Merge pull request #986 from kernelkit/mvpp2-tcam-fix

Fix `mvpp2` TCAM memory corruption

.github/CHECKLIST.md

@@ -0,0 +1,36 @@
+Checklists for Pull Requests and Releases
+=========================================
+
+Maintainer checklists for reviewing pull requests and doing releases.
+
+
+Pull Requests
+-------------
+
+ - If applicable, is there a readable ChangeLog entry?
+ - If any LICENSE file has been updated, has the `.hash` file been updated?
+ - If any change to a Finit `.svc` file, does any run/task linger?  
+   I.e., is there a runlevel and/or condition defined to prevent them
+   from running outside of their intended runlevel?
+ - If any change to grub or qemu/qeneth setup, has it been tested in GNS3?
+   - If any change to u-boot/buildroot, has it been tested with `<booloader>_defconfig`
+ - If any change to logging, have the resulting logs been audited?
+   - Check for duplicate entries, misspellings
+   - Check for sneaky severity changes, e.g., error vs note, error vs warning
+ - If new subsystem, or major changes to a subsystem, have the docs been updated?
+ - If change to mDNS, has it been tested with netbrowse?
+ - If change to `_defconfig`, verify `local.mk` and sync with other archs
+   - Test manually as well, e.g., CLI changes do not have ha regression tests
+   - Build from distclean, or use artifacts built by build servers, for manual tests
+
+
+Releases
+--------
+
+ - Make at least one -betaN release to verify the GitHub workflow well in time release day
+   - Stuff happens, remember kernelkit/infix#735
+ - Make at least one -rcN to flush out any issues in customer repos
+   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
+ - Ensure the markdown link for the release diff is updated
+ - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
+ - Sync tags for all repo. sync activities

.github/CONTRIBUTING.md

@@ -1,25 +1,49 @@
-Contributing to Infix
-=====================
+Contributing Guidelines
+=======================
 
-We welcome any and all help in the form of bug reports, fixes, patches
-to add new features -- *preferably as GitHub pull requests*.
+Thank :heart: you for taking the time to read this!
 
-If you are unsure of what to do, or how to implement an idea or bug fix,
-open an issue with `"[RFC]: Unsure if this is a bug ... ?"`, or use the
-[GitHub discussions forum](https://github.com/orgs/kernelkit/discussions).
-Talking about code and problems first is often the best way to get started
-before submitting a pull request.
+We welcome any help in the form of bug reports, fixes, or patches to add
+new features.  We *prefer* GitHub pull requests, but are open to other
+forms of collaboration as well.  [Let's talk!][support] :handshake:
 
-When submitting a bug report, patch, or pull request, please start by
-stating the version the change is made against, what it does, *and why*.
+If you are unsure how to start implementing an idea or fix:
+
+ - :bug: open an issue, there are human friendly templates for _bugs_
+   and _feature requests_ at <https://github.com/kernelkit/infix/issues>
+ - :speech_balloon: use the [Q&A Forum][discuss]
+ - :technologist: The [Developer's Guide][devguide] is also a useful start
+
+> _Talking about code and problems first is often the best way to get
+> started before submitting a pull request.  We have found it always
+> saves time, yours and ours._
+
+
+:sparkles: General Guidelines
+-----------------------------
+
+When submitting bug reports or patches to bugs, please state which
+version the change is made against, what it does, and, more importantly
+*why* -- from your perspective, why is it a bug, why does the code need
+changing in this way.  Start with why.
+
+ - :bug: Bug reports need metadata like Infix version or commit hash
+ - :adhesive_bandage: Bug fixes also need version, and (preferably) a
+   corresponding issue number for the ChangeLog
+ - :new: New features, you need to get approval of the YANG model first!  
+   :speech_balloon: Please use the [Forum][discuss], e.g., category:
+   *Ideas*, or open a :pray: feature request issue
+ - :white_check_mark: New features also need new regression tests, this
+   can be basic tests or more complex use-case tests comprising multiple
+   subsystems, see [Testing Changes](#test_tube-testing-changes), below
 
 Please take care to ensure you follow the project coding style and the
 commit message format.  If you follow these recommendations you help
-the maintainer(s) and make it easier for them to include your code.
+the maintainers and make it easier for them to include your code.
 
 
-Coding Style
-------------
+:woman_technologist: Coding Style
+---------------------------------
 
 Before jumping into code, remember to **document new features** and bug
 fixes.  Both the manual and ChangeLog are in the `doc/` sub-directory
@@ -40,23 +64,58 @@ We expect code contributions for:
 > code!  Legacy takes precedence, and remember, we read code a lot more
 > than write it, so legibility is important.
 
-As a final note, lines are allowed to be longer than 72 characters these
-days.  There is no enforced maximum, but the team usually keep it around
-100 characters for both C and Python.
+The ChangeLog deserves a separate mention:
+
+ - Releases are listed in reverse chronological order order, so the
+   latest/next release is at the beginning of the file
+ - Only *user-facing bugs and features* are detailed, so code refactor,
+   new tests, etc. are not listed.
+ - Add your changes/features to the Changes section
+ - Add your Fix line in the Fixes section, in numeric order 
+ - Changes and fixes without an issue number are listed after all
+   numbered ones
+ - YANG model changes are documented in their respective model, for
+   standard models, e.g., for `ietf-interfaces.yang`, the corresponding
+   `infix-interfaces.yang` detail augments/deviations as revisions.
+
+A final note, lines of code are allowed to be longer than 72 characters
+these days, unless you live by PEP-8 (see above).  There is no enforced
+maximum, but the team usually keep it around 100 characters for both C
+and Python.
 
 
-Commit Messages
----------------
+:test_tube: Testing Changes
+---------------------------
+
+Please test your changes, no matter how trivial or obviously correct
+they may seem.  Nobody is infallible, making mistakes is only human.
+It is also the best insurance policy for your feature, it ensures your
+use-case will remain functional as the source base evolves.
+
+For new functionality we expect new regression tests to be added in
+the same pull request.
+
+For help getting started with testing, see the following resources:
+
+ - [Developer's Guide][devguide]
+ - [Regression Testing][testing]
+
+
+:memo: Commit Messages
+----------------------
 
 Commit messages exist to track *why* a change was made.  Try to be as
 clear and concise as possible in your commit messages, and always, be
 proud of your work and set up a proper GIT identity for your commits:
 
+<img src="../doc/jack.png" width=70 align="right">
+
     $ git config --global user.name "Jacky Linker"
     $ git config --global user.email jacky.linker@example.com
 
-Example commit message from the [Pro Git][gitbook] online book, notice
-how `git commit -s` is used to automatically add a `Signed-off-by`:
+Example commit message from one of many [online guides][cbeams].  Use
+`git commit -s` to automatically add a `Signed-off-by` for proof of
+origin, see [DCO][] for more info.
 
     subsystem: brief, but clear and concise summary of changes
     
@@ -73,20 +132,58 @@ how `git commit -s` is used to automatically add a `Signed-off-by`:
      - Typically a hyphen or asterisk is used for the bullet, preceded
        by a single space, with blank lines in between, but conventions
        vary here
-    
+
+	If you use an issue tracker, put references to them at the bottom,
+	like this:
+
+	Resolves: #123
+	See also: #456, #789
+
     Signed-off-by: Jacky Linker <jacky.linker@example.com>
 
+This is an example of how to [automatically close][closing] an issue
+when the commit is merged to mainline.  Several keywords are available.
 
-Code of Conduct
----------------
+
+:twisted_rightwards_arrows: Pull Requests
+-----------------------------------------
+
+> _The git repository is the canonical location for information._
+
+A pull request should preferably address a single issue or change.  This
+may of course include multiple related changes, but what is important to
+remember is the bandwidth of the maintainers.  A smaller well documented
+PR is more likely to get attention quicker in some reviewer's busy day.
+
+Well documented here means that each commit message stands on its own,
+telling the complete story of the change.  In fact each commit should,
+as much as possible, be independent of other changes.  This is very
+important, not only when digging though logs to understand why a piece
+of code exists, but also when bisecting a problem -- each single commit
+should also compile and be possible to run.
+
+If you've worked on projects that send patches, like the Linux kernel or
+Buildroot, consider the pull request message body similar to the cover
+letter for a series of patches -- it's a summary of changes, and it is
+lost when the changes are merged to the mainline branch.
+
+
+:balance_scale: Code of Conduct
+-------------------------------
 
 It is expected of everyone to respect the [Code of Conduct][conduct].
 The *"maintainers have the right and responsibility to remove, edit, or
 reject comments, commits, code, discussion forum threads, issues, and
 other contributions that are not aligned to this Code of Conduct."*
 
-[Linux]:   https://www.kernel.org/doc/html/v6.9/process/coding-style.html
-[PEP-8]:   https://peps.python.org/pep-0008/
-[RDD]:     https://tom.preston-werner.com/2010/08/23/readme-driven-development
-[gitbook]: https://git-scm.com/book/ch5-2.html
-[conduct]: CODE-OF-CONDUCT.md
+[support]:  https://github.com/kernelkit/infix/blob/main/.github/SUPPORT.md
+[discuss]:  https://github.com/orgs/kernelkit/discussions
+[testing]:  https://github.com/kernelkit/infix/blob/main/doc/testing.md
+[devguide]: https://github.com/kernelkit/infix/blob/main/doc/developers-guide.md
+[Linux]:    https://www.kernel.org/doc/html/v6.9/process/coding-style.html
+[PEP-8]:    https://peps.python.org/pep-0008/
+[RDD]:      https://tom.preston-werner.com/2010/08/23/readme-driven-development
+[cbeams]:   https://cbea.ms/git-commit/#seven-rules
+[conduct]:  CODE-OF-CONDUCT.md
+[DCO]:      https://developercertificate.org/
+[closing]:  https://docs.github.com/en/get-started/writing-on-github/working-with-advanced-formatting/using-keywords-in-issues-and-pull-requests

.github/SUPPORT.md

@@ -1 +1,12 @@
-Paid support and development provided by Addiva Elektronik <https://addiva.se>
+Limited free support is only available using the online resources of the
+project on GitHub, and Discord, see <https://github.com/kernelkit>:
+
+&nbsp;&nbsp; :speech_balloon: <https://github.com/orgs/kernelkit/discussions>  
+&nbsp;&nbsp; :bug: <https://github.com/kernelkit/infix/issues>
+
+Support contracts, development of new features, fast-tracking of reviews
+and contributions, customer branding of Infix, and even customer specific
+features for dedicated products is provided by Addiva Elektronik.
+
+&nbsp;&nbsp; :globe_with_meridians: <https://www.addiva.se/electronics/>  
+&nbsp;&nbsp; :e-mail: <mailto:ael@addiva.se>

.github/pull_request_template.md

@@ -5,12 +5,6 @@
   -- Remember: assign a reviewer, or use @mentions if org. member.
   -->
 
-
-## Other information
-
-<!-- Other relevant info, e.g., before/after screenshots -->
-
-
 ## Checklist
 
 Tick *relevant* boxes, this PR is-a or has-a:
@@ -23,9 +17,12 @@ Tick *relevant* boxes, this PR is-a or has-a:
   - [ ] Regression tests added?
   - [ ] ChangeLog updates (for next release)
   - [ ] Documentation added?
+- [ ] Test changes
+  - [ ] Checked in changed Readme.adoc (make test-spec)
+  - [ ] Added new test to group Readme.adoc and yaml file
 - [ ] Code style update (formatting, renaming)
 - [ ] Refactoring (please detail in commit messages)
 - [ ] Build related changes
 - [ ] Documentation content changes
+  - [ ] ChangeLog updated (for major changes)
 - [ ] Other (please describe):
-

.github/workflows/add-issue-to-project.yml

@@ -0,0 +1,16 @@
+name: Adds all issues to project Infix & C:o
+
+on:
+  issues:
+    types:
+      - opened
+
+jobs:
+  add-to-project:
+    name: Add issue to project Infix&co
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/add-to-project@v1.0.2
+        with:
+          project-url: https://github.com/orgs/kernelkit/projects/3
+          github-token: ${{ secrets.ADD_TO_PROJECT }}

.github/workflows/release.yml

@@ -101,6 +101,7 @@ jobs:
     runs-on: [ self-hosted, release ]
     permissions:
       contents: write
+      discussions: write
     steps:
       - uses: actions/checkout@v4
         with:
@@ -115,12 +116,14 @@ jobs:
               ver=${GITHUB_REF#refs/tags/}
           fi
           echo "ver=${ver}"     >> $GITHUB_OUTPUT
+          echo "cat="           >> $GITHUB_OUTPUT
           if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
             echo "pre=true"     >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
           elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=true"  >> $GITHUB_OUTPUT
+            echo "cat=Releases" >> $GITHUB_OUTPUT
           else
             echo "pre=false"    >> $GITHUB_OUTPUT
             echo "latest=false" >> $GITHUB_OUTPUT
@@ -150,6 +153,7 @@ jobs:
           name: Infix ${{ github.ref_name }}
           prerelease: ${{ steps.rel.outputs.pre }}
           makeLatest: ${{ steps.rel.outputs.latest }}
+          discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile:  release.md
           artifacts: "*.tar.gz*"
 

.github/workflows/sync-fork.yml

@@ -1,28 +0,0 @@
-# To enable automatic sync of your Infix fork every day, or on dispatch,
-# set the repoistory or organisation variable (not secret):
-#
-#     SYNC_FORK = true
-#
-# You also need a GH_SYNC_REPO token allowed to update workflows.  For
-# more information on variables and secrets, see the GitHub docs.
-# See https://docs.github.com/en/actions/learn-github-actions/variables
-name: Synchronize your fork of Infix with upstream
-
-on:
-  schedule:
-    - cron: 42 2 * * *
-  workflow_dispatch:
-
-jobs:
-  sync_fork:
-    if: ${{github.repository_owner != 'kernelkit' && vars.SYNC_FORK == 'true' }}
-    runs-on: ubuntu-latest
-    steps:
-      - uses: TobKed/github-forks-sync-action@master
-        with:
-          github_token: ${{ secrets.GH_SYNC_REPO }}
-          upstream_repository: KernelKit/infix
-          upstream_branch: main
-          target_branch: main
-          force: false
-          tags: true

.gitignore

@@ -8,3 +8,4 @@
 /test/.venv
 /test/.log
 /local.mk
+/test/spec/Readme.adoc

Config.in

@@ -52,6 +52,17 @@ config INFIX_IMAGE_ID
 	  Mandatory.  When INFIX_RELEASE is set, this string is appended to
 	  the IMAGE_ID with a '-' separator.
 
+config INFIX_COMPATIBLE
+	string "Operating system compatible string"
+	default "${INFIX_IMAGE_ID}"
+	help
+	  A lower-case string (no spaces or other characters outside of 0–9,
+	  a–z, ".", "_" and "-"), used for image identification at upgrade.
+	  E.g., the RAUC [system] compatible string.
+
+	  Mandatory.  Defaults to $INFIX_IMAGE_ID, which in turn is composed
+	  of $INFIX_ID-$BR2_ARCH.
+
 config INFIX_TAGLINE
 	string "Operating system tagline"
 	default "Infix -- a Network Operating System"

README.md

@@ -27,13 +27,13 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.
 
-In itself Infix is perfectly suited for dedicated networking tasks and
-native support for Docker containers provides a versatile platform that
-can easily be adapted to any customer need.  Be it legacy applications,
-network protocols, process monitoring, or edge data analysis, it can run
-close to end equipment.  Either directly connected on dedicated Ethernet
-ports or indirectly using virtual network cables to exist on the same
-LAN as other connected equipment.
+In itself, Infix is perfectly suited for dedicated networking tasks, and
+with native support for Docker containers, the operating system provides
+a versatile platform that can easily be adapted to any customer need.
+Be it legacy applications, network protocols, process monitoring, or
+edge data analysis, it can run close to end equipment.  Either directly
+connected on dedicated Ethernet ports or indirectly using virtual
+network cables to exist on the same LAN as other connected equipment.
 
 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get

board/aarch64/dts/styx/dcp-sc-28p.dtsi

@@ -33,6 +33,14 @@
 	};
 };
 
+/*
+ * RTC has no valid bit, and this board does not connect any
+ * backup power (e.g. supercap) to it, so it returns garbage
+ * after every cold reset.
+ */
+&cp0_rtc {
+	status = "disabled";
+};
 
 /* UART0 (Console) */
 
@@ -257,14 +265,38 @@
 	};
 };
 
-#define SWP_LED(_func) \
+#define SWP_LED \
 	leds { \
 		#address-cells = <1>; \
 		#size-cells = <0>; \
 		\
 		led@0 { \
 			reg = <0>; \
-			function = _func; \
+			function = "tp"; \
+			color = <LED_COLOR_ID_GREEN>; \
+			default-state = "keep"; \
+		}; \
+		led@1 { \
+			reg = <1>; \
+			function = "aux"; \
+			color = <LED_COLOR_ID_GREEN>; \
+			default-state = "off"; \
+		}; \
+	}
+
+/* SFP LEDs
+ * Rev A. LEDs do not work at all
+ * Rev B. only outer-most (green) LEDs work
+ */
+
+#define SFP_LED \
+	leds { \
+		#address-cells = <1>; \
+		#size-cells = <0>; \
+		\
+		led@0 { \
+			reg = <0>; \
+			function = "sfp"; \
 			color = <LED_COLOR_ID_GREEN>; \
 			default-state = "keep"; \
 		}; \
@@ -279,7 +311,7 @@
 		phy-mode = "10gbase-r"; \
 		managed = "in-band-status"; \
 		sfp = <_sfp>; \
-		SWP_LED("sfp"); \
+		SFP_LED; \
 	}
 
 #define XSWCPU(_n, _eth) \
@@ -313,7 +345,7 @@
 		nvmem-cell-names = "mac-address"; \
 		phy-mode = "gmii"; \
 		phy-handle = <_phy>; \
-		SWP_LED("tp"); \
+		SWP_LED; \
 	}
 
 #define GPHY(_n) \

board/aarch64/linux_defconfig

@@ -539,6 +539,8 @@ CONFIG_DEBUG_KERNEL=y
 CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 # CONFIG_SCHED_DEBUG is not set
 # CONFIG_RCU_TRACE is not set

board/aarch64/r2s/README.md

@@ -128,7 +128,7 @@ what provides a default, the same default MAC addresses to Linux:
 
 This is important in case you want to run multiple R2S devices on the
 same LAN.  Meaning you either have to change the MAC address in the
-U-Boot environment (below), or modify your `phys-address` setting in
+U-Boot environment (below), or use the `custom-phys-address` setting in
 Infix for the interface(s).
 
 Break into U-Boot using Ctrl-C at power-on, preferably when the text

board/aarch64/r2s/rootfs/etc/factory-config.cfg

@@ -58,6 +58,7 @@
     }
   },
   "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
     "groups": {
       "group": [
         {
@@ -83,6 +84,21 @@
             "comment": "Allow 'admin' group complete access to all operations and data."
           }
         ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
       }
     ]
   },
@@ -123,7 +139,8 @@
           "name": "ntp.org",
           "udp": {
             "address": "pool.ntp.org"
-          }
+          },
+	  "iburst": true
         }
       ]
     },
@@ -169,7 +186,7 @@
     ]
   },
   "infix-meta:meta": {
-    "infix-meta:version": "1.0"
+    "infix-meta:version": "1.2"
   },
   "infix-services:mdns": {
     "enabled": true

board/aarch64/rootfs/usr/libexec/styx/led.sh

@@ -0,0 +1,111 @@
+#!/bin/sh
+# Raw switch LED Control for systems that do not run iitod
+
+
+LEDS=$(find /sys/class/leds -iname '*mdio-mii*')
+LINK=$(find /sys/class/leds -iname '*mdio-mii*p')
+
+# Disable ALL switch port LEDs
+clear()
+{
+    for led in $LEDS; do
+        echo 0 > "${led}/brightness"
+    done
+}
+
+setup()
+{
+    for led in $LINK; do
+        echo netdev > "${led}/trigger"
+    done
+
+    for led in $LINK; do
+        cd "$led"
+	# No sleep here, it's enough with the delay from previous loop
+        echo 1 > link
+        sleep 0.1
+        echo 1 > rx
+        sleep 0.1
+        echo 1 > tx
+        cd - >/dev/null
+    done
+}
+
+leds()
+{
+    for led in $LINK; do
+         printf "%3s: %s\n" "$(cat "$led/device_name" 2>/dev/null)" "$led"
+    done
+}
+
+list()
+{
+    leds | sort | while read -r port path; do
+        printf "%4s %s\n" "$port" "$(basename "$path")"
+
+        aux=${path%%:tp}:aux
+        if [ -e "$aux" ]; then
+            printf "%3s: %s\n" "" "$(basename "$aux")"
+        fi
+    done
+}
+
+flash()
+{
+    sec=$1
+
+    for led in $LEDS; do
+        echo timer > "${led}/trigger"
+    done
+
+    for led in $LEDS; do
+        echo 84 > "${led}/delay_on"
+        echo 84 > "${led}/delay_off"
+    done
+
+    sleep "$sec"
+    clear
+}
+
+usage()
+{
+    echo "usage: $0 [command]"
+    echo
+    echo "flash [SEC]  Flash all LEDs to locate device in rack, default: 5 sec"
+    echo "list         List all LEDs"
+    echo "setup        Set up and start normal operation"
+    echo "start        Call at system init, clears all LEDs and sets up normal op"
+    echo "stop         Clear all LEDs, may be called at system shutdown"
+    echo
+    echo "Please ensure no other tool or daemon is already managing the LEDs."
+}
+
+cmd=$1; shift
+case $cmd in
+    flash)
+        flash ${1:-5}
+        setup
+        ;;
+    help)
+	usage
+	exit 0
+	;;
+    list | ls)
+        list
+        ;;
+    setup)
+	setup
+	;;
+    start)
+	initctl -nbq cond clear led
+	clear
+	setup
+        ;;
+    stop)
+	clear
+	;;
+    *)
+        usage
+	exit 1
+        ;;
+esac

board/aarch64/rootfs/usr/share/product/dcp-sc-28p/etc/finit.d/available/iitod.conf

@@ -0,0 +1,2 @@
+# empty to disable port LED control on Styx, for details, see issue
+# https://github.com/kernelkit/infix/issues/670#issuecomment-2419025575

board/aarch64/rootfs/usr/share/product/styx,dcp-sc-28p/etc/product/init.d/S10-led

@@ -0,0 +1 @@
+/usr/libexec/styx/led.sh

board/common/busybox_defconfig

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Busybox version: 1.36.0
-# Thu Feb  8 08:22:32 2024
+# Busybox version: 1.36.1
+# Tue Oct 22 13:12:02 2024
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -957,10 +957,10 @@ CONFIG_FEATURE_NETSTAT_PRG=y
 CONFIG_NSLOOKUP=y
 CONFIG_FEATURE_NSLOOKUP_BIG=y
 CONFIG_FEATURE_NSLOOKUP_LONG_OPTIONS=y
-CONFIG_NTPD=y
-CONFIG_FEATURE_NTPD_SERVER=y
-CONFIG_FEATURE_NTPD_CONF=y
-CONFIG_FEATURE_NTP_AUTH=y
+# CONFIG_NTPD is not set
+# CONFIG_FEATURE_NTPD_SERVER is not set
+# CONFIG_FEATURE_NTPD_CONF is not set
+# CONFIG_FEATURE_NTP_AUTH is not set
 CONFIG_PING=y
 CONFIG_PING6=y
 CONFIG_FEATURE_FANCY_PING=y

board/common/lib.sh

@@ -16,13 +16,22 @@ die()
 #      DISK_IMAGE_SIZE="512"
 #      etc.
 #
+# Nested variables, like INFIX_COMPATIBLE="${INFIX_IMAGE_ID}"
+# are handled by sourcing the file in a subshell.
+#
 # shellcheck disable=SC1090
 load_cfg()
 {
     tmp=$(mktemp -p /tmp)
+    (
+	. "$BR2_CONFIG" 2>/dev/null
+
+	# Set *all* matching variables
+	set | grep -E "^${1}[^=]*=" | while IFS= read -r line; do
+            echo "$line"
+	done
+    ) > "$tmp"
 
-    grep -E "${1}.*=" "$BR2_CONFIG" >"$tmp"
     .  "$tmp"
-
     rm "$tmp"
 }

board/common/post-build.sh

@@ -62,7 +62,7 @@ else
 fi
 
 if [ -f "$TARGET_DIR/etc/rauc/system.conf" ]; then
-    sed -i "s/compatible=.*/compatible=$NAME/" "$TARGET_DIR/etc/rauc/system.conf"
+    sed -i "s/compatible=.*/compatible=$INFIX_COMPATIBLE/" "$TARGET_DIR/etc/rauc/system.conf"
 fi
 
 # This is a symlink to /usr/lib/os-release, so we remove this to keep

board/common/post-image.sh

@@ -7,11 +7,14 @@ common=$(dirname "$(readlink -f "$0")")
 # shellcheck disable=SC1091
 . "$TARGET_DIR/etc/os-release"
 
-load_cfg INFIX_ID
+# The INFIX_* variables may be composed from BR2_* variables,
+# so we source them last.
 load_cfg BR2_ARCH
 load_cfg BR2_DEFCONFIG
 load_cfg BR2_EXTERNAL_INFIX_PATH
 load_cfg BR2_TARGET_ROOTFS
+load_cfg INFIX_ID
+load_cfg INFIX_COMPATIBLE
 
 # The default IMAGE_ID is infix-$BR2_ARCH but can be overridden
 # for imaage names, and compat strings, like infix-r2s
@@ -39,7 +42,7 @@ if [ "$SIGN_ENABLED" = "y" ]; then
     $common/sign.sh $BR2_ARCH $SIGN_KEY
 
     ixmsg "Creating RAUC Update Bundle"
-    $common/mkrauc.sh "$NAME$(ver)" $NAME $SIGN_KEY
+    $common/mkrauc.sh "$NAME$(ver)" $INFIX_COMPATIBLE $SIGN_KEY
 fi
 
 load_cfg DISK_IMAGE

board/common/qemu/Config.in.in

@@ -106,6 +106,8 @@ config QEMU_DTB_EXTEND
 	depends on QEMU_LOADER_UBOOT
 	default y if QEMU_aarch64
 
+if QEMU_ROOTFS_INITRD
+
 config QEMU_RW
 	string "Writable /cfg layer"
 	depends on QEMU_ROOTFS_INITRD
@@ -123,6 +125,8 @@ config QEMU_RW_VAR
 	default "var.ext4"
 endif
 
+endif
+
 config QEMU_VPD
 	bool "Emulate a Vital Product Data (VPD) Memory"
 
@@ -137,10 +141,55 @@ config QEMU_APPEND
 config QEMU_EXTRA
 	string "Extra QEMU options"
 
+
+comment "RTC"
+
+choice
+	prompt "Mode"
+	default QEMU_RTC_UTC
+
+config QEMU_RTC_UTC
+	bool "UTC"
+
+config QEMU_RTC_LOCAL
+	bool "Local time"
+
+config QEMU_RTC_RANDOM
+	bool "Random"
+
+endchoice
+
+choice
+	prompt "Clock"
+	default QEMU_CLOCK_HOST
+
+config QEMU_CLOCK_HOST
+	bool "Host clock"
+
+config QEMU_CLOCK_RT
+	bool "Independent (monotonic)"
+
+config QEMU_CLOCK_VM
+	bool "Virtual"
+
+endchoice
+
+config QEMU_RTC
+	string
+	default "utc"       if QEMU_RTC_UTC
+	default "localtime" if QEMU_RTC_LOCAL
+	default "random"    if QEMU_RTC_RANDOM
+
+config QEMU_CLOCK
+	string
+	default "host"      if QEMU_CLOCK_HOST
+	default "rt"        if QEMU_CLOCK_RT
+	default "vm"        if QEMU_CLOCK_VM
+
 comment "Networking"
 
 choice
-     prompt "Mode"
+     prompt "Network Mode"
      default QEMU_NET_USER
 
 config QEMU_NET_NONE
@@ -155,6 +204,9 @@ config QEMU_NET_USER
 config QEMU_NET_TAP
      bool "TAP"
 
+config QEMU_NET_ROCKER
+     bool "Rocker"
+
 endchoice
 
 config QEMU_NET_MODEL
@@ -180,3 +232,8 @@ config QEMU_NET_TAP_N
 	int "Number of TAPs"
 	depends on QEMU_NET_TAP
 	default 1
+
+config QEMU_NET_PORTS
+	int "Number of Rocker switch ports"
+	depends on QEMU_NET_ROCKER
+	default 10

board/common/qemu/qemu.sh

@@ -17,9 +17,10 @@
 #
 #    ./qemu.sh -h
 #
+# shellcheck disable=SC3037
 
 # Local variables
-imgdir=$(readlink -f $(dirname "$0"))
+imgdir=$(readlink -f "$(dirname "$0")")
 prognm=$(basename "$0")
 
 usage()
@@ -30,6 +31,7 @@ usage()
     echo "Options:"
     echo "  -c     Run menuconfig to change Qemu settings"
     echo "  -h     This help text"
+    echo "  -k     Keep generated qemu.run script (name shown at end)"
     echo
     echo "Arguments:"
     echo "  ARGS1  Args before the '--' separator are for kernel space"
@@ -54,19 +56,20 @@ die()
 
 load_qemucfg()
 {
-    local tmp=$(mktemp -p /tmp)
+    tmp=$(mktemp -p /tmp)
 
-    grep ^CONFIG_QEMU_ $1 >$tmp
-    .  $tmp
-    rm $tmp
+    grep ^CONFIG_QEMU_ "$1" >"$tmp"
+    # shellcheck disable=SC1090
+    .  "$tmp"
+    rm "$tmp"
 
     [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
     [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"
 
-    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
+    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"
 
-    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
+    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
 }
 
@@ -93,7 +96,7 @@ append_args()
 
     if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
+	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
@@ -198,13 +201,24 @@ host_args()
 
 net_dev_args()
 {
-    local name="e$1"
-    local mac=$(printf "02:00:00:00:00:%02x" $1)
+    name="e$1"
+    mac=$(printf "02:00:00:00:00:%02x" "$1")
 
     echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
     echo "$name	$mac" >>"$mactab"
 }
 
+rocker_port_args()
+{
+    sw=$1
+    port=$2
+    name="sw${sw}p${port}"
+    mac=$(printf "02:00:00:00:%02x:%02x" "$sw" "$port")
+
+    echo -n "-netdev tap,id=$name,ifname=$name,script=no,downscript=no "
+    echo "$name	$mac" >> "$mactab"
+}
+
 net_args()
 {
     # Infix will pick up this file via fwcfg and install it to /etc
@@ -216,14 +230,25 @@ net_args()
 	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
     elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
+	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
-	    net_dev_args $i
+	    net_dev_args "$i"
+	done
+    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
+	sw=sw0			# Only single switch support atm.
+	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
+	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
+	echo -n "\"ports\":["
+	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	    [ "$i" -gt 1 ] && echo -n ", "
+	    echo -n "\"${sw}p${i}\""
+	done
+	echo -n "]}' "
+	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
+	    rocker_port_args 0 "$i"
 	done
     elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
-	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
-
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
     else
@@ -261,7 +286,25 @@ EOF
 
 wdt_args()
 {
-    echo -n "-device i6300esb -rtc clock=host"
+    echo -n "-device i6300esb "
+}
+
+random_date()
+{
+    rand=$(($(date +%_s) * $$ + $(date +%N | sed 's/^0*//')))
+    when=$((rand % 7258118400)) # 1970 - 2200
+    date -d "@$when" +"%Y-%m-%dT%H:%M:%S"
+}
+
+rtc_args()
+{
+    rtc="${CONFIG_QEMU_RTC:-utc}"
+    clock="${CONFIG_QEMU_CLOCK:-host}"
+    if [ "$rtc" = "random" ]; then
+	rtc=$(random_date)
+    fi
+
+    echo -n "-rtc base=$rtc,clock=$clock"
 }
 
 gdb_args()
@@ -273,11 +316,18 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	 qemu-img create -f qcow2 -o backing_file=$CONFIG_QEMU_ROOTFS -F raw $CONFIG_QEMU_ROOTFS.qcow2 > /dev/null
+	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
+	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
+	fi
+	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
+	    echo "Creating qcow2 disk image for Qemu ..."
+	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
+		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
+	fi
     fi
-    local qemu
-    read qemu <<EOF
-	$CONFIG_QEMU_MACHINE -m $CONFIG_QEMU_MACHINE_RAM \
+
+    read -r qemu <<EOF
+	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
 	  $(serial_args) \
@@ -286,15 +336,32 @@ run_qemu()
 	  $(host_args) \
 	  $(net_args) \
 	  $(wdt_args) \
+	  $(rtc_args) \
 	  $(vpd_args) \
 	  $(gdb_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF
-
+    # Save resulting command to a script, because I cannot for the life
+    # of me figure out how to embed the JSON snippet for Rocker and run
+    # it here without issues, spent way too much time on it -- Joachim
+    run=$(mktemp -t run.qemu.XXX)
+    echo "#!/bin/sh" > "$run"
     if [ "$CONFIG_QEMU_KERNEL" ]; then
-	$qemu -append "$(append_args)" "$@"
+	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
     else
-	$qemu "$@"
+	echo "$qemu $*" >> "$run"
+    fi
+    chmod +x "$run"
+
+    echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
+    line=$(stty -g)
+    stty raw
+    $run
+    stty "$line"
+    if [ -n "$keep" ]; then
+	echo "Keeping generated qemu.run script: $run"
+    else
+	rm "$run"
     fi
 }
 
@@ -331,7 +398,7 @@ generate_dot()
     hostports="<qtap1> qtap1"
     targetports="<e1> e1"
     edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -371,7 +438,8 @@ menuconfig()
     exec kconfig-mconf Config.in
 }
 
-cd $(dirname $(readlink -f "$0"))
+scriptdir=$(dirname "$(readlink -f "$0")")
+cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
 
 while [ "$1" != "" ]; do
     case $1 in
@@ -381,6 +449,9 @@ while [ "$1" != "" ]; do
 	-h)
 	    usage
 	    ;;
+	-k)
+	    keep=true
+	    ;;
 	*)
 	    break
     esac
@@ -401,8 +472,4 @@ fi
 
 generate_dot
 
-echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
-line=$(stty -g)
-stty raw
 run_qemu $(dtb_args)
-stty "$line"

board/common/rootfs/etc/default/ospfd

@@ -0,0 +1,2 @@
+# --log-level debug
+OSPFD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf --log syslog"

board/common/rootfs/etc/default/rauc

@@ -0,0 +1 @@
+RAUC_ARGS="-s"

board/common/rootfs/etc/default/zebra

@@ -0,0 +1,2 @@
+# --log-level debug
+ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,4 +1,4 @@
-service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
-	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
-sysv    :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> log kill:10 \
+task    name:container-%i :setup \
+	[2345] container -n %i setup -- Setup container %i
+sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
 	[2345] container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/sysklogd.conf

@@ -0,0 +1,4 @@
+# Use <pid/syslogd> as barrier for other system tasks and service that
+# rely on modules, firmware, and device nodes to be ready.
+service if:udevd nowarn env:-/etc/default/sysklogd <run/udevadm:post/success> \
+	[S0123456789] syslogd -F $SYSLOGD_ARGS -- System log daemon

board/common/rootfs/etc/machine-id

@@ -0,0 +1 @@
+/var/lib/dbus/machine-id

board/common/rootfs/etc/profile.d/alias.sh

@@ -1,2 +1 @@
 alias cli='clish'
-alias cfg='sysrepocfg -f json'

board/common/rootfs/usr/bin/cfg

@@ -0,0 +1,58 @@
+#!/bin/sh
+# User-friendly wrapper for sysrepocfg
+# TODO: add import/export, copy, ...
+
+# Edit YANG binary types using sysrepo, base64, and duct tape.
+edit()
+{
+    xpath=$1
+    if [ -z "$xpath" ]; then
+	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
+	exit 1
+    fi
+
+    if tmp=$(sysrepocfg -G "$xpath"); then
+	file=$(mktemp)
+
+	echo "$tmp" | base64 -d > "$file"
+	if /usr/bin/editor "$file"; then
+	    tmp=$(base64 -w0 < "$file")
+	    sysrepocfg -S "$xpath" -u "$tmp"
+	fi
+
+	rm -f "$file"
+    else
+	echo "Failed to retrieve value for $xpath"
+	exit 1
+    fi
+}
+
+usage()
+{
+    echo "Usage:"
+    echo "    cfg CMD [ARG]"
+    echo
+    echo "Command:"
+    echo "    edit XPATH   Edit YANG binary type"
+    echo "    help         This help text"
+    echo
+    echo "As a backwards compatible fallback, this script forwards"
+    echo "all other commands as options to sysrepocfg."
+    echo
+
+    exit 0
+}
+
+cmd=$1; shift
+case $cmd in
+    edit)
+	edit "$1"
+	;;
+    help)
+	usage
+	;;
+    *)
+	set -- "$cmd" "$@"
+	exec sysrepocfg -f json "$@"
+	;;
+esac

board/common/rootfs/usr/bin/pager

@@ -1 +0,0 @@
-less

board/common/rootfs/usr/bin/pager

@@ -0,0 +1,14 @@
+#!/bin/sh
+# -d ;; suppress error message "the terminal is dumb"
+# -F :: exit if the entire file can be displayed on the first screen
+# -I :: Ignore case, even for patterns
+# -K :: exit immediately when an interrupt character (usually ^C) is typed
+# -R :: Almost raw control charachters, only ANSI color escape sequences and
+#       OSC 8 hyperlink sequences are output.  Allows veritcal scrolling
+# -X :: No termcap initialization and deinitialization set to the terminal.
+#       This is what leaves the contents of the output on screen.
+
+export LESS="-P %f (press h for help or q to quit)"
+export LANG=en_US.UTF-8
+
+less -RIKd -FX "$@"

board/common/rootfs/usr/lib/finit/system/20-hw-wait.conf

@@ -0,0 +1,9 @@
+# Extend finit's default udevadm settle synchronization for situations
+# where device are very slow to probe (see #685)
+run nowarn if:udevd cgroup.init <service/udevd/ready> log \
+	[S] /usr/libexec/infix/hw-wait -- Probing hardware
+
+# Now that everything should be probed, do a final pass over the
+# uevent queue before starting syslogd and everything else
+run nowarn if:udevd cgroup.init :post <service/udevd/ready> log \
+	[S] udevadm settle -t 30 --

board/common/rootfs/usr/lib/tmpfiles.d/containers.conf

@@ -0,0 +1,6 @@
+d  /run/containers/args		0700 - -
+d  /run/containers/files	0700 - -
+d  /var/lib/containers		0700 - -
+d  /var/lib/containers/oci	0700 - -
+d  /run/cni			0755 - -
+L+ /var/lib/cni                 -    - - - /run/cni

board/common/rootfs/usr/lib/tmpfiles.d/frr.conf

@@ -1 +1,2 @@
 d /var/run/frr 0755 frr frr -
+R /var/tmp/frr -    -   -   -

board/common/rootfs/usr/libexec/infix/hw-wait

@@ -0,0 +1,41 @@
+#!/bin/sh
+# (Ab)use the kernel's device link subsystem to detect consumer side
+# devices that may be very slow to probe (looking at you, mv88e6xxx!).
+
+ident=$(basename "$0")
+
+report()
+{
+    if [ -r "/tmp/$ident" ]; then
+	logger -k -p "user.$1" -t "$ident" "Waited for slow devices:"
+	sort "/tmp/$ident" | uniq -c | logger -k -p "user.$1" -t "$ident"
+    fi
+
+    rm -f "/tmp/$ident"
+}
+
+for _ in $(seq 50); do
+    again=
+
+    for dl in /sys/class/devlink/*; do
+    	[ -r "$dl/status" ] || continue
+
+    	status=$(cat "$dl/status")
+	if [ "$status" = "consumer probing" ]; then
+	    basename "$(readlink "$dl/consumer")" >>"/tmp/$ident"
+	    again=yes
+	fi
+
+    done
+
+    if [ -z "$again" ]; then
+	report notice
+	exit 0
+    fi
+
+    sleep .2
+done
+
+logger -k -p user.error -t "$ident" "Timeout waiting for devices to come online"
+report error
+exit 1

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -8,10 +8,11 @@ import struct
 import subprocess
 import sys
 
-onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
-SYSTEM_JSON   = "/run/system.json"
+onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
+SYSTEM_JSON = "/run/system.json"
 KKIT_IANA_PEM = 61046
 
+
 class DTSystem:
     BASE = "/sys/firmware/devicetree/base"
     INFIX = BASE + "/chosen/infix"
@@ -28,7 +29,9 @@ class DTSystem:
             if not os.path.exists(phandle):
                 continue
 
-            ph, = struct.unpack(">L", open(phandle, "rb").read())
+            with open(phandle, "rb") as f:
+                data = f.read()
+            ph, = struct.unpack(">L", data)
             dt[ph] = root
 
         sys = {}
@@ -40,14 +43,18 @@ class DTSystem:
             if not os.path.exists(phandle):
                 continue
 
-            ph, = struct.unpack(">L", open(phandle, "rb").read())
+            with open(phandle, "rb") as f:
+                data = f.read()
+            ph, = struct.unpack(">L", data)
             if ph not in sys:
                 sys[ph] = []
             sys[ph].append(root)
 
         phs = set(list(dt.keys()) + list(sys.keys()))
 
-        self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None]  for ph in phs }
+        self.devs = {ph: [Device(ph, dt.get(ph), s if s is not None else "")
+                          for s in (sys.get(ph) or []) if ph is not None]
+                     for ph in phs}
         self.base = Device(0, None, DTSystem.BASE)
         self.infix = Device(0, None, DTSystem.INFIX)
 
@@ -56,7 +63,8 @@ class DTSystem:
         if not os.path.exists(path):
             return ()
 
-        data = open(path, "rb").read()
+        with open(path, "rb") as f:
+            data = f.read()
         elems = len(data) // struct.calcsize(">L")
         return struct.unpack(">" + elems * "L", data)
 
@@ -69,7 +77,8 @@ class DTSystem:
                 return {}
 
             try:
-                data = onieprom.from_tlv(open(dev.attrpath("nvmem"), "rb", 0))
+                with open(dev.attrpath("nvmem"), "rb", 0) as f:
+                    data = onieprom.from_tlv(f)
             except:
                 data = {}
 
@@ -84,14 +93,18 @@ class DTSystem:
         }
 
     def infix_usb_devices(self, out):
-        names=self.infix.str_array("usb-port-names", ())
-        phs=self.__get_phandle_array("usb-ports")
-        data=dict(zip(names,phs))
+        names = self.infix.str_array("usb-port-names", ())
+        phs = self.__get_phandle_array("usb-ports")
+        data = dict(zip(names, phs))
         if data != {}:
             out["usb-ports"] = []
-        for name,ph in data.items():
-            [out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
-
+        for name, ph in data.items():
+            [out["usb-ports"].extend([{
+                "name": name,
+                "path": dev.attrpath("authorized")}, {
+                    "name": name,
+                    "path": dev.attrpath("authorized_default")
+                }]) for dev in self.devices_from_ph(ph)]
 
     def infix_devices(self, kind):
         phs = self.__get_phandle_array(kind)
@@ -101,6 +114,7 @@ class DTSystem:
         flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
         return [self.into_vpd(device) for device in flat_devices]
 
+
 class QEMUSystem:
     BASE = "/sys/firmware/qemu_fw_cfg"
     REV = BASE + "/rev"
@@ -110,7 +124,8 @@ class QEMUSystem:
         data = {}
         if os.path.exists(QEMUSystem.VPD):
             try:
-                data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
+                with open(QEMUSystem.VPD, "rb", 0) as f:
+                    data = onieprom.from_tlv(f)
             except:
                 pass
 
@@ -127,31 +142,27 @@ class QEMUSystem:
     def usb_ports(self):
         ports = [
             {
-            "name": "USB",
-            "path": "/sys/bus/usb/devices/usb1/authorized"
-
-        },
-        {
-            "name": "USB",
-            "path": "/sys/bus/usb/devices/usb1/authorized_default"
-
-        },
-        {
-            "name": "USB2",
-            "path": "/sys/bus/usb/devices/usb2/authorized"
-        },
-        {
-            "name": "USB2",
-            "path": "/sys/bus/usb/devices/usb2/authorized_default"
-
-        }]
+                "name": "USB",
+                "path": "/sys/bus/usb/devices/usb1/authorized"
+            }, {
+                "name": "USB",
+                "path": "/sys/bus/usb/devices/usb1/authorized_default"
+            }, {
+                "name": "USB2",
+                "path": "/sys/bus/usb/devices/usb2/authorized"
+            }, {
+                "name": "USB2",
+                "path": "/sys/bus/usb/devices/usb2/authorized_default"
+            }]
         return ports
+
+
 class Device:
     def __init__(self, ph, dtpath, syspath):
         self.ph, self.dtpath, self.syspath = ph, dtpath, syspath
 
     def available(self):
-        return self.syspath != None
+        return self.syspath is not None
 
     def __getitem__(self, attr):
         return self.attr(attr).decode("utf-8").strip("\0")
@@ -159,7 +170,6 @@ class Device:
     def __setitem__(self, attr, value):
         return self.attr(attr, val=value.encode("utf-8"))
 
-
     def attrpath(self, attr):
         return os.path.join(self.syspath, attr)
 
@@ -168,13 +178,16 @@ class Device:
 
     def attr(self, attr, default=None, val=None):
         if not self.hasattr(attr):
-            return default if val == None else False
+            return default if val is None else False
 
         if val:
-            open(self.attrpath(attr), "wb").write(value)
+            with open(self.attrpath(attr), "wb") as f:
+                f.write(val)
             return True
 
-        return open(self.attrpath(attr), "rb").read()
+        with open(self.attrpath(attr), "rb") as f:
+            data = f.read()
+        return data
 
     def str(self, attr, default=None):
         val = self.attr(attr)
@@ -194,7 +207,9 @@ class Device:
         if not self.hasdtattr(attr):
             return default
 
-        return open(self.dtattrpath(attr), "rb").read()
+        with open(self.dtattrpath(attr), "rb") as f:
+            data = f.read()
+        return data
 
     def dtstr(self, attr, default=None):
         val = self.dtattr(attr)
@@ -212,6 +227,7 @@ def vpd_get_json_ve(vpd, pem):
 
     return out
 
+
 def vpd_get_pwhash(vpd):
     if not vpd.get("trusted"):
         return None
@@ -219,8 +235,9 @@ def vpd_get_pwhash(vpd):
     kkit = vpd_get_json_ve(vpd, KKIT_IANA_PEM)
     return kkit.get("pwhash")
 
+
 def vpd_inject(out, vpds):
-    out["vpd"] = { vpd["board"]: vpd for vpd in vpds }
+    out["vpd"] = {vpd["board"]: vpd for vpd in vpds}
 
     product = out["vpd"].get("product", {}).get("data", {})
     hoistattrs = ("vendor", "product-name", "part-number", "serial-number", "mac-address")
@@ -234,6 +251,7 @@ def vpd_inject(out, vpds):
             out["factory-password-hash"] = pwhash
             break
 
+
 def qemu_base_mac():
     """Find MAC address of first non-loopback interface, subtract with 1"""
     base_path = '/sys/class/net'
@@ -244,7 +262,8 @@ def qemu_base_mac():
             continue
         try:
             # pylint: disable=invalid-name
-            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
+            fn = os.path.join(base_path, iface, 'address')
+            with open(fn, 'r', encoding='ascii') as f:
                 mac = f.read().strip()
             interfaces.append((mac, iface))
         except FileNotFoundError:
@@ -261,6 +280,7 @@ def qemu_base_mac():
 
     return None
 
+
 def probe_qemusystem(out):
     """Probe Qemu based test systems and 'make run'"""
     admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
@@ -288,6 +308,7 @@ def probe_qemusystem(out):
     subprocess.run("initctl -nbq cond set qemu".split(), check=False)
     return 0
 
+
 def probe_dtsystem(out):
     """Probe DTS based system, expects a VPD in ONIE PROM format."""
     dtsys = DTSystem()
@@ -297,6 +318,8 @@ def probe_dtsystem(out):
     if model:
         out["product-name"] = model
 
+    out["compatible"] = dtsys.base.str_array("compatible")
+
     staticpw = dtsys.infix.str("factory-password-hash")
     if not out["factory-password-hash"]:
         out["factory-password-hash"] = staticpw
@@ -304,6 +327,7 @@ def probe_dtsystem(out):
     vpd_inject(out, vpds)
     return 0
 
+
 def main():
     out = {
         "vendor": None,
@@ -338,5 +362,6 @@ def main():
     shutil.chown(SYSTEM_JSON, user="root", group="wheel")
     return err
 
+
 if __name__ == "__main__":
     sys.exit(main())

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -1,22 +1,48 @@
 #!/bin/sh
-# Find and install any product specific files in /etc before bootstrap
+# Find, install, and run product specific files and script in /etc
+# before resuming bootstrap.
+#
+# Use /etc/product/init.d/S01-myscript for scripts, may be a symlink, it
+# will be called with `start` as its only argument.
+#
+# The compatible array is listed in the same order as the device tree,
+# most significant to least.  Hence the reverse.[], to ensure overrides
+# are applied in order of significance.
 ident=$(basename "$0")
 
+PRODUCT_INIT=/etc/product/init.d
 PREFIXD=/usr/share/product
-PRODUCT=$(jq -r '."product-name" | ascii_downcase' /run/system.json)
+COMPATIBLES=$(jq -r '.compatible | reverse.[] | ascii_downcase' /run/system.json)
 
 note()
 {
     logger -I $$ -k -p user.notice -t "$ident" "$1"
 }
 
-DIR="$PREFIXD/$PRODUCT"
-if [ -z "$PRODUCT" ] || [ ! -d "$DIR" ]; then
-    note "No vendor/product specific directory found, using built-in defaults."
-    exit 0
+found=false
+for PRODUCT in $COMPATIBLES; do
+    DIR="$PREFIXD/$PRODUCT"
+    if [ -d "$DIR" ]; then
+        note "Using vendor/product-specific defaults for $PRODUCT."
+        for dir in "$DIR"/*; do
+            [ -d "$dir" ] && cp -a "$dir" /
+        done
+        found=true
+    fi
+done
+
+if [ "$found" = false ]; then
+    note "No vendor/product-specific directory found, using built-in defaults."
 fi
 
-note "Using vendor/product specific defaults."
-for dir in "$DIR"/*; do
-    [ -d "$dir" ] && cp -a "$dir" /
-done
+# Conditions for bootstrap services, this enables product specific
+# init scripts to prevent select services from starting.
+initctl -nbq cond set led
+
+note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+
+# Product specific init done.
+initctl -nbq cond set product
+
+exit 0

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -46,7 +46,11 @@ while [ "$1" ]; do
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 
-    tc qdisc add dev $iface root mqprio hw 1 \
-       num_tc $txqs $(map $txqs) $(queues $txqs) || true
+    output=$(tc qdisc add dev $iface root mqprio hw 1 \
+		num_tc $txqs $(map $txqs) $(queues $txqs) 2>&1) || true
+    if echo "$output" | grep -q "does not support hardware offload"; then
+        echo "Skipping $iface, hardware offload not supported."
+    elif [ -n "$output" ]; then
+	echo "$output"
+    fi
 done
-

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -1,102 +1,16 @@
 #!/bin/sh
-# Run .cfg migration jq scripts to backup and transform older .cfg files
-ident=$(basename "$0")
-
-MIGRATIONS_DIR="/usr/share/confd/migrate"
+# Check if /cfg/startup-config.cfg needs to be migrated to new syntax.
+# Backup of the original is created in /cfg/backup/ for old versions,
+# the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
-BACKUP_DIR="/cfg/backup"
-
-note()
-{
-    logger -I $$ -k -p user.notice -t "$ident" "$1"
-}
-
-err()
-{
-    logger -I $$ -k -p user.err -t "$ident" "$1"
-}
-
-file_version()
-{
-    jq -r '
-        if .["infix-meta:meta"] | has("version") then
-            .["infix-meta:meta"]["version"]
-        else
-            "0.0"
-        end
-    ' "$1"
-}
-
-atoi()
-{
-    echo "$1" | awk -F. '{print $1 * 1000 + $2}'
-}
+BACKUP_FILE="/cfg/backup/startup-config.cfg"
+mkdir -p "$(dirname "$BACKUP_FILE")"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    # Nothing to migrate
     note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
-fi
-
-cfg_version=$(file_version "$CONFIG_FILE")
-current_version=$(atoi "$cfg_version")
-
-# Find the latest version by examining the highest numbered directory
-sys_version=$(find "$MIGRATIONS_DIR" -mindepth 1 -maxdepth 1 -type d | sort -V | tail -n1 | xargs -n1 basename)
-latest_version=$(atoi "$sys_version")
-
-# Check for downgrade
-if [ "$current_version" -gt "$latest_version" ]; then
-    err "Configuration file $CONFIG_FILE version ($cfg_version) is newer than the latest supported version ($sys_version). Exiting."
-    exit 1
-fi
-
-# If the current version is already the latest, exit the script
-if [ "$current_version" -eq "$latest_version" ]; then
-    note "Configuration is already at the latest version ($sys_version). No migration needed."
+elif migrate -cq "$CONFIG_FILE"; then
     exit 0
 fi
 
-note "Configuration file $CONFIG_FILE is of version $cfg_version, migrating ..."
-
-# Create the backup directory if it doesn't exist
-mkdir -p "$BACKUP_DIR"
-
-# Create a backup of the current configuration file
-nm=$(basename "$CONFIG_FILE" .cfg)
-BACKUP_FILE="$BACKUP_DIR/${nm}-${cfg_version}.cfg"
-if cp "$CONFIG_FILE" "$BACKUP_FILE"; then
-    note "Backup created: $BACKUP_FILE"
-else
-    err "Failed creating backup: $BACKUP_FILE"
-    exit 1
-fi
-
-# Apply the scripts for each version directory in sequence
-for version_dir in $(find "$MIGRATIONS_DIR" -mindepth 1 -maxdepth 1 -type d | sort -V); do
-    dir=$(basename "$version_dir")
-    version=$(atoi "$dir")
-
-    # Step by step upgrade file to latest version
-    if [ "$current_version" -lt "$version" ]; then
-        note "Applying migrations for version $dir ..."
-
-        # Apply all scripts in the version directory in order
-        for script in $(find "$version_dir" -type f -name '*.sh' | sort -V); do
-	    note "Calling $script for $CONFIG_FILE ..."
-            sh "$script" "$CONFIG_FILE"
-        done
-
-	# File now at $version ...
-        current_version="$version"
-    fi
-done
-
-# Update the JSON file to the latest version
-if jq --arg version "$sys_version" '.["infix-meta:meta"] = {"infix-meta:version": $version}' "$CONFIG_FILE" \
-   > "${CONFIG_FILE}.tmp" && mv "${CONFIG_FILE}.tmp" "$CONFIG_FILE"; then
-    note "Configuration updated to version $sys_version."
-else
-    err "Failed updating configuration to version $sys_version!"
-    exit 1
-fi
+migrate -i -b "$BACKUP_FILE" "$CONFIG_FILE"

board/common/rootfs/usr/libexec/infix/init.d/99-done

@@ -1,2 +1,2 @@
 #!/bin/sh
-exec initctl -bq cond set ixinit-done
+exec initctl -bq cond set ixinit

board/common/rootfs/usr/libexec/infix/mnt

@@ -45,11 +45,6 @@ factory_reset()
     find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
     logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."
 
-    # Shred all files to prevent restoring contents
-    find /mnt/cfg -type f -exec shred -zu {} \;
-    find /mnt/var -type f -exec shred -zu {} \;
-
-    # Remove any lingering directories and symlinks as well
     rm -rf /mnt/cfg/* /mnt/var/*
 
     logger $opt -p user.crit -t "$nm" "Factory reset complete."
@@ -146,7 +141,7 @@ mount_overlay home "$cfgsrc" /home
 mount_overlay root "$cfgsrc" /root
 mount_bind         "$varsrc" /var
 
-[ "$vlibsrc" ] && mount_bind "$vlibsrc" /var/lib
+[ -n "$vlibsrc" ] && mount_bind "$vlibsrc" /var/lib
 
 for tag in $(ls /sys/bus/virtio/devices/*/mount_tag 2>/dev/null); do
     if [ "$(cat $tag | tr -d '\0')" = hostfs ]; then

board/common/rootfs/usr/libexec/infix/prod/provision

@@ -17,6 +17,13 @@ device
   - Initializes auxiliary and configuration filesystems and metadata
   - Installs Infix to both primary and secondary partitions
 
+To run this script again (on an already provisioned system), erase the
+partition table, reboot and netboot Infix again.
+
+Example:
+
+  sudo sgdisk --zap-all /dev/mmcblk0
+
 EOF
 }
 

board/common/rootfs/usr/sbin/container

@@ -1,5 +1,18 @@
 #!/bin/sh
-
+# This script can be used to start, stop, create, and delete containers.
+# It is what confd use, with the Finit container@.conf template, to set
+# up, run, and delete containers.
+#
+# NOTE: when creating/deleting containers, remember 'initctl reload' to
+#       activate the changes!  In confd this is already handled.
+#
+DOWNLOADS=/var/lib/containers/oci
+BUILTIN=/lib/oci
+TMPDIR=/var/tmp
+checksum=""
+extracted=
+timeout=30
+dir=""
 all=""
 env=""
 port=""
@@ -10,6 +23,87 @@ log()
     logger -I $PPID -t container -p local1.notice -- "$*"
 }
 
+err()
+{
+    rc=$1; shift
+    logger -I $PPID -t container -p local1.err -- "Error: $*"
+
+    if [ -n "$extracted" ]; then
+	if [ -d "$TMPDIR/$dir" ]; then
+	    log "Cleaning up extracted $dir"
+	    rm -rf "$dir"
+	fi
+    fi
+
+    [ "$rc" -eq 0 ] || exit "$rc"
+}
+
+check()
+{
+    file=$1
+
+    if [ -z "$checksum" ]; then
+	log "no checksum to verify $file against, continuing."
+	return 0
+    fi
+
+    if echo "${checksum}  ${file}" | "$cmdsum" -c -s; then
+        log "$file checksum verified OK."
+	return 0
+    fi
+
+    got=$("$cmdsum" "${file}" | awk '{print $1}')
+    log "$file checksum mismatch, got $got, expected $checksum, removing file."
+    rm -f "$file"
+
+    return 1
+}
+
+# Fetch an OCI image over ftp/http/https.  Use wget for FTP, which curl
+# empirically does not work well with.  Log progress+ & error to syslog.
+fetch()
+{
+    url=$1
+    file=$(basename "$url")
+    dst="$DOWNLOADS/$file"
+
+    cd "$DOWNLOADS" || return
+    if [ -e "$file" ]; then
+	log "$file already available."
+	if check "$file"; then
+	    echo "$dst"
+	    return 0
+	fi
+    fi
+
+    log "Fetching $url"
+
+    if echo "$url" | grep -qE "^ftp://"; then
+        cmd="wget -q $url"
+    elif echo "$url" | grep -qE "^https?://"; then
+        cmd="curl $creds -sSL --fail -o \"$file\" $url"
+    else
+        log "Unsupported URL scheme: $url"
+        return 1
+    fi
+
+    if out=$(eval "$cmd" 2>&1); then
+	log "$file downloaded successfully."
+	if check "$file"; then
+	    echo "$dst"
+	    return 0
+	fi
+    fi
+
+    # log error message from backend
+    while IFS= read -r line; do
+	log "$line"
+    done <<EOF
+$out
+EOF
+    return 1
+}
+
 # Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
 # checks, at least one index.json in the top-level dir of the archive.
 # If there are more index files, this function does not handle them.
@@ -26,45 +120,74 @@ unpack_archive()
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
 	    file=${image#oci-archive:}
 	    ;;
+	ftp://* | http://* | https://*)
+            if ! file=$(fetch "$image"); then
+		return 1
+	    fi
+            ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    echo "$image"
+	    if podman image exists "$image"; then
+		echo "$image"
+		return 0
+	    fi
+	    # XXX: use --retry=0 with Podman 5.0 or later.
+	    if ! id=$(podman pull --quiet "$image"); then
+		log "Failed pulling $image"
+		return 1
+	    fi
+	    # Echo image name to caller
+	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
 	    return 0
 	    ;;
     esac
 
     if [ ! -e "$file" ]; then
-	if [ -e "/var/lib/containers/oci/$file" ]; then
-	    file="/var/lib/containers/oci/$file"
-	elif [ -e "/lib/oci/$file" ]; then
-	    file="/lib/oci/$file"
+	if [ -e "$DOWNLOADS/$file" ]; then
+	    file="$DOWNLOADS/$file"
+	elif [ -e "$BUILTIN/$file" ]; then
+	    file="$BUILTIN/$file"
 	else
-	    log "Error: cannot find OCI archive $file in search path."
-	    exit 1
+	    err 1 "cannot find OCI archive $file in search path."
 	fi
     fi
 
     if [ -d "$file" ]; then
 	index=$(find "$file" -name index.json)
 	if [ -z "$index" ]; then
-	    log "Error: cannot find index.json in OCI image $file"
-	    exit 1
+	    err 1 "cannot find index.json in OCI image $file"
 	fi
     else
+	cd "$TMPDIR" || err 0 "failed cd $TMPDIR, wiill use $(pwd) for OCI archive extraction."
+
 	index=$(tar tf "$file" |grep index.json)
 	if [ -z "$index" ]; then
-	    log "Error: invalid OCI archive, cannot find index.json in $file"
-	    exit 1
+	    err 1 "invalid OCI archive, cannot find index.json in $file"
 	fi
 
 	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
-        tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
-	remove=true
+        tar xf "$file"  || err 1 "failed unpacking $file in $(pwd)"
+	extracted=true
     fi
 
     dir=$(dirname "$index")
+    if echo "$dir" | grep -q ":"; then
+        if [ -z "$name" ]; then
+            name="$dir"
+        fi
+        sanitized_dir=$(echo "$dir" | cut -d':' -f1)
+        mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
+        dir="$sanitized_dir"
+    fi
+
     [ -n "$quiet" ] || log "Loading OCI image $dir ..."
     podman load -qi "$dir"        >/dev/null
 
+    # Clean up after ourselves
+    if [ -n "$extracted" ]; then
+	log "Cleaning up extracted $dir"
+	rm -rf "$dir"
+    fi
+
     # Rename image from podman default $dir:latest
     if [ -n "$name" ]; then
 	podman tag "$dir" "$name" >/dev/null
@@ -73,10 +196,6 @@ unpack_archive()
 	name=$dir
     fi
 
-    if [ "$remove" = "true" ]; then
-	rm -rf "$file"
-    fi
-
     echo "$name"
 }
 
@@ -102,15 +221,18 @@ create()
 
     # Unpack and load docker-archive/oci/oci-archive, returning image
     # name, or return docker:// URL for download.
-    image=$(unpack_archive "$image")
-
-    if [ -z "$logging" ]; then
-	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
+    if ! image=$(unpack_archive "$image"); then
+	exit 1
     fi
 
-    args="$args --replace --quiet --cgroup-parent=containers $caps"
+    if [ -z "$logging" ]; then
+	logging="--log-driver none"
+    fi
+
+    # When we get here we've already fetched, or pulled, the image
+    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
+    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
     pidfn=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
@@ -134,16 +256,17 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
     if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
-	[ -n "$quiet" ] || log "Successfully created container $name from $image"
-	rm -f "/run/containers/env/${name}.env"
+	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
+
+	# Should already be enabled by confd (this is for manual use)
+	initctl -bnq enable "container@${name}.conf"
 	exit 0
     fi
 
-    log "Error: failed creating container $name, please check the configuration."
-    exit 1
+    err 1 "failed creating container $name, please check the configuration."
 }
 
 delete()
@@ -157,18 +280,27 @@ delete()
 	exit 1
     fi
 
+    # Should already be stopped, but if not ...
+    container stop "$name"
+
+    while running "$name"; do
+	_=$((timeout -= 1))
+	if [ $timeout -le 0 ]; then
+	    err 1 "timed out waiting for container $1 to stop before deleting it."
+	fi
+	sleep 1
+    done
+
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
 }
 
 waitfor()
 {
-    timeout=$2
     while [ ! -f "$1" ]; do
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
-	    log "Timeout waiting for $1, aborting!"
-	    exit 1
+	    err 1 "timed out waiting for $1, aborting!"
 	fi
 	sleep 1;
     done
@@ -236,6 +368,12 @@ netrestart()
     done
 }
 
+cleanup()
+{
+    log "Received signal, exiting."
+    exit 1
+}
+
 usage()
 {
 	cat <<EOF
@@ -248,6 +386,7 @@ options:
       --dns-search LIST    Set host lookup search list when creating container
       --cap-add CAP        Add capability to unprivileged container
       --cap-drop CAP       Drop capability, for privileged containter
+      --checksum TYPE:SUM  Use md5/sha256/sha512 to verify ftp/http/https archives
   -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
   -d, --detach             Detach a container started with 'run IMG [CMD]'
   -e, --env FILE           Environment variables when creating container
@@ -267,14 +406,15 @@ options:
                            Syntax: [[ip:][hostPort]:]containerPort[/protocol]
   -q, --quiet              Quiet operation, called from confd
   -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
-      --read-only          Do not create a writable layer
   -s, --simple             Show output in simplified format
+  -t, --timeout SEC        Set timeout for delete/restart commands, default: 20
   -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
 
 commands:
   create   NAME IMAGE NET  Create container NAME using IMAGE with networks NET
   delete  [network] NAME   Remove container NAME or network NAME from all containers
   exec     NAME CMD        Run a command inside a container
+  flush                    Clean up lingering containers and associated anonymous volumes
   find    [ifname PID]     Find PID of container where '--net IFNAME' currently lives
                            or, find the name of our IFNAME inside the container @PID
   help                     Show this help text
@@ -285,6 +425,7 @@ commands:
   restart [network] NAME   Restart a (crashed) container or container(s) using network
   run      NAME [CMD]      Run a container interactively, with an optional command
   save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
+  setup    NAME            Create and set up container as a Finit task
   shell                    Start a shell inside a container
   show    [image | volume] Show containers, images, or volumes
   stat                     Show continuous stats about containers (Ctrl-C aborts)
@@ -307,6 +448,25 @@ while [ "$1" != "" ]; do
 	    shift
 	    caps="$caps --cap-drop=$1"
 	    ;;
+	--checksum)
+	    shift
+	    type="${1%%:*}"
+	    checksum="${1#*:}"
+	    case "$type" in
+		md5)
+		    cmdsum=md5sum
+		    ;;
+		sha256)
+		    cmdsum=sha256sum
+		    ;;
+		sha512)
+		    cmdsum=sha512sum
+		    ;;
+		*)
+		    err 1 "Unsupported checksum type: $type"
+		    ;;
+	    esac
+	    ;;
 	-c | --creds)
 	    shift
 	    creds="-u $1"
@@ -351,7 +511,6 @@ while [ "$1" != "" ]; do
 	--log-path)
 	    shift
 	    logging="$logging --log-opt path=$1"
-	    log_path="$1"
 	    ;;
 	-m | --mount)
 	    shift
@@ -386,12 +545,13 @@ while [ "$1" != "" ]; do
 	    shift
 	    restart=$1
 	    ;;
-	--read-only)
-	    ro="--read-only=true"
-	    ;;
 	-s | --simple)
 	    simple=true
 	    ;;
+	-t | --timeout)
+	    shift
+	    timeout=$1
+	    ;;
 	-v | --volume)
 	    shift
 	    vol="$vol -v $1"
@@ -408,6 +568,8 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
+trap cleanup INT TERM
+
 case $cmd in
     # Does not work atm., cannot attach to TTY because
     # we monitor 'podman start -ai foo' with Finit.
@@ -430,6 +592,10 @@ case $cmd in
     exec)
 	podman exec -it "$@"
 	;;
+    flush)
+	echo "Cleaning up any lingering containers";
+	podman rm -av
+	;;
     find)
 	cmd=$1
 	pid=$2
@@ -455,25 +621,12 @@ case $cmd in
 	usage
 	;;
     load)
-	url=$1
-	name=$2
 	# shellcheck disable=SC2086
-	if echo "$url" | grep -q "://"; then
-	    file=$(basename "$url")
-            curl -k $creds -Lo "$file" "$url"
-	else
-            file="$url"
-	fi
-
-	# shellcheck disable=SC2086
-	name=$(unpack_archive "$file" $name)
+	name=$(unpack_archive "$1" $2)
+	[ -n "$name" ] || exit 1
 
 	# Show resulting image(s) matching $name
-	if [ -n "$name" ]; then
-	    podman images -n "$name"
-	else
-	    exit 1
-	fi
+	podman images -n "$name"
 	;;
     locate)			# Find where the host's ifname lives
 	if [ -z "$network" ]; then
@@ -500,7 +653,7 @@ case $cmd in
 		podman images $all --format "{{.Repository}}:{{.Tag}}"
 		;;
 	    oci)
-		find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
+		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
 	    *)		
 		podman ps $all --format "{{.Names}}"
@@ -542,6 +695,20 @@ case $cmd in
 	    gzip "$file"
 	fi
 	;;
+    setup)
+	[ -n "$name" ] || err 1 "setup: missing container name."
+	script=/run/containers/${name}.sh
+	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
+	while ! "$script"; do
+	    # Wait for address/route changes, or retry every 60 secods
+	    # shellcheck disable=2162,3045
+	    ip monitor address route | while read -t 60 _; do break; done
+
+	    # On IP address/route changes, wait a few seconds more to ensure
+	    # the system has ample time to react and set things up for us.
+	    sleep 2
+	done
+	;;
     shell)
 	podman exec -it "$1" sh -l
 	;;
@@ -596,12 +763,10 @@ case $cmd in
 	    else
 		name=$1
 		stop "$name"
-		timeout=20
 		while running "$name"; do
 		    _=$((timeout -= 1))
 		    if [ $timeout -le 0 ]; then
-			log "Timeout waiting for container $1 to stop before restarting it."
-			exit 1
+			err 1 "timed out waiting for container $1 to stop before restarting it."
 		    fi
 		    sleep 1
 		done
@@ -627,7 +792,7 @@ case $cmd in
 	;;
     upgrade)
 	# Start script used to initially create container
-	script=/var/lib/containers/active/S01-${1}.sh
+	script=/run/containers/${1}.sh
 
 	# Find container image
 	img=$(podman inspect "$1" | jq -r .[].ImageName)
@@ -658,7 +823,7 @@ case $cmd in
 	[ -n "$cmd" ] && shift
 	case $cmd in
 	    prune)
-		podman volume $force prune
+		podman volume prune $force
 		;;
 	    *)
 		false

board/common/rootfs/usr/share/udhcpc/default.script

@@ -50,7 +50,7 @@ set_dhcp_routes()
 	# format: dest1/mask gw1 ... destn/mask gwn
 	set -- $staticroutes
 	while [ -n "$1" -a -n "$2" ]; do
-	    log "adding route $1 via $2 dev $interface proto dhcp"
+	    log "adding route $1 via $2 metric $metric tag 100"
 	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
 	    shift 2
 	done
@@ -115,7 +115,7 @@ case "$ACTION" in
 	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
 	fi
 
-	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto dhcp; then
 	    echo "$ip" > "$IP_CACHE"
 	fi
 	if [ -n "$ipv6" ] ; then

board/common/uboot/scripts/ixboot.sh

@@ -1,4 +1,4 @@
-echo "Press Ctrl-C NOW to enter boot menu"
+echo "Press Ctrl-C NOW to override the default boot sequence"
 if sleep "${ixbootdelay}"; then
     run ixbootorder
 
@@ -7,8 +7,12 @@ if sleep "${ixbootdelay}"; then
     reset
 fi
 
-bootmenu
 if test "${dev_mode}" != "yes"; then
+    bootmenu
     pause "Console shell access PROHIBITED. Press any key to reset..."
     reset
 fi
+
+echo
+echo 'Run "bootmenu" to interactively select a boot device'
+echo

board/common/uboot/scripts/ixprepdhcp.sh

@@ -1,16 +1,20 @@
 setenv autoload no
 
-if dhcp; then
+if test -n "${ipaddr}" || dhcp; then
     setenv proto tftp
     setenv dltool tftpboot
+    setenv dlfile "${bootfile}"
 
-    if setexpr proto sub "^(http|tftp)://.*" "\\1" "${bootfile}" && setexpr bootfile sub "^(http|tftp)://([^/]+?)/(.*)" "\2:\3"; then
+    if setexpr proto sub "^(http|tftp)://.*" "\\1" "${bootfile}"; then
 	if test "${proto}" = "http"; then
 	    setenv dltool wget
+	    setexpr dlfile sub "^http://([^/]+?)/(.*)" "\\1:/\\2" "${bootfile}"
+	else
+	    setexpr dlfile sub "^tftp://([^/]+?)/(.*)" "\\1:\\2" "${bootfile}"
 	fi
     fi
 
-    if ${dltool} ${ramdisk_addr_r} "${bootfile}"; then
+    if ${dltool} ${ramdisk_addr_r} "${dlfile}"; then
 	setenv old_fdt_addr ${fdt_addr}
 	if fdt addr ${ramdisk_addr_r}; then
 	    fdt get value sqoffs /images/rootfs data-position

board/x86_64/linux_defconfig

@@ -33,6 +33,7 @@ CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
 CONFIG_SMP=y
 CONFIG_EFI=y
+CONFIG_KPROBES=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -161,12 +162,14 @@ CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
+CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_PKTGEN=y
 # CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
+CONFIG_PCI_MSI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -208,6 +211,7 @@ CONFIG_NET_VRF=y
 CONFIG_E1000=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
+CONFIG_ROCKER=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y
@@ -260,7 +264,9 @@ CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
+CONFIG_PANIC_ON_OOPS=y
+CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-# CONFIG_FTRACE is not set
+CONFIG_FUNCTION_TRACER=y
 CONFIG_UNWINDER_FRAME_POINTER=y

configs/aarch64_defconfig

@@ -14,6 +14,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -24,7 +25,6 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
@@ -131,8 +131,9 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
-BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -140,10 +141,11 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -159,7 +161,6 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_PACKAGE_TEST_MODE=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/aarch64_minimal_defconfig

@@ -14,6 +14,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -24,7 +25,6 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
@@ -76,6 +76,9 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -111,12 +114,16 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -126,11 +133,6 @@ BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_TEST_MODE=y
-BR2_PACKAGE_NGINX=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_ROUSETTE=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y

configs/r2s_defconfig

@@ -175,7 +175,6 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -183,10 +182,11 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -201,7 +201,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-# BR2_PACKAGE_TEST_MODE is not set
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/riscv64_defconfig

@@ -11,8 +11,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-BR2_ROOTFS_MERGED_USR=y
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -65,9 +65,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
@@ -166,7 +164,7 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
-BR2_PACKAGE_EXECD=y
+# BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -174,10 +172,11 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -192,7 +191,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-# BR2_PACKAGE_TEST_MODE is not set
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/x86_64_defconfig

@@ -13,6 +13,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -23,7 +24,6 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
@@ -57,6 +57,7 @@ BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -134,8 +135,9 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
-BR2_PACKAGE_EXECD=y
+BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -143,10 +145,11 @@ BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
-BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -161,7 +164,6 @@ BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
-BR2_PACKAGE_TEST_MODE=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

configs/x86_64_minimal_defconfig

@@ -13,6 +13,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 # BR2_TARGET_ENABLE_ROOT_LOGIN is not set
+BR2_ROOTFS_MERGED_USR=y
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -23,7 +24,6 @@ BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/rootfs"
 BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
-BR2_ROOTFS_MERGED_USR=y
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.6.52"
@@ -56,6 +56,7 @@ BR2_PACKAGE_LIBSSH2_OPENSSL=y
 BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
+BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -71,6 +72,9 @@ BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPUTILS=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_NETCALC=y
+BR2_PACKAGE_NGINX=y
+BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
+BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
 BR2_PACKAGE_OPENRESOLV=y
 BR2_PACKAGE_OPENSSH=y
 BR2_PACKAGE_SOCAT=y
@@ -114,12 +118,16 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_CONFD_TEST_MODE=y
+BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
 BR2_PACKAGE_FINIT_PLUGIN_MODULES_LOAD=y
 BR2_PACKAGE_FINIT_PLUGIN_RTC=y
+BR2_PACKAGE_FINIT_RTC_DATE="2024-11-04 10:54:00"
+BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
@@ -128,11 +136,6 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
-BR2_PACKAGE_TEST_MODE=y
-BR2_PACKAGE_NGINX=y
-BR2_PACKAGE_NGINX_HTTP_SSL_MODULE=y
-BR2_PACKAGE_NGINX_HTTP_V2_MODULE=y
-BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_ROUSETTE=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

doc/ChangeLog.md

@@ -3,6 +3,253 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v24.11.2][] - 2025-03-19
+-------------------------
+
+### Fixes
+
+- Fix TCAM memory corruption in `mvpp2` Ethernet controller
+
+
+[v24.11.1][] - 2024-11-29
+-------------------------
+
+### Changes
+
+ - Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink
+   messages and drifted out of sync with the kernel's view of addresses
+   and interfaces available in the system
+ - Allow setting IP address directly on VLAN filtering bridges.  This
+   only works when the bridge is an untagged member of a (single) VLAN.
+ - cli: usability -- showing log files now automatically jump to the end
+   of the file, where the latest events are
+ - cli: usability -- showing container status, or other status that
+   overflows the terminal horizontally, now wrap the lines and exit the
+   pager immediately if the contents fit on the first screen
+ - The default log level of the mDNS responder, `avahi-daemon`, has been
+   adjusted to make it less verbose.  Now only `LOG_NOTICE` and higher
+   severity is logged -- making it very quiet
+
+### Fixes
+
+ - Fix #685: DSA conduit interface not always detected.  Previous
+   attempt at a fix (v24.10.2) mitigated the issue, but did not
+   completely solve it.
+ - Fix #835: redesign how the system creates/deletes containers from the
+   `running-config`.  Prior to this change, all removal and creation was
+   handled by a separate queue that ran asynchronously from the `confd`
+   process.  This could lead to situations where new configurations are
+   applied before the queue had been fully processed.  After this change
+   containers are deleted synchronously and new containers are created
+   in the same flow as during normal runtime operation (start/upgrade)
+ - Fix start of containers with `manual=True` option should now work
+   again, regression in v24.11.0
+ - Fix loss of writable volumes when temporarily disabling a container
+   in the configuration, now the container remains dormant with all its
+   volumes still available
+ - Fix presentation bug in CLI `show interfaces` where all line-drawing
+   characters showed up as hexadecimal values.  Regression in v24.11.0
+ - Fix missing log messages from Frr Zebra daemon
+ - Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an
+   interface, e.g., `br0`
+ - Creating more than one container trigger restarts of previously set
+   up containers.  Which in some cases may cause these earlier ones to
+   end up in an inconsistent state
+ - Prevent traffic assigned to locally terminated VLANs from being
+   forwarded, when the underlying ports are simultaneously attached to
+   a VLAN filtering bridge.
+
+
+[v24.11.0][] - 2024-11-20
+-------------------------
+
+> [!CAUTION]
+> This release contains breaking changes for container users!  As of
+> v24.11.0, all persistent[^1] containers always run in `read-only` mode
+> and the setting itself is deprecated (kept only for compatibility
+> reasons).  The main reason for this change is to better serve users
+> with embedded container images in their builds of Infix.  I.e., they
+> can now upgrade the OCI image in their build and rely on the container
+> being automatically upgraded when Infix is upgraded, issue #823.  For
+> other users, the benefit is that *all* container configuration changes
+> take when activated, issue #822, without having to perform any tricks.
+
+### Changes
+
+ - Add validation of interface name lengths, (1..15), Linux limit
+ - Add support for ftp/http/https URI:s in container image, with a new
+   `checksum` setting for MD5/SHA256/SHA512 verification, issue #801
+ - Add a retry timer to the background container create service.  This
+   will ensure failing `docker pull` operations from remote images are
+   retrying after 60 seconds, or quicker
+ - CLI base component, `klish`, has been updated with better support for
+   raw terminal mode and alternate quotes (' in addition to ")
+ - Log silenced from container activation messages, only the very bare
+   necessities are now logged, e.g., `podman create` command + status
+ - Factory reset no longer calls `shred` to "securely erase" any files
+   from writable data partitions.  This will speed up the next boot
+   considerably
+
+### Fixes
+
+ - Fix #659: paged output in CLI accessed via console port sometimes
+   causes lost lines, e.g. missing interfaces.  With updated `klish`
+   and the terminal in raw mode, the pager (less) can now control both
+   the horizontal and vertical
+ - Fix #822: adding, or changing, an environment variable to a running
+   container does not take without the `container upgrade NAME` trick
+ - Fix #823: with an OCI image embedded in the Infix image, an existing
+   container in the configuration is not upgraded to the new OCI image
+   with the Infix upgrade.
+ - Frr leaves log files in `/var/tmp/frr` on unclean shutdowns.  This
+   has now been fixed with a "tmpfiles" cleanup of that path at boot
+
+[^1]: I.e., set up in the configuration, as opposed to temporary ones
+    started with `container run` from the CLI admin-exec context.
+
+
+[v24.10.2][] - 2024-11-08
+-------------------------
+
+### Changes
+
+- Support for showing interfaces owned by running containers in the CLI
+  command `show interfaces`.  This also adds support for showing the
+  peer interface of VETH pairs.  Issue #626
+- Reboot system on kernel "oops", on "oops" the kernel now panics and
+  reboots after 20 seconds.  Issue #740
+- Update static factory-config for NanoPi R2S: enable NACM, securing all
+  passwords, and enabling `iburst` for the NTP client.  Issue #750
+- Updated QoS documentation with pictures and more information on VLAN
+  interface ingress/egress priority handling, issue #759
+- Disable RTC device in Styx device tree, issue #794
+- Support for saving and restoring system clock from a disk file.  This
+  allows restoring the system clock to a sane date in case the RTC is
+  disabled or does not have a valid time, issue #794
+- Update device discovery chapter with information on `infix.local` mDNS
+  alias, `netbrowse` support to discover *all* local units, and command
+  examples for disabling LLDP and mDNS services, issue #786
+- Updated OSPF documentation to include information on *global OSPF
+  settings* (`redistribution`, `explicit-router-id`, etc.), issue #812
+- Added information on *forwarding of IEEE reserved group addresses*
+  to bridge section of networking documentation, issue #788
+- Add support for bootstrap conditions and early init product overrides
+- Styx: enable second Ethernet port LED in device tree, again, rename
+  it: yellow -> aux, and make sure it is turned off at boot
+- Styx: disable second port LED for the 4xSFP slots, does not work
+- Styx: override iitod (LED daemon) with a product specific LED script
+
+### Fixes
+
+- Fix #685: DSA conduit interface not always detected, randomly causing
+  major issues configuring systems with multiple switch cores
+- Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S.
+  This fixes a regression in v24.10.0 causing loss of NETCONF support
+- Fix #809: enable syslog logging for RAUC
+- Fix harmless bootstrap log error message on systems without USB ports:
+  `jq: error (at <stdin>:0): Cannot iterate over null (null)`
+- Change confusing `tc` log error message: `Error: does not support
+  hardware offload` to `Skipping $iface, hardware offload not supported.`
+
+
+
+[v24.10.1][] - 2024-10-18
+-------------------------
+
+### Changes
+
+ - Add support for interface description, sometimes referred to as
+   "ifAlias".  Saved as an Linux interface alias (not `altname`), e.g.,
+   `/sys/class/interfaces/veth0a/ifalias`, includes operational support
+
+### Fixes
+
+ - Fix #735: `copy` and `erase` commands missing from CLI, regression
+   in Infix v24.10.0 defconfigs, now added as dep. in klish package
+
+
+[v24.10.0][] - 2024-10-18
+-------------------------
+
+**News:** this release contains *breaking YANG changes* in custom MAC
+addresses for interfaces!  For details, see below issue #680.
+
+Also, heads-up to all downstream users of Infix.  YANG models have been
+renamed to ease maintenance, more info below.
+
+### Changes
+
+- Software control of port LEDs on the Styx platform has been disabled.
+
+  Default driver behavior, green link and green traffic blink, is kept
+  as-is, which should mitigate issues reported in #670
+- Correcting documentation on QoS. For packets containing both a VLAN
+  tag and an IP header, PCP priority takes precedence over DSCP
+  priority (not vice versa).
+- Update CONTRIBUTING.md for scaling core team and helping external
+  contributors understand the development process, issue #672
+- Updated branding documentation with more information on how dynamic
+  and static factory-config work, including examples
+- Updated container documentation, improved images, detail how to set
+  interface name inside the container, and some syntax fixes
+- Updated networking documentation, new General settings section, and
+  more details added to initial section on network building blocks
+- As of this release, all Infix YANG models have dropped the `@DATE`
+  suffix from the name, this type of versioning is not handled using
+  symlinks instead.
+- Update Infix `provision` script, used to install Infix on eMMC, add
+  example of how to erase partition table to be able to re-run the
+  script on already provisioned devices, issue #671
+- OSPF: Add limitation to allow an interface to be in one area only
+- Add support for "dummy" interfaces, mostly useful for testing
+- Add support for container hostname format specifiers, just like it
+  already works for the host's hostname setting
+- Hide all `status obsolete` YANG nodes in CLI
+- Add YANG `units`, if available, to CLI help text (default value)
+- The CLI commands `copy` and `erase` are now available also from Bash
+- Greatly reduced size of bundled curiOS httpd OCI container image,
+  reduced from 1.8 MiB to 281 KiB
+- Add deviation to ietf-interfaces.yang, `link-up-down-trap-enable` is
+  not supported (yet) in Infix, issue #709
+- The default builds now include the curiOS nftables container image,
+  which can be used for advanced firewall setups.  For an introduction
+  see <https://kernelkit.org/posts/firewall-container/>
+
+### Fixes
+
+- Fix #499: add an NACM rule to factory-config, which by default deny
+  everyone to read user password hash(es)
+- Fix #663: internal Ethernet interfaces shown in CLI tab completion
+- Fix #674: CLI `show interfaces` display internal Ethernet interfaces,
+  regression introduced late in v24.09 release cycle
+- Fix #676: port dropped from bridge when changing its VLAN membership
+  from tagged to untagged
+- Fix #680: replace deviation for `phys-address` in ietf-interfaces.yang
+  with `custom-phys-address` to allow for constructing more free-form
+  MAC addresses based on the chassis MAC (a.k.a., base MAC) address.
+  For more information, see the YANG model, a few examples are listed in
+  the updated documentation.  
+  The syntax will be automatically updated in the `startup-config` and
+  `factory-config` -- make sure to verify the changes and update any
+  static `factory-config` used for your products
+- Fix #690: CLI `show ip route` command stops working after 24 hours,
+  this includes all operational data in ietf-routing:/routing/ribs.
+- Fix #697: password is not always set for new users, bug introduced
+  in v24.06.0 when replacing Augeas with native user handling
+- Fix #700: add missing `admin-status` to interface operational data
+- Fix #701: make sure CLI (and Bash) `copy` command use same sysrepo
+  timeout as other operations that load sysrepo.  Was 10 second timeout,
+  which caused some (really big) configurations not to apply from the
+  CLI, but worked at boot, for instance.  New timeout is 60 seconds
+- Fix #708: allow all container networks to set interface name inside
+  container, not just auto-generated veth-pair ends for `docker0` bridge
+- Fix `show interfaces` on platforms like the NanoPi R2S, which does not
+  support reading RMON counters in JSON format using `ethtool`
+- Fix #730: CLI command `show ntp [sources]` stopped working in v24.08.
+  Missing access rights after massive CLI lock-down
+- Fix BFD in OSPF, previously you could not enable BFD on a single
+  interface without enabling it on all interfaces
+
 
 [v24.09.0][] - 2024-09-30
 -------------------------
@@ -18,6 +265,7 @@ also been added to facilitate site specific adaptations.  Please see the
 documentation for details.
 
 ### Known Issues
+
 - The CLI command `show interfaces` may for some terminal resolutions
   not display all interfaces (on systems with >20 interfaces).  This
   problem is limited to the console port and only occurs for smaller
@@ -26,6 +274,7 @@ documentation for details.
   using the CLI from an SSH session, is not affected.  Issue #659
 
 ### Changes
+
 - Upgrade Buildroot to 2024.02.6 (LTS)
 - Upgrade Linux kernel to 6.6.52 (LTS)
 - Upgrade libyang to 3.4.2
@@ -45,6 +294,7 @@ documentation for details.
   by `mctl` reporting no multicast filtering enabled on bridge
 
 ### Fixes
+
 - Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be
   randomized.  Problem caused by kernel setting a random MAC before any
   bridge port is added.  Fixed by using the device's base MAC address on
@@ -107,6 +357,7 @@ Finally, the following consumer boards are now fully supported:
  - StarFive VisionFive2 (RISC-V)
 
 ### Changes
+
 - Upgrade Buildroot to 2024.02.5 (LTS)
 - Upgrade Linux kernel to 6.6.46 (LTS)
 - Issue #158: enhance security of factory reset.  All file content
@@ -158,6 +409,7 @@ Finally, the following consumer boards are now fully supported:
   log messages.  See `/var/log/debug` for *all* log messages
 
 ### Fixes
+
 - Fix #274: add missing link/traffic LEDs on NanoPi R2S LAN port
 - Fix #489: ensure all patches are versioned, including Linux kernel
 - Fix #531: creating a new VLAN interface named `vlanN` should not set
@@ -187,6 +439,7 @@ Finally, the following consumer boards are now fully supported:
 > upgrade, but before reboot, a factory reset is required!
 
 ### Changes
+
 - Upgrade Buildroot to 2024.02.3 (LTS)
 - Upgrade Linux kernel to 6.6.34 (LTS)
 - Upgrade bundled curiOS httpd container to v24.05.0
@@ -253,6 +506,7 @@ Finally, the following consumer boards are now fully supported:
 [yescrypt]: https://en.wikipedia.org/wiki/Yescrypt
 
 ### Fixes
+
 - Fix #424: regression, root user can log in without password
 - Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
   to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
@@ -284,11 +538,13 @@ Finally, the following consumer boards are now fully supported:
 -------------------------
 
 ### Changes
+
 - Add small delay in U-Boot to allow stopping boot on reference boards
 - Document how to provision the bootloader and Infix on a blank board
 - Use initial hostname from `/etc/os-release` as configuration fallback
 
 ### Fixes
+
 - Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
   to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
 - Fix provisioning script after changes to make GRUB loading more robust
@@ -303,6 +559,7 @@ Finally, the following consumer boards are now fully supported:
 -------------------------
 
 ### Changes
+
 - Default web landing page refactored into a Buildroot package to make
   it possible to overload from customer repos.
 - Enable DCB support in aarch64 kernel (for EtherType prio override)
@@ -313,6 +570,7 @@ Finally, the following consumer boards are now fully supported:
 - Issue #374: add timestamps to dagger .log files
 
 ### Fixes
+
 - Add missing LICENSE hash for factory reset tool
 - Fix #424: regression, root user can log in without password
 
@@ -334,6 +592,7 @@ idea is to generate supported features from the models and include in
 future releases.
 
 ### Changes
+
 - Bump the base Buildroot version to v2024.02 LTS
 - Bump the base Linux kernel version to 6.6 LTS
 - Drop Classic variant to reduce overhead, simplify build & release
@@ -414,6 +673,7 @@ future releases.
   named 'default'
 
 ### Fixes
+
 - confd: Fix memory leak when operating on candidate configuration
 - probe: Fix crash on systems without USB
 - Reduced syslog errors for accesses no non-existing xpaths
@@ -1156,7 +1416,13 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.08.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.11.0...HEAD
+[v24.11.2]:   https://github.com/kernelkit/infix/compare/v24.11.1...v24.11.2
+[v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
+[v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
+[v24.10.2]:   https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2
+[v24.10.1]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.10.1
+[v24.10.0]:   https://github.com/kernelkit/infix/compare/v24.09.0...v24.10.0
 [v24.09.0]:   https://github.com/kernelkit/infix/compare/v24.08.0...v24.09.0
 [v24.08.0]:   https://github.com/kernelkit/infix/compare/v24.06.0...v24.08.0
 [v24.06.0]:   https://github.com/kernelkit/infix/compare/v24.04.0...v24.06.0

doc/boot.md

@@ -143,7 +143,7 @@ which offers lots of benefits out-of-the-box:
   media like USB sticks or SD-cards) and from remote servers using FTP
   or HTTP(S).
 
-To initiate a system upgrade, run:
+To initiate a system upgrade from the shell[^1], run:
 
     rauc install <file|url>
 
@@ -349,3 +349,5 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.
 
+[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
+    via CLI.

doc/branding.md

@@ -41,13 +41,92 @@ Verify the result after a build by inspecting:
     printed on a label on the device.
 
 
-Factory Defaults
-----------------
+Factory & Failure Config
+------------------------
 
-The Infix default configuration, factory-config, is part static files
-and part per-device generated files, e.g., SSH hostkey and hostname.
-The latter is constructed from the file `/etc/hostname`, appended with
-the last three octets of the system's base MAC address.  To override the
+To support booting the same image (CPU architecture) on multiple boards,
+Infix by default generates the device's initial configuration every time
+at boot.  This also ensures the device can always be restored to a known
+state after a factory reset, since the `factory-config` is guaranteed to
+be compatible with the YANG models for the given software version. (For
+more information on how the system boots, please see the section [Key
+Concepts](introduction.md#key-concepts) in the Introduction document.)
+
+However, for custom builds of Infix it is possible to override this with
+a single static `/etc/factory-config.cfg` (and failure-config) in your
+rootfs overlay -- with a [VPD](vpd.md) you can even support several!
+
+
+### Variables & Format Specifiers
+
+Parts of the configuration you likely always want to generated, like the
+SSH hostkey used by NETCONF, a unique hostname, or the `admin` user's
+unique (per-device with a VPD) password hash.  This section lists the
+available keywords, see the next section for examples of how to use
+them:
+
+ - **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
+   XPath: `/ietf-system:system/authentication/user/password`
+ - **Default NETCONF hostkey:** `genkey` (regenerated at factory reset)  
+   XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+ - **Hostname format specifiers:**  
+   XPath: `/ietf-system:system/hostname`
+   - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
+   - `%h`: Default hostname, from `/etc/os-release`, from branding
+   - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
+   - `%%`: Literal %
+
+
+### Static Files
+
+> **Caveat:** maintaining static a factory-config and failure-config may
+> seem like an obvious choice, but as YANG models evolve (even the IETF
+> models get upgraded), you may need to upgrade your static files.
+
+First, for one-off builds (one image per product), the simplest way is
+to override the location where the system looks for the files, `/etc`
+already at build time.  This can be done using a Buildroot rootfs
+overlay providing, e.g., `/etc/factory-config.cfg`.  Example: [NanoPi
+R2S][] in `${INFIX}/board/aarch64/r2s/rootfs/etc/factory-config.cfg`.
+
+Second, to support multiple products in a single image, we can employ
+another method to install a `/etc/factory-config.cfg` override -- at
+runtime.  This relies on the very early system `probe` that detects the
+specific product from VPD data.
+
+The `probe` consists of several sequential steps that currently run from
+`${INFIX}/board/common/rootfs/usr/libexec/infix/init.d/`.  One of them
+check if `/usr/share/product/<PRODUCT>` exists, and if so attempts to
+copy the entire contents to `/`.  Here, `<PRODUCT>` is determined from
+the VPD, which is available in `/run/system.json` as `"product-name"`,
+after `00-probe` has run. The lower case version of the string is used.
+
+I.e., create a rootfs overlay that provides any combination of:
+
+ - `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
+ - `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
+
+
+### Dynamically Generated
+
+The generated `factory-config` and `failure-config` files consist of
+both static JSON files and part generated files at runtime for each
+device.  The resulting files are written to the RAM disk in `/run`:
+
+ - `/run/confd/factory-config.gen`
+ - `/run/confd/failure-config.gen`
+
+Provided no custom overrides (see above) have been installed already,
+these files are then copied to:
+
+ - `/etc/factory-config.cfg`
+ - `/etc/failure-config.cfg`
+
+... where the bootstrap process expects them to be in the next step.
+
+Examples of generated contents are the SSH hostkey and hostname.  The
+latter is constructed from the file `/etc/hostname`, appended with the
+last three octets of the system's base MAC address.  To override the
 base hostname, set `BR2_TARGET_GENERIC_HOSTNAME` in your defconfig.
 
 The static files are installed by Infix `confd` in `/usr/share/confd/`
@@ -97,6 +176,112 @@ bootstrap script for more help, and up-to-date information.
 > you may want to look into `GEN_IFACE_OPTS`.
 
 
+### Example Snippets
+
+**IETF System:**
+
+```hsib
+  "ietf-system:system": {
+    "hostname": "example-%m",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          }
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },            # <---- REMEMBER COMMA SEPARATORS IN SNIPPETS!
+                # <---- ... and no comments.
+```
+
+The `motd-banner` is a binary type, which is basically a Base64 encoded
+text file without line breaks (`-w0`):
+
+```bash
+$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.github.io
+'-'---'-'
+```
+
+**IETF Keystore**
+
+Notice how both the public and private keys are left empty here.  The
+`genkey` is always automatically regenerated after each factory reset.
+Keeping the `factory-config` snippet like this means we can use the same
+file on multiple devices, without risking them sharing the same host
+keys.  Sometimes you may want the same host keys, but that is the easy
+use-case and not documented here.
+
+```json
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+```
+
+The `genkey` is currently only used by the NETCONF SSH backend.
+
+**IETF NETCONF Server**
+
+```json
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+```
+
+
+
 Integration
 -----------
 
@@ -203,3 +388,4 @@ variable `INFIX_OEM_PATH` to that of the br2-external.  It is also
 possible to set the `GIT_VERSION` variable in your `post-build.sh`
 script to change how the VCS version is extracted.
 
+[NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg

doc/container.md

@@ -1,5 +1,6 @@
 Containers in Infix
 ===================
+<img align="right" src="img/docker.webp" alt="Docker whale" width=360>
 
 * [Introduction](#introduction)
 * [Caution](#caution)
@@ -19,6 +20,9 @@ Containers in Infix
   * [Application Container: ntpd](#application-container-ntpd)
 * [Advanced](#advanced)
   * [Running Host Commands From Container](#running-host-commands-from-container)
+* [Container Requirements](#container-requirements)
+  * [Advanced Users](#advanced-users)
+
 
 Introduction
 ------------
@@ -35,10 +39,11 @@ All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
 container networking in podman.
 
-> **Note:** even though the `podman` command can be used directly from a
-> shell prompt, we strongly recommend using the CLI commands instead.
-> They employ the services of a wrapper `container` script which handles
-> the integration of containers in the system.
+> [!IMPORTANT]
+> Even though the `podman` command can be used directly from a shell
+> prompt, we strongly recommend using the CLI commands instead.  They
+> employ the services of a wrapper `container` script which handles the
+> integration of containers in the system.
 
 
 Caution
@@ -75,39 +80,52 @@ Getting Started
 
 In the CLI, containers can be run in one of two ways:
 
- 1. `container run IMAGE [COMMAND]`, and
+ 1. `container run IMAGE [COMMAND]`, or
  2. enter `configure` context, then `edit container NAME`
 
-The first is useful mostly for testing, or running single commands in an
-image.  It is a wrapper for `podman run -it --rm ...`, while the latter
-is a wrapper and adaptation of `podman create ...`.
+The former is useful mostly for testing, or running single commands in
+an image.  It is a wrapper for `podman run -it --rm ...`, while the
+latter is a wrapper and adaptation of `podman create ...`.
 
-The second create a container with a semi-persistent writable layer that
-survives container restarts and host system restarts.  However, if you
-change the container configuration or upgrade the image (see below), the
-container will be recreated and the writable layer is lost.  This is why
-it is recommended to set up a named volume for directories, or use file
-[Content Mounts][], in your container you want truly persistent content.
+The second creates a read-only container that is automatically started
+at every boot.  When non-volatile storage is needed, data stored in a
+volume is persisted until explicitly removed from the configuration,
+i.e., across host and container reboots and upgrades.
 
-In fact, in many cases the best way is to create a `read-only` container
-and use file mounts and volumes only for the critical parts.  Podman
-ensures (using tmpfs) `read-only` containers still have writable
-directories for certain critical file system paths: `/dev`, `/dev/shm`,
-`/run`, `/tmp`, and `/var/tmp`.  Meaning, what you most often need is
-writable volumes for `/var/lib` and `/etc`, or only file mounts for a
-few files in `/etc`.  The actual needs depend on the container image and
-application to run.
+Another option is [Content Mounts](#content-mounts), where the content
+of a file mounted into the container is kept along with the container
+configuration in the device's `startup-config`.
 
-> **Note:** when running containers from public registries, double-check
-> that they support the CPU architecture of your host system.  Remember,
-> unlike virtualization, containers reuse the host's CPU and kernel.
+Podman ensures (using tmpfs) all containers have writable directories
+for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
+`/tmp`, and `/var/tmp`.  Meaning, what you most often need is writable
+volumes for `/var/lib` and `/etc`, or only file mounts for a few files
+in `/etc`.  The [actual requirements](#container-requirements) depend on
+your container image and application to run.
 
+> [!IMPORTANT]
+> When running containers from public registries, double-check that they
+> support the CPU architecture of your host system.  Remember, unlike
+> virtualization, containers reuse the host's CPU and kernel.
+
+
+<img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
 
 ### Examples
 
 Classic Hello World:
 
     admin@example:/> container run docker://hello-world
+    Starting docker://hello-world :: use Ctrl-p Ctrl-q to detach
+    Trying to pull docker.io/library/hello-world:latest...
+    Getting image source signatures
+    Copying blob c1ec31eb5944 done
+    Copying config d2c94e258d done
+    Writing manifest to image destination
+    Storing signatures
+
+    Hello from Docker!
+    This message shows that your installation appears to be working correctly.
 
 Persistent web server using nginx, sharing the host's network:
 
@@ -132,7 +150,7 @@ container at runtime.
 Container Images
 ----------------
 
-The underlying `podman` project support importing and fetching images in
+The underlying `podman` project supports importing and fetching images in
 a variety of ways, the most common ones are also supported by Infix.  In
 this section we present how to use them and in the next section we show
 how to upgrade to a newer base image.
@@ -154,13 +172,20 @@ The CLI help shows:
         oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
                                         May be in .tar or .tar.gz format
 
+        Additionally, the following URIs are also supported for setups
+        that do not use a HUB or similar.  Recommend using 'checksum'!
+
+        ftp://addr/path/to/archive   -- Downloaded using wget
+        http://addr/path/to/archive  -- Downloaded using curl
+        https://addr/path/to/archive -- Downloaded using curl
+
         Note: if a remote repository cannot be reached, the creation of the
               container will be put on a queue that retries pull every time
               there is a route change in the host's system.
 
-> **Note::** the built-in help system in the CLI is generated from the
-> YANG model, so the same information is also available for remote
-> NETCONF users.
+> [!TIP]
+> The built-in help system in the CLI is generated from the YANG model,
+> so the same information is also available for remote NETCONF users.
 
 The two most common variants are `docker://` and `oci-archive:/`.
 
@@ -203,40 +228,72 @@ mind.
     -rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
     drwx------    6 frr      frr           4096 Mar 27 11:57 frr/
 
-Importing the image into podman can be done either from the CLI
+Importing the image into Podman can be done either from the CLI
 admin-exec context ...
 
     admin@example:/var/tmp$ cli
     admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge
 
-> By assigning The `name curios:edge` is the tag you give the imported
-> (raw) archive which you can then reference in your container image
-> configuration: `set image curios:edge`.
+> [!TIP]
+> The `name curios:edge` is the tag you give the imported (raw) archive
+> which you can then reference in your container image configuration:
+> `set image curios:edge`.
 
 ... or by giving the container configuration the full path to the OCI
 archive, which helps greatly with container upgrades (see below):
 
     admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz
 
+**Checksum Example:**
+
+    admin@example:/> configure
+    admin@example:/config/> edit container sys
+    admin@example:/config/container/sys/> set hostname sys
+    admin@example:/config/container/sys/> set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
+    admin@example:/config/container/sys/> set checksum
+        md5 sha256 sha512
+    admin@example:/config/container/sys/> set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629
+    admin@example:/config/container/sys/> leave
+    admin@example:/> copy running-config startup-config
+    admin@example:/> show container
+    CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS        PORTS       NAMES
+    b02e945c43c9  localhost/curios-oci-amd64-v24.05.0:latest                              5 seconds ago   Up 5 seconds              sys
+
+    admin@example:/> show log
+    ...
+    Nov 20 07:24:56 infix container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
+    Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
+    Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
+    Nov 20 07:24:57 infix container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
+    Nov 20 07:24:57 infix container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
+    Nov 20 07:24:57 infix container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
+
 
 Upgrading a Container Image
 ---------------------------
+<img align="right" src="img/shield-checkmark.svg" alt="Hello World" width=100>
 
-> **Note:** the default writable layer is lost when upgrading the image.
-> Use named volumes for content that you want to persist across upgrades.
+The applications in your container are an active part of the system as a
+whole, so make it a routine to keep your container images up-to-date!
 
-All container configurations are locked to the image hash at the time of
-first download, not just ones that use an `:edge` or `:latest` tag.  An
-upgrade of containers using versioned images is more obvious -- update
-the configuration to use the new `image:tag` -- the latter is a bit
-trickier.  Either remove the configuration and recreate it (leave/apply
-the changes between), or use the admin-exec level command:
+Containers are created at first setup and at every boot.  If the image
+exists in the file system it is reused -- i.e., an image pulled from a
+remote registry is not fetched again.
+
+To upgrade a versioned image:
+ - update your `running-config` to use the new `image:tag`
+ - `leave` to activate the change, if you are in the CLI
+ - Podman pulls the new image in the background
+ - Your container is recreated with the new image
+ - The container is started
+
+For "unversioned" images, e.g., images using a `:latest` or `:edge` tag,
+use the following CLI command (`NAME` is the name of your container):
 
     admin@example:/> container upgrade NAME
 
-Where `NAME` is the name of your container.  This command stops the
-container, does `container pull IMAGE`, and then recreates it with the
-new image.  Upgraded containers are automatically restarted.
+This stops the container, does `container pull IMAGE`, and recreates it
+with the new image.  Upgraded containers are automatically restarted.
 
 **Example using registry:**
 
@@ -261,12 +318,30 @@ the upgrade command as
 	Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
 	7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52
 
+OCI archives can also be fetched from ftp/http/https URL, in that case
+the upgrade can be done the same way as a registry image (above).
+
+> [!TIP]
+> Containers running from OCI images embedded in the operating system,
+> e.g., `/lib/oci/mycontainer.tar.gz`, always run from the version in
+> the operating system.  To upgrade, install the new container image at
+> build time, after system upgrade the container is also upgraded.  The
+> system unpacks and loads the OCI images into Podman every boot, which
+> ensures the running container always has known starting state.
+>
+> **Example:** default builds of Infix include a couple of OCI images
+> for reference, one is `/lib/oci/curios-nftables-v24.11.0.tar.gz`, but
+> there is also a symlink called `curios-nftables-latest.tar.gz` in the
+> same directory, which is what the Infix regression tests use in the
+> image configuration of the container.  This is what enables easy
+> upgrades of the container along with the system itself.
+
 
 Capabilities
 -------------
 
 An unprivileged container works for almost all use-cases, but there are
-occasions where they are too restricted and users being looking for the
+occasions where they are too restricted and users start looking for the
 `privileged` flag.  Capabilities offers a middle ground.
 
 For example, a system container from which `ping` does not work:
@@ -282,9 +357,9 @@ For example, a system container from which `ping` does not work:
 	...
 
 Infix supports a subset of all [capabilities][6] that are relevant for
-containers.  Please note, that this is and advanced topic and will
-require time and analysis of your container application to figure out
-which capabilities you need.
+containers.  Please note, that this is an advanced topic that require
+time and analysis of your container application to figure out which
+capabilities you need.
 
 
 Networking and Containers
@@ -294,19 +369,31 @@ By default, unlike other systems, persistent[^1] containers have no
 networking enabled.  All network access has to be set up explicitly.
 Currently two types of of container networks are supported:
 
- - `host`: one end of a VETH pair, or a physical Ethernet port
+ - `host`: an managed host interface, e.g., one end of a VETH pair,
+   or even a physical interface
  - `bridge`: an IP masquerading bridge
 
+In the former the interface is delegated to (moved into) the container,
+while in the latter a VETH pair is automatically created by Podman and
+one end delegated to the container, while the other end is assigned to
+the bridge (see the next section).
+
+> [!TIP]
 > For more information on VETH pairs, see the [Networking Guide][0].
 
+
 ### Container Bridge
 
 A container bridge is what most container setups use and users want.
+
+![IP Masquerading Container Bridge](img/cni-bridge-firewall.svg)
+
 The difference from a regular bridge is that the container runtime fully
-manages them -- connecting containers automatically with VETH pairs and
-setting up firewall rules between the host and other containers, as well
-as managing port forwarding.  This transparent background management is
-what makes container use seem to be so simple.
+manages them -- connecting containers with automatically created VETH
+pairs (look at the bridge port names) and setting up firewall rules
+between the host and other containers, as well as managing port
+forwarding.  This transparent background management is what makes
+container use seem to be so simple.
 
 All interface configuration is done in configure context.
 
@@ -324,10 +411,12 @@ have to set manually:
     admin@example:/config/interface/docker0/> set type bridge
     admin@example:/config/interface/docker0/> set container-network type bridge
 
-> **Note:** when doing the same operation over NETCONF there is no
-> inference, so all the "magic" settings needs to be defined.  This
-> makes the CLI very useful for first setup and then extracting the
-> resulting XML from the shell using the `cfg -X` command.
+> [!IMPORTANT]
+> When configuring the system via an API such as NETCONF or RESTCONF, no
+> settings are inferred.  Instead it is up to the caller to fully define
+> the desired setup.  This makes the CLI very useful for first setup and
+> then extracting the resulting XML from the shell using the `cfg -X`
+> command.
 
 We have to declare the interface as a container network, ensuring the
 interface cannot be used by the system for any other purpose.  E.g., a
@@ -394,20 +483,25 @@ namespace of a container[^3].  This of course works with plain Ethernet
 interfaces as well, but here we will use one end of a VETH pair as an
 example.
 
+The network `option` setting is available also for this case, but only
+the `interface_name=foo0` option works.  Which is still very useful.  To
+set:
+
+ - IP address, use IPv4/IPv6 settings in the interface settings
+ - MAC address, to use the `custom-phys-address` in the interface settings
+
+For an example of both, see the next section.
+
 [^3]: Something which the container bridge network type does behind the
     scenes with one end of an automatically created VETH pair.
 
+
 #### Routed Setup
 
 In this routed setup we reserve 192.168.0.0/24 for the network between
 the host and the `ntpd` container.
 
-                                _____________
-                               |             |
-    veth0 .1                   |   .2 eth0   |
-           \   192.168.0.0/24  |  /          |
-            '--------------------'  [ntpd]   |
-                               |_____________|
+![Basic VETH pair connecting ntpd container.](img/cni-ntpd-routed.svg)
 
 Configuration is a straight-forward VETH pair setup where we name the
 container-end of pair `ntpd`.  This is just a convenience for us when
@@ -420,18 +514,23 @@ line where we declare the `ntpd` end as a container network interface:
     admin@example:/config/interface/veth0/> end
     admin@example:/config/> edit interface ntpd
     admin@example:/config/interface/ntpd/> set ipv4 address 192.168.0.2 prefix-length 24
-    admin@example:/config/interface/ntpd/> set phys-address 00:c0:ff:ee:00:01
+    admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
     admin@example:/config/interface/ntpd/> set container-network
 
+> [!TIP]
 > Notice how you can also set a custom MAC address at the same time.
 
 Adding the interface to the container is the same as before, but since
 everything for host interfaces is set up in the interfaces context, we
 can take a bit of a shortcut.
 
-    admin@example:/config/container/ntpd/> set network ntpd
+    admin@example:/config/container/ntpd/> set network interface ntpd
     admin@example:/config/container/ntpd/> leave
 
+> [!TIP]
+> Use the `set network interface ntpd option interface_name=foo0` to set
+> the name of the interface inside the container to `foo0`.
+
 The point of the routed case is that port forwarding from the container
 in this case is limited to a single interface, not *all interfaces* as
 is the default in the masquerading container bridge setup.
@@ -443,21 +542,16 @@ A perhaps more common case is to bridge the other end of the VETH pair
 with other physical ports.  In this section we show how to add a new
 pair to give our container two interfaces:
 
-                              _______________
-                             |               |                     .1 br0
-    veth0 .1                 |   .2 eth0     |                       /   \
-           \  192.168.0.0/24 |  /   eth1 .2  |                 veth1b     e1
-            '------------------'          \  | 192.168.1.0/24  /
-                             |     [ntpd]  '------------------'
-                             |_______________|
+![Bridged setup with ntpd container.](img/cni-ntpd-bridged.svg)
 
 We start by adding the second VETH pair:
 
     admin@example:/config/> edit interface veth1a
-    admin@example:/config/interface/veth1a/> set veth peer veth1b
+    admin@example:/config/interface/veth1a/> set veth peer veth1
     admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24
 
-> The LAN bridge (br0) in this example has IP address 192.168.1.1.
+> [!NOTE]
+> The LAN bridge (br1) in this example has IP address 192.168.1.1.
 
 When a container has multiple host interfaces it can often be useful to
 have a default route installed.  This can be added from the host with a
@@ -473,15 +567,16 @@ have a default route installed.  This can be added from the host with a
 	  }
 	}
 	veth {
-	  peer veth1b;
+	  peer veth1;
 	}
     admin@example:/config/interface/veth1a/> end
-    admin@example:/config/> set interface veth1b bridge-port bridge br0
+    admin@example:/config/> set interface veth1 bridge-port bridge br1
 
 Please note, container network routes require the base interface also
 have a static IP address set.  Setting only the route, but no address,
 means the route is skipped.
 
+
 ### Host Networking
 
 The third use-case is host networking, this is where a container share
@@ -491,7 +586,7 @@ the host operating system.
 
 The host networking setup cannot be combined with any other network.
 
-For an example, see below.
+For an example, [see below](#application-container-nftables).
 
 
 Mounts and Volumes
@@ -507,29 +602,40 @@ file system:
     admin@example:/config/container/system/mount/leds> end
     admin@example:/config/container/system/>
 
-Sometimes *volumes* are a better fit.  A volume is an automatically
+Any type of file can be *bind mounted* into the container, just watch
+out for permissions though.  In the example above, `/sys/class/leds` is
+not writable from a container unless it runs in *privileged* mode.  For
+plain configuration files you get more freedom, and your container can
+rely on, e.g., *inotify* events to trigger reloading its services when
+you change the file on the host.
+
+So it depends on the container, and indeed your overall setup, what to
+use.  An intriguing option is *Content Mounts*, which when changed also
+trigger a container restart.
+
+Other times *volumes* are a better fit.  A volume is an automatically
 created read-writable entity that follows the life of your container.
 
     admin@example:/config/container/ntpd/> set volume varlib target /var/lib
 
-Volumes survive reboots and upgrading of the base image, unlike the
-persistent writable layer you get by default, which does not survive
-upgrades.  The volume is created by podman when the container first
-starts up, unlike a regular bind mount it synchronizes with the contents
-of the underlying container image's path on the first start.  I.e.,
-"bind-mount, if empty: then rsync".
+Volumes are persistent across both reboots and upgrades of the base
+image.  They are created by Podman when the container first starts up,
+unlike a regular bind mount it synchronizes with the contents of the
+underlying container image's path at first use.  I.e., "bind-mount, if
+empty: then rsync".
 
+> [!NOTE]
 > Infix support named volumes (only), and it is not possible to share a
 > volume between containers.  All the tricks possible with volumes may
 > be added in a later release.
 
 ### Content Mounts
 
-Content mount is a special type of where the file contents for the
-container is stored alongside the container configuration.  This can be
-very useful when deploying similar systems at multiple sites.  When the
-host loads its `startup-config` (or even `factory-config`) a temporary
-file is created using the decoded base64 data from the `content` node.
+Content mounts are a special type of file mount where the file contents
+is stored with the container configuration.  This can be very useful
+when deploying similar systems at multiple sites.  When the host loads
+its `startup-config` (or even `factory-config`) a temporary file is
+created using the decoded base64 data from the `content` node.
 
     admin@example:/config/container/ntpd/> edit mount ntpd.conf
     admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
@@ -542,9 +648,10 @@ The editor is a small [Emacs clone called Mg][2], see the built-in help
 text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
 the contents are base64 encoded and stored in the candidate datastore.
 
-> **Note:** since these files are always recreated when the host is
-> restarted, changes made by the container are not preserved, or saved
-> back to the host's startup-config even if the read-only option is off.
+> [!NOTE]
+> Since these files are always recreated when the host is restarted,
+> changes made by the container are not preserved, or saved back to the
+> host's startup-config.
 
 Infix has three different text editors available.  For more information,
 see [CLI Text Editor](cli/text-editor.md).
@@ -566,10 +673,11 @@ we created previously:
     admin@example:/config/container/system/> set publish 222:22
     admin@example:/config/container/system/> leave
 
-> **Note:** ensure you have a network connection to the registry.
-> If the image cannot be pulled, creation of the container will be
-> put in a queue and be retried every time there is a change in the
-> routing table, e.g., default route is added.
+> [!NOTE]
+> Ensure you have a network connection to the registry.  If the image
+> cannot be pulled, creation of the container will be put in a queue and
+> be retried every time there is a change in the routing table, e.g.,
+> default route is added, and every 60 seconds.
 
 Provided the image is downloaded successfully, a new `system` container
 now runs behind the docker0 interface, forwarding container port 22 to
@@ -599,6 +707,17 @@ container ID (hash) is used, but this can be easily changed:
     admin@example:/> container shell system
     root@sys101:/#
 
+In fact, the container `hostname` setting supports the same format
+specifiers as the host's `hostname` setting:
+
+ - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
+ - `%h`: Default hostname, from `/etc/os-release`, from branding
+ - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
+ - `%%`: Literal %
+
+The most useful combination is probably `"container-name-%m"`, which in
+this example give the container hostname `container-name-c0-ff-ee`.
+
 [^1]: this does not apply to the admin-exec command `container run`.
     This command is intended to be used for testing and evaluating
 	container images.  Such containers are given a private network
@@ -626,6 +745,7 @@ Notice how we `set network host`, so the container can see and act on
 all the host's interfaces, and that we also have to run the container
 in *privileged* mode.
 
+
 ### Application Container: ntpd
 
 The default NTP server/client in Infix is Chrony, a fully working and
@@ -673,12 +793,13 @@ Another *insecure* approach is to access the host system directly,
 bypassing the namespaces that make up the boundary between host and
 container.
 
-> **Security:** Please note, this completely demolishes the isolation
-> barrier between container and host operating system.  It is only
-> suitable in situations where the container serves more as a unit of
-> distribution rather than as a separate component of the system.
-> *Strongly recommended* to use this only in trusted setups!  Consider
-> also limiting the time frame in which this is active!
+> [!CAUTION]
+> Please note, this completely demolishes the isolation barrier between
+> container and host operating system.  It is only suitable in
+> situations where the container serves more as a unit of distribution
+> rather than as a separate component of the system.  *Strongly
+> recommended* to use this only in trusted setups!  Consider also
+> limiting the time frame in which this is active!
 
 First, enable *Privileged* mode, this unlocks the door and allows the
 container to manage resources on the host system.  An example is the
@@ -706,18 +827,80 @@ and then asking what the hostname is on the host:
 
 One use-case for this method is when extending Infix with a management
 container that connects to other systems.  For some tips on how to
-control an Infix system this way, see [Scripting Infix](scriptiong.md).
+control an Infix system this way, see [Scripting Infix](scripting.md).
 
 [^2]: The `nsenter` program is available from either the util-linux
     package in Debian/Ubuntu/Mint, or in BusyBox.  Note, however,
 	it may not be enabled by default in BusyBox.
 
 
+Container Requirements
+----------------------
+
+In addition to general [*best practices*][7] for container images, there
+are a few more things to consider when targeting embedded systems:
+
+ - Ensure the image targets the CPU architecture of the target system,  
+   learn more about [Multi-platform Builds][8]
+ - Follow [best practices for naming and tagging][10], e.g., `:latest` vs `:1.0`
+ - Follow [OCI recommendations and layout][9],  
+   learn more about [OCI and Docker Exporters][6]
+
+If the [Docker documentation][11] is not enough, there are plenty of
+[guides online][12] with examples on how to create your own container
+image.  For the more advanced, please see the next section.
+
+
+### Advanced Users
+
+Most people prefer their system containers small, often based on Alpine
+Linux, or similar, with only a few small applications, including their
+own, and an SSH server perhaps.  For some developers, even this is too
+big, so they roll their own from source.  This section is for you.
+
+Depending on your needs, here is a checklist:
+
+ - you need something that can forward signals, e.g.,
+   - [tini][]
+   - [Bash only][13], or
+   - BusyBox init, a classic most embedded developers know, but read on ...
+ - a system container only need the bare necessities of a system bringup
+   - E.g., BusyBox's init, [but not everything][15]
+   - Some of the networking is set up by Podman and CNI for you, but
+     you may want to run a DHCP client?
+   - Do *not* rename interfaces inside the container, use the dedicated
+     `interface_name` option in the configuration instead
+   - Remember, Podman provides a `tmpfs` for all critical system paths:
+     `/dev`, `/dev/shm`, `/run`, `/tmp`, and `/var/tmp`, so you don't
+     need to clean or set up any of these mount points
+
+Examples using `tini` and BusyBox init are available from the KernelKit
+[curiOS project][14].  It is a small Buildroot based container image
+builder that generates OCI compatible image tarballs without any tools
+from Docker or Podman -- ready-made images exist for testing on both
+AMD64 and ARM64 targets, as well as `docker pull` images and and OCI
+tarballs with SHA256 checksums for integrity checking.
+
+Finally, if you build your own version of Infix, and embed OCI tarballs
+in the system image, then see the tip at the end of [Upgrading a
+Container Image](#upgrading-a-container-image) (above).
+
+
 [0]:      networking.md
-[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers%402023-12-14.yang
+[1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers.yang
 [2]:      https://github.com/troglobit/mg
 [3]:      https://github.com/opencontainers/image-spec/blob/main/image-layout.md
 [4]:      system.md#ssh-authorized-key
 [5]:      https://docs.docker.com/build/exporters/oci-docker/
 [6]:      https://man7.org/linux/man-pages/man7/capabilities.7.html
+[7]:      https://docs.docker.com/build/building/best-practices/
+[8]:      https://docs.docker.com/build/building/multi-platform/
+[9]:      https://github.com/opencontainers/image-spec/blob/main/image-layout.md
+[10]:     https://docs.docker.com/get-started/docker-concepts/building-images/build-tag-and-publish-an-image/#tagging-images
+[11]:     https://www.docker.com/blog/multi-arch-images/
+[12]:     https://lemariva.com/blog/2018/05/tutorial-docker-on-embedded-systems-raspberry-pi-beagleboard
+[13]:     https://sirikon.me/posts/0009-pid-1-bash-script-docker-container.html
+[14]:     https://github.com/kernelkit/curiOS/
+[15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
+[tini]:   https://github.com/krallin/tini
 [podman]: https://podman.io

doc/developers-guide.md

@@ -206,20 +206,18 @@ corresponding image for execution with our normal tooling:
 Contributing
 ------------
 
-Infix is built from many parts, when contributing you need to set up
-your own fork, create a local branch for your change, push to your fork,
-and then use GitHub to create a *Pull Reqeuest*.
+Infix is built from many components, when contributing you need to set
+up your own fork, create a local branch for your change, push to your
+fork, and then use GitHub to create a *Pull Reqeuest*.
 
-For this to work as painlessly as possible:
+For this to work as *painlessly as possible* for everyone involved:
 
-  1. Fork Infix to your own user or organization[^1]
-  2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
-     own user or organization as well
-  3. Clone your fork of Infix to your laptop/workstation
-
-If you use a GitHub organization you get the added benefit of having
-local peer reviews of changes before making a pull request to the
-upstream Infix repository.
+ 1. Fork Infix to your own user or organization[^1]
+ 2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
+    own user or organization as well
+ 3. Clone your fork of Infix to your laptop/workstation
+ 4. [Deactivate the Actions][6] you don't want in your fork
+ 5. Please read the [Contributing Guidelines][5] as well!
 
 ```bash
 $ cd ~/Projects
@@ -227,10 +225,10 @@ $ git clone https://github.com/YOUR_USER_NAME/infix.git
 $ cd infix/
 $ git submodule update --init
 ```
-
 > **Note:** when updating/synchronizing with upstream Infix changes you
 > may have to synchronize your forks as well.  GitHub have a `Sync fork`
-> button in the GUI for your fork for this purpose.
+> button in the GUI for your fork for this purpose.  A cronjob on your
+> server of choice can do this for you with the [GitHub CLI tool][7].
 
 [^1]: Organizations should make sure to lock the `main` (or `master`)
     branch of their clones to ensure members do not accidentally merge
@@ -243,3 +241,6 @@ $ git submodule update --init
 [2]: https://github.com/wkz/qeneth
 [3]: https://netopeer.liberouter.org/doc/sysrepo/master/html/dev_guide.html
 [4]: https://buildroot.org/downloads/manual/manual.html#_developer_guide
+[5]: https://github.com/kernelkit/infix/blob/main/.github/CONTRIBUTING.md
+[6]: https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/disabling-and-enabling-a-workflow
+[7]: https://cli.github.com/

doc/discovery.md

@@ -16,14 +16,14 @@ seen in the response.
 
 In the example below, the PC is connected to Infix via interface *tap0*
 (*tap0* is *if1* in Figure 1) and Infix responds with address
-*fe80::ff:fe00:0*.
+*fe80::ff:fec0:ffed*.
 
 ```
 linux-pc:# ping -6 -L -c 3 ff02::1%tap0
 PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
-64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=1 ttl=64 time=0.558 ms
-64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=2 ttl=64 time=0.419 ms
-64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=3 ttl=64 time=0.389 ms
+64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=1 ttl=64 time=0.558 ms
+64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=2 ttl=64 time=0.419 ms
+64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=3 ttl=64 time=0.389 ms
 
 --- ff02::1%tap0 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2043ms
@@ -34,9 +34,9 @@ linux-pc:#
 The PC could connect then connect to Infix, e.g., using SSH.
 
 ```
-linux-pc:# ssh admin@fe80::ff:fe00:0%tap0
-admin@fe80::ff:fe00:0%tap0's password: admin
-admin@infix-00-00-00:~$ 
+linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
+admin@fe80::ff:fec0:ffed%tap0's password: admin
+admin@infix-c0-ff-ee:~$ 
 ```
 
 ## Discovery mechanisms available in Infix
@@ -55,18 +55,18 @@ linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:51:52.061071 LLDP, length 193
     Chassis ID TLV (1), length 7
-      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
+      Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
     Port ID TLV (2), length 7
-      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
+      Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
     Time to Live TLV (3), length 2: TTL 120s
-    System Name TLV (5), length 14: infix-00-00-00
+    System Name TLV (5), length 14: infix-c0-ff-ee
     System Description TLV (6), length 91
       Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
     System Capabilities TLV (7), length 4
       System  Capabilities [Bridge, WLAN AP, Router, Station Only] (0x009c)
       Enabled Capabilities [Station Only] (0x0080)
     Management Address TLV (8), length 24
-      Management Address length 17, AFI IPv6 (2): fe80::ff:fe00:0
+      Management Address length 17, AFI IPv6 (2): fe80::ff:fec0:ffed
       Interface Index Interface Numbering (2): 2
     Port Description TLV (4), length 4: eth0
     Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
@@ -97,11 +97,11 @@ linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:46:07.908665 LLDP, length 207
     Chassis ID TLV (1), length 7
-      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
+      Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
     Port ID TLV (2), length 7
-      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
+      Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
     Time to Live TLV (3), length 2: TTL 120s
-    System Name TLV (5), length 14: infix-00-00-00
+    System Name TLV (5), length 14: infix-c0-ff-ee
     System Description TLV (6), length 91
       Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
     System Capabilities TLV (7), length 4
@@ -134,6 +134,15 @@ linux-pc:#
     (LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
     is handy to sniff and display LLDP packets.
 
+The LLDP service can be disabled using the following commands.
+
+```
+admin@infix-c0-ff-ee:/> configure
+admin@infix-c0-ff-ee:/config/> no lldp 
+admin@infix-c0-ff-ee:/config/> leave
+admin@infix-c0-ff-ee:/> 
+```
+
 ### mDNS
 
 DNS-SD/mDNS can be used to discover Infix units and services. Infix
@@ -144,33 +153,138 @@ be used to search for devices advertising their services via mDNS.
 
 ```
 linux-pc:# avahi-browse -ar
-+   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
-+   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
-+   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
-+   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
-=   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
-   hostname = [infix-00-00-00.local]
++   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
++   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
++   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
++   tap0 IPv4 infix-c0-ff-ee                                SSH Remote Terminal  local
+=   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
+   hostname = [infix-c0-ff-ee.local]
    address = [10.0.1.1]
    port = [22]
    txt = []
-=   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
-   hostname = [infix-00-00-00.local]
+=   tap0 IPv4 infix-c0-ff-ee                                SSH Remote Terminal  local
+   hostname = [infix-c0-ff-ee.local]
    address = [10.0.1.1]
    port = [22]
    txt = []
-=   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
-   hostname = [infix-00-00-00.local]
-   address = [fe80::ff:fe00:0]
+=   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
+   hostname = [infix-c0-ff-ee.local]
+   address = [fe80::ff:fec0:ffed]
    port = [22]
    txt = []
-=   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
-   hostname = [infix-00-00-00.local]
-   address = [fe80::ff:fe00:0]
+=   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
+   hostname = [infix-c0-ff-ee.local]
+   address = [fe80::ff:fec0:ffed]
    port = [22]
    txt = []
 ^C
 linux-pc:#
 ```
+
+Additionally, *avahi-resolve-host-name* can be used to verify domain
+name mappings for IP addresses. By default, it translates from IPv4
+addresses. This function allows users to confirm that addresses are
+mapped correctly.
+
+```
+linux-pc:# avahi-resolve-host-name infix-c0-ff-ee.local
+infix-c0-ff-ee.local	10.0.1.1
+linux-pc:#
+```
+
+Thanks to mDNS we can use the advertised name instead of the IP
+address for operations like `ping` and `ssh` as shown below:
+
+```
+linux-pc:# ping infix-c0-ff-ee.local -c 3
+PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
+64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.852 ms
+64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=1.12 ms
+64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.35 ms
+
+--- infix-c0-ff-ee.local ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2003ms
+rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
+
+linux-pc:# ssh admin@infix-c0-ff-ee.local
+(admin@infix-c0-ff-ee.local) Password: 
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.org
+'-'---'-
+
+Run the command 'cli' for interactive OAM
+
+linux-pc:#
+```
+
+To disable mDNS/mDNS-SD, type the commands:
+```
+admin@infix-c0-ff-ee:/> configure 
+admin@infix-c0-ff-ee:/config/> no mdns
+admin@infix-c0-ff-ee:/config/> leave
+```
+
+#### Human-Friendly Hostname Alias
+
+Each Infix unit will advertise itself as *infix.local*, in addition to
+its full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This
+alias works seamlessly on a network with a single Infix device, and
+makes it easy to connect when the exact hostname is not known in
+advance. The examples below show how the alias can be used for
+actions such as pinging or establishing an SSH connection:
+
+```
+linux-pc:# ping infix.local -c 3
+PING infix.local (10.0.1.1) 56(84) bytes of data.
+64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.751 ms
+64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=2.28 ms
+64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.42 ms
+
+--- infix.local ping statistics ---
+3 packets transmitted, 3 received, 0% packet loss, time 2003ms
+rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
+
+linux-pc:# ssh admin@infix.local
+(admin@infix.local) Password: 
+.-------.
+|  . .  | Infix -- a Network Operating System
+|-. v .-| https://kernelkit.org
+'-'---'-
+
+Run the command 'cli' for interactive OAM
+
+linux-pc:#
+```
+
+When multiple Infix devices are present on the LAN the alias will not
+uniquely identify a device; *infix.local* will refer to any of the
+Infix devices, likely the one that first appeared.
+
+> When multiple Infix units are present, use the full hostname (e.g.,
+> *infix-c0-ff-ee.local* or *foo.local*) rather than the alias
+> infix.local to deterministically connect to a unit.
+
+
+#### Netbrowse service to find all your devices
+
+Another mDNS alias that all Infix devices can advertise is
+*network.local*. This is a web service which basically runs avahi-browse
+and displays a table of other Infix devices and their services. 
+
+![Netbrowse Service - network.local](img/network-local.png)
+
+With multiple Infix devices on the LAN, one will be your portal to
+access all others, if it goes down another will take its place.
+
+To disable the netbrowse service, the following commands can be used:
+```
+admin@infix-c0-ff-ee:/> configure 
+admin@infix-c0-ff-ee:/config/> edit web
+admin@infix-c0-ff-ee:/config/web/> no netbrowse
+admin@infix-c0-ff-ee:/config/web/> leave
+```
+
 [^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
     tool for scanning for mDNS/DNS-SD published services on the local
     network

doc/introduction.md

@@ -15,7 +15,8 @@ managing entire fleets of installed equipment.
 Nevertheless, when it comes to initial deployment and debugging, it
 is very useful to know how to navigate and use the CLI.
 
-> Proceed to the [CLI User Guide](cli/tutorial.md).
+> Proceed to the [CLI Introduction](cli/introduction.md) or [CLI
+> Configuration Tutorial](cli/configure.md).
 
 
 ## Key Concepts
@@ -62,9 +63,11 @@ The system has several datastores (or files):
    configure context.  Any changes made here can be discarded (`abort`,
    `rollback`) or committed (`commit`, `leave`) to `running-config`.
 
-> See the [Branding & Releases](branding.md) for information on how
-> `factory-config` and `failure-config` can be adapted to different
-> customer requirements.
+> Please see the [Branding & Releases](branding.md) document for more
+> in-depth information on how `factory-config` and `failure-config` can
+> be adapted to different customer requirements.  Including how you can
+> override the generated versions of these files with plain per-product
+> ones -- this may even protect against some of the failure modes below.
 
 
 ## System Boot
@@ -90,7 +93,8 @@ password in VPD, are detailed later in this section.
     there is a working fail safe, or rather *fail secure*, mode
  4. On first power-on, and after a factory reset, the system does not
     have a `startup-config`, in which case `factory-config` is copied
-    to `startup-config`
+    to `startup-config` -- if a per-product specific version exists it
+    is preferred over the generated one
  5. Provided the integrity of the `startup-config` is OK, a system
     service loads and activates the configuration
 
@@ -123,13 +127,17 @@ syntax, failed validation against the system's YANG model, or a bug in
 the system's `confd` service, the *Fail Secure Mode* is triggered and
 `failure-config` is loaded (unless VPD Failure, see above).
 
+> Again, please see the [Branding & Releases](branding.md) document for
+> how to provide a per-product hard-coded `failure-config` to suit your
+> products preferences.
+
 *Fail Secure Mode* is a fail-safe mode provided for debugging the
-system.  The default[^3] is isolated interfaces with communication only to
-the management CPU, SSH and console login using the device's factory
-reset password, IP connectivity only using IPv6 link-local, and device
-discovery protocols: LLDP, mDNS-SD.  The login and shell prompt are set
-to `failure-c0-ff-ee`, the last three octets of the device's base MAC
-address.
+system.  The default[^3] creates a setup of isolated interfaces with
+communication only to the management CPU, SSH and console login using
+the device's factory reset password, IP connectivity only using IPv6
+link-local, and device discovery protocols: LLDP, mDNS-SD.  The login
+and shell prompt are set to `failure-c0-ff-ee`, the last three octets of
+the device's base MAC address.
 
 [^1]: YANG is a modeling language from IETF, replacing that used for
     SNMP (MIB), used to describe the subsystems and properties of

doc/networking.md

@@ -7,25 +7,55 @@ model forms the base, extended with [ietf-ip.yang][2] and other layer-3
 IETF models.  The layer-2 bridge and aggregate models are defined by
 Infix to exploit the unique features not available in IEEE models.
 
-> **Note:** when issuing `leave` to activate your changes, remember to
-> also save your settings, `copy running-config startup-config`.  See
-> the [CLI Introduction](cli/introduction.md) for a background.
+> [!IMPORTANT]
+> When issuing `leave` to activate your changes, remember to also save
+> your settings, `copy running-config startup-config`.  See the [CLI
+> Introduction](cli/introduction.md) for a background.
 
 
 ## Interface LEGO®
 
+The network building blocks available in Linux are akin to the popular
+LEGO® bricks.
+
 ![Linux Networking Blocks](img/lego.svg)
 
+There are two types of relationships that can link two blocks together:
+
+  1. **Lower-to-upper**: Visually represented by an extruding square
+     connected upwards to a square socket.  An interface _can only have
+     a single_ lower-to-upper relationship, i.e., it can be attached to
+     a single upper interface like a bridge or a LAG.  In `iproute2`
+     parlance, this corresponds to the interface's `master` setting
+  2. **Upper-to-lower**: Visually represented by an extruding semicircle
+     connected downwards to a semicircle socket.  The lower interface in
+     these relationships _accepts multiple_ upper-to-lower relationships
+     from different upper blocks.  E.g., multiple VLANs and IP address
+     blocks can be connected to the same lower interface
+
+![Stacking order dependencies](img/lego-relations.svg)
+
+An interface may simultaneously have a _lower-to-upper_ relation to some
+other interface, and be the target of one or more _upper-to-lower_
+relationships.  It is valid, for example, for a physical port to be
+attached to a bridge, but also have a VLAN interface stacked on top of
+it.  In this example, traffic assigned to the VLAN in question would be
+diverted to the VLAN interface before entering the bridge, while all
+other traffic would be bridged as usual.
+
 | **Type** | **Yang Model**             | **Description**                                               |
-| -------- | -----------------          | ------------------------------------------------------------- |
+|----------|----------------------------|---------------------------------------------------------------|
 | bridge   | infix-if-bridge            | SW implementation of an IEEE 802.1Q bridge                    |
 | ip       | ietf-ip, infix-ip          | IP address to the subordinate interface                       |
 | vlan     | infix-if-vlan              | Capture all traffic belonging to a specific 802.1Q VID        |
 | lag[^1]  | infix-if-lag               | Bonds multiple interfaces into one, creating a link aggregate |
 | lo       | ietf-interfaces            | Software loopback interface                                   |
-| eth      | ietf-interfaces,           | Physical Ethernet device/port                                 |
-|          | ieee802-ethernet-interface |                                                               |
+| eth      | ieee802-ethernet-interface | Physical Ethernet device/port.                                |
+|          | infix-ethernet-interface   |                                                               |
 | veth     | infix-if-veth              | Virtual Ethernet pair, typically one end is in a container    |
+| *common* | ietf-interfaces,           | Properties common to all interface types                      |
+|          | infix-interfaces           |                                                               |
+
 
 ## Data Plane
 
@@ -50,6 +80,70 @@ possible to share with a container.  Meaning, all the building blocks
 used on the left hand side can also be used freely on the right hand
 side as well.
 
+
+### General
+
+General interface settings include `type`, `enable`, custom MAC address,
+and text `description`.  Other settings have their own sections, below.
+
+The `type` is important to set when configuring devices remotely because
+unlike the CLI, a NETCONF or RESTCONF session cannot guess the interface
+type for you.  The operating system provides an override of the
+available interface types.
+
+An `enabled` interface can be inspected using the operational datastore,
+nodes `admin-state` and `oper-state` show the status, .  Possible values
+are listed in the YANG model.
+
+The `custom-phys-address` can be used to set an interface's MAC address.
+This is an extension to the ietf-interfaces YANG model, which defines
+`phys-address` as read-only[^4].  The following shows the different
+configuration options.
+
+The `description` is saved as Linux `ifalias` on an interface.  It is a
+free-form string, useful for describing purpose or just adding comments
+for remote debugging, e.g., using the operational datastore.
+
+> [!CAUTION]
+> There is no validation or safety checks performed by the system when
+> using `custom-phys-address`.  In particular the `offset` variant can
+> be dangerous to use -- pay attention to the meaning of bits in the
+> upper-most octet: local bit, multicast/group, etc.
+
+#### Fixed custom MAC
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address static 00:ab:00:11:22:33
+
+=> 00:ab:00:11:22:33
+```
+
+#### Chassis MAC
+
+Chassis MAC, sometimes also referred to as base MAC.  In these two
+examples it is `00:53:00:c0:ff:ee`.
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address chassis
+
+=> 00:53:00:c0:ff:ee
+```
+
+#### Chassis MAC, with offset
+
+When constructing a derived address it is recommended to set the locally
+administered bit.  Same chassis MAC as before.
+
+```
+admin@example:/config/> edit interface veth0a
+admin@example:/config/interface/veth0a/> set custom-phys-address chassis offset 02:00:00:00:00:02
+
+=> 02:53:00:c0:ff:f0
+```
+
+
 ### Bridging
 
 This is the most central part of the system.  A bridge is a switch, and
@@ -57,6 +151,8 @@ a switch is a bridge.  In Linux, setting up a bridge with ports
 connected to physical switch fabric, means you manage the actual switch
 fabric!
 
+#### MAC Bridge
+
 In Infix ports are by default not switch ports, unless the customer
 specific factory config sets it up this way.  To enable switching
 between ports you create a bridge and then add ports to that
@@ -73,11 +169,21 @@ admin@example:/config/> leave
 
 Here we add two ports to bridge `br0`: `eth0` and `eth1`.
 
-> **Note:** Infix has many built-in helpers controlled by convention.
-> E.g., if you name your bridge `brN`, where `N` is a number, Infix sets
-> the interface type automatically and unlocks all bridge features.
-> Other "magic" names are `ethN.M` for VLAN M on top of `ethN`, or
-> `dockerN` to create an IP masquerading container bridge.
+> [!TIP]
+> Infix has many built-in helpers controlled by convention.  Example,
+> naming your bridge `brN`, where `N` is a number, hints Infix to set
+> interface type automatically and unlocks all bridge features.  Other
+> "magic" names are `vethNA`, where `N` is a number and `A` is a letter
+> ('a' for access port and 'b' for bridge side is common), and `ethN.M`
+> for VLAN M on top of `ethN`, or `dockerN` to create an IP masquerading
+> container bridge.
+
+![A MAC bridge with two ports](img/mac-bridge.svg)
+
+It is possible to create multiple MAC bridges, however, it is
+currently[^5] _not recommended_ to use more than one MAC bridge on
+products with Marvell LinkStreet switching ASICs. A VLAN filtering
+bridge should be used instead.
 
 #### VLAN Filtering Bridge
 
@@ -92,7 +198,7 @@ admin@example:/config/> edit interface br0
 admin@example:/config/interface/br0/> up
 admin@example:/config/> set interface eth0 bridge-port bridge br0
 admin@example:/config/> set interface eth0 bridge-port pvid 10
-admin@example:/config interface eth1 bridge-port bridge br0
+admin@example:/config/> set interface eth1 bridge-port bridge br0
 admin@example:/config/> set interface eth1 bridge-port pvid 20
 admin@example:/config/> edit interface br0
 admin@example:/config/interface/br0/> set bridge vlans vlan 10 untagged eth0
@@ -103,6 +209,8 @@ This sets `eth0` as an untagged member of VLAN 10 and `eth1` as an
 untagged member of VLAN 20.  Switching between these ports is thus
 prohibited.
 
+![A VLAN bridge with two VLANs](img/vlan-bridge.svg)
+
 To terminate a VLAN in the switch itself, either for switch management
 or for routing, the bridge must become a (tagged) member of the VLAN.
 
@@ -111,9 +219,16 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 10 tagged br0
 admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
 ```
 
-> To route or to manage via a VLAN, a VLAN interface needs to be created
-> on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
-> below for more on this topic.
+To route or to manage via a VLAN, a VLAN interface needs to be created
+on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
+below for more on this topic.
+
+> [!NOTE]
+> In some use-cases only a single management VLAN on the bridge is used.
+> For the example above, if the bridge itself is an untagged member only
+> in VLAN 10, IP addresses can be set directly on the bridge without the
+> need for dedicated VLAN interfaces on top of the bridge.
+
 
 #### Multicast Filtering and Snooping
 
@@ -123,10 +238,11 @@ also supports "snooping", i.e., IGMP and MLD, to automatically reduce
 the broadcast effects of multicast.  See the next section for a summary
 of the [terminology used](#terminology--abbreviations).
 
-> **Note:** currently there is no way to just enable multicast filtering
-> without also enabling snooping.  This may change in the future, in
-> which case a `filtering` enabled setting will be made available along
-> with the existing `snooping` setting.
+> [!IMPORTANT]
+> Currently there is no way to just enable multicast filtering without
+> also enabling snooping.  This may change in the future, in which case
+> a `filtering` enabled setting will be made available along with the
+> existing `snooping` setting.
 
 When creating your bridge you must decide if you need a VLAN filtering
 bridge or a plain bridge (see previous section).  Multicast filtering is
@@ -266,19 +382,52 @@ an IGMP/MLD fast-leave port.
    tables shown above, a *None* timeout is declared when the current
    device is the active querier
 
-> **Note:** the reason why multicast flooding is enabled by default is
-> to ensure safe co-existence with MAC multicast, which is very common
-> in industrial networks.  It also allows end devices that do not know
-> of IGMP/MLD to communicate over multicast as long as the group they
-> have chosen is not used by other IGMP/MLD aware devices on the LAN.
+> [!TIP]
+> The reason why multicast flooding is enabled by default is to ensure
+> safe co-existence with MAC multicast, which is common in industrial
+> networks.  It also allows end devices that do not know of IGMP/MLD to
+> communicate over multicast as long as the group they have chosen is
+> not used by other IGMP/MLD aware devices on the LAN.
 >
 > As soon as an IGMP/MLD membership report to "join" a group is received
-> the group is added to the MDB and forwarding to other ports stop.  The
-> only exception to this rule is multicast router ports.
+> the group is added to the kernel MDB and forwarding to other ports
+> stop.  The only exception to this rule is multicast router ports.
+>
+> If your MAC multicast forwarding is not working properly, it may be
+> because an IP multicast group maps to the same MAC address.  Please
+> see [RFC 1112][RFC1112] for details.  Use static multicast router
+> ports, or static multicast MAC filters, to mitigate.
 
+[RFC1112]: https://www.rfc-editor.org/rfc/rfc1112.html
 [RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
 [RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html
 
+#### Forwarding of IEEE Reserved Group Addresses
+
+Addresses in range `01:80:C2:00:00:0X` are used by various bridge
+signaling protocols, and are not forwarded by default. Still, it is
+sometimes useful to let the bridge forward such packets, and Infix
+supports this by specifying protocol names or the last address
+*nibble* as decimal value `0..15`.
+
+```
+admin@example:/config/> edit interface br0 bridge
+admin@example:/config/interface/br0/bridge/> set ieee-group-forward <?>
+  [0..15]  List of IEEE link-local protocols to forward, e.g., STP, LLDP
+  dot1x    802.1X Port-Based Network Access Control.
+  lacp     802.3 Slow Protocols, e.g., LACP.
+  lldp     802.1AB Link Layer Discovery Protocol (LLDP).
+  stp      Spanning Tree (STP/RSPT/MSTP).
+admin@example:/config/interface/br0/bridge/> set ieee-group-forward
+```
+
+The following example configures bridge *br0* to forward LLDP packets.
+
+```
+admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
+admin@example:/config/interface/br0/bridge/>
+```
+
 ### VLAN Interfaces
 
 Creating a VLAN can be done in many ways. This section assumes VLAN
@@ -321,7 +470,9 @@ As conventions, a VLAN interface for VID 20 on top of an Ethernet
 interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
 top of a bridge interface *br0* is named *vlan10*.
 
-> **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.
+> [!NOTE]
+> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
+> number, Infix will set the interface type automatically for you.
 
 
 ### Physical Ethernet Interfaces
@@ -329,7 +480,7 @@ top of a bridge interface *br0* is named *vlan10*.
 #### Ethernet Settings and Status
 
 Physical Ethernet interfaces provide low-level settings for speed/duplex as
-well as packet status and statistics (*ieee802-ethernet-interface.yang*).
+well as packet status and [statistics](#ethernet-statistics).
 
 By default, Ethernet interfaces defaults to auto-negotiating
 speed/duplex modes, advertising all speed and duplex modes available.
@@ -380,9 +531,10 @@ Auto-negotiation of speed/duplex mode is desired in almost all
 use-cases, but it is possible to disable auto-negotiation and specify
 a fixed speed and duplex mode.
 
-> If setting a fixed speed and duplex mode, ensure both sides of the
-> link have matching configuration. If speed does not match, the link
-> will not come up. If duplex mode does not match, the result is
+> [!IMPORTANT]
+> When setting a fixed speed and duplex mode, ensure both sides of the
+> link have matching configuration.  If speed does not match, the link
+> will not come up.  If duplex mode does not match, the result is
 > reported collisions and/or bad throughput.
 
 The example below configures port eth3 to fixed speed 100 Mbit/s
@@ -411,7 +563,7 @@ require auto-negotiation to be enabled.
 
 #### Ethernet statistics
 
-Ethernet packet statistics can be listed as shown below.
+Ethernet packet statistics[^6] can be listed as shown below.
 
 ```
 admin@example:/> show interfaces name eth1
@@ -475,9 +627,10 @@ interfaces {
 admin@example:/config/>
 ```
 
-> **Note:** this is another example of the automatic inference of the
-> interface type from the name.  Any name can be used, but then you have
-> to set the interface type to `veth` manually.
+> [!TIP]
+> This is another example of the automatic inference of the interface
+> type from the name.  Any name can be used, but then you have to set
+> the interface type to `veth` manually.
 
 
 ## Management Plane
@@ -499,6 +652,10 @@ Multiple address assignment methods are available:
 | link-local | infix-ip          | Auto-assignment of IPv4 address in 169.254.x.x/16 range        |
 | dhcp       | infix-dhcp-client | Assignment of IPv4 address by DHCP server, e.g., *10.0.1.1/24* |
 
+> [!NOTE]
+> The DHCP address method is only available for *LAN* interfaces
+> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
+
 Supported DHCP (request) options, configurability (Cfg) and defaults,
 are listed below.  Configurable options can be disabled on a per client
 interface basis, some options, like `clientid` and option 81, are
@@ -524,8 +681,17 @@ possible to set the value of as well.
 **Default:** `router`, `dns`, `domain`, `broadcast`, `ntpsrv`, `search`,
              `address`, `staticroutes`, `msstaticroutes`
 
-> **Note:** DHCP address method is only available for *LAN* interfaces
-> (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)
+When configuring a DHCP client, ensure that the NTP client is enabled
+for the `ntpsrv` DHCP option to be processed correctly. If the NTP
+client is not enabled, any NTP servers provided by the DHCP server will
+be ignored. For details on how to enable the NTP client, see the 
+[NTP Client Configuration](system.md#ntp-client-configuration) section.
+
+> [!IMPORTANT]
+> Per [RFC3442][4], if the DHCP server returns both a Classless Static
+> Routes option (121) and Router option (3), the DHCP client *must*
+> ignore the latter.
+
 
 ### IPv6 Address Assignment
 
@@ -744,7 +910,7 @@ have changed type to *random*.
 ### IPv4 forwarding
 
 To be able to route (static or dynamic) on the interface it is
-required to enable forwarding. This setting controlls if packets
+required to enable forwarding. This setting controls if packets
 received on this interface can be forwarded.
    ```
    admin@example:/config/> edit interface eth0
@@ -760,12 +926,12 @@ This flag behaves totally different than for IPv4. For IPv6 the
 ability to route between interfaces is always enabled, instead this
 flag controls if the interface will be in host/router mode.
 
-| **Feature**                               | **Forward enabled** | **Forward disabled** |
-|:------------------------------------------|:--------------------|:---------------------|
-| IsRouter set in Neighbour Advertisements. | Yes                 | No                   |
-| Transmit Router Solicitations.            | No                  | Yes                  |
-| Router Advertisements are ignored         | No                  | Yes                  |
-| Accept Redirects                          | No                  | Yes                  |
+| **Feature**                              | **Forward enabled** | **Forward disabled** |
+|:-----------------------------------------|:--------------------|:---------------------|
+| IsRouter set in Neighbour Advertisements | Yes                 | No                   |
+| Transmit Router Solicitations            | No                  | Yes                  |
+| Router Advertisements are ignored        | No                  | Yes                  |
+| Accept Redirects                         | No                  | Yes                  |
 
    ```
    admin@example:/config/> edit interface eth0
@@ -791,9 +957,10 @@ The base model, ietf-routing, is where all the other models hook in.  It
 is used to set configuration and read operational status (RIB tables) in
 the other models.
 
-> **Note:** the standard IETF routing models allows multiple instances,
-> but Infix currently *only support one instance* per routing protocol!
-> In the examples presented here, the instance name `default` is used.
+> [!NOTE]
+> The standard IETF routing models allows multiple instances, but Infix
+> currently *only support one instance* per routing protocol!  In the
+> examples presented here, the instance name `default` is used.
 
 
 ### IPv4 Static routes
@@ -819,6 +986,7 @@ router 192.168.1.1, using the highest possible distance:
     admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
     admin@example:/>
 
+> [!TIP]
 > Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
 > interfaces you want to route between.
 
@@ -842,6 +1010,7 @@ enable OSPF and set one active interface in area 0:
     admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
     admin@example:/>
 
+> [!TIP]
 > Remember to enable [IPv4 forwarding](#IPv4-forwarding) for all the
 > interfaces you want to route between.
 
@@ -896,6 +1065,38 @@ an Ethernet interface can be done as follows.
     admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
     admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>
 
+#### OSPF global settings
+
+In addition to *area* and *interface* specific settings, OSPF provides
+global settings for route redistribution and OSPF router identifier.
+
+```
+admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
+admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set ?
+  area                     List of OSPF areas.
+  default-route-advertise  Distribute default route to network
+  explicit-router-id       Defined in RFC 2328.  A 32-bit number
+  redistribute             Redistribute protocols into OSPF
+admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set
+```
+
+- Explicit router ID: By default the router will pick an IP address
+  from one of its OSPF interfaces as OSPF router ID. An explicit ID is
+  used to get a deterministic behavior, e.g., `set explicit-router-id
+  1.1.1.1`.
+- Redistribution: `set redistribute static` and `set redistribute connected`
+  can be used to include static or connected routes into the OSPF routing
+  domain. These routes are redistributed as *external type-2* (E2)
+  routes.
+- Advertising default route: An OSPF router can be made to distribute
+  a default route into the OSPF domain by command `set
+  default-route-advertise enabled`. This route is distributed as long
+  as the router itself has an *active* default route in its routing
+  table. By adding command `set default-route-advertise always` the
+  router will distribute a default route even when it lacks a default
+  route. The default route will be distributed as an *external type-2*
+  (E2) route.
+
 
 #### Debug OSPFv2
 
@@ -967,7 +1168,7 @@ This CLI example show the IPv6 routing table.
 
 #### Route Preference
 
-The operating system leverages FRRouting ([Frr][4]) as routing engine
+The operating system leverages FRRouting ([Frr][0]) as routing engine
 for both static and dynamic routing.  Even routes injected from a DHCP
 client, and IPv4 link-local (IPv4) routes, are injected into Frr to let
 it weigh all routes before installing them into the kernel routing table
@@ -998,10 +1199,11 @@ different next-hop, learned from a DHCP server wins over an OSPF route.
 The distance used for static routes and DHCP routes can be changed by
 setting a different *routing preference* value.
 
-> **Note:** the kernel metric is an unsigned 32-bit value, which is read
-> by Frr as (upper) 8 bits distance and 24 bits metric.  But it does not
-> write it back to the kernel FIB this way, only selected routes are
-> candidates to be installed in the FIB by Frr.
+> [!NOTE]
+> The kernel metric is an unsigned 32-bit value, which is read by Frr as
+> (upper) 8 bits distance and 24 bits metric.  But it does not write it
+> back to the kernel FIB this way, only selected routes are candidates
+> to be installed in the FIB by Frr.
 
 
 #### Source protocol
@@ -1021,7 +1223,8 @@ currently supported, namely `ipv4` and `ipv6`.
 [1]: https://www.rfc-editor.org/rfc/rfc8343
 [2]: https://www.rfc-editor.org/rfc/rfc8344
 [3]: https://www.rfc-editor.org/rfc/rfc8981
-[4]: https://frrouting.org/
+[4]: https://www.rfc-editor.org/rfc/rfc3442
+[0]: https://frrouting.org/
 
 [^1]: Please note, link aggregates are not yet supported in Infix.
 [^2]: Link-local IPv6 addresses are implicitly enabled when enabling
@@ -1031,3 +1234,14 @@ currently supported, namely `ipv4` and `ipv6`.
     mapping the low-order 23-bits of the IP address in the low-order 23
     bits of the Ethernet address 01:00:5E:00:00:00.  Meaning, more than
 	one IP multicast group maps to the same MAC multicast group.
+[^4]: A YANG deviation was previously used to make it possible to set
+    `phys-address`, but this has been replaced with the more flexible
+	`custom-phys-address`.
+[^5]: Infix MAC bridges on Marvell Linkstreet devices are currently
+    limited to use a single MAC database, causing issues if the same
+    MAC address appears on different MAC bridges.
+[^6]: Ethernet counters are described in
+    *ieee802-ethernet-interface.yang* and
+    *infix-ethernet-interface.yang*. [Ethernet
+    Counters](eth-counters.md) page provides additional details on
+    statistics support.

doc/qos.md

@@ -12,14 +12,6 @@ packets to drop and which ones to prioritize, such that critical
 services remain operational.
 
 
-## Software Forwarded Traffic
-
-For packets which are processed by a CPU, i.e. typically routed
-traffic, and bridged traffic between interfaces that do not belong to
-the same hardware switching domain, an [nftables container][1] can be
-used to define a QoS policy.
-
-
 ## Hardware Forwarded Traffic
 
 The default QoS policy for flows which are offloaded to a switching
@@ -34,6 +26,14 @@ chips in this family where limited to 4 output queues per port, this
 documentation is _only_ valid for newer generations with 8 output
 queues per port.
 
+![Hardware offloading for Marvell Link Street](img/qos-hw-mvls.svg)
+
+The picture illustrates packets having their priority determined at
+ingress, here interface _e1_ and _e3_. In this example, both packets
+are forwarded to the same outgoing interface (_e2_), subject to output
+queueing. The sections below provides more information on these
+topics. 
+
 #### Default Policy
 
 ##### Queueing
@@ -54,8 +54,8 @@ significant bits of the DSCP is used to select the queue:
 |   6 | 48-55 | ⇒ |     6 |     25 |
 |   7 | 56-63 | ⇒ |     7 |     33 |
 
-For packets containing both a VLAN tag and an IP header, DSCP priority
-takes precedence over PCP priority. In cases where neither are
+For packets containing both a VLAN tag and an IP header, PCP priority
+takes precedence over DSCP priority. In cases where neither are
 available, packets are always assigned to queue 0.
 
 Each port's set of 8 egress queues operate on a Weighted Round Robin
@@ -73,6 +73,41 @@ set to the 3 most significant bits of it. If no priority information
 is available in the frame on ingress (i.e. untagged non-IP), then
 packets will egress out of tagged ports with PCP set to 0.
 
+## Software Forwarded Traffic
+
+For packets which are processed by a CPU, i.e. typically routed
+traffic, and bridged traffic between interfaces that do not belong to
+the same hardware switching domain, an [nftables container][1] can be
+used to define a QoS policy.
+
+For VLAN interfaces, Infix provides support for mapping the Priority
+Code Point (PCP) to internal priority on ingress, and the reverse on
+egress. 
+
+![Ingress and Egress Priority mapping for VLAN interfaces](img/qos-vlan-iface.svg)
+
+
+These `ingress-qos` and `egress-qos` settings are done per VLAN, both
+defaulting to '0'. The example below shows how to keep the PCP priority 
+for packets being routed between two VLAN interfaces.
+
+```
+admin@example:/config/> edit interface e1.10
+admin@example:/config/interface/e1.10/> set vlan ingress-qos priority from-pcp 
+admin@example:/config/interface/e1.10/> up
+admin@example:/config/> edit interface e1.20
+admin@example:/config/interface/e1.20/> set vlan egress-qos pcp from-priority 
+admin@example:/config/interface/e1.20/> leave
+admin@example:/> 
+```
+
+## A complex example
+
+The picture below shows a packet flow being subject both to software
+forwarding and hardware offloading.
+
+![Hardware and Software QoS Handling](img/qos-complex.svg)
+
 
 [1]: container.md#application-container-nftables
 [2]: https://en.wikipedia.org/wiki/IEEE_802.1Q

doc/scripting.md

@@ -653,6 +653,70 @@ on interface *e0*.
 ~$ 
 ```
 
+### Change a Binary Setting
+
+A YANG `binary` type setting is Base64 encoded and requires a little bit
+more tricks.  We take the opportunity to showcase a shell script helper:
+`/usr/bin/text-editor`, which works just like the `text-editor` command
+in the CLI, but this one takes an XPath argument to the binary leaf to
+edit.
+
+Stripped down, it looks something like this:
+
+```bash
+if tmp=$(sysrepocfg -G "$xpath"); then
+    file=$(mktemp)
+
+	echo "$tmp" | base64 -d > "$file"
+	if edit "$file"; then
+		tmp=$(base64 -w0 < "$file")
+		sysrepocfg -S "$xpath" -u "$tmp"
+	fi
+
+	rm -f "$file"
+else
+	echo "Failed to retrieve value for $xpath"
+	exit 1
+fi
+```
+
+An example container configuration, with an embedded file that is
+mounted to `/var/www/index.html` can look like this:
+
+```json
+  "infix-containers:containers": {
+    "container": [
+      {
+        "name": "web",
+        "image": "oci-archive:/lib/oci/curios-httpd-latest.tar.gz",
+        "hostname": "web",
+        "network": {
+          "interface": [
+            {
+              "name": "veth-sys0"
+            }
+          ]
+        },
+        "mount": [
+          {
+            "name": "index.html",
+            "content": "PCFET0NUWVBFIGh0bWwjibberish.shortened.down==",
+            "target": "/var/www/index.html"
+          }
+        ]
+      }
+    ]
+  }
+``` 
+
+The command to edit this file, and restart the container with the new
+contents, look like this:
+
+```
+admin@infix:~$ cfg edit "/infix-containers:containers/container[name='web']/mount[name='index.html']/content"
+```
+
+
 ### <a id="backup"></a> Backup Configuration Using sysrepocfg And scp 
 
 Displaying running or startup configuration is possible with

doc/system.md

@@ -145,7 +145,7 @@ is committed by issuing the `leave` command.
 admin@host:/config/> edit system
 admin@host:/config/system/> set hostname example
 admin@host:/config/system/> leave
-admin@example:/> 
+admin@host:/> 
 ```
 
 The hostname is advertised over mDNS-SD in the `.local` domain.  If
@@ -201,6 +201,82 @@ admin@host:/>
 > and then re-enter configure context to use your editor of choice.
 
 
+## NTP Client Configuration
+
+Below is an example configuration for enabling NTP 
+with a specific server and the `iburst` option for faster initial 
+synchronization.
+
+```
+admin@host:/> configure
+admin@host:/config/> set system ntp enabled
+admin@host:/config/> set system ntp server ntp-pool
+admin@host:/config/> set system ntp server ntp-pool udp address pool.ntp.org
+admin@host:/config/> set system ntp server ntp-pool iburst
+admin@host:/config/> set system ntp server ntp-pool prefer
+```
+
+This configuration enables the NTP client and sets the NTP server to 
+`pool.ntp.org` with the `iburst` and `prefer` options. The `iburst` 
+option ensures faster initial synchronization, and the `prefer` option 
+designates this server as preferred.
+
+* `prefer false`: The NTP client will choose the best available source
+based on several factors, such as network delay, stratum, and other 
+metrics (default config).
+* `prefer true`: The NTP client will try to use the preferred server 
+as the primary source unless it becomes unreachable or unusable.
+
+### Show NTP Status
+
+To check the status of NTP synchronization, use the following command:
+
+```
+admin@host:/> show ntp
+Reference ID    : C0248F86 (192.36.143.134)
+Stratum         : 2
+Ref time (UTC)  : Mon Oct 21 10:06:45 2024
+System time     : 0.000000001 seconds slow of NTP time
+Last offset     : -3845.151367188 seconds
+RMS offset      : 3845.151367188 seconds
+Frequency       : 4.599 ppm slow
+Residual freq   : +1293.526 ppm
+Skew            : 12.403 ppm
+Root delay      : 1.024467230 seconds
+Root dispersion : 0.273462683 seconds
+Update interval : 0.0 seconds
+Leap status     : Normal
+admin@host:/>
+```
+
+This output provides detailed information about the NTP status, including 
+reference ID, stratum, time offsets, frequency, and root delay.
+
+### Show NTP Sources
+
+To view the sources being used by the NTP client, run:
+
+```
+admin@host:/> show ntp sources 
+
+  .-- Source mode  '^' = server, '=' = peer, '#' = local clock.
+ / .- Source state '*' = current best, '+' = combined, '-' = not combined,
+| /             'x' = may be in error, '~' = too variable, '?' = unusable.
+||                                                 .- xxxx [ yyyy ] +/- zzzz
+||      Reachability register (octal) -.           |  xxxx = adjusted offset,
+||      Log2(Polling interval) --.      |          |  yyyy = measured offset,
+||                                \     |          |  zzzz = estimated error.
+||                                 |    |           \
+MS Name/IP address         Stratum Poll Reach LastRx Last sample               
+===============================================================================
+^* 192.36.143.134                1   6   177     9   +278ms[ -3845s] +/-  514ms
+admin@host:/>
+```
+
+> The system uses `chronyd` for Network Time Protocol (NTP)
+> synchronization. The output shown here is best explained in the
+> [Chrony documentation](https://chrony-project.org/doc/4.6.1/chronyc.html).
+
 [1]: https://www.rfc-editor.org/rfc/rfc7317
 [2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-system%402024-02-29.yang
 [3]: https://www.rfc-editor.org/rfc/rfc8341

doc/test-arch.md

@@ -17,7 +17,7 @@ Tenets
   It is also much more practical and economical to build large virtual
   networks than physical ones.
 
-- **Avoid CLI scipting & scraping**.  Reliably interacting with a DUT
+- **Avoid CLI scripting & scraping**.  Reliably interacting with a DUT
   over a serial line in a robust way is _very_ hard to get right.
   Given that we have a proper API (RESTCONF), we should leverage that
   when testing.  Front-ends can be tested by other means.

package/Config.in

@@ -1,7 +1,10 @@
 menu "Packages"
+
+source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/test-mode/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/confd-test-mode/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/curios-httpd/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/curios-nftables/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/execd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/gencert/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/statd/Config.in"
@@ -33,4 +36,5 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
+
 endmenu

package/bin/Config.in

@@ -0,0 +1,8 @@
+config BR2_PACKAGE_BIN
+	bool "bin"
+	select BR2_PACKAGE_SYSREPO
+	select BR2_PACKAGE_LIBITE
+	help
+	  Misc. tools for CLI and shell users.
+
+	  https://github.com/kernelkit/infix

package/bin/bin.hash

@@ -0,0 +1 @@
+sha256  d2f96418893ac66156d0e691cda189b0d85ae1d814065d1d9aa1845383100f46  LICENSE

package/bin/bin.mk

@@ -0,0 +1,21 @@
+################################################################################
+#
+# bin
+#
+################################################################################
+
+BIN_VERSION = 1.0
+BIN_SITE_METHOD = local
+BIN_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/bin
+BIN_LICENSE = BSD-3-Clause
+BIN_LICENSE_FILES = LICENSE
+BIN_REDISTRIBUTE = NO
+BIN_DEPENDENCIES = sysrepo libite
+BIN_CONF_OPTS = --prefix= --disable-silent-rules
+BIN_AUTORECONF = YES
+
+define BIN_CONF_ENV
+CFLAGS="$(INFIX_CFLAGS)"
+endef
+
+$(eval $(autotools-package))

package/confd-test-mode/Config.in

@@ -0,0 +1,10 @@
+config BR2_PACKAGE_CONFD_TEST_MODE
+	bool "confd test mode"
+	depends on BR2_PACKAGE_CONFD
+	select BR2_PACKAGE_LIBITE
+	select BR2_PACKAGE_LIBYANG
+	select BR2_PACKAGE_SYSREPO
+	select BR2_PACKAGE_LIBSRX
+	help
+	  A companion plugin to confd providing functionality required to
+	  run tests with Infamy, i.e., enable Infix test mode.

package/confd-test-mode/confd-test-mode.mk

@@ -0,0 +1,32 @@
+CONFD_TEST_MODE_VERSION = 1.0
+CONFD_TEST_MODE_SITE_METHOD = local
+CONFD_TEST_MODE_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/test-mode
+CONFD_TEST_MODE_LICENSE = BSD-3-Clause
+CONFD_TEST_MODE_LICENSE_FILES = LICENSE
+CONFD_TEST_MODE_REDISTRIBUTE = NO
+CONFD_TEST_MODE_DEPENDENCIES = sysrepo libite libyang confd
+CONFD_TEST_MODE_AUTORECONF = YES
+CONFD_TEST_MODE_SYSREPO_SHM_PREFIX = sr_buildroot$(subst /,_,$(CONFIG_DIR))_test_mode
+
+COMMON_SYSREPO_ENV = \
+	SYSREPO_SHM_PREFIX=$(CONFD_SYSREPO_SHM_PREFIX) \
+	SYSREPOCTL_EXECUTABLE="$(HOST_DIR)/bin/sysrepoctl" \
+	SYSREPOCFG_EXECUTABLE="$(HOST_DIR)/bin/sysrepocfg" \
+	SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/confd/"
+
+define CONFD_TEST_MODE_INSTALL_YANG_MODULES
+        $(COMMON_SYSREPO_ENV) \
+        SEARCH_PATH="$(TARGET_DIR)/usr/share/yang/modules/test-mode/" $(BR2_EXTERNAL_INFIX_PATH)/utils/sysrepo-load-modules.sh $(@D)/yang/test-mode.inc
+endef
+define CONFD_TEST_MODE_PERMISSIONS
+	/etc/sysrepo/data/ r 660 root wheel - - - - -
+	/etc/sysrepo/data  d 770 root wheel - - - - -
+endef
+define CONFD_TEST_MODE_CLEANUP
+        rm -f /dev/shm/$(CONFD_TEST_MODE_SYSREPO_SHM_PREFIX)*
+endef
+
+CONFD_TEST_MODE_PRE_INSTALL_TARGET_HOOKS += CONFD_TEST_MODE_CLEANUP
+CONFD_TEST_MODE_POST_INSTALL_TARGET_HOOKS += CONFD_TEST_MODE_INSTALL_YANG_MODULES
+
+$(eval $(autotools-package))

package/confd/confd.conf

@@ -1,6 +1,6 @@
 #set DEBUG=1
 
-run name:bootstrap log:prio:user.notice norestart <usr/ixinit-done> \
+run name:bootstrap log:prio:user.notice norestart <usr/ixinit> \
 	[S] /usr/libexec/confd/bootstrap \
 	-- Bootstrapping YANG datastore
 

package/confd/confd.mk

@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-CONFD_VERSION = 1.1
+CONFD_VERSION = 1.2
 CONFD_SITE_METHOD = local
 CONFD_SITE = $(BR2_EXTERNAL_INFIX_PATH)/src/confd
 CONFD_LICENSE = BSD-3-Clause

package/curios-httpd/Config.in

@@ -2,8 +2,8 @@ config BR2_PACKAGE_CURIOS_HTTPD
 	bool "curiOS-httpd"
 	help
 	  Example of how to bundle an OCI archive of curiOS-httpd in
-	  /lib/oci for the given target architecture.  OCI archives
-	  can also be bundled in post-build.sh, but with packaging
-	  the "source" is bundled in SDK builds.
+	  /lib/oci for the given target architecture.  OCI archives can
+	  also be bundled in post-build.sh, but with packaging all the
+	  "source" tarballs are bundled for SDK builds (archiving).
 
 	  https://github.com/kernelkit/curiOS

package/curios-httpd/curios-httpd.hash

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  988a523bf4be543cb4ea1d3472ce4720e0b92511546817028b90150a3f054e9f  curios-httpd-oci-arm64-v24.05.0.tar.gz
-sha256  25f94a7c44cdbbceca3f89382b8bea0dcd8d178032c97a9113bb69bbc1770528  curios-httpd-oci-amd64-v24.05.0.tar.gz
+sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
+sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz

package/curios-httpd/curios-httpd.mk

@@ -4,16 +4,18 @@
 #
 ################################################################################
 
-CURIOS_HTTPD_VERSION = v24.05.0
+CURIOS_HTTPD_VERSION = v24.11.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
 CURIOS_HTTPD_LICENSE_FILES = COPYING
-CURIOS_HTTPD_INSTALL_TARGET = YES
 
 define CURIOS_HTTPD_INSTALL_TARGET_CMDS
 	mkdir -p $(TARGET_DIR)/lib/oci
-	(cd $(@D)/.. && $(TAR) cfz $(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz $(notdir $(@D)))
+	cp $(CURIOS_HTTPD_DL_DIR)/$(CURIOS_HTTPD_SOURCE) \
+		$(TARGET_DIR)/lib/oci/$(CURIOS_HTTPD_NAME)-$(CURIOS_HTTPD_VERSION).tar.gz
+	ln -sf $(CURIOS_HTTPD_NAME)-$(CURIOS_HTTPD_VERSION).tar.gz \
+		$(TARGET_DIR)/lib/oci/$(CURIOS_HTTPD_NAME)-latest.tar.gz
 endef
 
 $(eval $(generic-package))

package/curios-nftables/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_CURIOS_NFTABLES
+	bool "curiOS-nftables"
+	help
+	  Example of how to bundle an OCI archive of curiOS-nftables in
+	  /lib/oci for the given target architecture.  OCI archives can
+	  also be bundled in post-build.sh, but with packaging all the
+	  "source" tarballs are bundled for SDK builds (archiving).
+
+	  https://github.com/kernelkit/curiOS

package/curios-nftables/curios-nftables.hash

@@ -0,0 +1,4 @@
+# Locally computed
+sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
+sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
+sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz

package/curios-nftables/curios-nftables.mk

@@ -0,0 +1,22 @@
+################################################################################
+#
+# curios-nftables
+#
+################################################################################
+
+CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
+CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
+CURIOS_NFTABLES_LICENSE = GPL
+CURIOS_NFTABLES_LICENSE_FILES = COPYING
+CURIOS_NFTABLES_INSTALL_TARGET = YES
+
+define CURIOS_NFTABLES_INSTALL_TARGET_CMDS
+	mkdir -p $(TARGET_DIR)/lib/oci
+	cp $(CURIOS_NFTABLES_DL_DIR)/$(CURIOS_NFTABLES_SOURCE) \
+		$(TARGET_DIR)/lib/oci/$(CURIOS_NFTABLES_NAME)-$(CURIOS_NFTABLES_VERSION).tar.gz
+	ln -sf $(CURIOS_NFTABLES_NAME)-$(CURIOS_NFTABLES_VERSION).tar.gz \
+		$(TARGET_DIR)/lib/oci/$(CURIOS_NFTABLES_NAME)-latest.tar.gz
+endef
+
+$(eval $(generic-package))

package/execd/execd.conf

@@ -1,2 +1,4 @@
+task log:prio:local1.notice,tag:container-flush <pid/syslogd> \
+	[S] container flush -- Cleaning up lingering containers
 service log:prio:local1.err,tag:container \
-	[2345] execd /run/containers/queue /var/lib/containers/active -- Container job runner
+	[2345] execd /run/containers/queue -- Container job runner

package/execd/tmpfiles.conf

@@ -1,8 +1 @@
-d  /run/containers/args		0700 - -
-d  /run/containers/files	0700 - -
-d  /var/lib/containers/active	0700 - -
-d  /var/lib/containers/oci	0755 - -
-d  /run/containers/inbox	0700 - -
 d  /run/containers/queue	0700 - -
-d  /run/cni			0755 - -
-L+ /var/lib/cni                 -    - - - /run/cni

package/finit/0001-Only-mark-rdeps-dirty-if-main-service-is-nohup.patch

@@ -0,0 +1,67 @@
+From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
+From: Joachim Wiberg <troglobit@gmail.com>
+Date: Thu, 17 Oct 2024 14:23:24 +0200
+Subject: [PATCH 1/7] Only mark rdeps dirty if main service is nohup
+Organization: Addiva Elektronik
+
+This patch changes a behavior that's been default since Finit 4.0,
+introduced in 4d05bf9 with 4.0-rc2.
+
+If service B depends on A and A needs to be reloaded, then B may be
+affected.  If A is declared as NOHUP <!>, then A will be stopped and
+restarted, during which time the condition it provides is removed,
+and B will also be stopped.
+
+However, and as of this patch, if A is declared supporting HUP, then the
+condition A provides will only go into flux, during which time B will be
+SIGSTOPed instead of needing to be reloaded.
+
+Fix #415
+
+Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
+---
+ src/service.c | 8 ++++++++
+ src/svc.h     | 1 +
+ 2 files changed, 9 insertions(+)
+
+diff --git a/src/service.c b/src/service.c
+index 61be85c..b995ff4 100644
+--- a/src/service.c
++++ b/src/service.c
+@@ -2001,6 +2001,10 @@ static void svc_mark_affected(char *cond)
+  * Called on conf_reload() to update service reverse dependencies.
+  * E.g., if ospfd depends on zebra and the zebra Finit conf has
+  * changed, we need to mark the ospfd Finit conf as changed too.
++ *
++ * However, a daemon that depends on syslogd (sysklogd project), need
++ * not be reloeaded (SIGHUP'ed or stop/started) because syslogd support
++ * reloading its configuration file on SIGHUP.
+  */
+ void service_update_rdeps(void)
+ {
+@@ -2012,6 +2016,10 @@ void service_update_rdeps(void)
+ 		if (!svc_is_changed(svc))
+ 			continue;
+ 
++		/* Service supports reloading conf without stop/start  */
++		if (!svc_is_nohup(svc))
++			continue; /* Yup, no need to stop start rdeps */
++
+ 		svc_mark_affected(mkcond(svc, cond, sizeof(cond)));
+ 	}
+ }
+diff --git a/src/svc.h b/src/svc.h
+index d00ac14..e2f6bd8 100644
+--- a/src/svc.h
++++ b/src/svc.h
+@@ -259,6 +259,7 @@ static inline int svc_is_tty       (svc_t *svc) { return svc && SVC_TYPE_TTY
+ static inline int svc_is_runtask   (svc_t *svc) { return svc && (SVC_TYPE_RUNTASK & svc->type);}
+ static inline int svc_is_forking   (svc_t *svc) { return svc && svc->forking; }
+ static inline int svc_is_manual    (svc_t *svc) { return svc && svc->manual; }
++static inline int svc_is_nohup     (svc_t *svc) { return svc && (0 == svc->sighup); }
+ 
+ static inline int svc_in_runlevel  (svc_t *svc, int runlevel) { return svc && ISSET(svc->runlevels, runlevel); }
+ static inline int svc_nohup        (svc_t *svc) { return svc &&  (0 == svc->sighup || 0 != svc->args_dirty); }
+-- 
+2.43.0
+