package/python-statd: update LICENSE hash

Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
package/statd: update LICENSE hash
2026-07-22 09:13:01 +02:00 · 2024-05-01 17:44:26 +02:00 · 2024-05-01 17:42:38 +02:00 · 2024-05-01 15:17:50 +02:00 · 2024-05-01 15:16:11 +02:00 · 2024-05-01 12:35:13 +02:00
372 changed files with 15562 additions and 11459 deletions
@@ -8,43 +8,32 @@ on:

 jobs:
  build:
-    name: Build ${{ matrix.platform }} ${{ matrix.variant }}
-    runs-on: ubuntu-latest
+    name: Build Infix ${{ matrix.platform }}
+    runs-on: [ self-hosted, latest ]
    strategy:
      matrix:
        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - name: Maintenance
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Build Variables
        id: vars
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}
-          fi
+          target=${{ matrix.platform }}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          if [ "$target" = x86_64 ]; then
-              echo "out=$PWD/output"      >> $GITHUB_OUTPUT
-          else
-              echo "out=/mnt/x-$target"   >> $GITHUB_OUTPUT
-          fi
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.variant }}-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -53,39 +42,35 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
+
      - name: Configure & Build
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
+          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
-          sudo mkdir ${{ steps.vars.outputs.out }}
-          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
-          export O=${{ steps.vars.outputs.out }}
          make $target
          make
+
      - name: Prepare Artifact
        run: |
-          cd ${{ steps.vars.outputs.out }}
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
      - name: Test
-        if: matrix.platform == 'x86_64' && matrix.variant == 'netconf'
+        if: matrix.platform == 'x86_64'
        run: |
-          export O=${{ steps.vars.outputs.out }}
-          make test-qeneth
+          make test
      - uses: actions/upload-artifact@v4
        with:
-          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
+          path: output/${{ steps.vars.outputs.tgz }}
+          name: artifact-${{ matrix.platform }}
+
  release:
    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
    name: Upload Latest Build
    needs: build
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, latest ]
    permissions:
      contents: write
    steps:
@@ -93,6 +78,7 @@ jobs:
        with:
          pattern: "artifact-*"
          merge-multiple: true
+
      - uses: ncipollo/release-action@v1
        with:
          allowUpdates: true
@@ -103,6 +89,7 @@ jobs:
          tag: "latest"
          token: ${{ secrets.GITHUB_TOKEN }}
          artifacts: "*.tar.gz"
+
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -24,6 +24,7 @@ jobs:
               --post-data "token=$TOKEN&project=${PROJECT_NAME}&md5=1" \
               -O coverity-latest.tar.gz.md5
          echo "md5=$(cat coverity-latest.tar.gz.md5)" | tee -a $GITHUB_OUTPUT
+
      - uses: actions/cache@v4
        id: cache
        with:
@@ -33,6 +34,7 @@ jobs:
            ${{ runner.os }}-coverity-${{ steps.var.outputs.md5 }}
            ${{ runner.os }}-coverity-
            ${{ runner.os }}-coverity
+
      - name: Download Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -47,12 +49,14 @@ jobs:
          fi
          mkdir coverity
          tar xzf coverity-latest.tar.gz --strip 1 -C coverity
+
      - name: Install dependencies
        run: |
          sudo apt-get -y update
          sudo apt-get -y install pkg-config libjansson-dev libev-dev \
                       libaugeas-dev libglib2.0-dev libpcre2-dev      \
                       libuev-dev libite-dev
+
      - name: Build dependencies
        run: |
          git clone https://github.com/CESNET/libyang.git
@@ -62,10 +66,12 @@ jobs:
          mkdir sysrepo/build
          (cd sysrepo/build && cmake .. && make all && sudo make install)
          make dep
+
      - name: Check applications
        run: |
          export PATH=`pwd`/coverity/bin:$PATH
          cov-build --dir cov-int make check
+
      - name: Submit results to Coverity Scan
        env:
          TOKEN: ${{ secrets.COVERITY_SCAN_TOKEN }}
@@ -78,6 +84,7 @@ jobs:
            --form version=$(git rev-parse HEAD) \
            --form description="${PROJECT_NAME} $(git rev-parse HEAD)" \
            https://scan.coverity.com/builds?project=${PROJECT_NAME}
+
      - name: Upload build.log
        uses: actions/upload-artifact@v4
        with:
@@ -16,18 +16,24 @@ concurrency:
 jobs:
  build:
    name: Regression Testing
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, regression ]
    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name != github.event.pull_request.base.repo.full_name
    steps:
      - uses: actions/checkout@v4
        with:
          submodules: 'true'
+
+      - name: Clean up cruft ...
+        run: |
+          ./test/env -c
+
      - name: Set Build Variables
        id: vars
        run: |
          target=x86_64
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
@@ -36,6 +42,7 @@ jobs:
          restore-keys: |
            dl-netconf-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -44,19 +51,22 @@ jobs:
          restore-keys: |
            ccache-x86_64-
            ccache-
+
      - name: Configure NETCONF
        run: |
          make x86_64_defconfig

      - name: Unit Test
-        run: make test-unit
+        run: |
+          make test-unit

      - name: Build
        run: |
          make
+
      - name: Prepare Artifact
        run: |
-          cd output
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
@@ -66,7 +76,8 @@ jobs:
          path: output/${{ steps.vars.outputs.tgz }}

      - name: Regression Test
-        run: make test-qeneth
+        run: |
+          make test

      - name: Publish Test Result
        # Ensure this runs even if Regression Test fails
@@ -20,20 +20,17 @@ on:
 jobs:
  build:
    if: github.repository == 'kernelkit/infix' && startsWith(github.ref, 'refs/tags/')
-    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}-${{ matrix.variant }}]
-    runs-on: ubuntu-latest
+    name: Build Infix ${{ github.ref_name }} [${{ matrix.platform }}]
+    runs-on: [ self-hosted, release ]
    strategy:
      matrix:
        platform: [aarch64, x86_64]
-        variant: [netconf, classic]
      fail-fast: false
    steps:
-      - name: Maintenance
-        run: |
-          docker image prune -af
-          docker volume prune -f
-          docker container prune -f
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Release Variables
        id: vars
        run: |
@@ -44,22 +41,18 @@ jobs:
          fi
          echo "ver=${ver}" >> $GITHUB_OUTPUT
          fver=${ver#v}
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}-${fver}
-          else
-              target=${{ matrix.platform }}-${{ matrix.variant }}-${fver}
-          fi
+          target=${{ matrix.platform }}-${fver}
          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "out=/mnt/x-$target"       >> $GITHUB_OUTPUT
+
      - name: Restore Cache of dl/
        uses: actions/cache@v4
        with:
          path: dl/
-          key: dl-${{ matrix.variant }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          key: dl-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
          restore-keys: |
-            dl-${{ matrix.variant }}-
            dl-
+
      - name: Restore Cache of .ccache/
        uses: actions/cache@v4
        with:
@@ -68,39 +61,46 @@ jobs:
          restore-keys: |
            ccache-${{ matrix.platform }}-
            ccache-
+
      - name: Configure & Build
        env:
          INFIX_RELEASE: ${{ steps.vars.outputs.ver }}
        run: |
-          if [ "${{ matrix.variant }}" = "netconf" ]; then
-              target=${{ matrix.platform }}_defconfig
-          else
-              target=${{ matrix.platform }}_${{ matrix.variant }}_defconfig
-          fi
+          target=${{ matrix.platform }}_defconfig
          echo "Building $target ..."
-          sudo mkdir ${{ steps.vars.outputs.out }}
-          sudo chown $(id -un):$(id -gn) ${{ steps.vars.outputs.out }}
-          export O=${{ steps.vars.outputs.out }}
          make $target
          make
-      - name: Prepare Artifact
+
+      - name: Generate SBOM from Build
        run: |
-          cd ${{ steps.vars.outputs.out }}
+          make legal-info
+
+      - name: Prepare Artifacts
+        run: |
+          cd output/
          mv images ${{ steps.vars.outputs.dir }}
          ln -s ${{ steps.vars.outputs.dir }} images
          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+
+          mv legal-info legal-info-$target
+          tar chfz legal-info-$target.tar.gz legal-info-$target
+
      - uses: actions/upload-artifact@v4
        with:
-          path: ${{ steps.vars.outputs.out }}/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.variant }}-${{ matrix.platform }}
+          name: artifact-${{ matrix.platform }}
+          path: output/*.tar.gz
+
  release:
    name: Release Infix ${{ github.ref_name }}
    needs: build
-    runs-on: ubuntu-latest
+    runs-on: [ self-hosted, release ]
    permissions:
      contents: write
    steps:
      - uses: actions/checkout@v4
+        with:
+          submodules: 'true'
+
      - name: Set Release Variables
        id: rel
        run: |
@@ -122,20 +122,24 @@ jobs:
          fi
          echo "pre=${{ steps.rel.outputs.pre }}"
          echo "latest=${{ steps.rel.outputs.latest }}"
+
      - uses: actions/download-artifact@v4
        with:
          pattern: "artifact-*"
          merge-multiple: true
+
      - name: Create checksums ...
        run: |
          for file in *.tar.gz; do
              sha256sum $file > $file.sha256
          done
+
      - name: Extract ChangeLog entry ...
        run: |
          awk '/^-----*$/{if (x == 1) exit; x=1;next}x' doc/ChangeLog.md \
              |head -n -1 > release.md
          cat release.md
+
      - uses: ncipollo/release-action@v1
        with:
          name: Infix ${{ github.ref_name }}
@@ -143,6 +147,7 @@ jobs:
          makeLatest: ${{ steps.rel.outputs.latest }}
          bodyFile:  release.md
          artifacts: "*.tar.gz*"
+
      - name: Summary
        run: |
          cat <<EOF >> $GITHUB_STEP_SUMMARY
@@ -112,25 +112,6 @@ config INFIX_ARCH
 	default "riscv64" if BR2_riscv
 	default "x86_64"  if BR2_x86_64

-# For /etc/os-release, VARIANT & VARIANT_ID used, e.g., in mnt script
-choice
-	prompt "Select variant/flavor"
-	default INFIX_VARIANT_NETCONF
-
-config INFIX_VARIANT_NETCONF
-	bool "NETCONF"
-	help
-	  Managed NETCONF mode, /etc is a ramdisk, all configuration is
-	  generated by sysrepo plugins using NETCONF (xml) or RESTCONF.
-
-config INFIX_VARIANT_CLASSIC
-	bool "Classic /etc mode"
-	help
-	  User managed mode, read-write configuration files in /etc that
-	  is saved across reboots.
-
-endchoice
-
 menu "Packages"

 source "$BR2_EXTERNAL_INFIX_PATH/package/Config.in"
@@ -25,6 +25,9 @@ $(config):
 %: | buildroot/Makefile
 	@+$(call bmake,$@)

+legal-info: | buildroot/Makefile
+	$(call bmake,legal-info LINUX_LICENSE_FILES=COPYING)
+
 # Workaround, see board/x86_64/board.mk
 test:
 	@+$(call bmake,$@)
@@ -1,29 +1,16 @@
-[![License Badge][]][License] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]
+[![License Badge][]][License] [![GitHub Status][]][GitHub] [![Coverity Status][]][Coverity Scan] [![Discord][discord-badge]][discord-url]

 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
-<details><summary><b>Documentation</b></summary>
-
- - **Infix In-Depth**
-   - [Infix Variants](doc/variant.md)
-   - [Boot Procedure](doc/boot.md)
-   - [Containers in Infix](doc/container.md)
-   - [Developer's Guide](doc/developers-guide.md)
-   - [Discover Your Device](doc/discovery.md)
-   - [Virtual Environments](doc/virtual.md)
-   - [Origin & Licensing](doc/license.md)
- **CLI Topics**
-   - [Introduction to the CLI](doc/cli/introduction.md)
-   - [CLI User's Guide](doc/cli/tutorial.md)
-   - [Quick Overview](doc/cli/quick.md)
-
-</details>

 Infix is a free, Linux based, immutable Network Operating System (NOS)
 built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
 porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF[^1] or the built-in [command
-line interface (CLI)][3] from a console or SSH login.  *Click the
-foldout (▶ Example CLI Session) below for an example.*
+provide made-easy management using NETCONF[^1] or the built-in command
+line interface (CLI) from a console or SSH login.
+
+> Click the **▶ Example CLI Session** foldout below for an example, or
+> head on over to the [Infix Documentation](doc/README.md) for more
+> information on how to set up the system.

 Although primarily focused on switches and routers, the core values
 may be appealing for other use-cases as well:
@@ -118,8 +105,7 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 >
 > For *customer specific builds* of Infix, see your product repository.

-[^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>,
-    for more information, see [Infix Variants](doc/variant.md).
+[^1]: NETCONF or RESTCONF, <https://datatracker.ietf.org/doc/html/rfc8040>

 [^2]: An immutable operating system is one with read-only file systems,
    atomic updates, rollbacks, declarative configuration, and workload
@@ -132,6 +118,8 @@ more information, see: [Infix in Virtual Environments](doc/virtual.md).
 [3]: doc/cli/introduction.md
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
+[GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/
+[GitHub Status]:   https://github.com/kernelkit/infix/actions/workflows/build.yml/badge.svg
 [Coverity Scan]:   https://scan.coverity.com/projects/29393
 [Coverity Status]: https://scan.coverity.com/projects/29393/badge.svg
 [discord-badge]:   https://img.shields.io/discord/1182652155618918411.svg?logo=discord
@@ -354,6 +354,7 @@
 #define XSWP(_n, _label, _mac_offs, _phy) \
 			port@_n { \
 				SWP_COMMON(_n, _label, _mac_offs, "usxgmii", _phy); \
+				managed = "in-band-status"; \
 			}

 #define GSWP(_n, _label, _mac_offs, _phy) \
@@ -6,3 +6,7 @@
 		compatible = "marvell,cp115-standalone-pinctrl";
 	};
 };
+
+&cp0_xmdio {
+	clock-names = "gop_clk", "mg_clk", "mg_core_clk", "axi_clk";
+};
@@ -0,0 +1,76 @@
+#ifndef _STYX_MPP_H
+#define _STYX_MPP_H
+
+#define SFP0_TX_DISABLE(X) X( "mpp0", cp0_gpio1,  0, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP1_TX_DISABLE(X) X( "mpp1", cp0_gpio1,  1, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP2_TX_DISABLE(X) X( "mpp2", cp0_gpio1,  2, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP3_TX_DISABLE(X) X( "mpp3", cp0_gpio1,  3, GPIO_ACTIVE_HIGH | GPIO_OPEN_DRAIN)
+#define SFP0_RS0(X)        X( "mpp4", cp0_gpio1,  4, GPIO_ACTIVE_HIGH)
+#define SFP1_RS0(X)        X( "mpp5", cp0_gpio1,  5, GPIO_ACTIVE_HIGH)
+#define SFP2_RS0(X)        X( "mpp6", cp0_gpio1,  6, GPIO_ACTIVE_HIGH)
+#define SFP3_RS0(X)        X( "mpp7", cp0_gpio1,  7, GPIO_ACTIVE_HIGH)
+#define SFP0_RS1(X)        X( "mpp8", cp0_gpio1,  8, GPIO_ACTIVE_HIGH)
+#define SFP1_RS1(X)        X( "mpp9", cp0_gpio1,  9, GPIO_ACTIVE_HIGH)
+#define SFP2_RS1(X)        X("mpp10", cp0_gpio1, 10, GPIO_ACTIVE_HIGH)
+#define SFP3_RS1(X)        X("mpp11", cp0_gpio1, 11, GPIO_ACTIVE_HIGH)
+/* mpp12: Unused */
+#define CP_SPI1_MISO(X)    X("mpp13", none, 0, 0)
+#define CP_SPI1_CS0(X)     X("mpp14", none, 0, 0)
+#define CP_SPI1_MOSI(X)    X("mpp15", none, 0, 0)
+#define CP_SPI1_SCK(X)     X("mpp16", none, 0, 0)
+/* mpp17: Unused */
+/* mpp18: Unused */
+/* mpp19: Unused */
+/* mpp20: Unused */
+/* mpp21: Unused */
+/* mpp22: Unused */
+/* mpp23: Unused */
+/* mpp24: Unused */
+/* mpp25: Unused */
+/* mpp26: Unused */
+#define SFP0_RX_LOS(X)     X("mpp27", cp0_gpio1, 27, GPIO_ACTIVE_HIGH)
+#define SFP1_RX_LOS(X)     X("mpp28", cp0_gpio1, 28, GPIO_ACTIVE_HIGH)
+#define SFP2_RX_LOS(X)     X("mpp29", cp0_gpio1, 29, GPIO_ACTIVE_HIGH)
+#define SFP3_RX_LOS(X)     X("mpp30", cp0_gpio1, 30, GPIO_ACTIVE_HIGH)
+#define SFP0_TX_FAULT(X)   X("mpp31", cp0_gpio1, 31, GPIO_ACTIVE_HIGH)
+#define SFP1_TX_FAULT(X)   X("mpp32", cp0_gpio2,  0, GPIO_ACTIVE_HIGH)
+#define SFP2_TX_FAULT(X)   X("mpp33", cp0_gpio2,  1, GPIO_ACTIVE_HIGH)
+#define SFP3_TX_FAULT(X)   X("mpp34", cp0_gpio2,  2, GPIO_ACTIVE_HIGH)
+#define CP_I2C1_SDA(X)     X("mpp35", none, 0, 0)
+#define CP_I2C1_SCK(X)     X("mpp36", none, 0, 0)
+#define CP_I2C0_SCK(X)     X("mpp37", none, 0, 0)
+#define CP_I2C0_SDA(X)     X("mpp38", none, 0, 0)
+/* mpp39: Unused */
+#define CP_SMI_MDIO(X)     X("mpp40",   none, 0, 0)
+#define CP_SMI_MDC(X)      X("mpp41",   none, 0, 0)
+/* mpp42: Unused */
+/* mpp43: Unused */
+/* mpp44: Unused */
+/* mpp45: Unused */
+/* mpp46: Unused */
+#define CP_UA1_TXD(X)      X("mpp47", none, 0, 0)
+/* mpp48: Unused */
+#define SW1_RESETn(X)      X("mpp49", cp0_gpio2, 17, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW2_RESETn(X)      X("mpp50", cp0_gpio2, 18, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW3_RESETn(X)      X("mpp51", cp0_gpio2, 19, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+/* mpp52: Unused */
+#define CP_UA1_RXD(X)      X("mpp53", none, 0, 0)
+#define SFP0_MOD_ABS(X)    X("mpp54", cp0_gpio2, 22, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP1_MOD_ABS(X)    X("mpp55", cp0_gpio2, 23, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP2_MOD_ABS(X)    X("mpp56", cp0_gpio2, 24, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SFP3_MOD_ABS(X)    X("mpp57", cp0_gpio2, 25, GPIO_ACTIVE_LOW | GPIO_OPEN_DRAIN)
+#define SW1_INTn(X)        X("mpp58", cp0_gpio2, 26, IRQ_TYPE_LEVEL_LOW)
+#define SW2_INTn(X)        X("mpp59", cp0_gpio2, 27, IRQ_TYPE_LEVEL_LOW)
+#define SW3_INTn(X)        X("mpp60", cp0_gpio2, 28, IRQ_TYPE_LEVEL_LOW)
+/* mpp61: Unused */
+#define DDR_TEN(X)         X("mpp62", cp0_gpio2, 30, GPIO_ACTIVE_HIGH)
+
+/* Macros to extract MPP info in different formats */
+#define MPP_ID(_mpp, _chip, _no, _flags) _mpp
+#define MPP_GPIO_CHIP(_mpp, _chip, _no, _flags) _chip
+
+#define MPP_GPIO_REF(_mpp, _chip, _no, _flags) <&_chip _no (_flags)>
+#define MPP_GPIO_REF_NO_CHIP(_mpp, _chip, _no, _flags) <_no (_flags)>
+#define MPP_IRQ_REF(_mpp, _chip, _no, _flags) <&_chip _no (_flags)>
+
+#endif	/* _STYX_MPP_H */
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2023 Addiva Elektronik AB
+ *
+ * Device tree for Styx board
+ */
+
+#include "styx.dtsi"
@@ -0,0 +1,566 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2021 Marvell International Ltd.
+ * Copyright (C) 2023 Addiva Elektronik AB
+ *
+ * Device tree for Styx board
+ */
+
+#include <dt-bindings/input/input.h>
+#include <dt-bindings/gpio/gpio.h>
+#include <dt-bindings/leds/common.h>
+
+#include "../marvell/cn9130-patched.dtsi"
+
+#include "styx-mpp.h"
+
+/ {
+	model = "Styx";
+	compatible = "styx,styx",
+		"marvell,armada-ap807-quad",
+		"marvell,armada-ap807";
+
+	chosen {
+		stdout-path = "serial0:115200n8";
+
+		infix {
+			/* "admin" */
+			factory-password-hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A";
+			vpds = <&vpd>;
+		};
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0x0 0x0 0x0 0x80000000>;
+	};
+};
+
+
+/* UART0 (Console) */
+
+&uart0 {
+	status = "okay";
+};
+
+
+/* UART1 (Auxiliary) */
+
+&cp0_pinctrl {
+	cp0_uart1_pins: cp0-uart1-pins {
+		marvell,pins = CP_UA1_RXD(MPP_ID), CP_UA1_TXD(MPP_ID);
+		marvell,function = "uart1";
+	};
+};
+
+&cp0_uart1 {
+	/* TODO: Figure out how to enable this without affecting
+         * /chosen/stdout-path
+	 */
+	status = "disabled";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_uart1_pins>;
+};
+
+
+/* GPIO */
+
+&cp0_gpio1 {
+	status = "okay";
+};
+
+&cp0_gpio2 {
+	status = "okay";
+};
+
+
+/* I2C0 (EEPROM) */
+
+&cp0_pinctrl {
+	cp0_i2c0_pins: cp0-i2c0-pins {
+		marvell,pins = CP_I2C0_SCK(MPP_ID), CP_I2C0_SDA(MPP_ID);
+		marvell,function = "i2c0";
+	};
+};
+
+&cp0_i2c0 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_i2c0_pins>;
+
+	vpd: eeprom@50 {
+		compatible = "atmel,24c256";
+                reg = <0x50>;
+
+		infix,board = "cpu";
+		infix,trusted;
+
+		nvmem-layout {
+			compatible = "onie,tlv-layout";
+
+			base_mac: mac-address {
+				#nvmem-cell-cells = <1>;
+			};
+		};
+	};
+
+	spd: eeprom@53 {
+		compatible = "spd";
+                reg = <0x53>;
+	};
+
+	eeprom@57 {
+		compatible = "atmel,24c256";
+                reg = <0x57>;
+	};
+};
+
+
+/* I2C1 (Mux) */
+
+&cp0_pinctrl {
+	cp0_i2c1_pins: cp0-i2c1-pins {
+		marvell,pins = CP_I2C1_SCK(MPP_ID), CP_I2C1_SDA(MPP_ID);
+		marvell,function = "i2c1";
+	};
+};
+
+&cp0_i2c1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_i2c1_pins>;
+
+	i2cmux@77 {
+		compatible = "nxp,pca9548";
+		#address-cells = <1>;
+                #size-cells = <0>;
+                reg = <0x77>;
+
+		i2c_sfp0: i2c@0 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <0>;
+		};
+
+		i2c_sfp1: i2c@1 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <1>;
+		};
+
+		i2c_sfp2: i2c@2 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <2>;
+		};
+
+		i2c_sfp3: i2c@3 {
+			#address-cells = <1>;
+			#size-cells = <0>;
+			reg = <3>;
+		};
+	};
+};
+
+
+/* SPI1 (Boot FLASH) */
+
+&cp0_pinctrl {
+	cp0_spi1_pins: cp0-spi-pins-0 {
+		marvell,pins = \
+			CP_SPI1_MISO(MPP_ID), CP_SPI1_CS0(MPP_ID), \
+			CP_SPI1_MOSI(MPP_ID), CP_SPI1_SCK(MPP_ID);
+		marvell,function = "spi1";
+	};
+};
+
+&cp0_spi1 {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_spi1_pins>;
+
+	/* Boot flash */
+	spi-flash@0 {
+		#address-cells = <0x1>;
+		#size-cells = <0x1>;
+		compatible = "jedec,spi-nor", "spi-flash";
+		reg = <0x0>;
+		spi-max-frequency = <90000000>;
+
+		partitions {
+			compatible = "fixed-partitions";
+			#address-cells = <1>;
+			#size-cells = <1>;
+
+			boot0@0 {
+				label = "boot0";
+				reg = <0x0 0x200000>;
+			};
+
+			boot1@200000 {
+				label = "boot1";
+				reg = <0x200000 0x200000>;
+			};
+		};
+	};
+};
+
+
+/* AP SDHCI (eMMC) */
+
+&ap_sdhci0 {
+	status = "okay";
+	bus-width = <8>;
+	mmc-ddr-1_8v;
+	mmc-hs400-1_8v;
+};
+
+
+&cp0_crypto {
+	status = "okay";
+};
+
+&cp0_ethernet {
+	status = "okay";
+};
+
+
+/* ETH1 (Connection to BMC) */
+
+&cp0_eth2 {
+	status = "okay";
+	phy-mode = "sgmii";
+	phys = <&cp0_comphy5 2>;
+	managed = "in-band-status";
+
+	nvmem-cells = <&base_mac 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+
+/* ETH0 (DSA connection to switch tree) */
+
+&cp0_eth0 {
+	status = "okay";
+	phy-mode = "10gbase-r";
+	phys = <&cp0_comphy2 0>;
+	managed = "in-band-status";
+
+	nvmem-cells = <&base_mac 0>;
+	nvmem-cell-names = "mac-address";
+};
+
+
+/* MDIO (Switch Tree) */
+
+&cp0_pinctrl {
+	cp0_mdio_pins: cp0-mdio-pins-0 {
+		marvell,pins = CP_SMI_MDIO(MPP_ID), CP_SMI_MDC(MPP_ID);
+		marvell,function = "ge";
+	};
+};
+
+#define SWP_LED(_func) \
+	leds { \
+		#address-cells = <1>; \
+		#size-cells = <0>; \
+		\
+		led@0 { \
+			reg = <0>; \
+			function = _func; \
+			color = <LED_COLOR_ID_GREEN>; \
+			default-state = "keep"; \
+		}; \
+		led@1 { \
+			reg = <1>; \
+			function = _func; \
+			color = <LED_COLOR_ID_YELLOW>; \
+			default-state = "off"; \
+		}; \
+	}
+
+#define XSWP(_n, _label, _mac_offs, _sfp) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		label = _label; \
+		nvmem-cells = <&base_mac _mac_offs>; \
+		nvmem-cell-names = "mac-address"; \
+		phy-mode = "10gbase-r"; \
+		managed = "in-band-status"; \
+		sfp = <&_sfp>; \
+		SWP_LED("sfp"); \
+	}
+
+#define GSWP(_n, _label, _mac_offs, _phy) \
+	port@_n { \
+		reg = <0x ## _n>; \
+		label = _label; \
+		nvmem-cells = <&base_mac _mac_offs>; \
+		nvmem-cell-names = "mac-address"; \
+		phy-mode = "gmii"; \
+		phy-handle = <&_phy>; \
+		SWP_LED("tp"); \
+	}
+
+#define GPHY(_n) \
+	ethernet-phy@_n { \
+		compatible = "ethernet-phy-ieee802.3-c22"; \
+		reg = <_n>; \
+		eee-broken-100tx; \
+		eee-broken-1000t; \
+	}
+
+&cp0_mdio {
+	status = "okay";
+	pinctrl-names = "default";
+	pinctrl-0 = <&cp0_mdio_pins>;
+
+	sw3: switch@6 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <6>;
+
+		reset-gpios = SW3_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW3_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 0>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			port@9 {
+				reg = <0x9>;
+				label = "cpu";
+				ethernet = <&cp0_eth0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			sw3p10: port@a {
+				reg = <0xa>;
+				link = <&sw2p10 &sw1p0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			/* Can't use XSWP macro as port 0 does not have
+			 * any LEDs attached to it. LEDs for port 10 seem
+			 * to be wired to the corresponding SFP cage. Maybe
+			 * we can apply a static workaround by binding port
+			 * 10's green LED to "Special LED 1", so we can at
+			 * least see link/act.
+			 */
+			port@0 {
+				reg = <0>;
+				label = "e16";
+				nvmem-cells = <&base_mac 16>;
+				nvmem-cell-names = "mac-address";
+				phy-mode = "10gbase-r";
+				managed = "in-band-status";
+				sfp = <&sfp3>;
+			};
+
+			GSWP(1,  "e22", 22, sw3phy1);
+			GSWP(2,  "e21", 21, sw3phy2);
+			GSWP(3,  "e24", 24, sw3phy3);
+			GSWP(4,  "e23", 23, sw3phy4);
+			GSWP(5,  "e26", 26, sw3phy5);
+			GSWP(6,  "e25", 25, sw3phy6);
+			GSWP(7,  "e28", 28, sw3phy7);
+			GSWP(8,  "e27", 27, sw3phy8);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw3phy1: GPHY(1);
+			sw3phy2: GPHY(2);
+			sw3phy3: GPHY(3);
+			sw3phy4: GPHY(4);
+			sw3phy5: GPHY(5);
+			sw3phy6: GPHY(6);
+			sw3phy7: GPHY(7);
+			sw3phy8: GPHY(8);
+		};
+	};
+
+	sw2: switch@4 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <4>;
+
+		reset-gpios = SW2_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW2_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 1>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw2p0: port@0 {
+				reg = <0x0>;
+				link = <&sw1p0>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			sw2p10: port@a {
+				reg = <0xa>;
+				link = <&sw3p10>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+
+			GSWP(1, "e10", 10, sw2phy1);
+			GSWP(2,  "e9",  9, sw2phy2);
+			GSWP(3, "e12", 12, sw2phy3);
+			GSWP(4, "e11", 11, sw2phy4);
+			GSWP(5, "e18", 18, sw2phy5);
+			GSWP(6, "e17", 17, sw2phy6);
+			GSWP(7, "e20", 20, sw2phy7);
+			GSWP(8, "e19", 19, sw2phy8);
+			XSWP(9, "e15", 15, sfp2);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw2phy1: GPHY(1);
+			sw2phy2: GPHY(2);
+			sw2phy3: GPHY(3);
+			sw2phy4: GPHY(4);
+			sw2phy5: GPHY(5);
+			sw2phy6: GPHY(6);
+			sw2phy7: GPHY(7);
+			sw2phy8: GPHY(8);
+		};
+	};
+
+	sw1: switch@2 {
+		compatible = "marvell,mv88e6190";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		reg = <2>;
+
+		reset-gpios = SW1_RESETn(MPP_GPIO_REF);
+
+		interrupts-extended = SW1_INTn(MPP_IRQ_REF);
+		interrupt-controller;
+
+		dsa,member = <0 2>;
+
+		ports {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw1p0: port@0 {
+				reg = <0x0>;
+				link = <&sw2p0 &sw3p10>;
+				phy-mode = "10gbase-r";
+				fixed-link {
+					speed = <10000>;
+					full-duplex;
+				};
+			};
+
+			GSWP(1,  "e2",  2, sw1phy1);
+			GSWP(2,  "e1",  1, sw1phy2);
+			GSWP(3,  "e4",  4, sw1phy3);
+			GSWP(4,  "e3",  3, sw1phy4);
+			GSWP(5,  "e6",  6, sw1phy5);
+			GSWP(6,  "e5",  5, sw1phy6);
+			GSWP(7,  "e8",  8, sw1phy7);
+			GSWP(8,  "e7",  7, sw1phy8);
+			XSWP(9, "e14", 14, sfp1);
+			XSWP(a, "e13", 13, sfp0);
+		};
+
+		mdio {
+			#address-cells = <1>;
+			#size-cells = <0>;
+
+			sw1phy1: GPHY(1);
+			sw1phy2: GPHY(2);
+			sw1phy3: GPHY(3);
+			sw1phy4: GPHY(4);
+			sw1phy5: GPHY(5);
+			sw1phy6: GPHY(6);
+			sw1phy7: GPHY(7);
+			sw1phy8: GPHY(8);
+		};
+	};
+};
+
+/ {
+	sfp0: sfp@0 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp0>;
+		mod-def0-gpios = SFP0_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP0_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP0_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP0_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP0_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP0_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp1: sfp@1 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp1>;
+		mod-def0-gpios = SFP1_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP1_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP1_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP1_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP1_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP1_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp2: sfp@2 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp2>;
+		mod-def0-gpios = SFP2_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP2_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP2_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP2_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP2_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP2_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+
+	sfp3: sfp@3 {
+		compatible = "sff,sfp";
+		i2c-bus = <&i2c_sfp3>;
+		mod-def0-gpios = SFP3_MOD_ABS(MPP_GPIO_REF);
+		los-gpios = SFP3_RX_LOS(MPP_GPIO_REF);
+		tx-disable-gpios = SFP3_TX_DISABLE(MPP_GPIO_REF);
+		tx-fault-gpios = SFP3_TX_FAULT(MPP_GPIO_REF);
+		rate-select0-gpios = SFP3_RS0(MPP_GPIO_REF);
+		rate-select1-gpios = SFP3_RS1(MPP_GPIO_REF);
+		maximum-power-milliwatt = <3000>;
+	};
+};
+
@@ -1,13 +0,0 @@
-#!/bin/sh
-. "$BR2_CONFIG"
-
-# Prevent regen of host key at every boot, /etc is saved across reboots
-if [ -L "$TARGET_DIR/etc/dropbear" ]; then
-	rm    "$TARGET_DIR/etc/dropbear"
-	mkdir "$TARGET_DIR/etc/dropbear"
-fi
-
-# Classic builds don't have D-Bus
-if [ -f "$TARGET_DIR/etc/dnsmasq.conf" ]; then
-    sed -i '/enable-dbus/d' "$TARGET_DIR/etc/dnsmasq.conf"
-fi
@@ -1,684 +0,0 @@
-#!/bin/sh
-# COLUMS and ROWS should be set on the console, if not, use fallback
-if [ -z "$COLUMNS" ]; then
-	if command -v tput; then
-		COLUMNS=$(tput cols)
-	else
-		COLUMNS=80
-	fi
-fi
-
-h1()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR" | tr '[:lower:]' '[:upper:]'
-		echo "$STR" | sed 's/./=/g'
-	else
-		printf "\033[7m%-${COLUMNS}s\033[0m" "$STR"
-	fi
-}
-
-h2()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR"
-		echo "$STR" | sed 's/./-/g'
-	else
-		printf "\033[1m%-${COLUMNS}s\033[0m" "$STR"
-	fi
-}
-
-ul()
-{
-	if [ -n "$plain" ]; then
-		echo "__${*}__"
-	else
-		printf "\033[54%s\033[0m" "$*"
-	fi
-}
-
-em()
-{
-	if [ -n "$plain" ]; then
-		echo "**${*}**"
-	else
-		printf "\033[5m%s\033[0m" "$*"
-	fi
-}
-
-overview()
-{
-	cat <<EOF
-$(h1 "Help System            Press 'Q' to quit | Arrow keys and PgUp/PgDn to scroll")
-
-$(h2 "See Also")
-  help edit            Tutorial on VI and Mg editors
-  help net             Network set up introduction
-  setup                User friendly setup and diagnostic tool
-
-$(h2 "General Syntax")
-  cmd [optional arg]   E.g., use 'date -h' to get help for date command
-
-$(h2 "File system")
-  pwd | ls | cd        Show directory, contents, or change directory
-  cat file             Show file contents
-  vi  | mg [file]      Edit file with the VI or Micro Emacs editor
-
-$(h2 "Services")
-  initctl list         Lists all configurable services (svc's)
-  initctl enable svc   Enable a service 'svc'
-  initctl reload       Reload init process' state, start/stop svc's
-  initctl start svc    Start a stopped service 'svc'
-  initctl stop svc     Stop 'svc'
-  initctl restart svc  Restart a running 'svc'
-  initctl status [svc] Display running status of all services, or one 'svc'
-
-$(h2 "Tools")
-  setup                User friendly setup and diagnostic tool
-  date    [-h]         Display current time, or sets the system date
-  factory              Factory reset the device (on the next boot)
-  hwclock [-h]         Query or set the hardware clock (RTC)
-  logout | Ctrl-D      Log out from TTY
-  mdio | mvls          Low-level MDIO access, also for Marvell switch status
-  tail -F file         Continuously read from a file Useful for monitoring the
-                       health of services, see 'ls /var/log/' for log files
-  less [file]          Pagers provding easily scrollable content (q quits) >
-  more [file]            > e.g., 'cat very-long-file | less'
-  most [file]            > e.g., 'cat very-long-file | most'
-  passwd               Change user password
-  pwgen                Password generator
-  reboot               Restart the device
-  reset                Reset the shell prompt if it gets garbled
-
-$(h2 "Network Tools")
-  ethtool    [-h]      Ethernet stats, and low-level MAC/PHY settings
-  traceroute [-h]      Trace the route ip packets follow going to a host
-  tcpdump    [-h]      Display network packet headers in real-time
-  arping     [-h]      Ping hosts by ARP requests/replies
-  fping      [-h]      Send ICMP ECHO_REQUEST packets to multiple hosts
-  ping       [-h]      Send ICMP ECHO_REQUEST packets to a network host
-  lynx URL   [-h]      The text mode web browser
-  netcalc    [-h]      Calculate IP network settings from a IP address
-  netcat     [-h]      NetCat - TCP/IP swiss army knife (alias: nc)
-  socat      [-h]      Multipurpose socket relay program
-  ttyd       [-h]      Sharing a terminal over the web
-
-  ifconfig   [--help]  See/Reconfigure available network interfaces
-  route      [--help]  Edit the kernel's routing tables
-
-  ifup | ifdown IFACE  Bring up/down interfaces in /etc/network/interfaces
-
-  ip [link|addr]       Manage available network interfaces
-  ip [rule|route]      Manage routing tables
-  bridge [link|vlan]   Manage bridge ports and VLANs
-
-  scp                  Securely copy a file to a remote host file system
-  tftp                 Copy a file to/from a remote host
-  ftpput               Store a local file on a remote machine via FTP
-  ftpget               Retrieve a remote file via FTP
-  wget                 Get a file using HTTP or FTP from a remote host
-
-$(h2 "Overview Commands")
-  df -h                List disk usage (in human readable format)
-  free                 List memory usage
-  ps                   List running processes
-  show [arg]           Show system status, see 'show help' for more info
-  top                  Displays CPU usage and top list of running tasks
-
-$(h2 "Interesting Files")
-  /etc/default/svc     Command line args for service 'svc' (see above)
-  /etc/rc.local        Local setup, runs after all services have started
-  /etc/network/        Directory of networking setup, see 'help net'
-
-$(h2 "Example Commands")
-  cd   /tmp; wget ftp://192.168.55.43/file && cat file
-  cd   /var/log; tftp -p -l messages 192.168.55.43
-  cat  /proc/net/arp
-  edit /etc/network/interfaces
-
-$(h2 "See Also")
-  help edit            Tutorial on VI and Mg editors
-  help net             Network set up introduction
-  setup                User friendly setup and diagnostic tool
-EOF
-}
-
-vi()
-{
-	cat <<EOF
-$(h1 "Visual Editor (vi)")
-Vi is the de facto standard editor in UNIX systems.  It comes with two modes:
-
-  - $(em "Command mode (default):") administrative tasks such as saving files,
-    executing commands, moving the cursor, cutting and pasting lines or words,
-    as well as finding and replacing.  $(em "Return to command mode with Esc")
-
-  - $(em "Insert mode:") Everything that's typed in this mode is interpreted as
-    input and placed in the file.
-
-$(h2 "Navigation commands")
-
-  h - move the cursor one character to the left
-  j - move the cursor down one character
-  k - mode the cursor up one character
-  l - move the cursor right one character
-  b - move to beginning of word, or previous word
-  w - move to next word
-  0 - move to beginning of line
-  $ - move to end of line
- :0 - move to beginning of file
-  G - move to end of file
-
-$(h2 "Editing commands")
-
-  u - undo last operation
-  x - delete the character the cursor is on
- cw - change word, from position of cursor
- dw - delete to end of word
- dd - delete the line the character is on
-  p - paste (line, word, or char) after cursor
-  P - paste (line, word, or char) before cursor
-
-$(h2 "Saving and quit commands")
-
-  :w            - save the current file
-  :w filename   - save a copy of the file named filename
-  :w!           - try to save the file, even if it is read only
-  :wq           - save and quit vi
-  ZZ            - save and quit vi
-  :wq!          - try to save the file if it is read only, quit if successful
-  :wq filename  - save a copy of the file named filename and quit
-  :wq! filename - save a copy of the file named filename and quit,
-                  override read only permissions if possible
-  :q            - quit vi
-  :q!           - quit vi even if the file has unsaved changes
-
-$(h2 "Enter insert mode")
-
-  a - append new text after the cursor
-  i - insert text before the cursor
-  o - open a new line below the cursor
-  O - open a new line above the cursor
-
-> Return to command mode with Esc
-
-EOF
-}
-
-emacs()
-{
-	cat <<EOF
-$(h1 "Micro Emacs (mg)")
-Mg is a bit more user-friendly than vi.  It has the same familiar interface
-as Notepad, but with slightly different keybindings.
-
-$(h2 "Introduction")
-
-Most commands involve using the Control ("Ctrl") or the Meta ("Alt") key.
-The following conventions are used in the online help:
-
-  C-<chr>   means hold down the Control key while typing the character <chr>
-  M-<chr>   means hold down the Alt key while typing the character <chr>
-
-If you don't have a Meta/Alt key, you can use Esc instead.  Press and release
-the Esc key and then type <chr>. This is equivalent to M-<chr>.
-
-$(h2 "Navigation")
-
-Though arrow keys, Home/End, and PgUp/PgDn usually work, using Mg over serial
-console can sometimes cause these keys to be mismapped by terminal program.
-
-  C-f          Move forward one character (can also use right arrow key)
-  C-b          Move backward one character (can also use left arrow key)
-  C-p          Move up one line (can also use up arrow key)
-  C-n          Move down one line (can also use down arrow key)
-  M-f          Move forward one word
-  M-b          Move backward one word
-  C-a          Move to beginning of line (can also use Home key)
-  C-e          Move to end of line (can also use End key)
-  C-v          Move forward one page (can also use PgDn/Page Down key)
-  M-v          Move backward one page (can also use PgUp/Page Up key)
-  M-<          Move to beginning of file
-  M->          Move to end of file
-  C-x g        Move to line number
-
-$(h2 "Editing")
-
-All edit commands that kill (cut) text is placed in a kill ring (clipboard).
-Note: when marking text, there is no visual mark.
-
-  C-_          Undo, also C-x u
-  M-%          Replace word/string in file, from cursor position
-  M-q          Reformat paragraph (set fill column with C-x f)
-  C-s          Search forward (type C-s again to find next)
-  C-r          Reversed search
-  C-Space      Set beginning of mark (beginning of selected text)
-  C-x C-x      Jump back and forth between mark and cursor position
-  C-x h        Mark whole buffer
-  C-w          Wipe (cut) region from mark to cursor position
-  M-w          Copy region from mark to cursor position
-  C-y          Yank (paste) text from kill ring
-  C-k          Kill (cut) to end of line
-  M-Backspace  Kill (delete) previous word
-  M-d          Kill (delete) next word
-  C-d          Delete character to the right
-  C-o          Open new line at cursor
-
-$(h2 "General Commands")
-
-  C-g          Abort current command
-  C-l          Recenter buffer on current line
-  C-h b        List all keybindings
-  M-!          Run shell command, output in new buffer
-  C-z          Suspend Mg, return to shell, use 'fg' to get back
-  C-x C-f      Open file
-  C-x C-i      Insert file at cursor position
-  C-x C-s      Save file
-  C-x s        Save file (interactive)
-  C-x k        Kill (close) file
-  C-x C-b      List open buffers (files)
-  C-x b        Switch to another buffer
-  C-x C-c      Exit
-
-$(h2 "Window Commands")
-
-  C-x 0        Unsplit, keep other window
-  C-x 1        Unsplit, keep this window
-  C-x 2        Split window in two
-  C-x o        Go to other window
-  C-x p        Go to previous window
-  C-x n        Go to next window
-  C-x ^        Enlarge this split
-
-EOF
-}
-
-editor()
-{
-	case $1 in
-		vi)
-			vi
-			;;
-		ed* | em* | mg)
-			emacs
-			;;
-		*)
-			vi
-			emacs
-			cat <<EOF
-$(h1 "Summary")
-Use Mg or GNU Nano if you are a beginner.  The system is set up to so you can
-use the 'edit' command, which will start GNU Nano:
-
-    edit /etc/rc.local                   # Starts GNU Nano
-
-EOF
-			;;
-	esac
-}
-
-networking()
-{
-	cat <<EOF
-$(h1 "Networking")
-This section details how to set up everything from basic to advanced networking.
-Topics covered include:
-
- - Static vs Dynamic Addresses
- - VLAN Interfaces
- - Bridging Interfaces
- - Link Aggregation (bonding)
- - Persistent Configuration
-
-Please note, the terms 'port' and 'interface' may be used interchangably in
-the following text (and elsewher online as well).  Usually the term 'port' is
-reserved for Ethernet links attached to a switch or bridge, while the term
-'interface' more generically refers to the physical interface in a system.
-
-
-$(h2 "Static vs Dynamic Addresses")
-
-An IPv4 address consists of four "octets" separated by periods.  A static IPv4
-address can look like this:
-
-    192.168.1.42
-
-However, for networking to function properly, a device usually needs a netmask,
-default route, NTP server, and at least one DNS address.  Setting all these up
-statically is a lot of work to maintain, in particular with many devices.
-
-For both IPv4 and IPv6 there is an alternative called DHCP.  It is a dynamic
-protocol where a server on request from a client device hands out a "lease" of
-an IP address, as well as lot of other network parameters, including but not
-limited to the ones already mentioned.  A client device can give hints to the
-server, e.g., its hostname, MAC address (default), or other client identifier.
-It is up to the server to honor these hints or not, but it is very common to
-set up the server to honor the client's hostname and automatically update the
-central name server (DNS) when the client is online.
-
-        |  There are many other interesting aspects to DHCP not covered here.
-        |  For instance, DHCP relay servers (proxies), that can be used to
-        |  forward DHCP requests from very large networks to a central server.
-        |  Some relay "agents" even support something called Option 82, which
-        |  when running on a simple switch, can attach port and relay info to
-        |  the client's DHCP request -- allowing the server to assign an IP
-        |  address per port, even on remote switches (with a relay agent).
-
-When your interface is setup with DHCP, use the 'ifconfig' or 'ip addr' tools
-to see which address you got, if needed (see next section).
-
-In cases when the DHCP client cannot find a DHCP server, and thus not obtain a
-lesae, the system falls back to set a link-local address (169.254.*.*).  This
-can be disabled by editing the file /etc/dhcpcd.conf, adding:
-
-    noipv4ll
-
-A link-local address is however very useful, in particular in combination with
-mDNS to discover and access a device you do not know, or do not want to know,
-the IP address to.  See more in the next section.
-
-
-$(h2 "DNS and mDNS")
-
-Managing a central DNS is both painful and time consuming, most networks, and
-in particular industrial, therefore only set up a DNS for static servers and
-resources.  Leaving end devices, switches, and in many cases even routers,
-without a human-friendly name on the network.  This have misled many to think
-that they need to know the IP address, and often opt for static addresses on
-equipment.  Meaning many devices out-of-the-box have a static address set that
-need to be manually changed before the device is deployed on the network.
-
-A less time consuming, and human-friendly, way is to enable mDNS (multicast
-DNS).  With this protocol the device notifies all neighbors on the same LAN
-of how to reach it:
-
-    "Hello everyone, my address is 169.254.47.11, you can call me device.local"
-
-Any other device that also has mDNS enabled can then automaticall update a
-local database of name-to-address mappings.  Usually the name sent out is
-the device's hostname.  (It is up to the device manufacturer to set a useful
-default hostname, i.e., model-01-02-03, where the suffix is the last octets
-of the base MAC address, from the product label on the case.)
-
-As you can see, in combination with a link-local address (previous section)
-mDNS is a very attractive combination that greatly simplify device management.
-
-Tools:
-
-    avahi-browse -a
-    ping foo.local
-
-mDNS, or more correctly mDNS-SD, is also used for *Service Discovery*.  E.g.,
-a printer can publish IPP records with meta data on the printer type and model
-or donwload URL for drivers.  Switches and routers usually publish how they
-can be reached: HTTP/HTTPS and SSH.
-
-mDNS is supported in this product and should be enabled by default.  To
-verify that it works, in Windows, macOS, or Linux, open your web browser
-and point it to <https://hostname-01-02-03.local>.  This is the hostname
-and three last octets of the device's base MAC address.  You can also use
-mDNS browsers or command line tools like mdns-scan
-
-
-$(h2 "VLAN Interfaces")
-
-A VLAN interface in Linux is an "upper" interface, e.g., 'eth0.1'.  It is
-where you set an IP address and interact with th rest of the world.  The
-base/raw/lower interface, here 'eth0', is the physical interface on which
-Ethernet packets ingress and egress with a VLAN tag.  To create 'eth0.1':
-
-    ip link add eth0.1 link eth0 vlan id 1
-
-In Linux a VLAN interface is a "stackable" entity.  Many VLAN interfaces
-can be built on top of each other.  When injecting a packet on the top
-most interface, the kernel adds the corresponding VLAN "tag" when the
-packet goes down the order of stacked interfaces, and then finally hits
-the physical interface and proceeds to egress onto the media.
-
-    ip link add eth0.1.2 link eth0.1 vlan id 2
-
-Injecting a packet on 'eth0.1.2' creates a double-tagged VLAN frame when
-the packet egresses 'eth0'.  The outermost tag has VID 1 and the inner
-VID is 2.
-
-VLAN interfaces can be used for many things, here we will focus on their
-use as upper interface on a bridge.
-
-
-$(h2 "Bridging Interfaces")
-
-A bridge is the correct name for a switch.  In the context of this text,
-however, we will use the term to refer to the Linux bridge module in the
-kernel, which implements an advanced software switch.  The Linux bridge
-supports "offloading" many switching functions to an underlying switching
-chipset, when available.  This greatly simplifies managing that switch since
-the same tools one use to manage the bridge will, by extension, also be used
-to manage the switch.
-
-To create a bridge in Linux:
-
-    ip link add br0 type bridge
-
-To add three ports (interfaces) to the bridge we use:
-
-    ip link set eth0 master br0
-    ip link set eth1 master br0
-    ip link set eth2 master br0
-
-Bring all ports and the bridge 'up' and you have a working switch!  Any frame
-injected on eth0 (from the outside) can be switched to either of eth1, eth2,
-*or* br0.  As soon as the bridge has learned where end devices are connected,
-none of the other ports will see the traffic -- like a regular switch.
-
-Note: these ports should not (cannot) have any IP address.  Instead, any IP
-      address is set on 'br0'.  To disable IPv6 link-local address, set the
-      /proc/sys/net/ipv6/conf/eth0/disable_ipv6 sysctl file to '1'.
-
-
-$(h2 "Bridging and VLANs")
-
-A VLAN-aware bridge works the same way, only with VLAN separation taken into
-account.  All communication, as well as MAC address learning, is limited to
-ports in the same VLAN.  The syntax is slightly different and requires a few
-more steps:
-
-    ip link add br0 type bridge vlan_filtering 1
-    ip link set eth0 master br0
-    ip link set eth1 master br0
-    ip link set eth2 master br0
-    ip link set eth3 master br0
-
-To assign ports to different VLANs, and make sure they are regular "access"
-ports (untagged).  We assign eth0 and eth1 to VLAN 1 and the others to VLAN 2:
-
-    bridge vlan add vid 1 dev eth0 pvid untagged
-    bridge vlan add vid 1 dev eth1 pvid untagged
-    bridge vlan add vid 2 dev eth2 pvid untagged
-    bridge vlan add vid 2 dev eth3 pvid untagged
-
-Here's the twist, to be able to reach the bridge (switch) itself from each
-VLAN, we need to ensure the bridge itself is a tagged member of each VLAN:
-
-    bridge vlan add vid 1 dev br0 self
-    bridge vlan add vid 2 dev br0 self
-
-This way we can add VLAN interfaces on top of br0, which we in turn can set
-a static or dynamic IP address on:
-
-    ip link add vlan1 link br0 type vlan id 1
-    ip link add vlan2 link br0 type vlan id 2
-
-The resulting stack of interfaces look like this:
-
-                         :
-                vlan1    :     vlan2       Layer-3 :: IP Networking
-                    \\    :    /            _________________________
-                  .-------------.
-                  |     br0     |          Layer-2 :: Switching
-                  '-------------'          _________________________
-                  /   |  :  |   \\
-              eth0 eth1  :  eth2 eth3      Layer-1 :: Link layer
-                         :
-
-
-$(h2 "Persistent Configuration")
-
-A simple end device can get by with the following in /etc/network/interfaces:
-
-    auto lo
-    iface lo inet loopback
-
-    auto eth0
-    iface eth0 inet dhcp
-
-This brings up both the loopback (required for UNIX networking to function),
-and the (presumed only) Ethernet interface.  The loopback gets its standard
-address, 127.0.0.1, and eth0 will request its IP address using DHCP.
-
-To set up the bridge example (above), is actually quite a lot easier than
-using the command line ip and bridge tools.  Create the file 'bridge':
-
-    edit /etc/network/interfaces.d/bridge
-
-Paste in the following content:
-
-    iface e0
-        bridge-access 1
-    iface e1
-        bridge-access 1
-    iface e2
-        bridge-access 2
-    iface e3
-        bridge-access 2
-
-    auto br0
-    iface br0
-        bridge-ports e0 e1 e2 e3 
-        bridge-vlan-aware yes
-        bridge-stp on
-        bridge-vids 1 2
-
-    auto vlan1
-    iface vlan1 inet dhcp
-        vlan-id 1
-        vlan-raw-device br0
-
-    auto vlan2
-    iface vlan2 inet static
-        vlan-id 2
-        vlan-raw-device br0
-        address 192.168.2.1/24
-
-Notice how 'vlan1' only has a DHCP and 'vlan2' uses a static address.  It is
-possible to combine the two if needed.  Use 'inet dhcp' and add an 'address'
-statement to the iface stanza.
-
-
-$(h2 "Port Classification")
-
-The bundled 'show' script is a very handy tool.  It use several tricks to make
-information about the system more accessible.  On switching capable hardware
-products, switch ports are identified early at system bootstrap and placed in
-the 'port' group.  See 'ip link' output:
-
-    ...
-    4: e0: <BROADCAST,MULTICAST> master br0 state UP $(em "group port")
-           link/ether 52:54:00:12:34:56 brd ff:ff:ff:ff:ff:ff
-    ...
-
-When running in Qemu or other hardware it may be useful to manually classify
-certain interfaces as ports.  This can be achieved in many ways, here we show
-two.  First /etc/mactab, which is read at boot to rename interfaces according
-their matching MAC address, one interface per line:
-
-    e0    52:54:00:12:34:56
-    e1    52:54:00:12:34:57
-    e2    52:54:00:12:34:58
-    e3    52:54:00:12:34:59
-
-Another way is to add something like this to /etc/rc.local:
-
-    for port in eth0 eth1 eth3 eth4; do
-        ip link set \$port group port
-    done
-
-
-$(h2 "Interesting Files")
-
- - /etc/dhcpcd.conf             General DHCP and ZeroConf (LL) settings
- - /etc/network/interfaces      The original, useful for small setups
- - /etc/network/interfaces.d/*  Snippets, useful for non-trivial setups
- - /etc/mactab                  Rename interfaces: 'NAME16CHARS WHITESPACE MAC'
- - /etc/sysctl.conf             Interface and TCP/IP settings, e.g., routing
- - /etc/sysctl.d/*              Snippets, useful for per-subsystem settings
-
-
-$(h1 "Summary")
-All persistent networking is set up in /etc/network/interfaces using the
-program ifupdown-ng.  The tools to reconfigure networking at runtime are:
-
-   ifup   [-a] [IFACES]
-   ifdown [-a] [IFACES]
-
-When changing the configuration at runtime you usually have to bring the
-affected interfaces down (ifdown e0 e1 e2 e3), if they were set up with
-/etc/network/interfaces before.  Then do the change, and bring it all up
-again.
-
-Both tools understand dependencies between interfaces, so when a 'ifup -a'
-command is received it brings up all interfaces: adding links to br0 before
-adding VLANs, the vlan1 and vlan2 interfaces on top so it of it all.  Then
-finally it can start the DHCP client on vlan1 and set the static IP address
-on vlan2.
-
-       $(em ">>> Be careful with these tools when logged in remotely! <<<")
-
-EOF
-}
-
-topic()
-{
-	topic=$1
-	[ -n "$1" ] && shift
-
-	case $topic in
-	ed*)
-		# shellcheck disable=SC2068
-		editor $*
-		;;
-	net*)
-		networking
-		;;
-	*)
-		overview
-		;;
-	esac
-}
-
-if [ "$1" = "-p" ]; then
-	shift
-	pager="cat"
-	plain="yes"
-else
-	if command -v most; then
-		pager=most
-	elif command -v less; then
-		pager="less -R"
-	elif command -v more; then
-		pager="more"
-	else
-		pager="cat"
-	fi
-fi
-
-if [ -t 1 ] ; then
-	fn=$(mktemp /tmp/system-help.XXXXXX)
-	# shellcheck disable=SC2086,SC2068
-	topic $@ >"$fn"
-	$pager "$fn"
-	rm "$fn"
-else
-	topic "$*"
-fi
@@ -1,16 +0,0 @@
-#!/bin/sh
-# Changes hostname in /etc/hostname and /etc/hosts
-
-current=$(cat /etc/hostname)
-newname=$1
-
-[ -n "$newname" ] || exit 1
-
-sed -i "s/$current/$newname/" /etc/hosts
-sed -i "s/$current/$newname/" /etc/hostname
-
-hostname $newname
-
-initctl touch sysklogd
-initctl touch dnsmasq
-initctl reload
@@ -1,3 +0,0 @@
-#!/bin/sh
-pdmenu
-clear
@@ -1,327 +0,0 @@
-#!/bin/sh
-# Displays basic information about the system
-# shellcheck disable=SC2048,SC2086
-. /etc/os-release
-
-bopt="-c"
-opt="-br"
-all=""
-plain=""
-
-TTY=$(resize)
-eval "$TTY"
-
-# COLUMS and ROWS should be set on the console, if not, use fallback
-if [ -z "$COLUMNS" ]; then
-	if command -v tput; then
-		COLUMNS=$(tput cols)
-	else
-		COLUMNS=80
-	fi
-fi
-
-h1()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR" | tr '[:lower:]' '[:upper:]'
-	else
-		printf "\033[7m%-${COLUMNS}s\033[0m\n" "$STR"
-	fi
-}
-
-h2()
-{
-	STR="$*"
-	if [ -n "$plain" ]; then
-		echo "$STR"
-		echo "$STR" | sed 's/./-/g'
-	else
-		printf "\033[1m%-${COLUMNS}s\033[0m\n" "$STR"
-	fi
-}
-
-dm()
-{
-	if [ -n "$plain" ]; then
-		echo "${*}"
-	else
-		printf "\033[2m%s\033[0m\n" "$*"
-	fi
-}
-
-ul()
-{
-	if [ -n "$plain" ]; then
-		printf "__%s__" "$*"
-	else
-		printf "\033[4%s\033[0m" "$*"
-	fi
-}
-
-em()
-{
-	if [ -n "$plain" ]; then
-		printf "**%s**" "$*"
-	else
-		printf "\033[5m%s\033[0m" "$*"
-	fi
-}
-
-usage()
-{
-	cat <<EOF
-usage:
-  show [opt] cmd
-
-options:
-  -a            Show all, of something
-  -f            Show full output, not brief port/iface listings
-  -h            Show this help text
-  -n            Show output without any footer
-  -p            Show plain output, no bells or whistles
-
-commands:
-  port PORT     Show port configuration and link information
-  ports         Show ports available for bridging
-  vlans         Show port groups in bridge
-  ifaces        Show interfaces and their addresses
-  fdb           Show forwarding database (unicast)
-  mdb           Show multicast forwarding database
-  ip route      Show routing table
-  log [FILE]    Show latest entries from syslog, or other FILE
-  rmon PORT     Show RMON counters for PORT (when applicable)
-  system        Show OS details
-  version       Show OS verson
-EOF
-}
-
-# Usage 1: show port eth0
-# Usage 2: show port
-# Usage 3: show ports
-#
-# The first show ethtool output for 'eth0' (in this case).  The latter
-# two are the same, showing a summary of all interfaces classified as
-# access ports.
-ports()
-{
-	if [ $# -gt 0 ] && [ -e "/sys/class/net/$1" ]; then
-		for port in $*; do
-			ethtool "$port"
-		done
-		return
-	fi
-
-	h1 "PORT             STATE          MAC ADDRESS        FLAGS"
-	if grep -q port /etc/iproute2/group && [ -z "$all" ]; then
-		ip $opt link show group port
-	else
-		ip $opt link show
-	fi
-
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "Use: '[ip|bridge] --help' and '[ip|bridge] link help' for more details."
-	fi
-}
-
-vlans()
-{
-	h1 "INTERFACE         VLAN  FLAGS"
-	bridge $bopt vlan show |tail +2 | awk 'NF { iface=$1; vid=$2; printf("%-16s  %4d  ", iface, vid); for (i=3; i <= NF; i++) printf("%s ", $i); printf("\n"); }'
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'bridge --help' and 'bridge vlan help' for more details."
-	fi
-}
-
-ifaces()
-{
-	h1 "INTERFACE        STATE          ADDRESS"
-	if [ -n "$all" ]; then
-		ip $opt addr show
-        elif grep -q iface /etc/iproute2/group; then
-                ip $opt addr show group iface
-	else
-		ip $opt addr show |awk '{ if ($1 !~ /eth[0-9]*/ && $1 !~ /.*@NONE/) { print }}'
-	fi
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'ip --help' and 'ip address help' for more details."
-	fi
-}
-
-log()
-{
-	if [ -n "$1" ] && [ -r "/var/log/$1" ]; then
-		fn="/var/log/$1"
-	else
-		fn="/var/log/syslog"
-	fi
-	if [ -n "$all" ]; then
-		cat $fn
-	else
-		tail -$LINES $fn
-	fi
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'tail -25 /log/FILE', 'tail -F /log/FILE' to continuously monitor files."
-	fi
-}
-
-rmon()
-{
-	if [ -z "$*" ]; then
-		echo "Missing argument, see 'show port' for available interfaces"
-		exit 1
-	fi
-	for port in $*; do
-		ethtool -S "$port"
-	done
-	if [ -z "$plain" ] && [ -z "$nofoot" ]; then
-		dm "______________________________________________________________________________"
-		dm "See: 'ethtool --help' for more details."
-	fi
-}
-
-rstp()
-{
-	mstpctl showbridge
-	echo "br0 port info"
-	mstpctl showport br0
-}
-
-fdb()
-{
-	bridge $bopt fdb show
-}
-
-mdb()
-{
-	bridge $bopt mdb show
-}
-
-routes()
-{
-	ip $opt route show
-}
-
-igmp()
-{
-	querierctl $@
-}
-
-system()
-{
-	h1 "SYSTEM INFORMATION"
-	echo "System Name        : $(uname -n)"
-	echo "System Variant     : $VARIANT"
-	echo "System Description : $PRETTY_NAME"
-	echo "System Contact     : $HOME_URL"
-	echo "System Timezone    : $(cat /etc/timezone)"
-	echo "System Type        : $NAME"
-	echo "System Version     : $(cat /etc/version)"
-	echo "System Arch        : $(uname -m)"
-	echo "Kernel Version     : $(uname -sr)"
-}
-
-version()
-{
-	cat /etc/version
-}
-
-while [ "$1" != "" ]; do
-	case $1 in
-		-a)
-			all=1
-			;;
-		-f)
-			opt=""
-			if [ -n "$plain" ]; then
-				opt="-color=never"
-				bopt="-color=never"
-			fi
-			;;
-		-n)
-			nofoot="yes"
-			;;
-		-p)
-			plain="yes"
-			opt="$opt -color=never"
-			bopt="$bopt -color=never"
-			;;
-		-h)
-			usage
-			exit 0
-			;;
-		*)
-			break
-	esac
-	shift
-done
-
-cmd=$1
-if [ -n "$cmd" ]; then
-	shift
-fi
-
-case $cmd in
-	help)
-		usage
-		;;
-	port*)
-		ports $*
-		;;
-	vlan*)
-		vlans
-		;;
-	fdb)
-		fdb
-		;;
-	mdb)
-		mdb
-		;;
-	if*)
-		ifaces
-		;;
-	ip)
-		cmd=$1
-		shift
-		case $cmd in
-			addr*)
-				ifaces
-				;;
-			route*)
-				routes
-				;;
-			igmp*)
-				igmp $*
-				;;
-			*)
-				usage
-				;;
-		esac
-		;;
-	log)
-		log $1
-		;;
-	rmon)
-		rmon $*
-		;;
-	route*)
-		routes
-		;;
-	span*)
-		rstp
-		;;
-	sys*)
-		system
-		;;
-	ver*)
-		version
-		;;
-	*)
-		usage
-		exit 1
-		;;
-esac
@@ -1,55 +0,0 @@
-#!/bin/sh
-#set -x
-
-usage()
-{
-    cat <<EOF
-usage:
-  yorn [-h] ["Do you want to run command?" command]
-
-options:
-  -h            Show this help text
-  -p            Show plain output, no bells or whistles
-
-Displays the yes-or-no question and runs command on yes.
-EOF
-}
-
-if [ -z "$1" ]; then
-    usage
-    exit 1
-fi
-
-case $1 in
-    -h)
-	usage
-	exit 0
-	;;
-    -p)
-	plain=1
-	shift
-	;;
-    *)
-	;;
-esac
-
-question=$1
-shift
-command=$*
-if [ -z "$command" ]; then
-    usage
-    exit 1
-fi
-
-if [ -z "$plain" ]; then
-    if dialog --erase-on-exit --colors --defaultno --yesno "\Zb$question\ZB" 0 0; then
-	yorn=y
-    fi
-else
-    # shellcheck disable=SC2162,SC3045
-    read -n 1 -p "$question (y/N): " yorn
-fi
-
-if [ "$yorn" = "y" ] || [ "$yorn" = "Y" ]; then
-    $command
-fi
@@ -1,18 +0,0 @@
-# System-wide .bashrc file for interactive bash(1) shells.
-
-# If not running interactively, don't do anything
-[ -z "$PS1" ] && return
-
-# Reevaluate for each line, in case hostname changes
-function prompt_command
-{
-    PS1="\u@$(hostname):\w\$ "
-}
-export PROMPT_COMMAND=prompt_command
-
-# check the window size after each command and, if necessary,
-# update the values of LINES and COLUMNS.
-shopt -s checkwinsize
-
-# Disble built-ins
-enable -n help
@@ -1,51 +0,0 @@
-# Infix's configuration for dhcpcd.
-# See dhcpcd.conf(5) for details.
-
-# Allow users of this group to interact with dhcpcd via the control socket.
-#controlgroup wheel
-
-# Inform the DHCP server of our hostname for DDNS.
-#hostname
-
-# Use the hardware address of the interface for the Client ID.
-#clientid
-# or
-# Use the same DUID + IAID as set in DHCPv6 for DHCPv4 ClientID as per RFC4361.
-# Some non-RFC compliant DHCP servers do not reply with this set.
-# In this case, comment out duid and enable clientid above.
-duid
-
-# Persist interface configuration when dhcpcd exits.
-persistent
-
-# vendorclassid is set to blank to avoid sending the default of
-# dhcpcd-<version>:<os>:<machine>:<platform>
-vendorclassid
-
-# A list of options to request from the DHCP server.
-option domain_name_servers, domain_name, domain_search
-option classless_static_routes
-# Respect the network MTU. This is applied to DHCP routes.
-option interface_mtu
-
-# Request a hostname from the network
-option host_name
-
-# Most distributions have NTP support.
-#option ntp_servers
-
-# Rapid commit support.
-# Safe to enable by default because it requires the equivalent option set
-# on the server to actually work.
-option rapid_commit
-
-# A ServerID is required by RFC2131.
-require dhcp_server_identifier
-
-# Generate SLAAC address using the Hardware Address of the interface
-#slaac hwaddr
-# OR generate Stable Private IPv6 Addresses based from the DUID
-slaac private
-
-# Background immediately, do not wait for DHCP lease (speed up boot process)
-background
@@ -1,144 +0,0 @@
-#
-# Run-time configuration file for dialog
-#
-# Automatically generated by "dialog --create-rc <file>"
-#
-#
-# Types of values:
-#
-# Number     -  <number>
-# String     -  "string"
-# Boolean    -  <ON|OFF>
-# Attribute  -  (foreground,background,highlight?,underline?,reverse?)
-
-# Set aspect-ration.
-aspect = 0
-
-# Set separator (for multiple widgets output).
-separate_widget = ""
-
-# Set tab-length (for textbox tab-conversion).
-tab_len = 0
-
-# Make tab-traversal for checklist, etc., include the list.
-visit_items = OFF
-
-# Shadow dialog boxes? This also turns on color.
-use_shadow = ON
-
-# Turn color support ON or OFF
-use_colors = ON
-
-# Screen color
-screen_color = (WHITE,BLUE,OFF)
-
-# Shadow color
-shadow_color = (BLACK,BLACK,OFF)
-
-# Dialog box color
-dialog_color = (BLACK,CYAN,OFF)
-
-# Dialog box title color
-title_color = (BLACK,CYAN,ON)
-
-# Dialog box border color
-border_color = dialog_color
-
-# Active button color
-button_active_color = (CYAN,BLACK,ON)
-
-# Inactive button color
-button_inactive_color = dialog_color
-
-# Active button key color
-button_key_active_color = (WHITE,BLACK,ON)
-
-# Inactive button key color
-button_key_inactive_color = (WHITE,CYAN,ON)
-
-# Active button label color
-button_label_active_color = button_active_color
-
-# Inactive button label color
-button_label_inactive_color = dialog_color
-
-# Input box color
-inputbox_color = (BLACK,CYAN,OFF)
-
-# Input box border color
-inputbox_border_color = inputbox_color
-
-# Search box color
-searchbox_color = inputbox_color
-
-# Search box title color
-searchbox_title_color = (BLUE,WHITE,ON)
-
-# Search box border color
-searchbox_border_color = (WHITE,WHITE,ON)
-
-# File position indicator color
-position_indicator_color = searchbox_title_color
-
-# Menu box color
-menubox_color = dialog_color
-
-# Menu box border color
-menubox_border_color = dialog_color
-
-# Item color
-item_color = inputbox_color
-
-# Selected item color
-item_selected_color = button_key_active_color
-
-# Tag color
-tag_color = button_inactive_color
-
-# Selected tag color
-tag_selected_color = (CYAN,BLACK,OFF)
-
-# Tag key color
-tag_key_color = button_key_inactive_color
-
-# Selected tag key color
-tag_key_selected_color = (WHITE,BLACK,ON)
-
-# Check box color
-check_color = inputbox_color
-
-# Selected check box color
-check_selected_color = button_key_active_color
-
-# Up arrow color
-uarrow_color = (GREEN,WHITE,ON)
-
-# Down arrow color
-darrow_color = uarrow_color
-
-# Item help-text color
-itemhelp_color = (WHITE,BLACK,OFF)
-
-# Active form text color
-form_active_text_color = button_key_active_color
-
-# Form text color
-form_text_color = (WHITE,CYAN,ON)
-
-# Readonly form item color
-form_item_readonly_color = (CYAN,WHITE,ON)
-
-# Dialog box gauge color
-gauge_color = searchbox_title_color
-
-# Dialog box border2 color
-border2_color = dialog_color
-
-# Input box border2 color
-inputbox_border2_color = inputbox_color
-
-# Search box border2 color
-searchbox_border2_color = inputbox_color
-
-# Menu box border2 color
-menubox_border2_color = dialog_color
@@ -1 +0,0 @@
-run [S] /libexec/infix/swup --
@@ -1,112 +0,0 @@
-# NetBox mdev.conf based on https://github.com/slashbeast/mdev-like-a-boss/
-
-# Syntax:
-# [-]devicename_regex user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-# [-]$ENVVAR=regex    user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-# [-]@maj,min[-min2]  user:group mode [=path]|[>path]|[!] [@|$|*cmd args...]
-#
-# [-]: do not stop on this match, continue reading mdev.conf
-# =: move, >: move and create a symlink
-# !: do not create device node
-# @|$|*: run cmd if $ACTION=remove, @cmd if $ACTION=add, *cmd in all cases
-
-# support module loading on hotplug
-$MODALIAS=.*    root:root 660 @modprobe -b "$MODALIAS"
-
-# null may already exist; therefore ownership has to be changed with command
-null        root:root 666 @chmod 666 $MDEV
-zero        root:root 666
-full        root:root 666
-random      root:root 444
-urandom     root:root 444
-hwrandom    root:root 444
-grsec       root:root 660
-
-# Kernel-based Virtual Machine.
-#kvm     root:kvm 660
-
-# vhost-net, to be used with kvm.
-#vhost-net   root:kvm 660
-
-kmem        root:root 640
-mem         root:root 640
-port        root:root 640
-# console may already exist; therefore ownership has to be changed with command
-console     root:tty 600 @chmod 600 $MDEV
-ptmx        root:tty 666
-pty.*       root:tty 660
-
-# Typical devices
-tty         root:tty 666
-tty[0-9]*   root:tty 660
-vcsa*[0-9]* root:tty 660
-ttyS[0-9]*  root:dialout 660
-
-# block devices
-ram([0-9]*)        root:disk 660 >rd/%1
-loop([0-9]+)       root:disk 660 >loop/%1
-sr[0-9]*           root:cdrom 660 @ln -sf $MDEV cdrom
-fd[0-9]*           root:floppy 660
-#SUBSYSTEM=block;.* root:disk 660 */libexec/infix/storage-device
-
-# Run settle-nics every time new NIC appear.
-# If you don't want to auto-populate /etc/mactab with NICs,
-# run 'settle-nis' without '--write-mactab' param.
-#-SUBSYSTEM=net;DEVPATH=.*/net/.*;.*     root:root 600 @/libexec/infix/settle-nics --write-mactab
-
-net/tun[0-9]*   root:netdev 660
-net/tap[0-9]*   root:root 600
-
-# alsa sound devices and audio stuff
-#SUBSYSTEM=sound;.*  root:audio 660 @/libexec/infix/sound-control
-
-adsp        root:audio 660 >sound/
-audio       root:audio 660 >sound/
-dsp         root:audio 660 >sound/
-mixer       root:audio 660 >sound/
-sequencer.* root:audio 660 >sound/
-
-
-# raid controllers
-cciss!(.*)  root:disk 660 =cciss/%1
-ida!(.*)    root:disk 660 =ida/%1
-rd!(.*)     root:disk 660 =rd/%1
-
-
-fuse        root:root 666
-
-card[0-9]   root:video 660 =dri/
-
-agpgart     root:root 660 >misc/
-psaux       root:root 660 >misc/
-rtc         root:root 664 >misc/
-
-# input stuff
-SUBSYSTEM=input;.* root:plugdev 660
-
-# v4l stuff
-vbi[0-9]    root:video 660 >v4l/
-video[0-9]  root:video 660 >v4l/
-
-# dvb stuff
-dvb.*       root:video 660
-
-# drm etc
-dri/.*      root:video 660
-
-# Don't create old usbdev* devices.
-usbdev[0-9].[0-9]* root:root 660 !
-
-# Stop creating x:x:x:x which looks like /dev/dm-*
-[0-9]+\:[0-9]+\:[0-9]+\:[0-9]+ root:root 660 !
-
-# /dev/cpu support.
-microcode       root:root 600 =cpu/
-cpu([0-9]+)     root:root 600 =cpu/%1/cpuid
-msr([0-9]+)     root:root 600 =cpu/%1/msr
-
-# Populate /dev/bus/usb.
-#SUBSYSTEM=usb;DEVTYPE=usb_device;.* root:root 660 */libexec/infix/dev-bus-usb
-
-# Catch-all other devices, Right now useful only for debuging.
-#.* root:root 660 */libexec/infix/catch-all
@@ -1 +0,0 @@
-[2m[1mNote:[0m[2m use help, show, and setup commands to set up and diagnose the system.[0m
@@ -1,6 +0,0 @@
-# interfaces(5) file used by ifup(8) and ifdown(8)
-auto lo
-iface lo inet loopback
-
-source-directory /etc/network/interfaces.d
-
@@ -1,75 +0,0 @@
-#!/usr/bin/pdmenu
-
-title:Setup & Diagnostics
-
-color:desktop:blue:blue
-color:title:blue:white
-color:base:blue:white
-
-menu:main:Main Menu:Use arrow keys, Enter, Escape, and Q to navigate
-	show:_System Settings..::system
-	show:_Network Settings..::network
-	show:_Tools..::tools
-	nop
-	exec:Show _fdb:truncate:show -p fdb
-	exec:Show _mdb:truncate:show -p mdb
-	exec:Show _ports:truncate:show -p ports
-	exec:Show _vlans:truncate:show -p  vlans
-	exec:Show _interfaces:truncate:show -p iface
-	exec:Show _routes:truncate:show -p route
-	nop
-	exec:Show _online users:truncate:w
-	exec:Show _CPU Load::top
-	nop
-	show:_Help..::help
-	exit:_Quit
-
-menu:help:Help:Help Menu
-	exec:Introduction:truncate:/bin/help -p
-	exec:Editors:truncate:/bin/help -p edit
-	exec:Networking:truncate:/bin/help -p net
-	nop
-	exit:_Main menu..
-
-menu:network:Network:Network Settings
-	exec:Show all _links:truncated:ip -br link
-	exec:Show all _addresses:truncated:ip -br address
-	exec:Show managed _interfaces:truncated:ifparse --all
-	nop
-	exec:Take _interface down:edit:ifdown ~Enter name of interface to take down:~
-	exec:Take _interface up:edit:ifup ~Enter name of interface to take up:~
-	nop
-	exec:Edit _dhcpcd.conf::edit /etc/dhcpcd.conf
-	exec:Edit _dnsmasq.conf::edit /etc/dnsmasq.conf
-	exec:Edit _interfaces::edit /etc/network/interfaces
-	exec:Edit _mactab::edit /etc/mactab
-	exec:Edit _sysctl.conf::edit /etc/sysctl.conf
-	nop
-	exit:_Main menu..
-
-menu:system:System:System Settings
-	exec:List _log files:truncate:ls -l /var/log
-	exec:Show _log file:edit,truncate:show -p -a log ~Show logfile, Enter for syslog:syslog~
-	exec:Change _hostname:edit:hostnm ~Enter new hostname \[-a-zA-Z0-9\]:~
-	exec:Change your _password::passwd
-	exec:Edit _rc.local::edit /etc/rc.local
-	nop
-	exec:_Show State of Services:truncate:initctl -p
-	exec:_Reload services:truncate:initctl reload;sleep 2;initctl -p
-	exec:Show _available services:truncate:initctl -p ls
-	exec:_Enable service:edit:initctl enable ~Enter name of service (filename) to enable:~
-	exec:_Disable service:edit:initctl disable ~Enter name of service (filename) to disable:~
-	nop
-	exec:_Factory Reset::yorn "Factory reset device (reboots), are you sure?" factory -y
-	nop
-	exit:_Main menu..
-
-menu:tools:Tools:Tools
-	exec:_Ping:edit,pause:ping ~Enter address (IP or name) to ping:~
-	exec:_Shell Prompt::/bin/bash --login
-	exec:_SSH:edit,pause:ssh ~Enter [username@]address (IP or name) to SSH to:~
-	exec:_Telnet:edit,pause:telnet ~Enter address (IP or name) to telnet to:~
-	exec:_Traceroute:edit,pause:mtr ~Enter address (IP or name) to traceroute to:~
-	exec:Browse _WWW:edit,pause:lynx ~Enter URL to browse:~
-	nop
-	exit:_Main menu..
@@ -1,19 +0,0 @@
-#!/bin/sh
-# This file is run at the very end of runlevel S (bootstrap)
-#
-# Note: 1) not all initctl commands are allowed here
-#       2) to enable IP forwarding, use /etc/sysctl.conf, or /etc/sysctl.d/
-#       3) ensure the script calls `exit 0` at the end
-#
-
-# Uncomment to classify all interfaces starting with 'eth' as ports.
-#for port in $(ip -br link |awk '/eth/{print $1}'); do
-#	ip link set $port group port
-#done
-
-# Uncomment to enable IP masquerading (NAT) of all traffic egressing
-# the WAN interface, here eth0.  E.g., if you are a router for your
-# LAN on eth1.
-#iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
-
-exit 0
@@ -1,62 +0,0 @@
-#!/bin/sh
-# Factory default:
-#  1) all switch ports in VLAN 1 of br0
-#  2) no switch ports => DHCP on eth0
-#  3) no eth0
-
-create_bridge()
-{
-    nm=$1
-    shift
-    ports=$@
-
-    touch "/etc/network/interfaces.d/$nm"
-    for port in $ports; do
-	cat <<-EOF >>"/etc/network/interfaces.d/$nm"
-		iface $port
-		    bridge-access 1
-		    post-up ip link set $port group port
-		EOF
-    done
-    cat <<-EOF >> "/etc/network/interfaces.d/$nm"
-
-	auto $nm
-	iface $nm
-	    bridge-ports $ports
-	    bridge-vlan-aware yes
-	    bridge-stp on
-	    bridge-vids 1
-
-	auto vlan1
-	iface vlan1 inet dhcp
-	    vlan-id 1
-	    vlan-raw-device $nm
-	    post-up ip link set vlan1 group iface
-	EOF
-    ip link set vlan1 group iface
-}
-
-# Check if already set up
-[ -z "$(ls -A /etc/network/interfaces.d/)" ] || exit 0
-
-# Check for custom hostname from Qemu/Qeneth
-nm=$(cat /sys/firmware/qemu_fw_cfg/by_name/opt/hostname/raw)
-if [ -n "$nm" ]; then
-    hostnm "$nm"
-fi
-
-# need to check for 'length > 0' because ip command
-# outputs empty json objects for non-port group ifs
-ports=$(ip -json link show group port | jq -r '.[].ifname | select(length > 0)' | tr "\n" " ")
-if [ -n "$ports" ]; then
-    create_bridge br0 $ports
-else
-    ifaces=$(ip -json addr show  |jq -r '.[] | select(.link_type=="ether").ifname')
-    for iface in $ifaces; do
-	cat  <<-EOF > "/etc/network/interfaces.d/$iface"
-		auto $iface
-		iface $iface inet dhcp
-		    pre-up ip link set $iface group iface
-		EOF
-    done
-fi
@@ -1,6 +0,0 @@
-#!/bin/sh
-# Probe for various types of harware features
-
-if dmesg |grep -q QEMU || test -d /sys/module/qemu_fw_cfg; then
-    initctl -nbq cond set qemu
-fi
@@ -18,7 +18,27 @@ endchoice
 config SIGN_KEY
 	string "Signing key"
 	depends on SIGN_ENABLED
-	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/dev-key" if SIGN_SRC_DIR
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development"  if SIGN_SRC_DIR
+
+menuconfig TRUSTED_KEYS
+	bool "Trusted keys for image"
+	depends on SIGN_ENABLED
+	help
+	 Keys that will be accepted for this image
+
+
+config TRUSTED_KEYS_DEVELOPMENT
+	bool "Development key"
+	depends on TRUSTED_KEYS
+
+config TRUSTED_KEYS_DEVELOPMENT_PATH
+	string
+	depends on TRUSTED_KEYS_DEVELOPMENT
+	default "${BR2_EXTERNAL_INFIX_PATH}/board/common/signing-keys/development/infix.crt"
+
+config TRUSTED_KEYS_EXTRA_PATH
+	string "Path to extra keys to include in image"
+	depends on TRUSTED_KEYS

 menuconfig DISK_IMAGE
 	bool "Disk image"
@@ -140,4 +160,3 @@ config FIT_ARCH
 config FIT_KERNEL_LOAD_ADDR
 	string "Kernel load address"
 	depends on FIT_IMAGE
-
@@ -1,11 +1,13 @@
 ifeq ($(SIGN_ENABLED),y)
 include $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/uboot.mk

+TRUSTED_KEYS=$(TRUSTED_KEYS_DEVELOPMENT_PATH) $(TRUSTED_KEYS_EXTRA_PATH)
 define RAUC_POST_BUILD_INSTALL_CERT
 	@$(call IXMSG,"Installing signing cert for RAUC")
 	mkdir -p $(TARGET_DIR)/etc/rauc/keys
-	$(foreach crt,$(shell ls $(SIGN_KEY)/*.crt), \
+	$(foreach crt,$(shell ls $(TRUSTED_KEYS)), \
 		cp $(crt) $(TARGET_DIR)/etc/rauc/keys/$(shell openssl x509 -hash -noout <$(crt)).0;)
+
 endef
 RAUC_POST_BUILD_HOOKS += RAUC_POST_BUILD_INSTALL_CERT
 endif
@@ -44,16 +44,19 @@ image @DISKIMG@ {
 	partition aux {
 		offset = @AUXOFFS@
 		image = "aux.ext4"
+		partition-uuid = @AUXUUID@
 	}

 	partition primary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
+		partition-uuid = @PRIMARYUUID@
 	}

 	partition secondary {
 		image = "rootfs.squashfs"
 		size = @IMGSIZE@
+		partition-uuid = @SECONDARYUUID@
 	}

 	partition cfg {
@@ -1,7 +1,8 @@
 #!/bin/sh
-
 set -e

+. $BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/etc/partition-uuid
+
 K=10
 M=20
 G=30
@@ -157,6 +158,9 @@ genboot
 # Use awk over sed because replacement text may contain newlines,
 # which sed does not approve of.
 awk \
+   	  -vauxuuid=$AUX_UUID \
+	  -vprimaryuuid=$PRIMARY_UUID \
+          -vsecondaryuuid=$SECONDARY_UUID \
 	  -vtotal=$total \
 	  -vauxsize=$auxsize -vauxoffs=$auxoffs \
 	  -vimgsize=$imgsize \
@@ -174,6 +178,10 @@ awk \
 		sub(/@DISKIMG@/, diskimg);
 		sub(/@BOOTIMG@/, bootimg);
 		sub(/@BOOTPART@/, bootpart);
+		sub(/@AUXUUID@/, auxuuid);
+		sub(/@PRIMARYUUID@/, primaryuuid);
+		sub(/@SECONDARYUUID@/, secondaryuuid);
+
 	  }1' \
 	      < $common/genimage.cfg.in >$root/genimage.cfg

@@ -60,7 +60,7 @@ cat <<EOF >"$BINARIES_DIR/${NM}.gns3a"
    "status": "stable",
    "maintainer": "$VENDOR_NAME",
    "maintainer_email": "${SUPPORT_URL#mailto:}",
-    "usage": "Default login, user/pass: admin/admin\n\nType 'help' for an overview of commands and relevant configuration files.\n\nFor Classic builds the following applies: the /etc directory is writable, use the passwd tool after login as part of your set up.\nFor networking, classify interfaces as switchports with /etc/mactab, syntax: 'MAC-address  eN', where N is the port number (1-MAX).\nTo set up bridging and management interfaces, use /etc/network/interfaces, and /etc/network/interfaces.d/",
+    "usage": "Default login, user/pass: admin/admin\n\nType 'cli' (and Enter) followed by 'help' for an overview of commands and relevant configuration files.",
    "port_name_format": "eth{0}",
    "linked_clone": true,
    "qemu": {
@@ -1,5 +1,6 @@
 #!/bin/sh
 # shellcheck disable=SC1090,SC1091
+common=$(dirname "$(readlink -f "$0")")
 . "$BR2_CONFIG" 2>/dev/null
 . "$TARGET_DIR/usr/lib/os-release"

@@ -31,6 +32,7 @@ rm -f "$TARGET_DIR/etc/os-release"
    echo "ID=$INFIX_ID"
    echo "PRETTY_NAME=\"$INFIX_TAGLINE $VERSION\""
    echo "ID_LIKE=\"${ID}\""
+    echo "DEFAULT_HOSTNAME=$BR2_TARGET_GENERIC_HOSTNAME"
    echo "VERSION=\"${VERSION}\""
    echo "VERSION_ID=${VERSION}"
    echo "BUILD_ID=\"${GIT_VERSION}\""
@@ -40,13 +42,6 @@ rm -f "$TARGET_DIR/etc/os-release"
    if [ -n "$INFIX_RELEASE" ]; then
 	echo "IMAGE_VERSION=\"$INFIX_RELEASE\""
    fi
-    if [ "$INFIX_VARIANT_NETCONF" = "y" ]; then
-	echo "VARIANT=\"Managed NETCONF\""
-	echo "VARIANT_ID=netconf"
-    else
-	echo "VARIANT=\"Classic, writable /etc\""
-	echo "VARIANT_ID=classic"
-    fi
    echo "ARCHITECTURE=\"${INFIX_ARCH}\""
    echo "HOME_URL=$INFIX_HOME"
    if [ -n "$INFIX_VENDOR" ]; then
@@ -68,6 +63,12 @@ rm -f "$TARGET_DIR/etc/os-release"

 echo "$INFIX_TAGLINE $VERSION -- $(date +"%b %e %H:%M %Z %Y")" > "$TARGET_DIR/etc/version"

+# Drop Buildroot default symlink to /tmp
+if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
+	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
+	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
+fi
+
 # Allow pdmenu (setup) and bash to be login shells, bash is added
 # automatically when selected in menuyconfig, but not when BusyBox
 # provides a symlink (for ash).  The /bin/{true,false} are old UNIX
@@ -80,3 +81,7 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/true" >> "$TARGET_DIR/etc/shells"
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
        || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
+
+# Allow clish (symlink to /usr/bin/klish) to be a login shell
+grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
+        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -54,17 +54,16 @@ choice

 config QEMU_CONSOLE_VIRTIO
     bool "Virtio (hvc0)"
-     depends on QEMU_LOADER_KERNEL

 config QEMU_CONSOLE_SERIAL
     bool "Serial (ttyS0/ttyAMA0)"
-
+     depends on !QEMU_LOADER_OVMF
 endchoice

 config QEMU_MACHINE
 	string "Select emulated machine"
-	default "qemu-system-aarch64 -M virt -cpu cortex-a72"   if QEMU_aarch64
-	default "qemu-system-x86_64 -M q35,accel=kvm -cpu host" if QEMU_x86_64
+	default "qemu-system-aarch64 -M virt,accel=kvm:tcg -cpu max" if QEMU_aarch64
+	default "qemu-system-x86_64  -M pc,accel=kvm:tcg   -cpu max" if QEMU_x86_64
 	help
 	  You should not have to change this setting, although you may
 	  want to tweak it, or change the acceleration.
@@ -77,9 +76,9 @@ config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
 	default "384M"
 	help
-	  The default, 384 MiB, works for most configurations, even less for
-	  the Infix Classic builds.  However, if you get kernel panic with:
-	  "System is deadlocked on memory", try increasing this one.
+	  The default, 384 MiB, works for most configurations.  However,
+	  if you get kernel panic with: "System is deadlocked on memory",
+	  try increasing this one.

 config QEMU_KERNEL
 	string
@@ -117,7 +117,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS,if=virtio,format=raw,bus=0,unit=0 "
+	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
    fi
 }

@@ -148,14 +148,20 @@ usb_args()
 	dd if=/dev/zero of=${USBSTICK} bs=8M count=1 >/dev/null 2>&1
 	mkfs.vfat $USBSTICK >/dev/null 2>&1
    fi
-    echo -n "-drive if=none,id=usbstick,format=raw,file=${USBSTICK} "
+    echo -n "-drive if=none,id=usbstick,format=raw,file=$USBSTICK "
    echo -n "-usb "
    echo -n "-device usb-ehci,id=ehci "
    echo -n "-device usb-storage,bus=ehci.0,drive=usbstick "
 }
 rw_args()
 {
-    [ "$CONFIG_QEMU_RW" ] || return
+    [ "$CONFIG_QEMU_RW" ] ||  return
+
+    if ! [ -f "aux.ext4" ]; then
+	dd if=/dev/zero of="aux.ext4" bs=1M count=1 >/dev/null 2>&1
+	mkfs.ext4 -L aux "aux.ext4" >/dev/null 2>&1
+    fi
+    echo -n "-drive file=aux.ext4,if=virtio,format=raw,bus=0,unit=3 "

    if ! [ -f "$CONFIG_QEMU_RW" ]; then
 	dd if=/dev/zero of="$CONFIG_QEMU_RW" bs=16M count=1 >/dev/null 2>&1
@@ -198,10 +204,10 @@ net_args()
    echo -n "-fw_cfg name=opt/mactab,file=$mactab "

    if [ "$CONFIG_QEMU_NET_BRIDGE" = "y" ]; then
-	echo -n "-netdev bridge,id=e0,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
-	net_dev_args 0
+	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
+	net_dev_args 1
    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 0 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
 	    net_dev_args $i
 	done
@@ -209,8 +215,8 @@ net_args()
 	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"

-	echo -n "-netdev user,id=e0${useropts} "
-	net_dev_args 0
+	echo -n "-netdev user,id=e1${useropts} "
+	net_dev_args 1
    else
 	echo -n "-nic none"
    fi
@@ -251,6 +257,9 @@ wdt_args()

 run_qemu()
 {
+    if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
+	 qemu-img create -f qcow2 -o backing_file=$CONFIG_QEMU_ROOTFS -F raw $CONFIG_QEMU_ROOTFS.qcow2 > /dev/null
+    fi
    local qemu
    read qemu <<EOF
 	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+# Generate a self signed certificate with unlimited expire time
+
+import argparse
+
+from cryptography import x509
+from cryptography.x509.oid import NameOID
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
+from cryptography.hazmat.backends import default_backend
+from datetime import datetime, timedelta
+
+# Generate private key
+private_key = rsa.generate_private_key(
+    public_exponent=65537,
+    key_size=2048,
+    backend=default_backend()
+
+)
+
+parser = argparse.ArgumentParser(description="Generate a self signed certificate")
+parser.add_argument('--country', required=True, help="Set country")
+parser.add_argument('--state', required=True, help="Set state or province name")
+parser.add_argument('--city', required=True, help="Set city name")
+parser.add_argument('--organisation', required=True, help="Set organisation name")
+parser.add_argument('--organisation-unit', required=True, help="Set organisation unit name")
+parser.add_argument('--common-name', required=True, help="Set common name")
+parser.add_argument('--out-certificate', required=True, help="Output certificate")
+parser.add_argument('--out-key', required=True, help="Output key")
+
+args = parser.parse_args()
+
+ # Builder for certificate
+subject = issuer = x509.Name([
+    x509.NameAttribute(NameOID.COUNTRY_NAME, args.country),
+    x509.NameAttribute(NameOID.STATE_OR_PROVINCE_NAME, args.state),
+    x509.NameAttribute(NameOID.LOCALITY_NAME, args.city),
+    x509.NameAttribute(NameOID.ORGANIZATION_NAME, args.organisation),
+    x509.NameAttribute(NameOID.ORGANIZATIONAL_UNIT_NAME, args.organisation_unit),
+    x509.NameAttribute(NameOID.COMMON_NAME, args.common_name),
+])
+certificate = x509.CertificateBuilder().subject_name(
+    subject
+).issuer_name(
+    issuer
+).public_key(
+    private_key.public_key()
+).serial_number(
+    x509.random_serial_number()
+).not_valid_before(
+    datetime(2000, 1, 1)
+).not_valid_after(
+    datetime(9999, 1, 1)
+).add_extension(
+    x509.SubjectAlternativeName([x509.DNSName(args.common_name)]),
+    critical=False,
+).sign(private_key, hashes.SHA256(), default_backend())
+
+# Serialize certificate and private key
+with open(args.out_certificate, "wb") as f:
+    f.write(certificate.public_bytes(serialization.Encoding.PEM))
+with open(args.out_key, "wb") as f:
+    f.write(private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption()
+    ))
@@ -43,7 +43,7 @@ if [ -x /bin/ip -o -x /sbin/ip ] ; then
        BIND)
            ip addr flush dev "$2" label "$2:avahi"
            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
-            ip route add default dev "$2" metric "$METRIC" scope link ||:
+            ip route add default dev "$2" metric "$METRIC" scope link proto zeroconf ||:
            ;;

        CONFLICT|UNBIND|STOP)
@@ -2,8 +2,12 @@
 # managed by openresolv.  DHCP lease, VPN tunnel establishment,
 # and similar events feed servers and configuration to dnsmasq.
 domain-needed
-#interface=lo
-listen-address=127.0.0.1
+
+# Only listen to loopback (local system)
+interface=lo
+bind-dynamic
+#listen-address=127.0.0.1,::1
+
 enable-dbus

 # Generated by openresolv
@@ -1 +1,2 @@
 set COLORTERM=yes
+rlimit soft core infinity
@@ -0,0 +1 @@
+task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate
@@ -0,0 +1 @@
+service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
@@ -0,0 +1 @@
+../available/mkcert.conf
@@ -19,4 +19,4 @@ LABEL=aux	/mnt/aux	auto		noatime,nodiratime,noauto	0	0
 LABEL=var	/mnt/var	auto		noatime,nodiratime,noauto	0	0
 LABEL=cfg	/mnt/cfg	auto		noatime,nodiratime,noauto	0	0
 hostfs		/mnt/host	9p		cache=none,msize=16384,noauto	0	0
-/libexec/infix/mnt# /cfg		helper		none				0	0
+/libexec/infix/mnt# /cfg	helper		none				0	0
@@ -0,0 +1,25 @@
+root:x:0:
+daemon:x:1:
+bin:x:2:
+sys:x:3:
+adm:x:4:
+tty:x:5:
+disk:x:6:
+lp:x:7:
+mail:x:8:
+kmem:x:9:
+wheel:x:10:root
+cdrom:x:11:
+dialout:x:18:
+floppy:x:19:
+video:x:28:
+audio:x:29:
+tape:x:32:
+www-data:x:33:
+backup:x:34:
+utmp:x:43:
+plugdev:x:46:
+lock:x:54:
+netdev:x:82:
+users:x:100:
+nobody:x:65534:
@@ -0,0 +1 @@
+configure ports dsa0 lldp status disabled
@@ -0,0 +1,6 @@
+# Sourced by mkcert at boot
+country=SE
+state=Vastmanland
+city=Vasteras
+org=KernelKit
+unit=Infix
@@ -1,4 +1,4 @@
 .-------.
 |  . .  | Infix -- a Network Operating System
 |-. v .-| https://kernelkit.github.io
-'-'---'-'
+'-'---'-'
@@ -0,0 +1,27 @@
+server {
+    listen       80;
+    listen       [::]:80;
+    server_name  _;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    server_name  _;
+    include      ssl.conf;
+
+    #error_page  404              /404.html;
+
+    # redirect server error pages to the static page /50x.html
+    #
+    error_page   500 502 503 504  /50x.html;
+    location = /50x.html {
+	root   html;
+    }
+
+    location / {
+	root   html;
+	index  index.html index.htm;
+    }
+}
@@ -0,0 +1,18 @@
+server {
+    listen       443 ssl;
+    listen       [::]:443 ssl;
+    server_name  network.local;
+    include      ssl.conf;
+
+    location / {
+	proxy_pass http://127.0.0.1:8000;
+	proxy_http_version 1.1;
+	proxy_set_header Upgrade $http_upgrade;
+	proxy_set_header Connection 'upgrade';
+	proxy_set_header Host $host;
+	proxy_set_header X-Real-IP $remote_addr;
+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header X-Forwarded-Proto $scheme;
+	proxy_redirect off;
+    }
+}
@@ -0,0 +1,19 @@
+server {
+    listen       7681 ssl;
+    listen       [::]:7681 ssl;
+    server_name  _;
+
+    include      ssl.conf;
+
+    location / {
+	proxy_http_version  1.1;
+	proxy_set_header    Host $host;
+	proxy_set_header    X-Real-IP $remote_addr;
+	proxy_set_header    X-Forwarded-Proto $scheme;
+	proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header    Upgrade $http_upgrade;
+	proxy_set_header    Connection "upgrade";
+	proxy_pass          http://127.0.0.1:8001;
+	proxy_redirect      off;
+    }
+}
@@ -0,0 +1 @@
+../available/default.conf
@@ -0,0 +1,24 @@
+user  www-data www-data;
+worker_processes  1;
+
+events {
+    worker_connections  1024;
+}
+
+http {
+    include       mime.types;
+    default_type  application/octet-stream;
+
+    sendfile        on;
+    #tcp_nopush     on;
+
+    #keepalive_timeout  0;
+    keepalive_timeout  65;
+
+    #gzip  on;
+
+    include /etc/nginx/enabled/*.conf;
+
+    access_log syslog:server=unix:/dev/log,nohostname,facility=local7,severity=info;
+    error_log  syslog:server=unix:/dev/log,nohostname,facility=local7 info;
+}
@@ -0,0 +1,9 @@
+ssl_certificate      /etc/ssl/certs/self-signed.crt;
+ssl_certificate_key  /etc/ssl/private/self-signed.key;
+
+ssl_protocols        TLSv1.3 TLSv1.2;
+ssl_ciphers          HIGH:!aNULL:!MD5;
+ssl_prefer_server_ciphers  on;
+
+ssl_session_cache    shared:SSL:1m;
+ssl_session_timeout  5m;
@@ -0,0 +1,3 @@
+AUX_UUID="78460f84-de84-4fe7-89bd-4c1f433b2230"
+PRIMARY_UUID="107ae911-a97b-4380-975c-7ce1a2dde1e0"
+SECONDARY_UUID="352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02"
@@ -0,0 +1,9 @@
+root:x:0:0:root:/root:/bin/sh
+daemon:x:1:1:daemon:/usr/sbin:/bin/false
+bin:x:2:2:bin:/bin:/bin/false
+sys:x:3:3:sys:/dev:/bin/false
+sync:x:4:100:sync:/bin:/bin/sync
+mail:x:8:8:mail:/var/spool/mail:/bin/false
+www-data:x:33:33:www-data:/var/www:/bin/false
+backup:x:34:34:backup:/var/backups:/bin/false
+nobody:x:65534:65534:nobody:/home:/bin/false
@@ -0,0 +1,9 @@
+root::::::::
+daemon:*:::::::
+bin:*:::::::
+sys:*:::::::
+sync:*:::::::
+mail:*:::::::
+www-data:*:::::::
+backup:*:::::::
+nobody:*:::::::
@@ -0,0 +1 @@
+kernel.core_pattern=/var/crash/core-%e
@@ -0,0 +1,42 @@
+#!/bin/sh
+
+KEY=/cfg/ssl/private/self-signed.key
+CRT=/cfg/ssl/certs/self-signed.crt
+
+country=US
+state=California
+city=Berkeley
+org="Acme, Inc."
+unit=Second
+
+if [ -f /etc/mkcert.conf ]; then
+     . /etc/mkcert.conf
+fi
+
+if [ -z "$cn" ]; then
+    cn=$1
+    if [ -z "$cn" ]; then
+	cn=$(hostname).local
+    fi
+fi
+
+generate()
+{
+    mkdir -p  /cfg/ssl/private /cfg/ssl/certs
+    chmod 700 /cfg/ssl/private
+
+    gencert --country "$country" --state "$state" --city "$city" --organisation "$org" \
+	    --organisation-unit "$unit" --common-name "$cn" \
+	    --out-certificate $CRT --out-key $KEY
+}
+
+CN=$(openssl x509 -noout -subject -in "${CRT}" 2>/dev/null |sed 's/.*CN=//')
+if [ -z "$CN" ] || [ "$CN" != "$cn" ]; then
+    generate "$cn"
+fi
+
+cp "${KEY}" "/etc/ssl/private/"
+cp "${CRT}" "/etc/ssl/certs/"
+initctl cond set mkcert
+
+exit 0
@@ -126,11 +126,6 @@ if ! mount_rw cfg >/dev/null 2>&1; then
    # Even if /mnt/var isn't available, if /mnt/cfg isn't either, then
    # there's no point in overlaying one ramdisk on top of another.
    vlibsrc=
-else
-    # Classic Infix has read-write /etc across boots
-    if [ "$VARIANT_ID" != "netconf" ]; then
-	etcsrc=/mnt/cfg
-    fi
 fi

 if check_factory; then
@@ -3,12 +3,13 @@
 import importlib.machinery
 import json
 import os
+import shutil
 import struct
 import subprocess
 import sys

 onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
-
+SYSTEM_JSON   = "/run/system.json"
 KKIT_IANA_PEM = 61046

 class DTSystem:
@@ -83,7 +84,7 @@ class DTSystem:
        }

    def infix_usb_devices(self, out):
-        names=self.infix.str_array("usb-port-names")
+        names=self.infix.str_array("usb-port-names", ())
        phs=self.__get_phandle_array("usb-ports")
        data=dict(zip(names,phs))
        if data != {}:
@@ -233,8 +234,36 @@ def vpd_inject(out, vpds):
            out["factory-password-hash"] = pwhash
            break

+def qemu_base_mac():
+    """Find MAC address of first non-loopback interface, subtract with 1"""
+    base_path = '/sys/class/net'
+    interfaces = []
+
+    for iface in os.listdir(base_path):
+        if iface == 'lo':
+            continue
+        try:
+            # pylint: disable=invalid-name
+            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
+                mac = f.read().strip()
+            interfaces.append((mac, iface))
+        except FileNotFoundError:
+            continue
+
+    if interfaces:
+        interfaces.sort()
+        mac  = interfaces[0][0]
+        mac  = int(mac.replace(':', ''), 16)
+        mac -= 1
+        mac %= 1 << 48
+        mac  = ':'.join(f"{(mac >> 8 * i) & 0xff:02x}" for i in range(5, -1, -1))
+        return mac
+
+    return None
+
 def probe_qemusystem(out):
-    ADMINHASH = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
+    """Probe Qemu based test systems and 'make run'"""
+    admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"

    qsys = QEMUSystem()
    vpds = qsys.vpds()
@@ -244,6 +273,7 @@ def probe_qemusystem(out):
    for (attr, default) in (
            ("vendor", "QEMU"),
            ("product-name", "VM"),
+            ("mac-address", qemu_base_mac()),
    ):
        if not out[attr]:
            out[attr] = default
@@ -252,13 +282,14 @@ def probe_qemusystem(out):
       not out["vpd"]["product"]["available"]:
        # Virtual instance without VPD emulation, fallback to
        # admin/admin
-        out["factory-password-hash"] = ADMINHASH
+        out["factory-password-hash"] = admin_hash

    # Let others react to the fact that we are running in QEMU
-    subprocess.run("initctl -nbq cond set qemu".split())
+    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
    return 0

 def probe_dtsystem(out):
+    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
    vpds = dtsys.infix_vpds()
    dtsys.infix_usb_devices(out)
@@ -296,11 +327,15 @@ def main():
        return err

    if not out["factory-password-hash"]:
-        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\nNO FACTORY PASSWORD FOUND\033[0m\n\n")
+        sys.stdout.write("\n\n\033[31mCRITICAL BOOTSTRAP ERROR\n" +
+                         "NO FACTORY PASSWORD FOUND\033[0m\n\n")
        err = 1

-    json.dump(out, open("/run/system.json", "w"))
-    os.chmod("/run/system.json", 0o444)
+    os.umask(0o337)
+    # pylint: disable=invalid-name
+    with open(SYSTEM_JSON, "w", encoding="ascii") as f:
+        json.dump(out, f)
+    shutil.chown(SYSTEM_JSON, user="root", group="wheel")
    return err

 if __name__ == "__main__":
@@ -1,14 +1,15 @@
 #!/bin/sh
-
 set -e

+. /etc/partion-uuid
+
 disk=$1
 bootoffs=$2

 bootsize=8M
 auxsize=8M

-total=$(awk -vdisk="$(basename $disk)" '$4 == disk { print($3 / 1024); }' /proc/partitions)
+total=$(awk -vdisk="$(basename $disk)" '$4 == disk { print(int($3 / 1024)); }' /proc/partitions)
 if [ "$total" -ge 4096 ]; then
    imgsize=1024M
    cfgsize=512M
@@ -29,9 +30,9 @@ fi
 sgdisk \
    -o \
    -n1:${bootoffs}:+${bootsize} -t1:8301 -c1:boot \
-    -n2::+${auxsize} -t2:8301 -c2:aux \
-    -n3::+${imgsize} -t3:8300 -c3:primary \
-    -n4::+${imgsize} -t4:8300 -c4:secondary \
+    -n2::+${auxsize} -t2:8301 -c2:aux -u2:${AUX_UUID}\
+    -n3::+${imgsize} -t3:8300 -c3:primary -u3:${PRIMARY_UUID} \
+    -n4::+${imgsize} -t4:8300 -c4:secondary -u4:${SECONDARY_UUID}\
    -n5::+${cfgsize} -t5:8302 -c5:cfg \
    -n6::            -t6:8310 -c6:var \
    -p \
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+<title>Error</title>
+<style>
+html { color-scheme: light dark; }
+body { width: 35em; margin: 0 auto;
+font-family: Tahoma, Verdana, Arial, sans-serif; }
+</style>
+</head>
+<body>
+<h1>An error occurred.</h1>
+<p>Sorry, the page you are looking for is currently unavailable.</p>
+</body>
+</html>
@@ -0,0 +1,12 @@
+#!/bin/sh
+# Generate index.html from Infix README.md
+
+BASE=../../../../..
+TITLE="Welcome to Infix :-)"
+
+cp $BASE/doc/logo.png .
+cat $BASE/README.md \
+    | tail +2 \
+    | sed 's/doc\/logo.png/logo.png/' \
+    | pandoc -f markdown+implicit_figures+link_attributes -o index.html \
+	     --metadata pagetitle="$TITLE" --template=hpstr-template.html
@@ -103,8 +103,8 @@ create()
 	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
    fi

-    args="$args --cgroup-parent=containers"
-    args="$args --restart=$restart --systemd=false --tz=local $privileged --replace --quiet"
+    args="$args --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --restart=$restart --systemd=false --tz=local $privileged"
    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
    pidfn=/run/container:${name}.pid

@@ -125,10 +125,11 @@ create()
 	    args="$args --dns-search=$domain"
 	done
    else
-	network="--net none"
+	args="$args --network=none"
    fi

    # shellcheck disable=SC2048
+    log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
 	[ -n "$quiet" ] || log "Successfully created container $name from $image"
 	rm -f "/run/containers/env/${name}.env"
@@ -216,6 +217,20 @@ netwrm()
    done
 }

+# Schedule restart of (any) container using network $1 to activate network changes
+netrestart()
+{
+    net=$1
+
+    for c in $(podman ps $all --format "{{.Names}}"); do
+	for n in $(podman inspect "$c" |jq -r '.[].NetworkSettings.Networks | keys[]'); do
+	    if [ "$n" = "$net" ]; then
+		initctl -nbq touch "container@$c"
+	    fi
+	done
+    done
+}
+
 usage()
 {
 	cat <<EOF
@@ -226,6 +241,8 @@ options:
  -a, --all                Show all, of something
      --dns NAMESERVER     Set nameserver(s) when creating a container
      --dns-search LIST    Set host lookup search list when creating container
+      --cap-add CAP        Add capability to unprivileged container
+      --cap-drop CAP       Drop capability, for privileged containter
  -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
  -d, --detach             Detach a container started with 'run IMG [CMD]'
  -e, --env FILE           Environment variables when creating container
@@ -259,7 +276,7 @@ commands:
  list    [image | oci]    List names (only) of containers, images, or OCI archives
  load    [NAME | URL] NM  Load OCI tarball fileNAME or URL to image NM
  remove   IMAGE           Remove an (unused) container image
-  restart [NAME]           Restart a crashed container
+  restart [network] NAME   Restart a (crashed) container or container(s) using network
  run      NAME [CMD]      Run a container interactively, with an optional command
  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
  shell                    Start a shell inside a container
@@ -276,6 +293,14 @@ while [ "$1" != "" ]; do
 	-a | --all)
 	    all="-a"
 	    ;;
+	--cap-add)
+	    shift
+	    caps="$caps --cap-add=$1"
+	    ;;
+	--cap-drop)
+	    shift
+	    caps="$caps --cap-drop=$1"
+	    ;;
 	-c | --creds)
 	    shift
 	    creds="-u $1"
@@ -541,8 +566,24 @@ case $cmd in
 	if [ -n "$name" ]; then
 	    wrap "$name" restart
 	elif [ -n "$1" ]; then
-	    stop  "$1"
-	    start "$1"
+	    cmd=$1
+	    name=$2
+	    if [ "$cmd" = "network" ] && [ -n "$name" ]; then
+		netrestart "$name"
+	    else
+		name=$1
+		stop "$name"
+		timeout=20
+		while running "$name"; do
+		    _=$((timeoute -= 1))
+		    if [ $timeout -le 0 ]; then
+			log "Timeout waiting for container $1 to stop before restarting it."
+			exit 1
+		    fi
+		    sleep 1
+		done
+		start "$name"
+	    fi
 	else
 	    usage
 	    exit 1
@@ -567,8 +608,14 @@ case $cmd in
 	    echo "No such container ($1), or invalid ImageName.  Cannot upgrade."
 	    exit 1;
 	fi
-	podman stop "$1"
-	podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	if echo "$img" | grep -Eq '^localhost/'; then
+	    # Likely an OCI archive, or local directory, assume user has updated image.
+	    file=$(awk '{s=$NF} END{print s}' "/var/lib/containers/active/${1}.sh")
+	    echo "Upgrading container ${1} with local archive: $file ..."
+	else
+	    podman stop "$1"
+	    podman pull "$img" || (echo "Failed fetching $img, check your network (settings)."; exit 1)
+	fi
 	"/var/lib/containers/active/${1}.sh" || (echo "Failed recreating container $1"; exit 1)
 	;;
    volume)
@@ -1,26 +1,27 @@
-# This is a bit awkward. If you know about a more straight forward way
-# of doing this, please simplify.
-#
-# U-Boot needs the public part of the signing key to be preprocessed
-# and then inserted into its control DT. mkimage(1) can perform this
-# conversion, but only as a side-effect of building/signing an FIT
-# image. Since we might not always be doing that, e.g. when only
-# building a hardware specific bootloader, we build a dummy FIT just
-# to get the key information into a DTB, which we then convert back to
-# a .dtsi and install in the U-Boot build tree. This will then be
-# built in to the final U-Boot image's control DT via the
-# CONFIG_DEVICE_TREE_INCLUDES option (see extras.config).
+define uboot-add-pubkey
+	$(call IXMSG,"Installing trusted key $1")
+	$(HOST_DIR)/bin/fdt_add_pubkey \
+		-a sha256,rsa$(shell \
+			openssl x509 -text -noout -in $1 | \
+			grep 'Public-Key: ' | \
+			sed -e 's/.*(\(.*\) bit)/\1/') \
+		-k $(dir $1) \
+		-n $(notdir $(basename $1)) \
+		-r image \
+		$2
+endef
+
+# U-Boot has its own public key format which has to be stored in its
+# control DT. So we collect all of the trusted keys, convert them to
+# the required format, and write the result to infix-key.dtb in the
+# U-Boot build tree. This will then be built in to the final U-Boot
+# image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
+# extras.config).
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	@$(call IXMSG,"Installing Infix signing key ($(SIGN_KEY))")
 	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
-	$(HOST_DIR)/bin/mkimage \
-		-k $(SIGN_KEY) \
-		-f $(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/key-dummy.its \
-		-K $(@D)/infix-key.dtb \
-		$(if $(SIGN_SRC_PKCS11),-N pkcs11) \
-		-r \
-		$(@D)/key-dummy.itb
-	rm $(@D)/key-dummy.itb
+	$(foreach key, \
+		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
+		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
 	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
@@ -1,3 +1,5 @@
 # Allow users in wheel group to reboot and perform a factory reset
 /sbin/initctl f 4750 root wheel  - - - - -
 /sbin/factory f 4750 root wheel  - - - - -
+
+/var/lib/avahi-autoipd  d 0755 avahi avahi - - - - -
@@ -1,13 +0,0 @@
-#!/bin/sh
-# shellcheck disable=SC1090
-. "$BR2_CONFIG" 2>/dev/null
-
-# Drop Buildroot default symlink to /tmp
-if [ -L "$TARGET_DIR/var/lib/avahi-autoipd" ]; then
-	rm    "$TARGET_DIR/var/lib/avahi-autoipd"
-	mkdir "$TARGET_DIR/var/lib/avahi-autoipd"
-fi
-
-# Allow clish (symlink to /usr/bin/klish) to be a login shell
-grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
-        || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"
@@ -1,88 +0,0 @@
-#!/bin/sh
-
-# This file is part of avahi.
-#
-# avahi is free software; you can redistribute it and/or modify it
-# under the terms of the GNU Lesser General Public License as
-# published by the Free Software Foundation; either version 2 of the
-# License, or (at your option) any later version.
-#
-# avahi is distributed in the hope that it will be useful, but WITHOUT
-# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
-# or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public
-# License for more details.
-#
-# You should have received a copy of the GNU Lesser General Public
-# License along with avahi; if not, write to the Free Software
-# Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
-# USA.
-
-set -e
-
-# Command line arguments:
-#   $1 event that happened:
-#          BIND:     Successfully claimed address
-#          CONFLICT: An IP address conflict happened
-#          UNBIND:   The IP address is no longer needed
-#          STOP:     The daemon is terminating
-#   $2 interface name
-#   $3 IP adddress
-
-PATH="$PATH:/usr/bin:/usr/sbin:/bin:/sbin"
-
-# Use a different metric for each interface, so that we can set
-# identical routes to multiple interfaces.
-
-METRIC=$((1000 + `cat "/sys/class/net/$2/ifindex" 2>/dev/null || echo 0`))
-
-if [ -x /bin/ip -o -x /sbin/ip ] ; then
-
-    # We have the Linux ip tool from the iproute package
-
-    case "$1" in
-        BIND)
-            ip addr flush dev "$2" label "$2:avahi"
-            ip addr add "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2" proto 6
-            ip route add default dev "$2" metric "$METRIC" scope link proto 17 ||:
-            ;;
-
-        CONFLICT|UNBIND|STOP)
-            ip route del default dev "$2" metric "$METRIC" scope link ||:
-            ip addr del "$3"/16 brd 169.254.255.255 label "$2:avahi" scope link dev "$2"
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
-    esac
-
-elif [ -x /bin/ifconfig -o -x /sbin/ifconfig ] ; then
-
-    # We have the old ifconfig tool
-
-    case "$1" in
-        BIND)
-            ifconfig "$2:avahi" inet "$3" netmask 255.255.0.0 broadcast 169.254.255.255 up
-            route add default dev "$2:avahi" metric "$METRIC" ||:
-            ;;
-
-        CONFLICT|STOP|UNBIND)
-            route del default dev "$2:avahi" metric "$METRIC" ||:
-            ifconfig "$2:avahi" down
-            ;;
-
-        *)
-            echo "Unknown event $1" >&2
-            exit 1
-            ;;
-    esac
-
-else
-
-    echo "No network configuration tool found." >&2
-    exit 1
-
-fi
-
-exit 0
@@ -1 +0,0 @@
-/var/lib/avahi-autoipd  d 0755 avahi avahi - - - - -
@@ -1,18 +1,16 @@
 test-dir := $(BR2_EXTERNAL_INFIX_PATH)/test
-UNIT_TESTS ?= $(test-dir)/case/all-repo.yaml $(test-dir)/case/all-unit.yaml
 INFIX_TESTS ?= $(test-dir)/case/all.yaml

 test-env = $(test-dir)/env \
 	-f $(BINARIES_DIR)/infix-x86_64.img \
-	-p $(BINARIES_DIR)/infix-x86_64.pkg \
+	-f $(BINARIES_DIR)/infix-x86_64-disk.img \
+	-f $(BINARIES_DIR)/OVMF.fd \
+        -p $(BINARIES_DIR)/infix-x86_64.pkg \
 	$(1) $(2)

 test-env-qeneth = $(call test-env,-q $(test-dir)/virt/quad,$(1))
 test-env-run    = $(call test-env,-C -t $(BINARIES_DIR)/qemu.dot,$(1))

-test-unit:
-	$(test-dir)/env $(test-dir)/9pm/9pm.py $(UNIT_TESTS)
-
 test test-qeneth:
 	$(call test-env-qeneth,\
 		$(BR2_EXTERNAL_INFIX_PATH)/test/9pm/9pm.py \
@@ -33,4 +31,4 @@ test-run-play: | ~/.infix-test-venv
 ~/.infix-test-venv:
 	$(test-dir)/docker/init-venv.sh $(test-dir)/docker/pip-requirements.txt

-.PHONY: test-unit test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
+.PHONY: test test-sh test-qeneth test-qeneth-sh test-run test-run-sh test-run-play
@@ -1 +1,6 @@
-set prefix=(hd0,gpt2)/grub
+search -l aux --set=aux
+search -l primary --set=primary
+search -l secondary --set=secondary
+
+set prefix=($aux)/grub
+configfile ($aux)/grub/grub.cfg
@@ -33,17 +33,24 @@ else
    set log="loglevel=4"
 fi

+# From board/common/rootfs/etc/partition-uuid
+search -p 107ae911-a97b-4380-975c-7ce1a2dde1e0 --set primary
+search -p 352bd9b2-2ca9-44e2-bdc7-edbc87ba1e02 --set secondary
+
+export primary
+export secondary
+
 submenu "primary" "$log" {
    set slot="$1"
-    set append="console=ttyS0 root=PARTLABEL=$slot $2"
-    set root=(hd0,gpt3)
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
+    set root="($primary)"
    source /boot/grub/grub.cfg
 }

 submenu "secondary" "$log"  {
    set slot="$1"
-    set append="console=ttyS0 root=PARTLABEL=$slot $2"
-    set root=(hd0,gpt4)
+    set append="console=ttyS0 console=hvc0 root=PARTLABEL=$slot $2"
+    set root="($secondary)"
    source /boot/grub/grub.cfg
 }

@@ -56,7 +63,7 @@ submenu "net" "$log"  {
 	set root=(initrd)

 	set slot="$1"
-	set append="console=ttyS0 root=/dev/ram0 ramdisk_size=65536 $2"
+	set append="console=ttyS0 console=hvc0 qroot=/dev/ram0 ramdisk_size=65536 $2"
 	source /boot/grub/grub.cfg
    else
 	if [ -z "$net_efinet0_dhcp_next_server" ]; then
@@ -1,120 +0,0 @@
-BR2_aarch64=y
-BR2_ARM_FPU_VFPV4=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
-BR2_GENERATE_LOCALE="en_US en_CA"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
-BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
-BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
-BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
-BR2_PACKAGE_STRACE=y
-BR2_PACKAGE_STRESS_NG=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_MDIO_TOOLS=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_CHRONY=y
-BR2_PACKAGE_DHCPCD=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_DROPBEAR=y
-BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
-BR2_PACKAGE_DROPBEAR_WTMP=y
-BR2_PACKAGE_DROPBEAR_LASTLOG=y
-BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MTR=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_VARIANT_CLASSIC=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_SULOGIN=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
-BR2_PACKAGE_TETRIS=y
@@ -12,24 +12,25 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
-BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="alder/alder styx/styx marvell/armada-3720-espressobin marvell/armada-3720-espressobin-emmc marvell/armada-3720-espressobin-v7 marvell/armada-3720-espressobin-v7-emmc marvell/armada-3720-espressobin-ultra marvell/cn9130-crb-A marvell/cn9130-crb-B microchip/sparx5_pcb135_emmc_no_psci"
 BR2_LINUX_KERNEL_CUSTOM_DTS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/dts"
 BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -53,6 +54,8 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_CRYPTOGRAPHY=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -79,6 +82,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -91,6 +97,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -136,13 +143,17 @@ BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 BR2_PACKAGE_LIBINPUT=y
 DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -16,6 +16,7 @@ BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
@@ -27,7 +28,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/linux_defconfig"
@@ -63,6 +64,8 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_CRYPTOGRAPHY=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_CA_CERTIFICATES=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
@@ -91,6 +94,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -103,6 +109,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -165,12 +172,14 @@ BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 BR2_PACKAGE_LIBINPUT=y
 # SIGN_ENABLED is not set
 # GNS3_APPLIANCE is not set
@@ -1,121 +0,0 @@
-BR2_x86_64=y
-BR2_x86_corei7=y
-BR2_TOOLCHAIN_EXTERNAL=y
-BR2_TOOLCHAIN_EXTERNAL_GDB_SERVER_COPY=y
-BR2_DL_DIR="${BR2_EXTERNAL_INFIX_PATH}/dl"
-BR2_CCACHE=y
-BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
-BR2_ENABLE_DEBUG=y
-BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_TARGET_GENERIC_HOSTNAME="infix"
-BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
-BR2_INIT_FINIT=y
-BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_MDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_TARGET_GENERIC_GETTY_TERM="xterm"
-BR2_SYSTEM_DHCP="eth0"
-BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
-BR2_GENERATE_LOCALE="en_US en_CA"
-BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/classic/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/classic/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
-BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
-BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
-BR2_PACKAGE_BUSYBOX_SHOW_OTHERS=y
-BR2_PACKAGE_JQ=y
-BR2_PACKAGE_RNG_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
-BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
-BR2_PACKAGE_CA_CERTIFICATES=y
-BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_NSS_MDNS=y
-BR2_PACKAGE_ONIGURUMA=y
-BR2_PACKAGE_AVAHI=y
-# BR2_PACKAGE_AVAHI_AUTOIPD is not set
-BR2_PACKAGE_AVAHI_DAEMON=y
-BR2_PACKAGE_AVAHI_DEFAULT_SERVICES=y
-BR2_PACKAGE_DHCPCD=y
-BR2_PACKAGE_DNSMASQ=y
-BR2_PACKAGE_DROPBEAR=y
-BR2_PACKAGE_DROPBEAR_DISABLE_REVERSEDNS=y
-BR2_PACKAGE_DROPBEAR_WTMP=y
-BR2_PACKAGE_DROPBEAR_LASTLOG=y
-BR2_PACKAGE_DROPBEAR_LEGACY_CRYPTO=y
-BR2_PACKAGE_ETHTOOL=y
-BR2_PACKAGE_FPING=y
-# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
-BR2_PACKAGE_IPROUTE2=y
-BR2_PACKAGE_IPTABLES=y
-BR2_PACKAGE_IPTABLES_NFTABLES=y
-BR2_PACKAGE_LLDPD=y
-BR2_PACKAGE_LYNX=y
-BR2_PACKAGE_MTR=y
-BR2_PACKAGE_NETCALC=y
-BR2_PACKAGE_NFTABLES=y
-BR2_PACKAGE_NMAP=y
-BR2_PACKAGE_NMAP_NMAP=y
-BR2_PACKAGE_NMAP_NPING=y
-BR2_PACKAGE_OPENRESOLV=y
-BR2_PACKAGE_SOCAT=y
-BR2_PACKAGE_TCPDUMP=y
-BR2_PACKAGE_TRACEROUTE=y
-BR2_PACKAGE_DIALOG=y
-BR2_PACKAGE_PDMENU=y
-BR2_PACKAGE_HTOP=y
-BR2_PACKAGE_IRQBALANCE=y
-BR2_PACKAGE_KMOD_TOOLS=y
-BR2_PACKAGE_PWGEN=y
-BR2_PACKAGE_RAUC=y
-BR2_PACKAGE_RAUC_GPT=y
-BR2_PACKAGE_RAUC_NETWORK=y
-BR2_PACKAGE_SYSKLOGD=y
-BR2_PACKAGE_SYSKLOGD_LOGGER=y
-BR2_PACKAGE_WATCHDOGD=y
-BR2_PACKAGE_MG=y
-BR2_PACKAGE_MOST=y
-BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_SQUASHFS=y
-# BR2_TARGET_ROOTFS_TAR is not set
-BR2_TARGET_EDK2=y
-BR2_TARGET_GRUB2=y
-BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
-BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
-BR2_TARGET_GRUB2_INSTALL_TOOLS=y
-BR2_PACKAGE_HOST_DOSFSTOOLS=y
-BR2_PACKAGE_HOST_E2FSPROGS=y
-BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
-BR2_PACKAGE_HOST_GENEXT2FS=y
-BR2_PACKAGE_HOST_GENIMAGE=y
-BR2_PACKAGE_HOST_MTOOLS=y
-BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
-BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
-INFIX_HOME="https://github.com/kernelkit/infix/"
-INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
-INFIX_VARIANT_CLASSIC=y
-BR2_PACKAGE_FACTORY=y
-BR2_PACKAGE_FINIT_SULOGIN=y
-BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
-BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
-BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
-BR2_PACKAGE_FINIT_PLUGIN_MODPROBE=y
-BR2_PACKAGE_FINIT_PLUGIN_RTC=y
-BR2_PACKAGE_FINIT_PLUGIN_TTY=y
-BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
-BR2_PACKAGE_IFUPDOWN_NG=y
-BR2_PACKAGE_TETRIS=y
-DISK_IMAGE_BOOT_BIN=y
@@ -11,20 +11,21 @@ BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
-BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/xattrs"
+BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
+BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
 BR2_SYSTEM_DHCP="eth0"
 BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA"
 BR2_GENERATE_LOCALE="en_US en_CA"
 BR2_TARGET_TZ_INFO=y
-BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/netconf/post-build.sh"
+BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
+BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.5.11"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.22"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -48,6 +49,8 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
+BR2_PACKAGE_PYTHON_CRYPTOGRAPHY=y
+BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
@@ -74,6 +77,9 @@ BR2_PACKAGE_NETCALC=y
 BR2_PACKAGE_NETCAT_OPENBSD=y
 BR2_PACKAGE_NETSNMP=y
 BR2_PACKAGE_NFTABLES=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_NMAP=y
 BR2_PACKAGE_NMAP_NCAT=y
 BR2_PACKAGE_NMAP_NMAP=y
@@ -86,6 +92,7 @@ BR2_PACKAGE_TRACEROUTE=y
 BR2_PACKAGE_ULOGD=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_TTYD=y
 BR2_PACKAGE_HTOP=y
 BR2_PACKAGE_IRQBALANCE=y
 BR2_PACKAGE_KMOD_TOOLS=y
@@ -105,7 +112,7 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_EDK2=y
 BR2_TARGET_GRUB2=y
 BR2_TARGET_GRUB2_X86_64_EFI=y
-BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback"
+BR2_TARGET_GRUB2_BUILTIN_MODULES_EFI="boot linux ext2 squash4 part_gpt normal efi_gop configfile loadenv test echo reboot net efinet tftp loopback cat search"
 BR2_TARGET_GRUB2_BUILTIN_CONFIG_EFI="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/grub-embed.cfg"
 BR2_TARGET_GRUB2_INSTALL_TOOLS=y
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
@@ -139,11 +146,15 @@ BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
+BR2_PACKAGE_MCD=y
+BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_NETBROWSE=y
 BR2_PACKAGE_PODMAN=y
 BR2_PACKAGE_PODMAN_DRIVER_BTRFS=y
 BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
-BR2_PACKAGE_QUERIERD=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10
+TRUSTED_KEYS=y
+TRUSTED_KEYS_DEVELOPMENT=y
@@ -4,6 +4,153 @@ Change Log
 All notable changes to the project are documented in this file.


+[v24.04.0][] - 2024-04-30
+-------------------------
+
+**News:** this release marks the first major upgrade of the underlying
+Buildroot to the latest LTS release, v2024.02.  This caused a few small
+regressions in the release cycle, all known issues have been addressed.
+
+Also worth highlighting, as of this release the Infix Classic variant
+has been dropped.  It was the legacy Infix with manual configuration of
+the system using a persistent `/etc`.  May be resurrected later as a
+separate project.  Going forward Infix' focus is entirely on NETCONF.
+
+Finally, the YANG Status section has been dropped for this release, the
+idea is to generate supported features from the models and include in
+future releases.
+
+### Changes
+- Bump the base Buildroot version to v2024.02 LTS
+- Bump the base Linux kernel version to 6.6 LTS
+- Drop Classic variant to reduce overhead, simplify build & release
+  processes, and focus on NETCONF for Arm64 and Amd64 platforms
+- Add hostname restrictions to ietf-system, and infix-dhcp-client
+  models.  Max 64 characters on Linux systems
+- Add mDNS CNAME (alias) advertisement, e.g., infix.local in addition to
+  the default infix-c0-ff-ee.local.  Note: this is build-specific and
+  does not change if system hostname is changed
+- Add mDNS browser web application, https://network.local that shows all
+  mDNS devices on the LAN.  The network.local mDNS name is also a CNAME,
+  so with multiple Infix devices, only one will act as the mDNS browser
+- Add temporary landing page to web server for https://infix.local
+- Add web console using ttyd, https://infix.local:7681
+- Add support for disabling web services using CLI
+- The bridge model now has built-in validation of port memberships,
+  i.e., a port must be a bridge member to be used in VLAN filtering
+- The bridge model only permits the bridge itself to be a tagged
+  member of VLANs -- meaning, the only way to set an IP address on
+  such bridges is to use a VLAN interface on top
+- A VLAN filtering bridge now validates that no IP address has been
+  set.  Use a VLAN interface on top for that (see above)
+- Restructure documentation, let first page in doc/ be table of contents
+- Scripting Infix, new document on how to script Infix from remote,
+  e.g., for production or from a container
+- Introduction, update documentation now that the `admin` user's default
+  login shell is `/bin/bash`
+- System documentation, first outline of how to change hostname, add
+  users, add system administrator users, changing login banner, change
+  the system default editor, and more
+- Network documentation, add section on VETH pairs
+- Container documentation:
+  - CLI prompts have been updated to match the examples used in other
+    parts of the User Guide
+  - Default route example for static container interfaces
+  - How to upgrade a container image
+- As a follow-up to port speed/duplex/autoneg support added in v24.02,
+  this release ensures flow-control is always disabled on all Ethernet
+  ports, as described in the IEEE Ethernet interfaces YANG model
+- Add support for core dumps, saving them in `/var/crash`, max one dump
+  per process, for use with future support tarballs
+- Add support for multicast snooping, both IPv4 (IGMP) and IPv6 (MLD) in
+  bridge setups, including offloading to switchdev
+- Add support for acting as passive (proxy) or active IGMP querier
+- Add support for static multicast filters, MAC, IPv4 and IPv6 groups
+  are supported -- multicast snooping must be enabled
+- Include Buildroot `legal-info` in releases, i.e., licenses, sources
+  with patches, as well as csv files for packages and toolchain
+- Drop `shell` command from CLI to allow confining users
+- The CLI `copy` command now allows absolute paths
+- Local resolver, `dnsmasq`, had port 53 visible from external `nmap`
+  scans, even though it dropped non-local requests, it now only binds to
+  the loopback interface reduce number of externally visible ports
+- Kernel log messages, of severity error or higher, now log directly to
+  the console.  This may cause some annoyance but has been enabled to
+  ease debugging, in particular issues where the system crashes before
+  the syslog daemon has flushed logs to disk.  (Logs are still saved to
+  log files as well.)
+- Issue #325: Add support for multiple administrator users by opening
+  up basic NETCONF ACM support.  See documentation for details
+  - Any user can be added to the `admin` NACM group
+  - Any user *not* in the `admin` group is not allowed to have a login
+    shell other than the CLI (or disabled).  POSIX shell, e.g., Bash is
+	reserved for system administrators
+- Issue #327: Remove IPv6LL from bridge port interfaces
+- Issue #358: translate YANG model's LOWER-LAYER-DOWN -> LINK-DOWN in
+  CLI `show interfaces` command
+- Issue #360: document factory-config, startup-config, and the various
+  failure modes in the system
+- Issue #361: document how a privileged container can break out of its
+  confinement and run host commands, e.g., call `sysrepocfg`
+- Issue #365: add limited support for container capabilities, e.g., to
+  enable `CAP_NET_RAW` to allow containers to use `ping`.  This allows
+  users to avoid enabling privileged mode
+- Issue #367: setting date/time over NETCONF now saves system time also
+  to the RTC, which otherwise is only saved on reboot or power-down
+- Issue #369: Remove limitation that the routing instance must be
+  named 'default'
+
+### Fixes
+- confd: Fix memory leak when operating on candidate configuration
+- probe: Fix crash on systems without USB
+- Reduced syslog errors for accesses no non-existing xpaths
+- Fix bogus warning about not properly updating `/etc/motd` in new
+  `motd-banner` setting, introduced in v24.02.0
+- infix-routing model: the `enable` configuration setting for OSPF, in
+  `default-route-advertise` has been obsoleted and replaced by `enabled`
+- Fix #328: when setting up a VLAN filtering bridge, the PVID for bridge
+  ports defaulted to 1, making it impossible to set up "tagged-only"
+  ports which drop ingressing untagged traffic
+- Fix #329: VLAN inference for interfaces named `eth0.1`, i.e., VID 1 on
+  lower-layer-if `eth0`.  Only affects automatic inference in the CLI,
+  entering the values manually (CLI/NETCONF) not affected by this bug
+- Fix #331: inconsistent naming of 'enabled' in infix-routing.yang
+- Fix #349: minor changes to `bridge-port` settings, like setting `pvid`
+  when you forget it, did not take without a reboot
+- Fix #353: impossible to remove bridge port with `no bridge-port`
+- Fix #358: MAC address no longer shown for bridge interfaces in CLI
+  `show interfaces` command
+- Fix #365: not possible to run `ping` from container
+- Fix #366: static routes from container host interfaces do not work.
+  Documentation updated with an example
+- Fix #368: upgrading `oci-archive:/` images fail because system thinks
+  the image can be pulled from a localhost registry.  Documentation has
+  also been updated, describing various methods and how to upgrade them
+- Fix #370: despite the documentation stating containers must explicitly
+  declare `network` settings, Infix v23.02 had a late regression that
+  reverted back to the podman default: network behind a CNI bridge
+  (firewalled and NAT:ed, hidden from the rest of the network)
+- Fix #375: k8s-logger, used for containers, does not exit properly and
+  causes 100% CPU load when container stop or are restarted.  Also in
+  this issue: handle ip/route additions to container networks at runtime
+- Fix #384: segfault in helper function when disabling the DHCP client
+  using `no dhcp-client` from the CLI
+- Fix #391 Creating VLAN interface in the CLI with "edit interface vlanN"
+  does not set VLAN id to N.
+- Fix #404: `lldpd` should be disabled on internal interface `dsa0`
+- Fix #406: an overly restrictive `when` expression in the bridge YANG
+  model prevented users from adding VLAN interfaces as bridge ports.
+  E.g., creating interface `eth0.10` and adding that to `br0`
+- Fix #412: after starting up with DHCP client enabled on any interface
+  `set dhcp-client enabled false` does not bite at runtime
+- Fix #414: spelling error in `infix-hardware.yang`, leaf node `coutry`
+- Fix #415: `startup-config` owned by `root` user and group instead of
+  `admin`.  The file ownership is now adjusted on every boot
+- Fix #416: `admin` user cannot perform a factory reset with RPC using
+  `sysrepocfg` tool over SSH
+- Fix bogus syslog warning about not updating `/etc/motd` properly
+
+
 [v24.02.0][] - 2024-03-01
 -------------------------

@@ -438,11 +585,11 @@ Currently supported models:
 - Replace `ietf-if-vlan-encapsulation` YANG model with the native
  `infix-if-vlan` model.  This fits better with Linux VLAN interfaces and
  simplifies the syntax greatly.  For details, see PR #179
-  
+
        admin@example:/config/interfaces/interface/eth0.10/> set vlan id 10 lower-layer-if eth0

 - The following new NETCONF interface operational counters have been added:
-  
+
 | **YANG**                    | **Linux / Ethtool**               |
 |-----------------------------|-----------------------------------|
 | `out-frames`                | `FramesTransmittedOK`             |
@@ -480,7 +627,7 @@ Currently supported models:

 - Fix #106: confd: drop deviation `ietf-system:timezone-utc-offset`
 - Fix #151: Operational status broken in v23.09
- Fix #159: Hacky generation of `/etc/resolv.conf` at boot 
+- Fix #159: Hacky generation of `/etc/resolv.conf` at boot
 - Fix #162: VLAN interface without encapsulation is accepted by YANG model


@@ -696,7 +843,8 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.02.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.04.0...HEAD
+[v24.04.0]:   https://github.com/kernelkit/infix/compare/v24.02.0...v24.04.0
 [v24.02.0]:   https://github.com/kernelkit/infix/compare/v23.11.0...v24.02.0
 [v23.11.0]:   https://github.com/kernelkit/infix/compare/v23.10.0...v23.11.0
 [v23.10.0]:   https://github.com/kernelkit/infix/compare/v23.09.0...v23.10.0
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`[2m[1mNote:[0m[2m use help, show, and setup commands to set up and diagnose the system.[0m`
				`@@ -0,0 +1 @@`
				`task [S] <service/confd/ready> /libexec/infix/mkcert -- Verifying self-signed https certificate`
				`@@ -0,0 +1 @@`
				`service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)`
				`@@ -1 +0,0 @@`
				`/var/lib/avahi-autoipd d 0755 avahi avahi - - - - -`