0
-    admin@example-c0-ff-ee:/config/container/system/> set publish 222:22
-    admin@example-c0-ff-ee:/config/container/system/> leave
+    admin@example:/> configure
+    admin@example:/config> edit container system
+    admin@example:/config/container/system/> set image ghcr.io/kernelkit/curios:edge
+    admin@example:/config/container/system/> set network interface docker0
+    admin@example:/config/container/system/> set publish 222:22
+    admin@example:/config/container/system/> leave

 > **Note:** ensure you have a network connection to the registry.
 > If the image cannot be pulled, creation of the container will be
@@ -319,25 +538,25 @@ container configuration context for the full syntax.)

 Available containers can be accessed from admin-exec:

-    admin@example-c0-ff-ee:/> show container
+    admin@example:/> show container
    CONTAINER ID  IMAGE                          COMMAND     CREATED       STATUS       PORTS                 NAMES
    439af2917b44  ghcr.io/kernelkit/curios:edge              41 hours ago  Up 16 hours  0.0.0.0:222->222/tcp  system

 This is a system container, so you can "attach" to it by starting a
 shell (or logging in with SSH):

-    admin@example-c0-ff-ee:/> container shell system
+    admin@example:/> container shell system
    root@439af2917b44:/#

 Notice how the hostname inside the container changes.  By default the
 container ID (hash) is used, but this can be easily changed:

    root@439af2917b44:/# exit
-    admin@infix-00-00-00:/> configure
-    admin@infix-00-00-00:/config/> edit container system
-    admin@infix-00-00-00:/config/container/system/> set hostname sys101
-    admin@infix-00-00-00:/config/container/system/> leave
-    admin@infix-00-00-00:/> container shell system
+    admin@example:/> configure
+    admin@example:/config/> edit container system
+    admin@example:/config/container/system/> set hostname sys101
+    admin@example:/config/container/system/> leave
+    admin@example:/> container shell system
    root@sys101:/#

 [^1]: this does not apply to the admin-exec command `container run`.
@@ -350,18 +569,22 @@ container ID (hash) is used, but this can be easily changed:

 Infix currently does not have a native firewall configuration, and even
 when it does it will never expose the full capabilities of `nftables`.
-For really advanced setups, the following will be the only alternative:
+For advanced setups, the following is an interesting alternative.

-    admin@example-c0-ff-ee:/> configure
-    admin@example-c0-ff-ee:/config> edit container nftables
-    admin@example-c0-ff-ee:/config/container/system/> set image ghcr.io/kernelkit/curios-nftables:edge
-    admin@example-c0-ff-ee:/config/container/system/> set network host
-    admin@example-c0-ff-ee:/config/container/system/> edit mount nftables.conf
-    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set target /etc/nftables.conf
-    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> set content
+    admin@example:/> configure
+    admin@example:/config> edit container nftables
+    admin@example:/config/container/nftables/> set image ghcr.io/kernelkit/curios-nftables:edge
+    admin@example:/config/container/nftables/> set network host
+    admin@example:/config/container/nftables/> set privileged
+    admin@example:/config/container/nftables/> edit mount nftables.conf
+    admin@example:/config/container/nftables/mount/nftables.conf/> set target /etc/nftables.conf
+    admin@example:/config/container/nftables/mount/nftables.conf/> text-editor content
    ... interactive editor starts up where you can paste your rules ...
-    admin@example-c0-ff-ee:/config/container/system/mount/nftables.conf/> leave
+    admin@example:/config/container/nftables/mount/nftables.conf/> leave

+Notice how we `set network host`, so the container can see and act on
+all the host's interfaces, and that we also have to run the container
+in *privileged* mode.

 ### Application Container: ntpd

@@ -375,49 +598,86 @@ file system and store in the host's `startup-config`.  However, `ntpd`
 also saves clock drift information in `/var/lib/ntpd`, so we will also
 use volumes in this example.

-    admin@example-c0-ff-ee:/> configure
-    admin@example-c0-ff-ee:/config> edit container ntpd
-    admin@example-c0-ff-ee:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
-    admin@example-c0-ff-ee:/config/container/ntpd/> set network interface ntpd    # From veth0 above
-    admin@example-c0-ff-ee:/config/container/ntpd/> edit mount ntp.conf
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> set content
+    admin@example:/> configure
+    admin@example:/config> edit container ntpd
+    admin@example:/config/container/ntpd/> set image ghcr.io/kernelkit/curios-ntpd:edge
+    admin@example:/config/container/ntpd/> set network interface ntpd    # From veth0 above
+    admin@example:/config/container/ntpd/> edit mount ntp.conf
+    admin@example:/config/container/ntpd/mount/ntp.conf/> set target /etc/ntp.conf
+    admin@example:/config/container/ntpd/mount/ntp.conf/> text-editor content
    ... interactive editor starts up where you can paste your rules ...
-    admin@example-c0-ff-ee:/config/container/ntpd/mount/ntp.conf/> end
-    admin@example-c0-ff-ee:/config/container/ntpd/> edit volume varlib
-    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> set target /var/lib
-    admin@example-c0-ff-ee:/config/container/ntpd/volume/varlib/> leave
-    admin@example-c0-ff-ee:/> copy running-config startup-config
+    admin@example:/config/container/ntpd/mount/ntp.conf/> end
+    admin@example:/config/container/ntpd/> edit volume varlib
+    admin@example:/config/container/ntpd/volume/varlib/> set target /var/lib
+    admin@example:/config/container/ntpd/volume/varlib/> leave
+    admin@example:/> copy running-config startup-config

 The `ntp.conf` file is stored in the host's `startup-config` and any
 state data in the container's `/var/lib` is retained between reboots
 and across image upgrades.


-Upgrading a Container Image
---------------------------
+Advanced
+--------

-All container configurations are locked to the image hash at the time of
-first download, not just ones that use an `:edge` or `:latest` tag.  An
-upgrade of containers using versioned images is more obvious -- update
-the configuration -- but the latter is a bit trickier.  Either remove
-the configuration and recreate it (leave/apply the changes between), or
-use the admin-exec level command:
+This section covers advanced, and sometimes dangerous, topics.  Please
+read any warnings and always consider the security aspects.

-    admin@example-c0-ff-ee:/> container upgrade NAME
+### Running Host Commands From Container

-Where `NAME` is the name of your container.  This command stops your
-container, does a `container pull IMAGE`, and then recreates the
-container with the new image.  Upgraded containers are not automatically
-restarted.
+SSH login with keys is very handy, both remote scripting friendly *and
+secure*, but it does require a few extra configuration steps.  The way
+to set it up is covered in part in [SSH Authorized Key][4].

-    admin@example-c0-ff-ee:/> container start NAME
+Another *insecure* approach is to access the host system directly,
+bypassing the namespaces that make up the boundary between host and
+container.

-> **Note:** the default writable layer is lost when upgrading the image
-> Use named volumes for directories with writable content you wish to
-> keep over an upgrade.
+> **Security:** Please note, this completely demolishes the isolation
+> barrier between container and host operating system.  It is only
+> suitable in situations where the container serves more as a unit of
+> distribution rather than as a separate component of the system.
+> *Strongly recommended* to use this only in trusted setups!  Consider
+> also limiting the time frame in which this is active!
+
+First, enable *Privileged* mode, this unlocks the door and allows the
+container to manage resources on the host system.  An example is the
+`nftables` container mentioned previously.
+
+    admin@example:/config/container/system/> set privileged
+
+Second, mount the host's `/proc/1` directory to somewhere inside your
+container.  Here we pick `/1`:
+
+	admin@example:/config/container/system/> edit mount host
+	admin@example:/config/container/system/mount/host/> set source /proc/1
+	admin@example:/config/container/system/mount/host/> set target /1
+	admin@example:/config/container/system/mount/host/> leave
+
+Third, from inside the container, use the host's PID 1 namespaces with
+the `nsenter`[^2] command to slide through the container's walls.  Here
+we show two example calls to `hostname`, first the container's own name
+and then asking what the hostname is on the host:
+
+	root@sys101:/# hostname
+	sys101
+    root@sys101:/# nsenter -m/1/ns/mnt -u/1/ns/uts -i/1/ns/ipc -n/1/ns/net hostname
+	example
+
+One use-case for this method is when extending Infix with a management
+container that connects to other systems.  For some tips on how to
+control an Infix system this way, see [Scripting Infix](scriptiong.md).
+
+[^2]: The `nsenter` program is available from either the util-linux
+    package in Debian/Ubuntu/Mint, or in BusyBox.  Note, however,
+	it may not be enabled by default in BusyBox.


+[0]:      networking.md
 [1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers%402023-12-14.yang
 [2]:      https://github.com/troglobit/mg
+[3]:      https://github.com/opencontainers/image-spec/blob/main/image-layout.md
+[4]:      system.md#ssh-authorized-key
+[5]:      https://docs.docker.com/build/exporters/oci-docker/
+[6]:      https://man7.org/linux/man-pages/man7/capabilities.7.html
 [podman]: https://podman.io
@@ -66,7 +66,15 @@ The instructions here are for Debian/Ubuntu based systems (YMMV):
 $ sudo apt install bc binutils build-essential bzip2 cpio \
                   diffutils file findutils git gzip      \
                   libncurses-dev libssl-dev perl patch   \
-                   python rsync sed tar unzip wget
+                   python3 rsync sed tar unzip wget       \
+                   autopoint bison flex
+```
+
+For testing, a few more tools and services are required on your system:
+
+```bash
+$ sudo apt install jq graphviz qemu-system-x86 qemu-system-arm \
+				   ethtool gdb-multiarch tcpdump tshark
 ```

 > For details, see the Getting Started and System Requirements sections
@@ -1,4 +1,5 @@
 # YANG to Ethtool Mapping
+
 This column contains the mapping between YANG and Linux / Ethtool counters.

 ```
@@ -1,10 +1,13 @@
-# Hardware information and status
+# Hardware Information and Status

-The hardware infomation and status is handled by the YANG model [IETF hardware][ietf-hardware].
-with deviations and augmentations in _infix-hardware_.
+The hardware infomation and status is handled by the YANG model [IETF
+hardware][1], with deviations and augmentations in _infix-hardware_.

 ## USB Ports
-For infix to be able to control the USB port(s), a device tree modification is needed (see _alder.dtsi_ for full example).
+
+For Infix to be able to control USB port(s), a device tree modification
+is needed (see _alder.dtsi_ for full example).
+
 ```
 chosen {
   infix {
@@ -13,33 +16,44 @@ For infix to be able to control the USB port(s), a device tree modification is n
   };
 };
 ```
+
 Two USB ports are also exposed in QEMU for test purpose.

-All USB ports in the system will be disabled during boot due to the file _board/common/rootfs/etc/modprobe.d/usbcore.conf_.
-If you not want Infix to controll the USB port(s), remove the file or manually enable the USB bus, here is an example:
+All USB ports in the system will be disabled during boot due to the file
+`board/common/rootfs/etc/modprobe.d/usbcore.conf`.  If you do not want
+Infix to control USB port(s), remove the file or manually enable the USB
+bus, here is an example:

 ```
- # Enable the bus
+# Enable the bus
 echo 1 > /sys/bus/usb/devices/usb1/authorized
 ```
+
 And then enable sub-devices (e.g. USB memory)
+
 ```
 # Enable a device plugged into usb1
 echo 1 >  /sys/bus/usb/devices/usb1/1-1/authorized
 ```

 ### Current status
+
 ```
 admin@example:/> show hardware
 USB PORTS
 NAME                STATE
 USB                 unlocked
 ```
-An USB port can be in two states _unlocked_ and _locked_. When a port is locked,
-all connected devices will get power, but never authorized by Linux to use.
+
+An USB port can be in two states _unlocked_ and _locked_. When a port is
+locked, all connected devices will get power, but never authorized by
+Linux to use.

 ### Configure USB port
-> **Note:** You can only configure an USB ports that exist in _show hardware_ in admin exec.
+
+> **Note:** You can only configure USB ports known to the system.  See
+> `show hardware` in admin-exec context.  (Use `do` prefix in configure
+> context.)

 ```
 root@example:/> configure
@@ -48,4 +62,4 @@ all connected devices will get power, but never authorized by Linux to use.
 root@example:/>
 ```

-[ietf-hardware]:         https://www.rfc-editor.org/rfc/rfc8348.html
+[1]:  https://www.rfc-editor.org/rfc/rfc8348.html
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`[2m[1mNote:[0m[2m use help, show, and setup commands to set up and diagnose the system.[0m`
				`@@ -0,0 +1 @@`
				`task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate`
				`@@ -0,0 +1 @@`
				`service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)`
				`@@ -1 +0,0 @@`
				`/var/lib/avahi-autoipd d 0755 avahi avahi - - - - -`