package/skeleton-init-finit: enable rngd by default

Platforms with /dev/hwrandom use that to see /dev/urandom. Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
2026-07-25 18:23:01 +02:00 · 2024-11-05 13:32:38 +01:00
200 changed files with 1725 additions and 8175 deletions
@@ -33,4 +33,3 @@ Releases
   - Easy to forget adaptations/hacks in customer repos -- may need Infix change/support
 - Ensure the markdown link for the release diff is updated
 - Ensure subrepos are tagged (can be automated, see kernelkit/infix#393)
- - Sync tags for all repo. sync activities
@@ -101,7 +101,6 @@ jobs:
    runs-on: [ self-hosted, release ]
    permissions:
      contents: write
-      discussions: write
    steps:
      - uses: actions/checkout@v4
        with:
@@ -116,14 +115,12 @@ jobs:
              ver=${GITHUB_REF#refs/tags/}
          fi
          echo "ver=${ver}"     >> $GITHUB_OUTPUT
-          echo "cat="           >> $GITHUB_OUTPUT
          if echo $ver | grep -qE 'v[0-9.]+(-alpha|-beta|-rc)[0-9]*'; then
            echo "pre=true"     >> $GITHUB_OUTPUT
            echo "latest=false" >> $GITHUB_OUTPUT
          elif echo $ver | grep -qE '^v[0-9.]+\.[0-9.]+(\.[0-9]+)?$'; then
            echo "pre=false"    >> $GITHUB_OUTPUT
            echo "latest=true"  >> $GITHUB_OUTPUT
-            echo "cat=Releases" >> $GITHUB_OUTPUT
          else
            echo "pre=false"    >> $GITHUB_OUTPUT
            echo "latest=false" >> $GITHUB_OUTPUT
@@ -153,7 +150,7 @@ jobs:
          name: Infix ${{ github.ref_name }}
          prerelease: ${{ steps.rel.outputs.pre }}
          makeLatest: ${{ steps.rel.outputs.latest }}
-          discussionCategory: ${{ steps.rel.outputs.cat }}
+          discussionCategory: Releases
          bodyFile:  release.md
          artifacts: "*.tar.gz*"

@@ -8,4 +8,3 @@
 /test/.venv
 /test/.log
 /local.mk
-/test/spec/Readme.adoc
@@ -27,13 +27,13 @@ it maintenance-free.  Configuration and data, e.g, containers, is stored
 on separate partitions to ensure complete separation from system files
 and allow for seamless backup, restore, and provisioning.

-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+In itself Infix is perfectly suited for dedicated networking tasks and
+native support for Docker containers provides a versatile platform that
+can easily be adapted to any customer need.  Be it legacy applications,
+network protocols, process monitoring, or edge data analysis, it can run
+close to end equipment.  Either directly connected on dedicated Ethernet
+ports or indirectly using virtual network cables to exist on the same
+LAN as other connected equipment.

 The simple design of Infix provides complete control over both system
 and data, minimal cognitive burden, and makes it incredibly easy to get
@@ -265,38 +265,14 @@
 	};
 };

-#define SWP_LED \
+#define SWP_LED(_func) \
 	leds { \
 		#address-cells = <1>; \
 		#size-cells = <0>; \
 		\
 		led@0 { \
 			reg = <0>; \
-			function = "tp"; \
-			color = <LED_COLOR_ID_GREEN>; \
-			default-state = "keep"; \
-		}; \
-		led@1 { \
-			reg = <1>; \
-			function = "aux"; \
-			color = <LED_COLOR_ID_GREEN>; \
-			default-state = "off"; \
-		}; \
-	}
-
-/* SFP LEDs
- * Rev A. LEDs do not work at all
- * Rev B. only outer-most (green) LEDs work
- */
-
-#define SFP_LED \
-	leds { \
-		#address-cells = <1>; \
-		#size-cells = <0>; \
-		\
-		led@0 { \
-			reg = <0>; \
-			function = "sfp"; \
+			function = _func; \
 			color = <LED_COLOR_ID_GREEN>; \
 			default-state = "keep"; \
 		}; \
@@ -311,7 +287,7 @@
 		phy-mode = "10gbase-r"; \
 		managed = "in-band-status"; \
 		sfp = <_sfp>; \
-		SFP_LED; \
+		SWP_LED("sfp"); \
 	}

 #define XSWCPU(_n, _eth) \
@@ -345,7 +321,7 @@
 		nvmem-cell-names = "mac-address"; \
 		phy-mode = "gmii"; \
 		phy-handle = <_phy>; \
-		SWP_LED; \
+		SWP_LED("tp"); \
 	}

 #define GPHY(_n) \
@@ -1,111 +0,0 @@
-#!/bin/sh
-# Raw switch LED Control for systems that do not run iitod
-
-
-LEDS=$(find /sys/class/leds -iname '*mdio-mii*')
-LINK=$(find /sys/class/leds -iname '*mdio-mii*p')
-
-# Disable ALL switch port LEDs
-clear()
-{
-    for led in $LEDS; do
-        echo 0 > "${led}/brightness"
-    done
-}
-
-setup()
-{
-    for led in $LINK; do
-        echo netdev > "${led}/trigger"
-    done
-
-    for led in $LINK; do
-        cd "$led"
-	# No sleep here, it's enough with the delay from previous loop
-        echo 1 > link
-        sleep 0.1
-        echo 1 > rx
-        sleep 0.1
-        echo 1 > tx
-        cd - >/dev/null
-    done
-}
-
-leds()
-{
-    for led in $LINK; do
-         printf "%3s: %s\n" "$(cat "$led/device_name" 2>/dev/null)" "$led"
-    done
-}
-
-list()
-{
-    leds | sort | while read -r port path; do
-        printf "%4s %s\n" "$port" "$(basename "$path")"
-
-        aux=${path%%:tp}:aux
-        if [ -e "$aux" ]; then
-            printf "%3s: %s\n" "" "$(basename "$aux")"
-        fi
-    done
-}
-
-flash()
-{
-    sec=$1
-
-    for led in $LEDS; do
-        echo timer > "${led}/trigger"
-    done
-
-    for led in $LEDS; do
-        echo 84 > "${led}/delay_on"
-        echo 84 > "${led}/delay_off"
-    done
-
-    sleep "$sec"
-    clear
-}
-
-usage()
-{
-    echo "usage: $0 [command]"
-    echo
-    echo "flash [SEC]  Flash all LEDs to locate device in rack, default: 5 sec"
-    echo "list         List all LEDs"
-    echo "setup        Set up and start normal operation"
-    echo "start        Call at system init, clears all LEDs and sets up normal op"
-    echo "stop         Clear all LEDs, may be called at system shutdown"
-    echo
-    echo "Please ensure no other tool or daemon is already managing the LEDs."
-}
-
-cmd=$1; shift
-case $cmd in
-    flash)
-        flash ${1:-5}
-        setup
-        ;;
-    help)
-	usage
-	exit 0
-	;;
-    list | ls)
-        list
-        ;;
-    setup)
-	setup
-	;;
-    start)
-	initctl -nbq cond clear led
-	clear
-	setup
-        ;;
-    stop)
-	clear
-	;;
-    *)
-        usage
-	exit 1
-        ;;
-esac
@@ -1 +0,0 @@
-/usr/libexec/styx/led.sh
@@ -189,7 +189,7 @@ config QEMU_CLOCK
 comment "Networking"

 choice
-     prompt "Network Mode"
+     prompt "Mode"
     default QEMU_NET_USER

 config QEMU_NET_NONE
@@ -204,9 +204,6 @@ config QEMU_NET_USER
 config QEMU_NET_TAP
     bool "TAP"

-config QEMU_NET_ROCKER
-     bool "Rocker"
-
 endchoice

 config QEMU_NET_MODEL
@@ -232,8 +229,3 @@ config QEMU_NET_TAP_N
 	int "Number of TAPs"
 	depends on QEMU_NET_TAP
 	default 1
-
-config QEMU_NET_PORTS
-	int "Number of Rocker switch ports"
-	depends on QEMU_NET_ROCKER
-	default 10
@@ -17,10 +17,9 @@
 #
 #    ./qemu.sh -h
 #
-# shellcheck disable=SC3037

 # Local variables
-imgdir=$(readlink -f "$(dirname "$0")")
+imgdir=$(readlink -f $(dirname "$0"))
 prognm=$(basename "$0")

 usage()
@@ -31,7 +30,6 @@ usage()
    echo "Options:"
    echo "  -c     Run menuconfig to change Qemu settings"
    echo "  -h     This help text"
-    echo "  -k     Keep generated qemu.run script (name shown at end)"
    echo
    echo "Arguments:"
    echo "  ARGS1  Args before the '--' separator are for kernel space"
@@ -56,20 +54,19 @@ die()

 load_qemucfg()
 {
-    tmp=$(mktemp -p /tmp)
+    local tmp=$(mktemp -p /tmp)

-    grep ^CONFIG_QEMU_ "$1" >"$tmp"
-    # shellcheck disable=SC1090
-    .  "$tmp"
-    rm "$tmp"
+    grep ^CONFIG_QEMU_ $1 >$tmp
+    .  $tmp
+    rm $tmp

    [ "$CONFIG_QEMU_MACHINE" ] || die "Missing QEMU_MACHINE"
    [ "$CONFIG_QEMU_ROOTFS"  ] || die "Missing QEMU_ROOTFS"

-    [ -n "$CONFIG_QEMU_KERNEL" ] && [ -n "$CONFIG_QEMU_BIOS" ] \
+    [ "$CONFIG_QEMU_KERNEL" -a "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL conflicts with QEMU_BIOS"

-    [ -z "$CONFIG_QEMU_KERNEL" ] && [ -z "$CONFIG_QEMU_BIOS" ] \
+    [ ! "$CONFIG_QEMU_KERNEL" -a ! "$CONFIG_QEMU_BIOS" ] \
 	&& die "QEMU_KERNEL or QEMU_BIOS must be set"
 }

@@ -96,7 +93,7 @@ append_args()

    if [ "$CONFIG_QEMU_ROOTFS_INITRD" = "y" ]; then
 	# Size of initrd, rounded up to nearest kb
-	size=$((($(stat -c %s "$CONFIG_QEMU_ROOTFS") + 1023) >> 10))
+	local size=$((($(stat -c %s $CONFIG_QEMU_ROOTFS) + 1023) >> 10))
 	echo -n "root=/dev/ram0 ramdisk_size=${size} "
    elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
 	echo -n "root=PARTLABEL=primary "
@@ -201,24 +198,13 @@ host_args()

 net_dev_args()
 {
-    name="e$1"
-    mac=$(printf "02:00:00:00:00:%02x" "$1")
+    local name="e$1"
+    local mac=$(printf "02:00:00:00:00:%02x" $1)

    echo -n "-device $CONFIG_QEMU_NET_MODEL,netdev=$name,mac=$mac "
    echo "$name	$mac" >>"$mactab"
 }

-rocker_port_args()
-{
-    sw=$1
-    port=$2
-    name="sw${sw}p${port}"
-    mac=$(printf "02:00:00:00:%02x:%02x" "$sw" "$port")
-
-    echo -n "-netdev tap,id=$name,ifname=$name,script=no,downscript=no "
-    echo "$name	$mac" >> "$mactab"
-}
-
 net_args()
 {
    # Infix will pick up this file via fwcfg and install it to /etc
@@ -230,25 +216,14 @@ net_args()
 	echo -n "-netdev bridge,id=e1,br=$CONFIG_QEMU_NET_BRIDGE_DEV "
 	net_dev_args 1
    elif [ "$CONFIG_QEMU_NET_TAP" = "y" ]; then
-	for i in $(seq 1 "$CONFIG_QEMU_NET_TAP_N"); do
+	for i in $(seq 1 $(($CONFIG_QEMU_NET_TAP_N))); do
 	    echo -n "-netdev tap,id=e$i,ifname=qtap$i "
-	    net_dev_args "$i"
-	done
-    elif [ "$CONFIG_QEMU_NET_ROCKER" = "y" ]; then
-	sw=sw0			# Only single switch support atm.
-	echo -n "-device '{\"driver\":\"rocker\", \"name\":\"${sw}\", "
-	echo -n "\"fp_start_macaddr\":\"02:00:00:00:00:01\", "
-	echo -n "\"ports\":["
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
-	    [ "$i" -gt 1 ] && echo -n ", "
-	    echo -n "\"${sw}p${i}\""
-	done
-	echo -n "]}' "
-	for i in $(seq 1 "$CONFIG_QEMU_NET_PORTS"); do
-	    rocker_port_args 0 "$i"
+	    net_dev_args $i
 	done
    elif [ "$CONFIG_QEMU_NET_USER" = "y" ]; then
+	local useropts=
 	[ "$CONFIG_QEMU_NET_USER_OPTS" ] && useropts=",$CONFIG_QEMU_NET_USER_OPTS"
+
 	echo -n "-netdev user,id=e1${useropts} "
 	net_dev_args 1
    else
@@ -326,7 +301,8 @@ run_qemu()
 	fi
    fi

-    read -r qemu <<EOF
+    local qemu
+    read qemu <<EOF
 	$CONFIG_QEMU_MACHINE -nodefaults -m $CONFIG_QEMU_MACHINE_RAM \
 	  $(loader_args) \
 	  $(rootfs_args) \
@@ -341,28 +317,18 @@ run_qemu()
 	  $(gdb_args) \
 	  $CONFIG_QEMU_EXTRA
 EOF
-    # Save resulting command to a script, because I cannot for the life
-    # of me figure out how to embed the JSON snippet for Rocker and run
-    # it here without issues, spent way too much time on it -- Joachim
-    run=$(mktemp -t run.qemu.XXX)
-    echo "#!/bin/sh" > "$run"
-    if [ "$CONFIG_QEMU_KERNEL" ]; then
-	echo "$qemu -append \"$(append_args)\" $*" >> "$run"
-    else
-	echo "$qemu $*" >> "$run"
-    fi
-    chmod +x "$run"

    echo "Starting Qemu  ::  Ctrl-a x -- exit | Ctrl-a c -- toggle console/monitor"
    line=$(stty -g)
    stty raw
-    $run
-    stty "$line"
-    if [ -n "$keep" ]; then
-	echo "Keeping generated qemu.run script: $run"
+
+    if [ "$CONFIG_QEMU_KERNEL" ]; then
+	$qemu -append "$(append_args)" "$@"
    else
-	rm "$run"
+	$qemu "$@"
    fi
+
+    stty "$line"
 }

 dtb_args()
@@ -398,7 +364,7 @@ generate_dot()
    hostports="<qtap1> qtap1"
    targetports="<e1> e1"
    edges="host:qtap1 -- target:e1 [kind=mgmt];"
-    for tap in $(seq 2 $((CONFIG_QEMU_NET_TAP_N - 1))); do
+    for tap in $(seq 2 $(($CONFIG_QEMU_NET_TAP_N - 1))); do
 	hostports="$hostports | <qtap$tap> qtap$tap "
 	targetports="$targetports | <e$tap> e$tap "
 	edges="$edges host:qtap$tap -- target:e$tap;"
@@ -438,8 +404,7 @@ menuconfig()
    exec kconfig-mconf Config.in
 }

-scriptdir=$(dirname "$(readlink -f "$0")")
-cd "$scriptdir" || (echo "Failed cd to $scriptdir"; exit 1)
+cd $(dirname $(readlink -f "$0"))

 while [ "$1" != "" ]; do
    case $1 in
@@ -449,9 +414,6 @@ while [ "$1" != "" ]; do
 	-h)
 	    usage
 	    ;;
-	-k)
-	    keep=true
-	    ;;
 	*)
 	    break
    esac
@@ -1,2 +0,0 @@
-# --log-level debug
-OSPFD_ARGS="-A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf --log syslog"
@@ -1 +0,0 @@
-RAUC_ARGS="-s"
@@ -1,2 +0,0 @@
-# --log-level debug
-ZEBRA_ARGS="-A 127.0.0.1 -u frr -g frr --log syslog "
@@ -1,4 +1,4 @@
-task    name:container-%i :setup \
-	[2345] container -n %i setup -- Setup container %i
-sysv    <!usr/container:%i> :%i pid:!/run/container:%i.pid log:prio:local1,tag:%i kill:10 \
+service :%i pid:!/run/k8s-logger-%i.pid <usr/container:%i> \
+	[2345] k8s-logger -cni %i -f local1 /run/containers/%i.fifo -- Logger for container %i
+sysv    :%i pid:!/run/container:%i.pid <pid/k8s-logger:%i> log kill:10 \
 	[2345] container -n %i -- container %i
@@ -1,4 +0,0 @@
-# Use <pid/syslogd> as barrier for other system tasks and service that
-# rely on modules, firmware, and device nodes to be ready.
-service if:udevd nowarn env:-/etc/default/sysklogd <run/udevadm:post/success> \
-	[S0123456789] syslogd -F $SYSLOGD_ARGS -- System log daemon
@@ -1 +0,0 @@
-/var/lib/dbus/machine-id
@@ -1 +1,2 @@
 alias cli='clish'
+alias cfg='sysrepocfg -f json'
@@ -1,58 +0,0 @@
-#!/bin/sh
-# User-friendly wrapper for sysrepocfg
-# TODO: add import/export, copy, ...
-
-# Edit YANG binary types using sysrepo, base64, and duct tape.
-edit()
-{
-    xpath=$1
-    if [ -z "$xpath" ]; then
-	echo "Usage: cfg edit \"/full/xpath/to/binary/leaf\""
-	exit 1
-    fi
-
-    if tmp=$(sysrepocfg -G "$xpath"); then
-	file=$(mktemp)
-
-	echo "$tmp" | base64 -d > "$file"
-	if /usr/bin/editor "$file"; then
-	    tmp=$(base64 -w0 < "$file")
-	    sysrepocfg -S "$xpath" -u "$tmp"
-	fi
-
-	rm -f "$file"
-    else
-	echo "Failed to retrieve value for $xpath"
-	exit 1
-    fi
-}
-
-usage()
-{
-    echo "Usage:"
-    echo "    cfg CMD [ARG]"
-    echo
-    echo "Command:"
-    echo "    edit XPATH   Edit YANG binary type"
-    echo "    help         This help text"
-    echo
-    echo "As a backwards compatible fallback, this script forwards"
-    echo "all other commands as options to sysrepocfg."
-    echo
-
-    exit 0
-}
-
-cmd=$1; shift
-case $cmd in
-    edit)
-	edit "$1"
-	;;
-    help)
-	usage
-	;;
-    *)
-	set -- "$cmd" "$@"
-	exec sysrepocfg -f json "$@"
-	;;
-esac
@@ -1,14 +0,0 @@
-#!/bin/sh
-# -d ;; suppress error message "the terminal is dumb"
-# -F :: exit if the entire file can be displayed on the first screen
-# -I :: Ignore case, even for patterns
-# -K :: exit immediately when an interrupt character (usually ^C) is typed
-# -R :: Almost raw control charachters, only ANSI color escape sequences and
-#       OSC 8 hyperlink sequences are output.  Allows veritcal scrolling
-# -X :: No termcap initialization and deinitialization set to the terminal.
-#       This is what leaves the contents of the output on screen.
-
-export LESS="-P %f (press h for help or q to quit)"
-export LANG=en_US.UTF-8
-
-less -RIKd -FX "$@"
@@ -0,0 +1 @@
+less
@@ -1,9 +0,0 @@
-# Extend finit's default udevadm settle synchronization for situations
-# where device are very slow to probe (see #685)
-run nowarn if:udevd cgroup.init <service/udevd/ready> log \
-	[S] /usr/libexec/infix/hw-wait -- Probing hardware
-
-# Now that everything should be probed, do a final pass over the
-# uevent queue before starting syslogd and everything else
-run nowarn if:udevd cgroup.init :post <service/udevd/ready> log \
-	[S] udevadm settle -t 30 --
@@ -1,6 +0,0 @@
-d  /run/containers/args		0700 - -
-d  /run/containers/files	0700 - -
-d  /var/lib/containers		0700 - -
-d  /var/lib/containers/oci	0700 - -
-d  /run/cni			0755 - -
-L+ /var/lib/cni                 -    - - - /run/cni
@@ -1,2 +1 @@
 d /var/run/frr 0755 frr frr -
-R /var/tmp/frr -    -   -   -
@@ -1,41 +0,0 @@
-#!/bin/sh
-# (Ab)use the kernel's device link subsystem to detect consumer side
-# devices that may be very slow to probe (looking at you, mv88e6xxx!).
-
-ident=$(basename "$0")
-
-report()
-{
-    if [ -r "/tmp/$ident" ]; then
-	logger -k -p "user.$1" -t "$ident" "Waited for slow devices:"
-	sort "/tmp/$ident" | uniq -c | logger -k -p "user.$1" -t "$ident"
-    fi
-
-    rm -f "/tmp/$ident"
-}
-
-for _ in $(seq 50); do
-    again=
-
-    for dl in /sys/class/devlink/*; do
-    	[ -r "$dl/status" ] || continue
-
-    	status=$(cat "$dl/status")
-	if [ "$status" = "consumer probing" ]; then
-	    basename "$(readlink "$dl/consumer")" >>"/tmp/$ident"
-	    again=yes
-	fi
-
-    done
-
-    if [ -z "$again" ]; then
-	report notice
-	exit 0
-    fi
-
-    sleep .2
-done
-
-logger -k -p user.error -t "$ident" "Timeout waiting for devices to come online"
-report error
-exit 1
@@ -8,11 +8,10 @@ import struct
 import subprocess
 import sys

-onieprom = importlib.machinery.SourceFileLoader("onieprom", "/bin/onieprom").load_module()
-SYSTEM_JSON = "/run/system.json"
+onieprom = importlib.machinery.SourceFileLoader("onieprom","/bin/onieprom").load_module()
+SYSTEM_JSON   = "/run/system.json"
 KKIT_IANA_PEM = 61046

-
 class DTSystem:
    BASE = "/sys/firmware/devicetree/base"
    INFIX = BASE + "/chosen/infix"
@@ -29,9 +28,7 @@ class DTSystem:
            if not os.path.exists(phandle):
                continue

-            with open(phandle, "rb") as f:
-                data = f.read()
-            ph, = struct.unpack(">L", data)
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
            dt[ph] = root

        sys = {}
@@ -43,18 +40,14 @@ class DTSystem:
            if not os.path.exists(phandle):
                continue

-            with open(phandle, "rb") as f:
-                data = f.read()
-            ph, = struct.unpack(">L", data)
+            ph, = struct.unpack(">L", open(phandle, "rb").read())
            if ph not in sys:
                sys[ph] = []
            sys[ph].append(root)

        phs = set(list(dt.keys()) + list(sys.keys()))

-        self.devs = {ph: [Device(ph, dt.get(ph), s if s is not None else "")
-                          for s in (sys.get(ph) or []) if ph is not None]
-                     for ph in phs}
+        self.devs = { ph: [Device(ph, dt.get(ph), s if s is not None else "") for s in (sys.get(ph) or []) if ph is not None]  for ph in phs }
        self.base = Device(0, None, DTSystem.BASE)
        self.infix = Device(0, None, DTSystem.INFIX)

@@ -63,8 +56,7 @@ class DTSystem:
        if not os.path.exists(path):
            return ()

-        with open(path, "rb") as f:
-            data = f.read()
+        data = open(path, "rb").read()
        elems = len(data) // struct.calcsize(">L")
        return struct.unpack(">" + elems * "L", data)

@@ -77,8 +69,7 @@ class DTSystem:
                return {}

            try:
-                with open(dev.attrpath("nvmem"), "rb", 0) as f:
-                    data = onieprom.from_tlv(f)
+                data = onieprom.from_tlv(open(dev.attrpath("nvmem"), "rb", 0))
            except:
                data = {}

@@ -93,18 +84,14 @@ class DTSystem:
        }

    def infix_usb_devices(self, out):
-        names = self.infix.str_array("usb-port-names", ())
-        phs = self.__get_phandle_array("usb-ports")
-        data = dict(zip(names, phs))
+        names=self.infix.str_array("usb-port-names", ())
+        phs=self.__get_phandle_array("usb-ports")
+        data=dict(zip(names,phs))
        if data != {}:
            out["usb-ports"] = []
-        for name, ph in data.items():
-            [out["usb-ports"].extend([{
-                "name": name,
-                "path": dev.attrpath("authorized")}, {
-                    "name": name,
-                    "path": dev.attrpath("authorized_default")
-                }]) for dev in self.devices_from_ph(ph)]
+        for name,ph in data.items():
+            [out["usb-ports"].extend([{"name": name, "path": dev.attrpath("authorized")}, {"name": name, "path": dev.attrpath("authorized_default")}]) for dev in self.devices_from_ph(ph)]
+

    def infix_devices(self, kind):
        phs = self.__get_phandle_array(kind)
@@ -114,7 +101,6 @@ class DTSystem:
        flat_devices = [device for sublist in self.infix_devices("vpds") for device in sublist]
        return [self.into_vpd(device) for device in flat_devices]

-
 class QEMUSystem:
    BASE = "/sys/firmware/qemu_fw_cfg"
    REV = BASE + "/rev"
@@ -124,8 +110,7 @@ class QEMUSystem:
        data = {}
        if os.path.exists(QEMUSystem.VPD):
            try:
-                with open(QEMUSystem.VPD, "rb", 0) as f:
-                    data = onieprom.from_tlv(f)
+                data = onieprom.from_tlv(open(QEMUSystem.VPD, "rb", 0))
            except:
                pass

@@ -142,27 +127,31 @@ class QEMUSystem:
    def usb_ports(self):
        ports = [
            {
-                "name": "USB",
-                "path": "/sys/bus/usb/devices/usb1/authorized"
-            }, {
-                "name": "USB",
-                "path": "/sys/bus/usb/devices/usb1/authorized_default"
-            }, {
-                "name": "USB2",
-                "path": "/sys/bus/usb/devices/usb2/authorized"
-            }, {
-                "name": "USB2",
-                "path": "/sys/bus/usb/devices/usb2/authorized_default"
-            }]
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized"
+
+        },
+        {
+            "name": "USB",
+            "path": "/sys/bus/usb/devices/usb1/authorized_default"
+
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized"
+        },
+        {
+            "name": "USB2",
+            "path": "/sys/bus/usb/devices/usb2/authorized_default"
+
+        }]
        return ports
-
-
 class Device:
    def __init__(self, ph, dtpath, syspath):
        self.ph, self.dtpath, self.syspath = ph, dtpath, syspath

    def available(self):
-        return self.syspath is not None
+        return self.syspath != None

    def __getitem__(self, attr):
        return self.attr(attr).decode("utf-8").strip("\0")
@@ -170,6 +159,7 @@ class Device:
    def __setitem__(self, attr, value):
        return self.attr(attr, val=value.encode("utf-8"))

+
    def attrpath(self, attr):
        return os.path.join(self.syspath, attr)

@@ -178,16 +168,13 @@ class Device:

    def attr(self, attr, default=None, val=None):
        if not self.hasattr(attr):
-            return default if val is None else False
+            return default if val == None else False

        if val:
-            with open(self.attrpath(attr), "wb") as f:
-                f.write(val)
+            open(self.attrpath(attr), "wb").write(value)
            return True

-        with open(self.attrpath(attr), "rb") as f:
-            data = f.read()
-        return data
+        return open(self.attrpath(attr), "rb").read()

    def str(self, attr, default=None):
        val = self.attr(attr)
@@ -207,9 +194,7 @@ class Device:
        if not self.hasdtattr(attr):
            return default

-        with open(self.dtattrpath(attr), "rb") as f:
-            data = f.read()
-        return data
+        return open(self.dtattrpath(attr), "rb").read()

    def dtstr(self, attr, default=None):
        val = self.dtattr(attr)
@@ -227,7 +212,6 @@ def vpd_get_json_ve(vpd, pem):

    return out

-
 def vpd_get_pwhash(vpd):
    if not vpd.get("trusted"):
        return None
@@ -235,9 +219,8 @@ def vpd_get_pwhash(vpd):
    kkit = vpd_get_json_ve(vpd, KKIT_IANA_PEM)
    return kkit.get("pwhash")

-
 def vpd_inject(out, vpds):
-    out["vpd"] = {vpd["board"]: vpd for vpd in vpds}
+    out["vpd"] = { vpd["board"]: vpd for vpd in vpds }

    product = out["vpd"].get("product", {}).get("data", {})
    hoistattrs = ("vendor", "product-name", "part-number", "serial-number", "mac-address")
@@ -251,7 +234,6 @@ def vpd_inject(out, vpds):
            out["factory-password-hash"] = pwhash
            break

-
 def qemu_base_mac():
    """Find MAC address of first non-loopback interface, subtract with 1"""
    base_path = '/sys/class/net'
@@ -262,8 +244,7 @@ def qemu_base_mac():
            continue
        try:
            # pylint: disable=invalid-name
-            fn = os.path.join(base_path, iface, 'address')
-            with open(fn, 'r', encoding='ascii') as f:
+            with open(os.path.join(base_path, iface, 'address'), 'r', encoding='ascii') as f:
                mac = f.read().strip()
            interfaces.append((mac, iface))
        except FileNotFoundError:
@@ -280,7 +261,6 @@ def qemu_base_mac():

    return None

-
 def probe_qemusystem(out):
    """Probe Qemu based test systems and 'make run'"""
    admin_hash = "$5$mI/zpOAqZYKLC2WU$i7iPzZiIjOjrBF3NyftS9CCq8dfYwHwrmUK097Jca9A"
@@ -308,7 +288,6 @@ def probe_qemusystem(out):
    subprocess.run("initctl -nbq cond set qemu".split(), check=False)
    return 0

-
 def probe_dtsystem(out):
    """Probe DTS based system, expects a VPD in ONIE PROM format."""
    dtsys = DTSystem()
@@ -318,8 +297,6 @@ def probe_dtsystem(out):
    if model:
        out["product-name"] = model

-    out["compatible"] = dtsys.base.str_array("compatible")
-
    staticpw = dtsys.infix.str("factory-password-hash")
    if not out["factory-password-hash"]:
        out["factory-password-hash"] = staticpw
@@ -327,7 +304,6 @@ def probe_dtsystem(out):
    vpd_inject(out, vpds)
    return 0

-
 def main():
    out = {
        "vendor": None,
@@ -362,6 +338,5 @@ def main():
    shutil.chown(SYSTEM_JSON, user="root", group="wheel")
    return err

-
 if __name__ == "__main__":
    sys.exit(main())
@@ -1,48 +1,22 @@
 #!/bin/sh
-# Find, install, and run product specific files and script in /etc
-# before resuming bootstrap.
-#
-# Use /etc/product/init.d/S01-myscript for scripts, may be a symlink, it
-# will be called with `start` as its only argument.
-#
-# The compatible array is listed in the same order as the device tree,
-# most significant to least.  Hence the reverse.[], to ensure overrides
-# are applied in order of significance.
+# Find and install any product specific files in /etc before bootstrap
 ident=$(basename "$0")

-PRODUCT_INIT=/etc/product/init.d
 PREFIXD=/usr/share/product
-COMPATIBLES=$(jq -r '.compatible | reverse.[] | ascii_downcase' /run/system.json)
+PRODUCT=$(jq -r '."product-name" | ascii_downcase' /run/system.json)

 note()
 {
    logger -I $$ -k -p user.notice -t "$ident" "$1"
 }

-found=false
-for PRODUCT in $COMPATIBLES; do
-    DIR="$PREFIXD/$PRODUCT"
-    if [ -d "$DIR" ]; then
-        note "Using vendor/product-specific defaults for $PRODUCT."
-        for dir in "$DIR"/*; do
-            [ -d "$dir" ] && cp -a "$dir" /
-        done
-        found=true
-    fi
-done
-
-if [ "$found" = false ]; then
-    note "No vendor/product-specific directory found, using built-in defaults."
+DIR="$PREFIXD/$PRODUCT"
+if [ -z "$PRODUCT" ] || [ ! -d "$DIR" ]; then
+    note "No vendor/product specific directory found, using built-in defaults."
+    exit 0
 fi

-# Conditions for bootstrap services, this enables product specific
-# init scripts to prevent select services from starting.
-initctl -nbq cond set led
-
-note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
-
-# Product specific init done.
-initctl -nbq cond set product
-
-exit 0
+note "Using vendor/product specific defaults."
+for dir in "$DIR"/*; do
+    [ -d "$dir" ] && cp -a "$dir" /
+done
@@ -14,6 +14,24 @@ for file in /sys/firmware/qemu_fw_cfg/by_name/opt/mactab/raw /etc/mactab; do
 	fi
 done

+# Sometimes the sysfs is not populated when the switch driver is loaded, with the result
+# that the DSA interface was not found (no /dsa/tagging entry in sysfs. See issue #685.
+#
+# This mitigates that problem by waiting for sysfs to come up if a DSA switch is found
+if [ -n "$(devlink -j dev info | jq -r '.info.[].driver' | grep -q mv88e6085)" ]; then
+	timeout=50
+	while [ -z "$(ls /sys/class/net/*/dsa/tagging)" ]; do
+		timeout=$((timeout-1))
+		if [ $timeout -eq 0 ]; then
+			logger -k -p user.emerg -t "$ident" "Failed to find DSA interface"
+			exit 1
+		fi
+		sleep 0.1
+	done
+
+	logger -k -p user.notice -t "$ident" "Found DSA interface in $timeout seconds"
+fi
+
 # Find CPU interfaces used for connecting to a switch managed by DSA
 for netif in /sys/class/net/*; do
 	iface=$(basename "$netif")
@@ -46,11 +46,7 @@ while [ "$1" ]; do
    [ $txqs -lt 2 ] && continue
    [ $txqs -gt 8 ] && txqs=8

-    output=$(tc qdisc add dev $iface root mqprio hw 1 \
-		num_tc $txqs $(map $txqs) $(queues $txqs) 2>&1) || true
-    if echo "$output" | grep -q "does not support hardware offload"; then
-        echo "Skipping $iface, hardware offload not supported."
-    elif [ -n "$output" ]; then
-	echo "$output"
-    fi
+    tc qdisc add dev $iface root mqprio hw 1 \
+       num_tc $txqs $(map $txqs) $(queues $txqs) || true
 done
+
@@ -1,2 +1,2 @@
 #!/bin/sh
-exec initctl -bq cond set ixinit
+exec initctl -bq cond set ixinit-done
@@ -45,6 +45,11 @@ factory_reset()
    find /sys/class/leds/ -type l -exec sh -c 'echo 100 > $0/brightness' {} \;
    logger $opt -p user.crit -t "$nm" "Resetting to factory defaults."

+    # Shred all files to prevent restoring contents
+    find /mnt/cfg -type f -exec shred -zu {} \;
+    find /mnt/var -type f -exec shred -zu {} \;
+
+    # Remove any lingering directories and symlinks as well
    rm -rf /mnt/cfg/* /mnt/var/*

    logger $opt -p user.crit -t "$nm" "Factory reset complete."
@@ -1,18 +1,5 @@
 #!/bin/sh
-# This script can be used to start, stop, create, and delete containers.
-# It is what confd use, with the Finit container@.conf template, to set
-# up, run, and delete containers.
-#
-# NOTE: when creating/deleting containers, remember 'initctl reload' to
-#       activate the changes!  In confd this is already handled.
-#
-DOWNLOADS=/var/lib/containers/oci
-BUILTIN=/lib/oci
-TMPDIR=/var/tmp
-checksum=""
-extracted=
-timeout=30
-dir=""
+
 all=""
 env=""
 port=""
@@ -23,87 +10,6 @@ log()
    logger -I $PPID -t container -p local1.notice -- "$*"
 }

-err()
-{
-    rc=$1; shift
-    logger -I $PPID -t container -p local1.err -- "Error: $*"
-
-    if [ -n "$extracted" ]; then
-	if [ -d "$TMPDIR/$dir" ]; then
-	    log "Cleaning up extracted $dir"
-	    rm -rf "$dir"
-	fi
-    fi
-
-    [ "$rc" -eq 0 ] || exit "$rc"
-}
-
-check()
-{
-    file=$1
-
-    if [ -z "$checksum" ]; then
-	log "no checksum to verify $file against, continuing."
-	return 0
-    fi
-
-    if echo "${checksum}  ${file}" | "$cmdsum" -c -s; then
-        log "$file checksum verified OK."
-	return 0
-    fi
-
-    got=$("$cmdsum" "${file}" | awk '{print $1}')
-    log "$file checksum mismatch, got $got, expected $checksum, removing file."
-    rm -f "$file"
-
-    return 1
-}
-
-# Fetch an OCI image over ftp/http/https.  Use wget for FTP, which curl
-# empirically does not work well with.  Log progress+ & error to syslog.
-fetch()
-{
-    url=$1
-    file=$(basename "$url")
-    dst="$DOWNLOADS/$file"
-
-    cd "$DOWNLOADS" || return
-    if [ -e "$file" ]; then
-	log "$file already available."
-	if check "$file"; then
-	    echo "$dst"
-	    return 0
-	fi
-    fi
-
-    log "Fetching $url"
-
-    if echo "$url" | grep -qE "^ftp://"; then
-        cmd="wget -q $url"
-    elif echo "$url" | grep -qE "^https?://"; then
-        cmd="curl $creds -sSL --fail -o \"$file\" $url"
-    else
-        log "Unsupported URL scheme: $url"
-        return 1
-    fi
-
-    if out=$(eval "$cmd" 2>&1); then
-	log "$file downloaded successfully."
-	if check "$file"; then
-	    echo "$dst"
-	    return 0
-	fi
-    fi
-
-    # log error message from backend
-    while IFS= read -r line; do
-	log "$line"
-    done <<EOF
-$out
-EOF
-    return 1
-}
-
 # Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
 # checks, at least one index.json in the top-level dir of the archive.
 # If there are more index files, this function does not handle them.
@@ -120,74 +26,45 @@ unpack_archive()
 	oci-archive:*)		# Packed OCI image, .tar or .tar.gz format
 	    file=${image#oci-archive:}
 	    ;;
-	ftp://* | http://* | https://*)
-            if ! file=$(fetch "$image"); then
-		return 1
-	    fi
-            ;;
 	*)			# docker://*, docker-archive:*, or URL
-	    if podman image exists "$image"; then
-		echo "$image"
-		return 0
-	    fi
-	    # XXX: use --retry=0 with Podman 5.0 or later.
-	    if ! id=$(podman pull --quiet "$image"); then
-		log "Failed pulling $image"
-		return 1
-	    fi
-	    # Echo image name to caller
-	    podman images --filter id="$id" --format "{{.Repository}}:{{.Tag}}"
+	    echo "$image"
 	    return 0
 	    ;;
    esac

    if [ ! -e "$file" ]; then
-	if [ -e "$DOWNLOADS/$file" ]; then
-	    file="$DOWNLOADS/$file"
-	elif [ -e "$BUILTIN/$file" ]; then
-	    file="$BUILTIN/$file"
+	if [ -e "/var/lib/containers/oci/$file" ]; then
+	    file="/var/lib/containers/oci/$file"
+	elif [ -e "/lib/oci/$file" ]; then
+	    file="/lib/oci/$file"
 	else
-	    err 1 "cannot find OCI archive $file in search path."
+	    log "Error: cannot find OCI archive $file in search path."
+	    exit 1
 	fi
    fi

    if [ -d "$file" ]; then
 	index=$(find "$file" -name index.json)
 	if [ -z "$index" ]; then
-	    err 1 "cannot find index.json in OCI image $file"
+	    log "Error: cannot find index.json in OCI image $file"
+	    exit 1
 	fi
    else
-	cd "$TMPDIR" || err 0 "failed cd $TMPDIR, wiill use $(pwd) for OCI archive extraction."
-
 	index=$(tar tf "$file" |grep index.json)
 	if [ -z "$index" ]; then
-	    err 1 "invalid OCI archive, cannot find index.json in $file"
+	    log "Error: invalid OCI archive, cannot find index.json in $file"
+	    exit 1
 	fi

 	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
-        tar xf "$file"  || err 1 "failed unpacking $file in $(pwd)"
-	extracted=true
+        tar xf "$file" || (log "Error: failed unpacking $file in $(pwd)"; exit 1)
+	remove=true
    fi

    dir=$(dirname "$index")
-    if echo "$dir" | grep -q ":"; then
-        if [ -z "$name" ]; then
-            name="$dir"
-        fi
-        sanitized_dir=$(echo "$dir" | cut -d':' -f1)
-        mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
-        dir="$sanitized_dir"
-    fi
-
    [ -n "$quiet" ] || log "Loading OCI image $dir ..."
    podman load -qi "$dir"        >/dev/null

-    # Clean up after ourselves
-    if [ -n "$extracted" ]; then
-	log "Cleaning up extracted $dir"
-	rm -rf "$dir"
-    fi
-
    # Rename image from podman default $dir:latest
    if [ -n "$name" ]; then
 	podman tag "$dir" "$name" >/dev/null
@@ -196,6 +73,10 @@ unpack_archive()
 	name=$dir
    fi

+    if [ "$remove" = "true" ]; then
+	rm -rf "$file"
+    fi
+
    echo "$name"
 }

@@ -221,18 +102,15 @@ create()

    # Unpack and load docker-archive/oci/oci-archive, returning image
    # name, or return docker:// URL for download.
-    if ! image=$(unpack_archive "$image"); then
-	exit 1
-    fi
+    image=$(unpack_archive "$image")

    if [ -z "$logging" ]; then
-	logging="--log-driver none"
+	logging="--log-driver k8s-file --log-opt path=/run/containers/$name.fifo"
    fi

-    # When we get here we've already fetched, or pulled, the image
-    args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
+    args="$args --replace --quiet --cgroup-parent=containers $caps"
    args="$args --restart=$restart --systemd=false --tz=local $privileged"
-    args="$args $vol $mount $hostname $entrypoint $env $port $logging"
+    args="$args $ro $vol $mount $hostname $entrypoint $env $port $logging"
    pidfn=/run/container:${name}.pid

    [ -n "$quiet" ] || log "---------------------------------------"
@@ -256,17 +134,16 @@ create()
    fi

    # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
+    log "Calling podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
-	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
+	[ -n "$quiet" ] || log "Successfully created container $name from $image"
+	rm -f "/run/containers/env/${name}.env"
 	[ -n "$manual" ] || start "$name"
-
-	# Should already be enabled by confd (this is for manual use)
-	initctl -bnq enable "container@${name}.conf"
 	exit 0
    fi

-    err 1 "failed creating container $name, please check the configuration."
+    log "Error: failed creating container $name, please check the configuration."
+    exit 1
 }

 delete()
@@ -280,27 +157,18 @@ delete()
 	exit 1
    fi

-    # Should already be stopped, but if not ...
-    container stop "$name"
-
-    while running "$name"; do
-	_=$((timeout -= 1))
-	if [ $timeout -le 0 ]; then
-	    err 1 "timed out waiting for container $1 to stop before deleting it."
-	fi
-	sleep 1
-    done
-
    podman rm -vif "$name" >/dev/null 2>&1
    [ -n "$quiet" ] || log "Container $name has been removed."
 }

 waitfor()
 {
+    timeout=$2
    while [ ! -f "$1" ]; do
 	_=$((timeout -= 1))
 	if [ $timeout -le 0 ]; then
-	    err 1 "timed out waiting for $1, aborting!"
+	    log "Timeout waiting for $1, aborting!"
+	    exit 1
 	fi
 	sleep 1;
    done
@@ -368,12 +236,6 @@ netrestart()
    done
 }

-cleanup()
-{
-    log "Received signal, exiting."
-    exit 1
-}
-
 usage()
 {
 	cat <<EOF
@@ -386,7 +248,6 @@ options:
      --dns-search LIST    Set host lookup search list when creating container
      --cap-add CAP        Add capability to unprivileged container
      --cap-drop CAP       Drop capability, for privileged containter
-      --checksum TYPE:SUM  Use md5/sha256/sha512 to verify ftp/http/https archives
  -c, --creds USR[:PWD]    Credentials to pass to curl -u for remote ops
  -d, --detach             Detach a container started with 'run IMG [CMD]'
  -e, --env FILE           Environment variables when creating container
@@ -406,15 +267,14 @@ options:
                           Syntax: [[ip:][hostPort]:]containerPort[/protocol]
  -q, --quiet              Quiet operation, called from confd
  -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
+      --read-only          Do not create a writable layer
  -s, --simple             Show output in simplified format
-  -t, --timeout SEC        Set timeout for delete/restart commands, default: 20
  -v, --volume NAME:PATH   Create named volume mounted inside container on PATH

 commands:
  create   NAME IMAGE NET  Create container NAME using IMAGE with networks NET
  delete  [network] NAME   Remove container NAME or network NAME from all containers
  exec     NAME CMD        Run a command inside a container
-  flush                    Clean up lingering containers and associated anonymous volumes
  find    [ifname PID]     Find PID of container where '--net IFNAME' currently lives
                           or, find the name of our IFNAME inside the container @PID
  help                     Show this help text
@@ -425,7 +285,6 @@ commands:
  restart [network] NAME   Restart a (crashed) container or container(s) using network
  run      NAME [CMD]      Run a container interactively, with an optional command
  save     IMAGE FILE      Save a container image to an OCI tarball FILE[.tar.gz]
-  setup    NAME            Create and set up container as a Finit task
  shell                    Start a shell inside a container
  show    [image | volume] Show containers, images, or volumes
  stat                     Show continuous stats about containers (Ctrl-C aborts)
@@ -448,25 +307,6 @@ while [ "$1" != "" ]; do
 	    shift
 	    caps="$caps --cap-drop=$1"
 	    ;;
-	--checksum)
-	    shift
-	    type="${1%%:*}"
-	    checksum="${1#*:}"
-	    case "$type" in
-		md5)
-		    cmdsum=md5sum
-		    ;;
-		sha256)
-		    cmdsum=sha256sum
-		    ;;
-		sha512)
-		    cmdsum=sha512sum
-		    ;;
-		*)
-		    err 1 "Unsupported checksum type: $type"
-		    ;;
-	    esac
-	    ;;
 	-c | --creds)
 	    shift
 	    creds="-u $1"
@@ -511,6 +351,7 @@ while [ "$1" != "" ]; do
 	--log-path)
 	    shift
 	    logging="$logging --log-opt path=$1"
+	    log_path="$1"
 	    ;;
 	-m | --mount)
 	    shift
@@ -545,13 +386,12 @@ while [ "$1" != "" ]; do
 	    shift
 	    restart=$1
 	    ;;
+	--read-only)
+	    ro="--read-only=true"
+	    ;;
 	-s | --simple)
 	    simple=true
 	    ;;
-	-t | --timeout)
-	    shift
-	    timeout=$1
-	    ;;
 	-v | --volume)
 	    shift
 	    vol="$vol -v $1"
@@ -568,8 +408,6 @@ if [ -n "$cmd" ]; then
    shift
 fi

-trap cleanup INT TERM
-
 case $cmd in
    # Does not work atm., cannot attach to TTY because
    # we monitor 'podman start -ai foo' with Finit.
@@ -592,10 +430,6 @@ case $cmd in
    exec)
 	podman exec -it "$@"
 	;;
-    flush)
-	echo "Cleaning up any lingering containers";
-	podman rm -av
-	;;
    find)
 	cmd=$1
 	pid=$2
@@ -621,12 +455,25 @@ case $cmd in
 	usage
 	;;
    load)
+	url=$1
+	name=$2
 	# shellcheck disable=SC2086
-	name=$(unpack_archive "$1" $2)
-	[ -n "$name" ] || exit 1
+	if echo "$url" | grep -q "://"; then
+	    file=$(basename "$url")
+            curl -k $creds -Lo "$file" "$url"
+	else
+            file="$url"
+	fi
+
+	# shellcheck disable=SC2086
+	name=$(unpack_archive "$file" $name)

 	# Show resulting image(s) matching $name
-	podman images -n "$name"
+	if [ -n "$name" ]; then
+	    podman images -n "$name"
+	else
+	    exit 1
+	fi
 	;;
    locate)			# Find where the host's ifname lives
 	if [ -z "$network" ]; then
@@ -653,7 +500,7 @@ case $cmd in
 		podman images $all --format "{{.Repository}}:{{.Tag}}"
 		;;
 	    oci)
-		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
+		find /lib/oci /var/lib/containers/oci -type f 2>/dev/null
 		;;
 	    *)		
 		podman ps $all --format "{{.Names}}"
@@ -695,20 +542,6 @@ case $cmd in
 	    gzip "$file"
 	fi
 	;;
-    setup)
-	[ -n "$name" ] || err 1 "setup: missing container name."
-	script=/run/containers/${name}.sh
-	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
-	while ! "$script"; do
-	    # Wait for address/route changes, or retry every 60 secods
-	    # shellcheck disable=2162,3045
-	    ip monitor address route | while read -t 60 _; do break; done
-
-	    # On IP address/route changes, wait a few seconds more to ensure
-	    # the system has ample time to react and set things up for us.
-	    sleep 2
-	done
-	;;
    shell)
 	podman exec -it "$1" sh -l
 	;;
@@ -763,10 +596,12 @@ case $cmd in
 	    else
 		name=$1
 		stop "$name"
+		timeout=20
 		while running "$name"; do
 		    _=$((timeout -= 1))
 		    if [ $timeout -le 0 ]; then
-			err 1 "timed out waiting for container $1 to stop before restarting it."
+			log "Timeout waiting for container $1 to stop before restarting it."
+			exit 1
 		    fi
 		    sleep 1
 		done
@@ -792,7 +627,7 @@ case $cmd in
 	;;
    upgrade)
 	# Start script used to initially create container
-	script=/run/containers/${1}.sh
+	script=/var/lib/containers/active/S01-${1}.sh

 	# Find container image
 	img=$(podman inspect "$1" | jq -r .[].ImageName)
@@ -823,7 +658,7 @@ case $cmd in
 	[ -n "$cmd" ] && shift
 	case $cmd in
 	    prune)
-		podman volume prune $force
+		podman volume $force prune
 		;;
 	    *)
 		false
@@ -50,7 +50,7 @@ set_dhcp_routes()
 	# format: dest1/mask gw1 ... destn/mask gwn
 	set -- $staticroutes
 	while [ -n "$1" -a -n "$2" ]; do
-	    log "adding route $1 via $2 metric $metric tag 100"
+	    log "adding route $1 via $2 dev $interface proto dhcp"
 	    echo "ip route $1 $2 $metric tag 100" >> "$NEXT"
 	    shift 2
 	done
@@ -115,7 +115,7 @@ case "$ACTION" in
 	    /usr/sbin/avahi-autoipd -c $interface && /usr/sbin/avahi-autoipd -k $interface
 	fi

-	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto dhcp; then
+	if /bin/ip addr add dev $interface $ip/$subnet $BROADCAST proto 5; then
 	    echo "$ip" > "$IP_CACHE"
 	fi
 	if [ -n "$ipv6" ] ; then
@@ -33,7 +33,6 @@ CONFIG_KALLSYMS_ALL=y
 CONFIG_PROFILING=y
 CONFIG_SMP=y
 CONFIG_EFI=y
-CONFIG_KPROBES=y
 # CONFIG_GCC_PLUGINS is not set
 CONFIG_MODULES=y
 CONFIG_MODULE_UNLOAD=y
@@ -162,14 +161,12 @@ CONFIG_MPLS=y
 CONFIG_NET_MPLS_GSO=y
 CONFIG_MPLS_ROUTING=m
 CONFIG_MPLS_IPTUNNEL=m
-CONFIG_NET_SWITCHDEV=y
 CONFIG_NET_PKTGEN=y
 # CONFIG_WIRELESS is not set
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
 CONFIG_LWTUNNEL=y
 CONFIG_PCI=y
-CONFIG_PCI_MSI=y
 CONFIG_UEVENT_HELPER=y
 CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
@@ -211,7 +208,6 @@ CONFIG_NET_VRF=y
 CONFIG_E1000=y
 CONFIG_NE2K_PCI=y
 CONFIG_8139CP=y
-CONFIG_ROCKER=y
 # CONFIG_WLAN is not set
 CONFIG_INPUT_EVDEV=y
 CONFIG_SERIAL_8250=y
@@ -268,5 +264,5 @@ CONFIG_PANIC_ON_OOPS=y
 CONFIG_PANIC_TIMEOUT=20
 CONFIG_DETECT_HUNG_TASK=y
 CONFIG_BOOTPARAM_HUNG_TASK_PANIC=y
-CONFIG_FUNCTION_TRACER=y
+# CONFIG_FTRACE is not set
 CONFIG_UNWINDER_FRAME_POINTER=y
@@ -134,6 +134,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -146,6 +147,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -175,6 +175,7 @@ INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -187,6 +188,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -165,6 +165,7 @@ INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -177,6 +178,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -138,6 +138,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
+BR2_PACKAGE_EXECD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
 BR2_PACKAGE_FACTORY=y
@@ -150,6 +151,7 @@ BR2_PACKAGE_FINIT_RTC_FILE="/var/lib/misc/rtc"
 BR2_PACKAGE_FINIT_PLUGIN_TTY=y
 BR2_PACKAGE_FINIT_PLUGIN_URANDOM=y
 BR2_PACKAGE_IITO=y
+BR2_PACKAGE_K8S_LOGGER=y
 BR2_PACKAGE_KEYACK=y
 BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LANDING=y
@@ -4,104 +4,7 @@ Change Log
 All notable changes to the project are documented in this file.


-[v24.11.1][] - 2024-11-29
-------------------------
-
-### Changes
-
- - Upgrade Frr to 9.1.2, fixes an OSPF issue where *Zebra* lost netlink
-   messages and drifted out of sync with the kernel's view of addresses
-   and interfaces available in the system
- - Allow setting IP address directly on VLAN filtering bridges.  This
-   only works when the bridge is an untagged member of a (single) VLAN.
- - cli: usability -- showing log files now automatically jump to the end
-   of the file, where the latest events are
- - cli: usability -- showing container status, or other status that
-   overflows the terminal horizontally, now wrap the lines and exit the
-   pager immediately if the contents fit on the first screen
- - The default log level of the mDNS responder, `avahi-daemon`, has been
-   adjusted to make it less verbose.  Now only `LOG_NOTICE` and higher
-   severity is logged -- making it very quiet
-
-### Fixes
-
- - Fix #685: DSA conduit interface not always detected.  Previous
-   attempt at a fix (v24.10.2) mitigated the issue, but did not
-   completely solve it.
- - Fix #835: redesign how the system creates/deletes containers from the
-   `running-config`.  Prior to this change, all removal and creation was
-   handled by a separate queue that ran asynchronously from the `confd`
-   process.  This could lead to situations where new configurations are
-   applied before the queue had been fully processed.  After this change
-   containers are deleted synchronously and new containers are created
-   in the same flow as during normal runtime operation (start/upgrade)
- - Fix start of containers with `manual=True` option should now work
-   again, regression in v24.11.0
- - Fix loss of writable volumes when temporarily disabling a container
-   in the configuration, now the container remains dormant with all its
-   volumes still available
- - Fix presentation bug in CLI `show interfaces` where all line-drawing
-   characters showed up as hexadecimal values.  Regression in v24.11.0
- - Fix missing log messages from Frr Zebra daemon
- - Stop the zeroconf (IPv4LL) agent, `avahi-autoipd`, when removing an
-   interface, e.g., `br0`
- - Creating more than one container trigger restarts of previously set
-   up containers.  Which in some cases may cause these earlier ones to
-   end up in an inconsistent state
- - Prevent traffic assigned to locally terminated VLANs from being
-   forwarded, when the underlying ports are simultaneously attached to
-   a VLAN filtering bridge.
-
-
-[v24.11.0][] - 2024-11-20
-------------------------
-
-> [!CAUTION]
-> This release contains breaking changes for container users!  As of
-> v24.11.0, all persistent[^1] containers always run in `read-only` mode
-> and the setting itself is deprecated (kept only for compatibility
-> reasons).  The main reason for this change is to better serve users
-> with embedded container images in their builds of Infix.  I.e., they
-> can now upgrade the OCI image in their build and rely on the container
-> being automatically upgraded when Infix is upgraded, issue #823.  For
-> other users, the benefit is that *all* container configuration changes
-> take when activated, issue #822, without having to perform any tricks.
-
-### Changes
-
- - Add validation of interface name lengths, (1..15), Linux limit
- - Add support for ftp/http/https URI:s in container image, with a new
-   `checksum` setting for MD5/SHA256/SHA512 verification, issue #801
- - Add a retry timer to the background container create service.  This
-   will ensure failing `docker pull` operations from remote images are
-   retrying after 60 seconds, or quicker
- - CLI base component, `klish`, has been updated with better support for
-   raw terminal mode and alternate quotes (' in addition to ")
- - Log silenced from container activation messages, only the very bare
-   necessities are now logged, e.g., `podman create` command + status
- - Factory reset no longer calls `shred` to "securely erase" any files
-   from writable data partitions.  This will speed up the next boot
-   considerably
-
-### Fixes
-
- - Fix #659: paged output in CLI accessed via console port sometimes
-   causes lost lines, e.g. missing interfaces.  With updated `klish`
-   and the terminal in raw mode, the pager (less) can now control both
-   the horizontal and vertical
- - Fix #822: adding, or changing, an environment variable to a running
-   container does not take without the `container upgrade NAME` trick
- - Fix #823: with an OCI image embedded in the Infix image, an existing
-   container in the configuration is not upgraded to the new OCI image
-   with the Infix upgrade.
- - Frr leaves log files in `/var/tmp/frr` on unclean shutdowns.  This
-   has now been fixed with a "tmpfiles" cleanup of that path at boot
-
-[^1]: I.e., set up in the configuration, as opposed to temporary ones
-    started with `container run` from the CLI admin-exec context.
-
-
-[v24.10.2][] - 2024-11-08
+[v24.10.2][UNRELEASED]
 -------------------------

 ### Changes
@@ -119,44 +22,23 @@ All notable changes to the project are documented in this file.
 - Support for saving and restoring system clock from a disk file.  This
  allows restoring the system clock to a sane date in case the RTC is
  disabled or does not have a valid time, issue #794
- Update device discovery chapter with information on `infix.local` mDNS
-  alias, `netbrowse` support to discover *all* local units, and command
-  examples for disabling LLDP and mDNS services, issue #786
- Updated OSPF documentation to include information on *global OSPF
-  settings* (`redistribution`, `explicit-router-id`, etc.), issue #812
- Added information on *forwarding of IEEE reserved group addresses*
-  to bridge section of networking documentation, issue #788
- Add support for bootstrap conditions and early init product overrides
- Styx: enable second Ethernet port LED in device tree, again, rename
-  it: yellow -> aux, and make sure it is turned off at boot
- Styx: disable second port LED for the 4xSFP slots, does not work
- Styx: override iitod (LED daemon) with a product specific LED script

 ### Fixes
-
 - Fix #685: DSA conduit interface not always detected, randomly causing
  major issues configuring systems with multiple switch cores
 - Fix #778: reactivate OpenSSL backend for libssh/libssh2 for NanoPI R2S.
-  This fixes a regression in v24.10.0 causing loss of NETCONF support
- Fix #809: enable syslog logging for RAUC
- Fix harmless bootstrap log error message on systems without USB ports:
-  `jq: error (at <stdin>:0): Cannot iterate over null (null)`
- Change confusing `tc` log error message: `Error: does not support
-  hardware offload` to `Skipping $iface, hardware offload not supported.`
-
+  This fixes a regression in v24.10.0 causing loss of NETCONF supprt


 [v24.10.1][] - 2024-10-18
 -------------------------

 ### Changes
-
 - Add support for interface description, sometimes referred to as
   "ifAlias".  Saved as an Linux interface alias (not `altname`), e.g.,
   `/sys/class/interfaces/veth0a/ifalias`, includes operational support

 ### Fixes
-
 - Fix #735: `copy` and `erase` commands missing from CLI, regression
   in Infix v24.10.0 defconfigs, now added as dep. in klish package

@@ -171,9 +53,7 @@ Also, heads-up to all downstream users of Infix.  YANG models have been
 renamed to ease maintenance, more info below.

 ### Changes
-
 - Software control of port LEDs on the Styx platform has been disabled.
-
  Default driver behavior, green link and green traffic blink, is kept
  as-is, which should mitigate issues reported in #670
 - Correcting documentation on QoS. For packets containing both a VLAN
@@ -209,7 +89,6 @@ renamed to ease maintenance, more info below.
  see <https://kernelkit.org/posts/firewall-container/>

 ### Fixes
-
 - Fix #499: add an NACM rule to factory-config, which by default deny
  everyone to read user password hash(es)
 - Fix #663: internal Ethernet interfaces shown in CLI tab completion
@@ -258,7 +137,6 @@ also been added to facilitate site specific adaptations.  Please see the
 documentation for details.

 ### Known Issues
-
 - The CLI command `show interfaces` may for some terminal resolutions
  not display all interfaces (on systems with >20 interfaces).  This
  problem is limited to the console port and only occurs for smaller
@@ -267,7 +145,6 @@ documentation for details.
  using the CLI from an SSH session, is not affected.  Issue #659

 ### Changes
-
 - Upgrade Buildroot to 2024.02.6 (LTS)
 - Upgrade Linux kernel to 6.6.52 (LTS)
 - Upgrade libyang to 3.4.2
@@ -287,7 +164,6 @@ documentation for details.
  by `mctl` reporting no multicast filtering enabled on bridge

 ### Fixes
-
 - Fix #357: EUI-64 based IPv6 autoconf address on bridges seem to be
  randomized.  Problem caused by kernel setting a random MAC before any
  bridge port is added.  Fixed by using the device's base MAC address on
@@ -350,7 +226,6 @@ Finally, the following consumer boards are now fully supported:
 - StarFive VisionFive2 (RISC-V)

 ### Changes
-
 - Upgrade Buildroot to 2024.02.5 (LTS)
 - Upgrade Linux kernel to 6.6.46 (LTS)
 - Issue #158: enhance security of factory reset.  All file content
@@ -402,7 +277,6 @@ Finally, the following consumer boards are now fully supported:
  log messages.  See `/var/log/debug` for *all* log messages

 ### Fixes
-
 - Fix #274: add missing link/traffic LEDs on NanoPi R2S LAN port
 - Fix #489: ensure all patches are versioned, including Linux kernel
 - Fix #531: creating a new VLAN interface named `vlanN` should not set
@@ -432,7 +306,6 @@ Finally, the following consumer boards are now fully supported:
 > upgrade, but before reboot, a factory reset is required!

 ### Changes
-
 - Upgrade Buildroot to 2024.02.3 (LTS)
 - Upgrade Linux kernel to 6.6.34 (LTS)
 - Upgrade bundled curiOS httpd container to v24.05.0
@@ -499,7 +372,6 @@ Finally, the following consumer boards are now fully supported:
 [yescrypt]: https://en.wikipedia.org/wiki/Yescrypt

 ### Fixes
-
 - Fix #424: regression, root user can log in without password
 - Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
  to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
@@ -531,13 +403,11 @@ Finally, the following consumer boards are now fully supported:
 -------------------------

 ### Changes
-
 - Add small delay in U-Boot to allow stopping boot on reference boards
 - Document how to provision the bootloader and Infix on a blank board
 - Use initial hostname from `/etc/os-release` as configuration fallback

 ### Fixes
-
 - Fix build regressions in `cn9130_crb_boot_defconfig` caused by upgrade
  to Buildroot v2024.02 and recent multi-key support in RAUC and U-Boot
 - Fix provisioning script after changes to make GRUB loading more robust
@@ -552,7 +422,6 @@ Finally, the following consumer boards are now fully supported:
 -------------------------

 ### Changes
-
 - Default web landing page refactored into a Buildroot package to make
  it possible to overload from customer repos.
 - Enable DCB support in aarch64 kernel (for EtherType prio override)
@@ -563,7 +432,6 @@ Finally, the following consumer boards are now fully supported:
 - Issue #374: add timestamps to dagger .log files

 ### Fixes
-
 - Add missing LICENSE hash for factory reset tool
 - Fix #424: regression, root user can log in without password

@@ -585,7 +453,6 @@ idea is to generate supported features from the models and include in
 future releases.

 ### Changes
-
 - Bump the base Buildroot version to v2024.02 LTS
 - Bump the base Linux kernel version to 6.6 LTS
 - Drop Classic variant to reduce overhead, simplify build & release
@@ -666,7 +533,6 @@ future releases.
  named 'default'

 ### Fixes
-
 - confd: Fix memory leak when operating on candidate configuration
 - probe: Fix crash on systems without USB
 - Reduced syslog errors for accesses no non-existing xpaths
@@ -1409,10 +1275,7 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
 - N/A

 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.11.0...HEAD
-[v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1
-[v24.11.0]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.11.0
-[v24.10.2]:   https://github.com/kernelkit/infix/compare/v24.10.1...v24.10.2
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v24.10.1...HEAD
 [v24.10.1]:   https://github.com/kernelkit/infix/compare/v24.10.0...v24.10.1
 [v24.10.0]:   https://github.com/kernelkit/infix/compare/v24.09.0...v24.10.0
 [v24.09.0]:   https://github.com/kernelkit/infix/compare/v24.08.0...v24.09.0
@@ -20,9 +20,6 @@ Containers in Infix
  * [Application Container: ntpd](#application-container-ntpd)
 * [Advanced](#advanced)
  * [Running Host Commands From Container](#running-host-commands-from-container)
-* [Container Requirements](#container-requirements)
-  * [Advanced Users](#advanced-users)
-

 Introduction
 ------------
@@ -39,11 +36,10 @@ All network specific settings are done using the IETF interfaces YANG
 model, with augments for containers to ensure smooth integration with
 container networking in podman.

-> [!IMPORTANT]
-> Even though the `podman` command can be used directly from a shell
-> prompt, we strongly recommend using the CLI commands instead.  They
-> employ the services of a wrapper `container` script which handles the
-> integration of containers in the system.
+> **Note:** even though the `podman` command can be used directly from a
+> shell prompt, we strongly recommend using the CLI commands instead.
+> They employ the services of a wrapper `container` script which handles
+> the integration of containers in the system.


 Caution
@@ -87,26 +83,26 @@ The former is useful mostly for testing, or running single commands in
 an image.  It is a wrapper for `podman run -it --rm ...`, while the
 latter is a wrapper and adaptation of `podman create ...`.

-The second creates a read-only container that is automatically started
-at every boot.  When non-volatile storage is needed, data stored in a
-volume is persisted until explicitly removed from the configuration,
-i.e., across host and container reboots and upgrades.
+The second create a container with a semi-persistent writable layer that
+survives container restarts and host system restarts.  However, if you
+change the container configuration or upgrade the image (see below), the
+container will be recreated and the writable layer is lost.  This is why
+it is recommended to set up a named volume for directories, or use file
+[Content Mounts](#content-mounts), in your container if you want truly
+persistent content.

-Another option is [Content Mounts](#content-mounts), where the content
-of a file mounted into the container is kept along with the container
-configuration in the device's `startup-config`.
+In fact, in many cases the best way is to create a `read-only` container
+and use file mounts and volumes only for the critical parts.  Podman
+ensures (using tmpfs) `read-only` containers still have writable
+directories for certain critical file system paths: `/dev`, `/dev/shm`,
+`/run`, `/tmp`, and `/var/tmp`.  Meaning, what you most often need is
+writable volumes for `/var/lib` and `/etc`, or only file mounts for a
+few files in `/etc`.  The actual needs depend on the container image and
+application to run.

-Podman ensures (using tmpfs) all containers have writable directories
-for certain critical file system paths: `/dev`, `/dev/shm`, `/run`,
-`/tmp`, and `/var/tmp`.  Meaning, what you most often need is writable
-volumes for `/var/lib` and `/etc`, or only file mounts for a few files
-in `/etc`.  The [actual requirements](#container-requirements) depend on
-your container image and application to run.
-
-> [!IMPORTANT]
-> When running containers from public registries, double-check that they
-> support the CPU architecture of your host system.  Remember, unlike
-> virtualization, containers reuse the host's CPU and kernel.
+> **Note:** when running containers from public registries, double-check
+> that they support the CPU architecture of your host system.  Remember,
+> unlike virtualization, containers reuse the host's CPU and kernel.


 <img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
@@ -172,20 +168,13 @@ The CLI help shows:
        oci-archive:/lib/oci/archive -- Use archive:latest from OCI archive
                                        May be in .tar or .tar.gz format

-        Additionally, the following URIs are also supported for setups
-        that do not use a HUB or similar.  Recommend using 'checksum'!
-
-        ftp://addr/path/to/archive   -- Downloaded using wget
-        http://addr/path/to/archive  -- Downloaded using curl
-        https://addr/path/to/archive -- Downloaded using curl
-
        Note: if a remote repository cannot be reached, the creation of the
              container will be put on a queue that retries pull every time
              there is a route change in the host's system.

-> [!TIP]
-> The built-in help system in the CLI is generated from the YANG model,
-> so the same information is also available for remote NETCONF users.
+> **Note::** the built-in help system in the CLI is generated from the
+> YANG model, so the same information is also available for remote
+> NETCONF users.

 The two most common variants are `docker://` and `oci-archive:/`.

@@ -228,46 +217,21 @@ mind.
    -rw-r--r--    1 root     root       7261785 Mar 27 14:22 curios-oci-amd64.tar.gz
    drwx------    6 frr      frr           4096 Mar 27 11:57 frr/

-Importing the image into Podman can be done either from the CLI
+Importing the image into podman can be done either from the CLI
 admin-exec context ...

    admin@example:/var/tmp$ cli
    admin@example:/> container load /var/tmp/curios-oci-amd64.tar.gz name curios:edge

-> [!TIP]
-> The `name curios:edge` is the tag you give the imported (raw) archive
-> which you can then reference in your container image configuration:
-> `set image curios:edge`.
+> The `name curios:edge` is the tag you give the imported
+> (raw) archive which you can then reference in your container image
+> configuration: `set image curios:edge`.

 ... or by giving the container configuration the full path to the OCI
 archive, which helps greatly with container upgrades (see below):

    admin@example:/config/container/system/> set image oci-archive:/var/tmp/curios-oci-amd64.tar.gz

-**Checksum Example:**
-
-    admin@example:/> configure
-    admin@example:/config/> edit container sys
-    admin@example:/config/container/sys/> set hostname sys
-    admin@example:/config/container/sys/> set image ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
-    admin@example:/config/container/sys/> set checksum
-        md5 sha256 sha512
-    admin@example:/config/container/sys/> set checksum sha256 4f01077036527498ed910f1a3e80645ae3eff629d10043cf80ebc6850c99c629
-    admin@example:/config/container/sys/> leave
-    admin@example:/> copy running-config startup-config
-    admin@example:/> show container
-    CONTAINER ID  IMAGE                                             COMMAND               CREATED         STATUS        PORTS       NAMES
-    b02e945c43c9  localhost/curios-oci-amd64-v24.05.0:latest                              5 seconds ago   Up 5 seconds              sys
-
-    admin@example:/> show log
-    ...
-    Nov 20 07:24:56 infix container[5040]: Fetching ftp://192.168.122.1/curios-oci-amd64-v24.05.0.tar.gz
-    Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz downloaded successfully.
-    Nov 20 07:24:56 infix container[5040]: curios-oci-amd64-v24.05.0.tar.gz checksum verified OK.
-    Nov 20 07:24:57 infix container[5040]: Cleaning up extracted curios-oci-amd64-v24.05.0
-    Nov 20 07:24:57 infix container[5040]: podman create --name sys --conmon-pidfile=/run/container:sys.pid --read-only --replace --quiet --cgroup-parent=containers  --restart=always --systemd=false --tz=local --hostname sys --log-driver k8s-file --log-opt path=/run/containers/sys.fifo --network=none curios-oci-amd64-v24.05.0
-    Nov 20 07:24:57 infix container[3556]: b02e945c43c9bce2c4be88e31d6f63cfdb1a3c8bdd02179376eb059a49ae05e4
-

 Upgrading a Container Image
 ---------------------------
@@ -276,24 +240,21 @@ Upgrading a Container Image
 The applications in your container are an active part of the system as a
 whole, so make it a routine to keep your container images up-to-date!

-Containers are created at first setup and at every boot.  If the image
-exists in the file system it is reused -- i.e., an image pulled from a
-remote registry is not fetched again.
+> **Note:** the default writable layer is lost when upgrading the image.
+> Use named volumes for content that you want to persist across upgrades.

-To upgrade a versioned image:
- - update your `running-config` to use the new `image:tag`
- - `leave` to activate the change, if you are in the CLI
- - Podman pulls the new image in the background
- - Your container is recreated with the new image
- - The container is started
-
-For "unversioned" images, e.g., images using a `:latest` or `:edge` tag,
-use the following CLI command (`NAME` is the name of your container):
+All container configurations are locked to the image hash at the time of
+first download, not just ones that use an `:edge` or `:latest` tag.  An
+upgrade of containers using versioned images is more obvious -- update
+the configuration to use the new `image:tag` -- the latter is a bit
+trickier.  Either remove the configuration and recreate it (leave/apply
+the changes between), or use the admin-exec level command:

    admin@example:/> container upgrade NAME

-This stops the container, does `container pull IMAGE`, and recreates it
-with the new image.  Upgraded containers are automatically restarted.
+Where `NAME` is the name of your container.  This command stops the
+container, does `container pull IMAGE`, and then recreates it with the
+new image.  Upgraded containers are automatically restarted.

 **Example using registry:**

@@ -318,30 +279,12 @@ the upgrade command as
 	Upgrading container system with local archive: oci-archive:/var/tmp/curios-oci-amd64.tar.gz ...
 	7ab4a07ee0c6039837419b7afda4da1527a70f0c60c0f0ac21cafee05ba24b52

-OCI archives can also be fetched from ftp/http/https URL, in that case
-the upgrade can be done the same way as a registry image (above).
-
-> [!TIP]
-> Containers running from OCI images embedded in the operating system,
-> e.g., `/lib/oci/mycontainer.tar.gz`, always run from the version in
-> the operating system.  To upgrade, install the new container image at
-> build time, after system upgrade the container is also upgraded.  The
-> system unpacks and loads the OCI images into Podman every boot, which
-> ensures the running container always has known starting state.
->
-> **Example:** default builds of Infix include a couple of OCI images
-> for reference, one is `/lib/oci/curios-nftables-v24.11.0.tar.gz`, but
-> there is also a symlink called `curios-nftables-latest.tar.gz` in the
-> same directory, which is what the Infix regression tests use in the
-> image configuration of the container.  This is what enables easy
-> upgrades of the container along with the system itself.
-

 Capabilities
 -------------

 An unprivileged container works for almost all use-cases, but there are
-occasions where they are too restricted and users start looking for the
+occasions where they are too restricted and users being looking for the
 `privileged` flag.  Capabilities offers a middle ground.

 For example, a system container from which `ping` does not work:
@@ -357,9 +300,9 @@ For example, a system container from which `ping` does not work:
 	...

 Infix supports a subset of all [capabilities][6] that are relevant for
-containers.  Please note, that this is an advanced topic that require
-time and analysis of your container application to figure out which
-capabilities you need.
+containers.  Please note, that this is and advanced topic and will
+require time and analysis of your container application to figure out
+which capabilities you need.


 Networking and Containers
@@ -369,16 +312,9 @@ By default, unlike other systems, persistent[^1] containers have no
 networking enabled.  All network access has to be set up explicitly.
 Currently two types of of container networks are supported:

- - `host`: an managed host interface, e.g., one end of a VETH pair,
-   or even a physical interface
+ - `host`: one end of a VETH pair, or a physical Ethernet port
 - `bridge`: an IP masquerading bridge

-In the former the interface is delegated to (moved into) the container,
-while in the latter a VETH pair is automatically created by Podman and
-one end delegated to the container, while the other end is assigned to
-the bridge (see the next section).
-
-> [!TIP]
 > For more information on VETH pairs, see the [Networking Guide][0].


@@ -411,12 +347,10 @@ have to set manually:
    admin@example:/config/interface/docker0/> set type bridge
    admin@example:/config/interface/docker0/> set container-network type bridge

-> [!IMPORTANT]
-> When configuring the system via an API such as NETCONF or RESTCONF, no
-> settings are inferred.  Instead it is up to the caller to fully define
-> the desired setup.  This makes the CLI very useful for first setup and
-> then extracting the resulting XML from the shell using the `cfg -X`
-> command.
+> **Note:** when doing the same operation over NETCONF there is no
+> inference, so all the "magic" settings need to be defined.  This
+> makes the CLI very useful for first setup and then extracting the
+> resulting XML from the shell using the `cfg -X` command.

 We have to declare the interface as a container network, ensuring the
 interface cannot be used by the system for any other purpose.  E.g., a
@@ -485,12 +419,8 @@ example.

 The network `option` setting is available also for this case, but only
 the `interface_name=foo0` option works.  Which is still very useful.  To
-set:
-
- - IP address, use IPv4/IPv6 settings in the interface settings
- - MAC address, to use the `custom-phys-address` in the interface settings
-
-For an example of both, see the next section.
+change the MAC address, you need to use the `custom-phys-address` in the
+general network settings.

 [^3]: Something which the container bridge network type does behind the
    scenes with one end of an automatically created VETH pair.
@@ -517,7 +447,6 @@ line where we declare the `ntpd` end as a container network interface:
    admin@example:/config/interface/ntpd/> set custom-phys-address static 00:c0:ff:ee:00:01
    admin@example:/config/interface/ntpd/> set container-network

-> [!TIP]
 > Notice how you can also set a custom MAC address at the same time.

 Adding the interface to the container is the same as before, but since
@@ -527,7 +456,6 @@ can take a bit of a shortcut.
    admin@example:/config/container/ntpd/> set network interface ntpd
    admin@example:/config/container/ntpd/> leave

-> [!TIP]
 > Use the `set network interface ntpd option interface_name=foo0` to set
 > the name of the interface inside the container to `foo0`.

@@ -550,7 +478,6 @@ We start by adding the second VETH pair:
    admin@example:/config/interface/veth1a/> set veth peer veth1
    admin@example:/config/interface/veth1a/> set ipv4 address 192.168.1.2 prefix-length 24

-> [!NOTE]
 > The LAN bridge (br1) in this example has IP address 192.168.1.1.

 When a container has multiple host interfaces it can often be useful to
@@ -602,40 +529,29 @@ file system:
    admin@example:/config/container/system/mount/leds> end
    admin@example:/config/container/system/>

-Any type of file can be *bind mounted* into the container, just watch
-out for permissions though.  In the example above, `/sys/class/leds` is
-not writable from a container unless it runs in *privileged* mode.  For
-plain configuration files you get more freedom, and your container can
-rely on, e.g., *inotify* events to trigger reloading its services when
-you change the file on the host.
-
-So it depends on the container, and indeed your overall setup, what to
-use.  An intriguing option is *Content Mounts*, which when changed also
-trigger a container restart.
-
-Other times *volumes* are a better fit.  A volume is an automatically
+Sometimes *volumes* are a better fit.  A volume is an automatically
 created read-writable entity that follows the life of your container.

    admin@example:/config/container/ntpd/> set volume varlib target /var/lib

-Volumes are persistent across both reboots and upgrades of the base
-image.  They are created by Podman when the container first starts up,
-unlike a regular bind mount it synchronizes with the contents of the
-underlying container image's path at first use.  I.e., "bind-mount, if
-empty: then rsync".
+Volumes survive reboots and upgrading of the base image, unlike the
+persistent writable layer you get by default, which does not survive
+upgrades.  The volume is created by podman when the container first
+starts up, unlike a regular bind mount it synchronizes with the contents
+of the underlying container image's path on the first start.  I.e.,
+"bind-mount, if empty: then rsync".

-> [!NOTE]
 > Infix support named volumes (only), and it is not possible to share a
 > volume between containers.  All the tricks possible with volumes may
 > be added in a later release.

 ### Content Mounts

-Content mounts are a special type of file mount where the file contents
-is stored with the container configuration.  This can be very useful
-when deploying similar systems at multiple sites.  When the host loads
-its `startup-config` (or even `factory-config`) a temporary file is
-created using the decoded base64 data from the `content` node.
+Content mount is a special type of where the file contents for the
+container is stored alongside the container configuration.  This can be
+very useful when deploying similar systems at multiple sites.  When the
+host loads its `startup-config` (or even `factory-config`) a temporary
+file is created using the decoded base64 data from the `content` node.

    admin@example:/config/container/ntpd/> edit mount ntpd.conf
    admin@example:/config/container/ntpd/mount/ntpd.conf> text-editor content
@@ -648,10 +564,9 @@ The editor is a small [Emacs clone called Mg][2], see the built-in help
 text, or press Ctrl-x Ctrl-c to exit and save.  When the editor exits
 the contents are base64 encoded and stored in the candidate datastore.

-> [!NOTE]
-> Since these files are always recreated when the host is restarted,
-> changes made by the container are not preserved, or saved back to the
-> host's startup-config.
+> **Note:** since these files are always recreated when the host is
+> restarted, changes made by the container are not preserved, or saved
+> back to the host's startup-config even if the read-only option is off.

 Infix has three different text editors available.  For more information,
 see [CLI Text Editor](cli/text-editor.md).
@@ -673,11 +588,10 @@ we created previously:
    admin@example:/config/container/system/> set publish 222:22
    admin@example:/config/container/system/> leave

-> [!NOTE]
-> Ensure you have a network connection to the registry.  If the image
-> cannot be pulled, creation of the container will be put in a queue and
-> be retried every time there is a change in the routing table, e.g.,
-> default route is added, and every 60 seconds.
+> **Note:** ensure you have a network connection to the registry.
+> If the image cannot be pulled, creation of the container will be
+> put in a queue and be retried every time there is a change in the
+> routing table, e.g., default route is added.

 Provided the image is downloaded successfully, a new `system` container
 now runs behind the docker0 interface, forwarding container port 22 to
@@ -793,13 +707,12 @@ Another *insecure* approach is to access the host system directly,
 bypassing the namespaces that make up the boundary between host and
 container.

-> [!CAUTION]
-> Please note, this completely demolishes the isolation barrier between
-> container and host operating system.  It is only suitable in
-> situations where the container serves more as a unit of distribution
-> rather than as a separate component of the system.  *Strongly
-> recommended* to use this only in trusted setups!  Consider also
-> limiting the time frame in which this is active!
+> **Security:** Please note, this completely demolishes the isolation
+> barrier between container and host operating system.  It is only
+> suitable in situations where the container serves more as a unit of
+> distribution rather than as a separate component of the system.
+> *Strongly recommended* to use this only in trusted setups!  Consider
+> also limiting the time frame in which this is active!

 First, enable *Privileged* mode, this unlocks the door and allows the
 container to manage resources on the host system.  An example is the
@@ -834,58 +747,6 @@ control an Infix system this way, see [Scripting Infix](scripting.md).
 	it may not be enabled by default in BusyBox.


-Container Requirements
----------------------
-
-In addition to general [*best practices*][7] for container images, there
-are a few more things to consider when targeting embedded systems:
-
- - Ensure the image targets the CPU architecture of the target system,  
-   learn more about [Multi-platform Builds][8]
- - Follow [best practices for naming and tagging][10], e.g., `:latest` vs `:1.0`
- - Follow [OCI recommendations and layout][9],  
-   learn more about [OCI and Docker Exporters][6]
-
-If the [Docker documentation][11] is not enough, there are plenty of
-[guides online][12] with examples on how to create your own container
-image.  For the more advanced, please see the next section.
-
-
-### Advanced Users
-
-Most people prefer their system containers small, often based on Alpine
-Linux, or similar, with only a few small applications, including their
-own, and an SSH server perhaps.  For some developers, even this is too
-big, so they roll their own from source.  This section is for you.
-
-Depending on your needs, here is a checklist:
-
- - you need something that can forward signals, e.g.,
-   - [tini][]
-   - [Bash only][13], or
-   - BusyBox init, a classic most embedded developers know, but read on ...
- - a system container only need the bare necessities of a system bringup
-   - E.g., BusyBox's init, [but not everything][15]
-   - Some of the networking is set up by Podman and CNI for you, but
-     you may want to run a DHCP client?
-   - Do *not* rename interfaces inside the container, use the dedicated
-     `interface_name` option in the configuration instead
-   - Remember, Podman provides a `tmpfs` for all critical system paths:
-     `/dev`, `/dev/shm`, `/run`, `/tmp`, and `/var/tmp`, so you don't
-     need to clean or set up any of these mount points
-
-Examples using `tini` and BusyBox init are available from the KernelKit
-[curiOS project][14].  It is a small Buildroot based container image
-builder that generates OCI compatible image tarballs without any tools
-from Docker or Podman -- ready-made images exist for testing on both
-AMD64 and ARM64 targets, as well as `docker pull` images and and OCI
-tarballs with SHA256 checksums for integrity checking.
-
-Finally, if you build your own version of Infix, and embed OCI tarballs
-in the system image, then see the tip at the end of [Upgrading a
-Container Image](#upgrading-a-container-image) (above).
-
-
 [0]:      networking.md
 [1]:      https://github.com/kernelkit/infix/blob/main/src/confd/yang/infix-containers.yang
 [2]:      https://github.com/troglobit/mg
@@ -893,14 +754,4 @@ Container Image](#upgrading-a-container-image) (above).
 [4]:      system.md#ssh-authorized-key
 [5]:      https://docs.docker.com/build/exporters/oci-docker/
 [6]:      https://man7.org/linux/man-pages/man7/capabilities.7.html
-[7]:      https://docs.docker.com/build/building/best-practices/
-[8]:      https://docs.docker.com/build/building/multi-platform/
-[9]:      https://github.com/opencontainers/image-spec/blob/main/image-layout.md
-[10]:     https://docs.docker.com/get-started/docker-concepts/building-images/build-tag-and-publish-an-image/#tagging-images
-[11]:     https://www.docker.com/blog/multi-arch-images/
-[12]:     https://lemariva.com/blog/2018/05/tutorial-docker-on-embedded-systems-raspberry-pi-beagleboard
-[13]:     https://sirikon.me/posts/0009-pid-1-bash-script-docker-container.html
-[14]:     https://github.com/kernelkit/curiOS/
-[15]:     https://github.com/kernelkit/curiOS/blob/2e4748f65e356b2c117f586cd9420d7ba66f79d5/board/system/rootfs/etc/inittab
-[tini]:   https://github.com/krallin/tini
 [podman]: https://podman.io
@@ -16,14 +16,14 @@ seen in the response.

 In the example below, the PC is connected to Infix via interface *tap0*
 (*tap0* is *if1* in Figure 1) and Infix responds with address
-*fe80::ff:fec0:ffed*.
+*fe80::ff:fe00:0*.

 ```
 linux-pc:# ping -6 -L -c 3 ff02::1%tap0
 PING ff02::1%tap0(ff02::1%tap0) 56 data bytes
-64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=1 ttl=64 time=0.558 ms
-64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=2 ttl=64 time=0.419 ms
-64 bytes from fe80::ff:fec0:ffed%tap0: icmp_seq=3 ttl=64 time=0.389 ms
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=1 ttl=64 time=0.558 ms
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=2 ttl=64 time=0.419 ms
+64 bytes from fe80::ff:fe00:0%tap0: icmp_seq=3 ttl=64 time=0.389 ms

 --- ff02::1%tap0 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 2043ms
@@ -34,9 +34,9 @@ linux-pc:#
 The PC could connect then connect to Infix, e.g., using SSH.

 ```
-linux-pc:# ssh admin@fe80::ff:fec0:ffed%tap0
-admin@fe80::ff:fec0:ffed%tap0's password: admin
-admin@infix-c0-ff-ee:~$ 
+linux-pc:# ssh admin@fe80::ff:fe00:0%tap0
+admin@fe80::ff:fe00:0%tap0's password: admin
+admin@infix-00-00-00:~$ 
 ```

 ## Discovery mechanisms available in Infix
@@ -55,18 +55,18 @@ linux-pc:# tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:51:52.061071 LLDP, length 193
    Chassis ID TLV (1), length 7
-      Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
+      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
    Port ID TLV (2), length 7
-      Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
+      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
    Time to Live TLV (3), length 2: TTL 120s
-    System Name TLV (5), length 14: infix-c0-ff-ee
+    System Name TLV (5), length 14: infix-00-00-00
    System Description TLV (6), length 91
      Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
    System Capabilities TLV (7), length 4
      System  Capabilities [Bridge, WLAN AP, Router, Station Only] (0x009c)
      Enabled Capabilities [Station Only] (0x0080)
    Management Address TLV (8), length 24
-      Management Address length 17, AFI IPv6 (2): fe80::ff:fec0:ffed
+      Management Address length 17, AFI IPv6 (2): fe80::ff:fe00:0
      Interface Index Interface Numbering (2): 2
    Port Description TLV (4), length 4: eth0
    Organization specific TLV (127), length 9: OUI IEEE 802.3 Private (0x00120f)
@@ -97,11 +97,11 @@ linux-pc:# sudo tcpdump -i tap0 -Qin -v ether proto 0x88cc
 tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
 15:46:07.908665 LLDP, length 207
    Chassis ID TLV (1), length 7
-      Subtype MAC address (4): 02:00:00:c0:ff:ee (oui Unknown)
+      Subtype MAC address (4): 02:00:00:00:00:00 (oui Unknown)
    Port ID TLV (2), length 7
-      Subtype MAC address (3): 02:00:00:c0:ff:ee (oui Unknown)
+      Subtype MAC address (3): 02:00:00:00:00:00 (oui Unknown)
    Time to Live TLV (3), length 2: TTL 120s
-    System Name TLV (5), length 14: infix-c0-ff-ee
+    System Name TLV (5), length 14: infix-00-00-00
    System Description TLV (6), length 91
      Infix by KernelKit Linux 5.19.17 #1 SMP PREEMPT_DYNAMIC Wed Jun 7 08:47:23 CEST 2023 x86_64
    System Capabilities TLV (7), length 4
@@ -134,15 +134,6 @@ linux-pc:#
    (LLDP)](https://github.com/lldp/lldpd) includes *lldpcli*, which
    is handy to sniff and display LLDP packets.

-The LLDP service can be disabled using the following commands.
-
-```
-admin@infix-c0-ff-ee:/> configure
-admin@infix-c0-ff-ee:/config/> no lldp 
-admin@infix-c0-ff-ee:/config/> leave
-admin@infix-c0-ff-ee:/> 
-```
-
 ### mDNS

 DNS-SD/mDNS can be used to discover Infix units and services. Infix
@@ -153,138 +144,33 @@ be used to search for devices advertising their services via mDNS.

 ```
 linux-pc:# avahi-browse -ar
-+   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
-+   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
-+   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
-+   tap0 IPv4 infix-c0-ff-ee                                SSH Remote Terminal  local
-=   tap0 IPv4 infix-c0-ff-ee                                SFTP File Transfer   local
-   hostname = [infix-c0-ff-ee.local]
+   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
+   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
+   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
+   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
+=   tap0 IPv4 infix-00-00-00                                SFTP File Transfer   local
+   hostname = [infix-00-00-00.local]
   address = [10.0.1.1]
   port = [22]
   txt = []
-=   tap0 IPv4 infix-c0-ff-ee                                SSH Remote Terminal  local
-   hostname = [infix-c0-ff-ee.local]
+=   tap0 IPv4 infix-00-00-00                                SSH Remote Terminal  local
+   hostname = [infix-00-00-00.local]
   address = [10.0.1.1]
   port = [22]
   txt = []
-=   tap0 IPv6 infix-c0-ff-ee                                SFTP File Transfer   local
-   hostname = [infix-c0-ff-ee.local]
-   address = [fe80::ff:fec0:ffed]
+=   tap0 IPv6 infix-00-00-00                                SFTP File Transfer   local
+   hostname = [infix-00-00-00.local]
+   address = [fe80::ff:fe00:0]
   port = [22]
   txt = []
-=   tap0 IPv6 infix-c0-ff-ee                                SSH Remote Terminal  local
-   hostname = [infix-c0-ff-ee.local]
-   address = [fe80::ff:fec0:ffed]
+=   tap0 IPv6 infix-00-00-00                                SSH Remote Terminal  local
+   hostname = [infix-00-00-00.local]
+   address = [fe80::ff:fe00:0]
   port = [22]
   txt = []
 ^C
 linux-pc:#
 ```
-
-Additionally, *avahi-resolve-host-name* can be used to verify domain
-name mappings for IP addresses. By default, it translates from IPv4
-addresses. This function allows users to confirm that addresses are
-mapped correctly.
-
-```
-linux-pc:# avahi-resolve-host-name infix-c0-ff-ee.local
-infix-c0-ff-ee.local	10.0.1.1
-linux-pc:#
-```
-
-Thanks to mDNS we can use the advertised name instead of the IP
-address for operations like `ping` and `ssh` as shown below:
-
-```
-linux-pc:# ping infix-c0-ff-ee.local -c 3
-PING infix-c0-ff-ee.local (10.0.1.1) 56(84) bytes of data.
-64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.852 ms
-64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=1.12 ms
-64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.35 ms
-
--- infix-c0-ff-ee.local ping statistics ---
-3 packets transmitted, 3 received, 0% packet loss, time 2003ms
-rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
-
-linux-pc:# ssh admin@infix-c0-ff-ee.local
-(admin@infix-c0-ff-ee.local) Password: 
-.-------.
-|  . .  | Infix -- a Network Operating System
-|-. v .-| https://kernelkit.org
-'-'---'-
-
-Run the command 'cli' for interactive OAM
-
-linux-pc:#
-```
-
-To disable mDNS/mDNS-SD, type the commands:
-```
-admin@infix-c0-ff-ee:/> configure 
-admin@infix-c0-ff-ee:/config/> no mdns
-admin@infix-c0-ff-ee:/config/> leave
-```
-
-#### Human-Friendly Hostname Alias
-
-Each Infix unit will advertise itself as *infix.local*, in addition to
-its full hostname (e.g., *infix-c0-ff-ee.local* or *foo.local*).  This
-alias works seamlessly on a network with a single Infix device, and
-makes it easy to connect when the exact hostname is not known in
-advance. The examples below show how the alias can be used for
-actions such as pinging or establishing an SSH connection:
-
-```
-linux-pc:# ping infix.local -c 3
-PING infix.local (10.0.1.1) 56(84) bytes of data.
-64 bytes from 10.0.1.1: icmp_seq=1 ttl=64 time=0.751 ms
-64 bytes from 10.0.1.1: icmp_seq=2 ttl=64 time=2.28 ms
-64 bytes from 10.0.1.1: icmp_seq=3 ttl=64 time=1.42 ms
-
--- infix.local ping statistics ---
-3 packets transmitted, 3 received, 0% packet loss, time 2003ms
-rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
-
-linux-pc:# ssh admin@infix.local
-(admin@infix.local) Password: 
-.-------.
-|  . .  | Infix -- a Network Operating System
-|-. v .-| https://kernelkit.org
-'-'---'-
-
-Run the command 'cli' for interactive OAM
-
-linux-pc:#
-```
-
-When multiple Infix devices are present on the LAN the alias will not
-uniquely identify a device; *infix.local* will refer to any of the
-Infix devices, likely the one that first appeared.
-
-> When multiple Infix units are present, use the full hostname (e.g.,
-> *infix-c0-ff-ee.local* or *foo.local*) rather than the alias
-> infix.local to deterministically connect to a unit.
-
-
-#### Netbrowse service to find all your devices
-
-Another mDNS alias that all Infix devices can advertise is
-*network.local*. This is a web service which basically runs avahi-browse
-and displays a table of other Infix devices and their services. 
-
-![Netbrowse Service - network.local](img/network-local.png)
-
-With multiple Infix devices on the LAN, one will be your portal to
-access all others, if it goes down another will take its place.
-
-To disable the netbrowse service, the following commands can be used:
-```
-admin@infix-c0-ff-ee:/> configure 
-admin@infix-c0-ff-ee:/config/> edit web
-admin@infix-c0-ff-ee:/config/web/> no netbrowse
-admin@infix-c0-ff-ee:/config/web/> leave
-```
-
 [^2]: [mdns-scan](http://0pointer.de/lennart/projects/mdns-scan/): a
    tool for scanning for mDNS/DNS-SD published services on the local
    network
@@ -7,10 +7,9 @@ model forms the base, extended with [ietf-ip.yang][2] and other layer-3
 IETF models.  The layer-2 bridge and aggregate models are defined by
 Infix to exploit the unique features not available in IEEE models.

-> [!IMPORTANT]
-> When issuing `leave` to activate your changes, remember to also save
-> your settings, `copy running-config startup-config`.  See the [CLI
-> Introduction](cli/introduction.md) for a background.
+> **Note:** when issuing `leave` to activate your changes, remember to
+> also save your settings, `copy running-config startup-config`.  See
+> the [CLI Introduction](cli/introduction.md) for a background.


 ## Interface LEGO®
@@ -104,11 +103,10 @@ The `description` is saved as Linux `ifalias` on an interface.  It is a
 free-form string, useful for describing purpose or just adding comments
 for remote debugging, e.g., using the operational datastore.

-> [!CAUTION]
-> There is no validation or safety checks performed by the system when
-> using `custom-phys-address`.  In particular the `offset` variant can
-> be dangerous to use -- pay attention to the meaning of bits in the
-> upper-most octet: local bit, multicast/group, etc.
+> **Note:** there is no validation or safety checks performed by the
+> system when using `custom-phys-address`.  In particular the `offset`
+> variant can be dangerous to use -- pay attention to the meaning of
+> bits in the upper-most octet: local bit, multicast/group, etc.

 #### Fixed custom MAC

@@ -169,14 +167,11 @@ admin@example:/config/> leave

 Here we add two ports to bridge `br0`: `eth0` and `eth1`.

-> [!TIP]
-> Infix has many built-in helpers controlled by convention.  Example,
-> naming your bridge `brN`, where `N` is a number, hints Infix to set
-> interface type automatically and unlocks all bridge features.  Other
-> "magic" names are `vethNA`, where `N` is a number and `A` is a letter
-> ('a' for access port and 'b' for bridge side is common), and `ethN.M`
-> for VLAN M on top of `ethN`, or `dockerN` to create an IP masquerading
-> container bridge.
+> **Note:** Infix has many built-in helpers controlled by convention.
+> E.g., if you name your bridge `brN`, where `N` is a number, Infix sets
+> the interface type automatically and unlocks all bridge features.
+> Other "magic" names are `ethN.M` for VLAN M on top of `ethN`, or
+> `dockerN` to create an IP masquerading container bridge.

 ![A MAC bridge with two ports](img/mac-bridge.svg)

@@ -219,15 +214,9 @@ admin@example:/config/interface/br0/> set bridge vlans vlan 10 tagged br0
 admin@example:/config/interface/br0/> set bridge vlans vlan 20 tagged br0
 ```

-To route or to manage via a VLAN, a VLAN interface needs to be created
-on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
-below for more on this topic.
-
-> [!NOTE]
-> In some use-cases only a single management VLAN on the bridge is used.
-> For the example above, if the bridge itself is an untagged member only
-> in VLAN 10, IP addresses can be set directly on the bridge without the
-> need for dedicated VLAN interfaces on top of the bridge.
+> To route or to manage via a VLAN, a VLAN interface needs to be created
+> on top of the bridge, see section [VLAN Interfaces](#vlan-interfaces)
+> below for more on this topic.


 #### Multicast Filtering and Snooping
@@ -238,11 +227,10 @@ also supports "snooping", i.e., IGMP and MLD, to automatically reduce
 the broadcast effects of multicast.  See the next section for a summary
 of the [terminology used](#terminology--abbreviations).

-> [!IMPORTANT]
-> Currently there is no way to just enable multicast filtering without
-> also enabling snooping.  This may change in the future, in which case
-> a `filtering` enabled setting will be made available along with the
-> existing `snooping` setting.
+> **Note:** currently there is no way to just enable multicast filtering
+> without also enabling snooping.  This may change in the future, in
+> which case a `filtering` enabled setting will be made available along
+> with the existing `snooping` setting.

 When creating your bridge you must decide if you need a VLAN filtering
 bridge or a plain bridge (see previous section).  Multicast filtering is
@@ -382,52 +370,19 @@ an IGMP/MLD fast-leave port.
   tables shown above, a *None* timeout is declared when the current
   device is the active querier

-> [!TIP]
-> The reason why multicast flooding is enabled by default is to ensure
-> safe co-existence with MAC multicast, which is common in industrial
-> networks.  It also allows end devices that do not know of IGMP/MLD to
-> communicate over multicast as long as the group they have chosen is
-> not used by other IGMP/MLD aware devices on the LAN.
+> **Note:** the reason why multicast flooding is enabled by default is
+> to ensure safe co-existence with MAC multicast, which is very common
+> in industrial networks.  It also allows end devices that do not know
+> of IGMP/MLD to communicate over multicast as long as the group they
+> have chosen is not used by other IGMP/MLD aware devices on the LAN.
 >
 > As soon as an IGMP/MLD membership report to "join" a group is received
-> the group is added to the kernel MDB and forwarding to other ports
-> stop.  The only exception to this rule is multicast router ports.
->
-> If your MAC multicast forwarding is not working properly, it may be
-> because an IP multicast group maps to the same MAC address.  Please
-> see [RFC 1112][RFC1112] for details.  Use static multicast router
-> ports, or static multicast MAC filters, to mitigate.
+> the group is added to the MDB and forwarding to other ports stop.  The
+> only exception to this rule is multicast router ports.

-[RFC1112]: https://www.rfc-editor.org/rfc/rfc1112.html
 [RFC3376]: https://www.rfc-editor.org/rfc/rfc3376.html
 [RFC3810]: https://www.rfc-editor.org/rfc/rfc3810.html

-#### Forwarding of IEEE Reserved Group Addresses
-
-Addresses in range `01:80:C2:00:00:0X` are used by various bridge
-signaling protocols, and are not forwarded by default. Still, it is
-sometimes useful to let the bridge forward such packets, and Infix
-supports this by specifying protocol names or the last address
-*nibble* as decimal value `0..15`.
-
-```
-admin@example:/config/> edit interface br0 bridge
-admin@example:/config/interface/br0/bridge/> set ieee-group-forward <?>
-  [0..15]  List of IEEE link-local protocols to forward, e.g., STP, LLDP
-  dot1x    802.1X Port-Based Network Access Control.
-  lacp     802.3 Slow Protocols, e.g., LACP.
-  lldp     802.1AB Link Layer Discovery Protocol (LLDP).
-  stp      Spanning Tree (STP/RSPT/MSTP).
-admin@example:/config/interface/br0/bridge/> set ieee-group-forward
-```
-
-The following example configures bridge *br0* to forward LLDP packets.
-
-```
-admin@example:/config/interface/br0/bridge/> set ieee-group-forward lldp
-admin@example:/config/interface/br0/bridge/>
-```
-
 ### VLAN Interfaces

 Creating a VLAN can be done in many ways. This section assumes VLAN
@@ -470,9 +425,7 @@ As conventions, a VLAN interface for VID 20 on top of an Ethernet
 interface *eth0* is named *eth0.20*, and a VLAN interface for VID 10 on
 top of a bridge interface *br0* is named *vlan10*.

-> [!NOTE]
-> If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a
-> number, Infix will set the interface type automatically for you.
+> **Note:** If you name your VLAN interface `foo0.N` or `vlanN`, where `N` is a number, Infix will set the interface type automatically for you.


 ### Physical Ethernet Interfaces
@@ -531,10 +484,9 @@ Auto-negotiation of speed/duplex mode is desired in almost all
 use-cases, but it is possible to disable auto-negotiation and specify
 a fixed speed and duplex mode.

-> [!IMPORTANT]
-> When setting a fixed speed and duplex mode, ensure both sides of the
-> link have matching configuration.  If speed does not match, the link
-> will not come up.  If duplex mode does not match, the result is
+> If setting a fixed speed and duplex mode, ensure both sides of the
+> link have matching configuration. If speed does not match, the link
+> will not come up. If duplex mode does not match, the result is
 > reported collisions and/or bad throughput.

 The example below configures port eth3 to fixed speed 100 Mbit/s
@@ -627,10 +579,9 @@ interfaces {
 admin@example:/config/>
 ```

-> [!TIP]
-> This is another example of the automatic inference of the interface
-> type from the name.  Any name can be used, but then you have to set
-> the interface type to `veth` manually.
+> **Note:** this is another example of the automatic inference of the
+> interface type from the name.  Any name can be used, but then you have
+> to set the interface type to `veth` manually.


 ## Management Plane
@@ -652,8 +603,7 @@ Multiple address assignment methods are available:
 | link-local | infix-ip          | Auto-assignment of IPv4 address in 169.254.x.x/16 range        |
 | dhcp       | infix-dhcp-client | Assignment of IPv4 address by DHCP server, e.g., *10.0.1.1/24* |

-> [!NOTE]
-> The DHCP address method is only available for *LAN* interfaces
+> **Note:** DHCP address method is only available for *LAN* interfaces
 > (Ethernet, virtual Ethernet (veth), bridge, link aggregates, etc.)

 Supported DHCP (request) options, configurability (Cfg) and defaults,
@@ -687,10 +637,9 @@ client is not enabled, any NTP servers provided by the DHCP server will
 be ignored. For details on how to enable the NTP client, see the 
 [NTP Client Configuration](system.md#ntp-client-configuration) section.

-> [!IMPORTANT]
-> Per [RFC3442][4], if the DHCP server returns both a Classless Static
-> Routes option (121) and Router option (3), the DHCP client *must*
-> ignore the latter.
+> **Note:** as per [RFC3442][4], if the DHCP server returns both a
+> Classless Static Routes option (121) and Router option (3), the
+> DHCP client *must* ignore the latter.


 ### IPv6 Address Assignment
@@ -957,10 +906,9 @@ The base model, ietf-routing, is where all the other models hook in.  It
 is used to set configuration and read operational status (RIB tables) in
 the other models.

-> [!NOTE]
-> The standard IETF routing models allows multiple instances, but Infix
-> currently *only support one instance* per routing protocol!  In the
-> examples presented here, the instance name `default` is used.
+> **Note:** the standard IETF routing models allows multiple instances,
+> but Infix currently *only support one instance* per routing protocol!
+> In the examples presented here, the instance name `default` is used.


 ### IPv4 Static routes
@@ -986,7 +934,6 @@ router 192.168.1.1, using the highest possible distance:
    admin@example:/config/routing/control-plane-protocol/static/name/default/> leave
    admin@example:/>

-> [!TIP]
 > Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
 > interfaces you want to route between.

@@ -1010,7 +957,6 @@ enable OSPF and set one active interface in area 0:
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/> leave
    admin@example:/>

-> [!TIP]
 > Remember to enable [IPv4 forwarding](#IPv4-forwarding) for all the
 > interfaces you want to route between.

@@ -1065,38 +1011,6 @@ an Ethernet interface can be done as follows.
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/> set interface-type point-to-point
    admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/area/0.0.0.0/interface/e0/>

-#### OSPF global settings
-
-In addition to *area* and *interface* specific settings, OSPF provides
-global settings for route redistribution and OSPF router identifier.
-
-```
-admin@example:/config/> edit routing control-plane-protocol ospfv2 name default ospf
-admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set ?
-  area                     List of OSPF areas.
-  default-route-advertise  Distribute default route to network
-  explicit-router-id       Defined in RFC 2328.  A 32-bit number
-  redistribute             Redistribute protocols into OSPF
-admin@example:/config/routing/control-plane-protocol/ospfv2/name/default/ospf/> set
-```
-
- Explicit router ID: By default the router will pick an IP address
-  from one of its OSPF interfaces as OSPF router ID. An explicit ID is
-  used to get a deterministic behavior, e.g., `set explicit-router-id
-  1.1.1.1`.
- Redistribution: `set redistribute static` and `set redistribute connected`
-  can be used to include static or connected routes into the OSPF routing
-  domain. These routes are redistributed as *external type-2* (E2)
-  routes.
- Advertising default route: An OSPF router can be made to distribute
-  a default route into the OSPF domain by command `set
-  default-route-advertise enabled`. This route is distributed as long
-  as the router itself has an *active* default route in its routing
-  table. By adding command `set default-route-advertise always` the
-  router will distribute a default route even when it lacks a default
-  route. The default route will be distributed as an *external type-2*
-  (E2) route.
-

 #### Debug OSPFv2

@@ -1199,11 +1113,10 @@ different next-hop, learned from a DHCP server wins over an OSPF route.
 The distance used for static routes and DHCP routes can be changed by
 setting a different *routing preference* value.

-> [!NOTE]
-> The kernel metric is an unsigned 32-bit value, which is read by Frr as
-> (upper) 8 bits distance and 24 bits metric.  But it does not write it
-> back to the kernel FIB this way, only selected routes are candidates
-> to be installed in the FIB by Frr.
+> **Note:** the kernel metric is an unsigned 32-bit value, which is read
+> by Frr as (upper) 8 bits distance and 24 bits metric.  But it does not
+> write it back to the kernel FIB this way, only selected routes are
+> candidates to be installed in the FIB by Frr.


 #### Source protocol
@@ -653,70 +653,6 @@ on interface *e0*.
 ~$ 
 ```

-### Change a Binary Setting
-
-A YANG `binary` type setting is Base64 encoded and requires a little bit
-more tricks.  We take the opportunity to showcase a shell script helper:
-`/usr/bin/text-editor`, which works just like the `text-editor` command
-in the CLI, but this one takes an XPath argument to the binary leaf to
-edit.
-
-Stripped down, it looks something like this:
-
-```bash
-if tmp=$(sysrepocfg -G "$xpath"); then
-    file=$(mktemp)
-
-	echo "$tmp" | base64 -d > "$file"
-	if edit "$file"; then
-		tmp=$(base64 -w0 < "$file")
-		sysrepocfg -S "$xpath" -u "$tmp"
-	fi
-
-	rm -f "$file"
-else
-	echo "Failed to retrieve value for $xpath"
-	exit 1
-fi
-```
-
-An example container configuration, with an embedded file that is
-mounted to `/var/www/index.html` can look like this:
-
-```json
-  "infix-containers:containers": {
-    "container": [
-      {
-        "name": "web",
-        "image": "oci-archive:/lib/oci/curios-httpd-latest.tar.gz",
-        "hostname": "web",
-        "network": {
-          "interface": [
-            {
-              "name": "veth-sys0"
-            }
-          ]
-        },
-        "mount": [
-          {
-            "name": "index.html",
-            "content": "PCFET0NUWVBFIGh0bWwjibberish.shortened.down==",
-            "target": "/var/www/index.html"
-          }
-        ]
-      }
-    ]
-  }
-``` 
-
-The command to edit this file, and restart the container with the new
-contents, look like this:
-
-```
-admin@infix:~$ cfg edit "/infix-containers:containers/container[name='web']/mount[name='index.html']/content"
-```
-
-
 ### <a id="backup"></a> Backup Configuration Using sysrepocfg And scp 

 Displaying running or startup configuration is possible with
@@ -1,6 +1,6 @@
 #set DEBUG=1

-run name:bootstrap log:prio:user.notice norestart <usr/ixinit> \
+run name:bootstrap log:prio:user.notice norestart <usr/ixinit-done> \
 	[S] /usr/libexec/confd/bootstrap \
 	-- Bootstrapping YANG datastore

@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  3e7f777a054fbc29173bcdafe50ca096a8abf9e556bec9f52617c9881c9ce3e3  curios-httpd-oci-arm64-v24.11.0.tar.gz
-sha256  bfa52f712301427a21b89cfee31ca315e1404973affaf34b23978a70a3ec4f63  curios-httpd-oci-amd64-v24.11.0.tar.gz
+sha256  988a523bf4be543cb4ea1d3472ce4720e0b92511546817028b90150a3f054e9f  curios-httpd-oci-arm64-v24.05.0.tar.gz
+sha256  25f94a7c44cdbbceca3f89382b8bea0dcd8d178032c97a9113bb69bbc1770528  curios-httpd-oci-amd64-v24.05.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_HTTPD_VERSION = v24.11.0
+CURIOS_HTTPD_VERSION = v24.05.0
 CURIOS_HTTPD_SOURCE = curios-httpd-oci-$(GO_GOARCH)-$(CURIOS_HTTPD_VERSION).tar.gz
 CURIOS_HTTPD_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_HTTPD_VERSION)
 CURIOS_HTTPD_LICENSE = GPL
@@ -13,9 +13,7 @@ CURIOS_HTTPD_LICENSE_FILES = COPYING
 define CURIOS_HTTPD_INSTALL_TARGET_CMDS
 	mkdir -p $(TARGET_DIR)/lib/oci
 	cp $(CURIOS_HTTPD_DL_DIR)/$(CURIOS_HTTPD_SOURCE) \
-		$(TARGET_DIR)/lib/oci/$(CURIOS_HTTPD_NAME)-$(CURIOS_HTTPD_VERSION).tar.gz
-	ln -sf $(CURIOS_HTTPD_NAME)-$(CURIOS_HTTPD_VERSION).tar.gz \
-		$(TARGET_DIR)/lib/oci/$(CURIOS_HTTPD_NAME)-latest.tar.gz
+		$(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz
 endef

 $(eval $(generic-package))
@@ -1,4 +1,4 @@
 # Locally computed
 sha256  ab15fd526bd8dd18a9e77ebc139656bf4d33e97fc7238cd11bf60e2b9b8666c6  COPYING
-sha256  95b3625587738cb0a8cc6e9eb41d10a0b2f77ae99dbb1d9b213148d35268eb75  curios-nftables-oci-arm64-v24.11.0.tar.gz
-sha256  4f61ccef90721b8f95a5c7b77b69ccccb5dbd215b9c38986d20e5b245244e902  curios-nftables-oci-amd64-v24.11.0.tar.gz
+sha256  f25651505bf4fc635dc8d391f377b1116837e99dee522ce0691c15b090cee818  curios-nftables-oci-arm64-v24.05.0.tar.gz
+sha256  025c2a5d6c71c62ebbe6f96d8b9ffa3235d6812e87b51645f6e89357d9762669  curios-nftables-oci-amd64-v24.05.0.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-CURIOS_NFTABLES_VERSION = v24.11.0
+CURIOS_NFTABLES_VERSION = v24.05.0
 CURIOS_NFTABLES_SOURCE = curios-nftables-oci-$(GO_GOARCH)-$(CURIOS_NFTABLES_VERSION).tar.gz
 CURIOS_NFTABLES_SITE = https://github.com/kernelkit/curiOS/releases/download/$(CURIOS_NFTABLES_VERSION)
 CURIOS_NFTABLES_LICENSE = GPL
@@ -14,9 +14,7 @@ CURIOS_NFTABLES_INSTALL_TARGET = YES
 define CURIOS_NFTABLES_INSTALL_TARGET_CMDS
 	mkdir -p $(TARGET_DIR)/lib/oci
 	cp $(CURIOS_NFTABLES_DL_DIR)/$(CURIOS_NFTABLES_SOURCE) \
-		$(TARGET_DIR)/lib/oci/$(CURIOS_NFTABLES_NAME)-$(CURIOS_NFTABLES_VERSION).tar.gz
-	ln -sf $(CURIOS_NFTABLES_NAME)-$(CURIOS_NFTABLES_VERSION).tar.gz \
-		$(TARGET_DIR)/lib/oci/$(CURIOS_NFTABLES_NAME)-latest.tar.gz
+		$(TARGET_DIR)/lib/oci/$(notdir $(@D)).tar.gz
 endef

 $(eval $(generic-package))
@@ -1,4 +1,2 @@
-task log:prio:local1.notice,tag:container-flush <pid/syslogd> \
-	[S] container flush -- Cleaning up lingering containers
 service log:prio:local1.err,tag:container \
-	[2345] execd /run/containers/queue -- Container job runner
+	[2345] execd /run/containers/queue /var/lib/containers/active -- Container job runner
@@ -1 +1,8 @@
+d  /run/containers/args		0700 - -
+d  /run/containers/files	0700 - -
+d  /var/lib/containers/active	0700 - -
+d  /var/lib/containers/oci	0755 - -
+d  /run/containers/inbox	0700 - -
 d  /run/containers/queue	0700 - -
+d  /run/cni			0755 - -
+L+ /var/lib/cni                 -    - - - /run/cni
@@ -1,7 +1,7 @@
 From 46ffa81f5c88ce95db011369d8bfb802313e4217 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 17 Oct 2024 14:23:24 +0200
-Subject: [PATCH 1/7] Only mark rdeps dirty if main service is nohup
+Subject: [PATCH 1/6] Only mark rdeps dirty if main service is nohup
 Organization: Addiva Elektronik

 This patch changes a behavior that's been default since Finit 4.0,
@@ -1,7 +1,7 @@
 From 119e66a7e9c95283918639b51dd03a3d666955f8 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 28 Oct 2024 10:58:04 +0100
-Subject: [PATCH 2/7] Reset color attributes and clear screen when starting up
+Subject: [PATCH 2/6] Reset color attributes and clear screen when starting up
 Organization: Addiva Elektronik

 Some boot loaders, like GRUB, leave background color artifacts from
@@ -1,7 +1,7 @@
 From 0c0e880f3fdd38f7bbde618408378dc0a19ff005 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 09:39:46 +0100
-Subject: [PATCH 3/7] plugins: refactor rtc.so
+Subject: [PATCH 3/6] plugins: refactor rtc.so
 Organization: Addiva Elektronik

 Factor out time_set() and time_get() for readability and reuse.
@@ -1,7 +1,7 @@
 From bc8118d515839dc598f437aa01f07a771646968d Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 09:47:16 +0100
-Subject: [PATCH 4/7] Fix #418: support systems with a broken RTC
+Subject: [PATCH 4/6] Fix #418: support systems with a broken RTC
 Organization: Addiva Elektronik

 This patch introduces a new configure option --with-rtc-file=FILE.  When
@@ -1,7 +1,7 @@
 From 6be16f2f6d093ef495d0fe4313f7b05b4ba3e08f Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 10:38:38 +0100
-Subject: [PATCH 5/7] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
+Subject: [PATCH 5/6] Fix buggy --with-rtc-date=DATE, introduced in Finit v4.4
 Organization: Addiva Elektronik

 In 42ef3d3c, for v4.4-rc1, support for setting a custom RTC restore date
@@ -1,7 +1,7 @@
 From 49c0557cedd8d3c1a2f74d27fa7db83dd529914a Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Sun, 3 Nov 2024 20:49:04 +0100
-Subject: [PATCH 6/7] plugins: reduce log level LOG_ERR -> LOG_WARNING
+Subject: [PATCH 6/6] plugins: reduce log level LOG_ERR -> LOG_WARNING
 Organization: Addiva Elektronik

 These plugins signal success and failure directly to the console, the
@@ -1,57 +0,0 @@
-From 465bc17ca4b131f8c1ef27ff8279f4ea13745a78 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 28 Nov 2024 11:06:57 +0100
-Subject: [PATCH 7/7] Fix unintended restart of template siblings
-Organization: Addiva Elektronik
-
-Consider the case where container@.conf is an available template.  When
-creating a container@foo.conf it will share the same base .conf as an
-existing container@bar.conf, but we do not expect to restart bar just
-because foo is instantiated.
-
-Up until this change, all template siblings were considered "dirty" if a
-new one was created or updated.  Skipping realpath() for all files that
-have a '@' works around the problem.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- src/conf.c | 20 +++++++++++++-------
- 1 file changed, 13 insertions(+), 7 deletions(-)
-
-diff --git a/src/conf.c b/src/conf.c
-index 1cfcd87..531923c 100644
--- a/src/conf.c
-+++ b/src/conf.c
-@@ -1432,16 +1432,22 @@ static int conf_change_act(char *dir, char *name, uint32_t mask)
- 		strlcpy(fn, dir, sizeof(fn));
- 	dbg("path: %s mask: %08x", fn, mask);
- 
-	/* Handle disabling/removal of service */
-	rp = realpath(fn, NULL);
-	if (!rp) {
-		if (errno != ENOENT)
-			goto fail;
-+	if (strchr(name, '@')) {
-+		/* Skip realpath for templates */
- 		rp = strdup(fn);
-		if (!rp)
-			goto fail;
-+	} else {
-+		/* Handle disabling/removal of service */
-+		rp = realpath(fn, NULL);
-+		if (!rp) {
-+			if (errno != ENOENT)
-+				goto fail;
-+			rp = strdup(fn);
-+		}
- 	}
- 
-+	if (!rp)
-+		goto fail;
-+
- 	node = conf_find(rp);
- 	if (node) {
- 		dbg("event already registered for %s ...", name);
-- 
-2.43.0
-
@@ -1 +1 @@
-service [S0123456789] <!usr/product,usr/led> iitod -- LED daemon
+service [S0123456789] <!pid/syslogd> iitod -- LED daemon
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  b579d0028c8c88ddea27282f03c8c23fa9a758ad47918aeffb048456cf204375  klish-plugin-sysrepo-b693714a1ff5f8021651d7619556afb19945e5e6-br1.tar.gz
+sha256  58b6b271912f9331ea78a815a8cec073924b423403868dd9fcc48de0942f49f8  klish-plugin-sysrepo-213cd51aa8863e7ef66944137db3dffc88d58cc1-br1.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_PLUGIN_SYSREPO_VERSION = b693714a1ff5f8021651d7619556afb19945e5e6
+KLISH_PLUGIN_SYSREPO_VERSION = 213cd51aa8863e7ef66944137db3dffc88d58cc1
 KLISH_PLUGIN_SYSREPO_SITE = https://github.com/kernelkit/klish-plugin-sysrepo.git
 #KLISH_PLUGIN_SYSREPO_VERSION = cdd3eb51a7f7ee0ed5bd925fa636061d3b1b85fb
 #KLISH_PLUGIN_SYSREPO_SITE = https://src.libcode.org/pkun/klish-plugin-sysrepo.git
@@ -1,3 +1,3 @@
 # Locally calculated
 sha256  9d9d33b873917ca5d0bdcc47a36d2fd385971ab0c045d1472fcadf95ee5bcf5b  LICENCE
-sha256  0305355dd29dc276f7957d51e2406907e0c862dfd46f496c8a921df4f3d72a8d  klish-019ebd2704e322b5d500f5687d526431e535eec8-br1.tar.gz
+sha256  4293851b355285be3564873fc1f92ce5a3f4386fe8ce1195f18a79b55b5c99ac  klish-710a6314c00bc0485221769d73a5b5d6897c1d81-br1.tar.gz
@@ -4,7 +4,7 @@
 #
 ################################################################################

-KLISH_VERSION = 019ebd2704e322b5d500f5687d526431e535eec8
+KLISH_VERSION = 710a6314c00bc0485221769d73a5b5d6897c1d81
 KLISH_SITE = https://github.com/kernelkit/klish.git
 #KLISH_VERSION = tags/3.0.0
 #KLISH_SITE = https://src.libcode.org/pkun/klish.git
@@ -204,6 +204,14 @@ endif

 endif # BR2_PACKAGE_QUAGGA

+ifeq ($(BR2_PACKAGE_RNG_TOOLS),y)
+define SKELETON_INIT_FINIT_SET_RNGD
+	cp $(SKELETON_INIT_FINIT_AVAILABLE)/rngd.conf $(FINIT_D)/available/
+	ln -sf ../available/rngd.conf $(FINIT_D)/enabled/rngd.conf
+endef
+SKELETON_INIT_FINIT_POST_INSTALL_TARGET_HOOKS += SKELETON_INIT_FINIT_SET_RNGD
+endif
+
 ifeq ($(BR2_PACKAGE_SMCROUTE),y)
 define SKELETON_INIT_FINIT_SET_SMCROUTE
 	cp $(SKELETON_INIT_FINIT_AVAILABLE)/smcroute.conf $(FINIT_D)/available/
@@ -1 +1 @@
-service [2345] name:mdns avahi-daemon -s -l notice -- Avahi mDNS-SD daemon
+service [2345] name:mdns avahi-daemon -s -- Avahi mDNS-SD daemon
@@ -1,2 +1 @@
-service <!pid/zebra> env:-/etc/default/ospfd \
-	[2345] ospfd $OSPFD_ARGS -- OSPF daemon
+service [2345] log:null <!pid/zebra> ospfd -A 127.0.0.1 -u frr -g frr -f /etc/frr/ospfd.conf -- OSPF daemon
@@ -1,2 +1 @@
-service <!> pid:!/run/frr/zebra.pid env:-/etc/default/zebra \
-	[2345] zebra $ZEBRA_ARGS -- Zebra routing daemon
+service [2345] <!> pid:!/run/frr/zebra.pid zebra -A 127.0.0.1 -u frr -g frr -- Zebra routing daemon
@@ -0,0 +1 @@
+service [S12345789] log rngd -f -- Entropy gathering daemon (rngd)
@@ -1,8 +1,7 @@
 From 74ec0f8335f811e4f5becc8bbea4a52af4d3e749 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 17 Sep 2024 04:08:12 +0200
-Subject: [PATCH 1/2] On SIGTERM, allow dispatcher to process event before
- exiting
+Subject: [PATCH] On SIGTERM, allow dispatcher to process event before exiting
 Organization: Addiva Elektronik

 On non-systemd systems, like those managed by Finit, when the main PID
@@ -1,145 +0,0 @@
-From bceb724d328f156efa4ad18f26f1760504bd093d Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Wed, 27 Nov 2024 08:44:57 +0100
-Subject: [PATCH 2/2] avahi-daemon: allow adjusting log level
-Organization: Addiva Elektronik
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- avahi-daemon/main.c | 50 ++++++++++++++++++++++++++++++++++++++++-----
- 1 file changed, 45 insertions(+), 5 deletions(-)
-
-diff --git a/avahi-daemon/main.c b/avahi-daemon/main.c
-index 346338f..b7f0969 100644
--- a/avahi-daemon/main.c
-+++ b/avahi-daemon/main.c
-@@ -30,6 +30,7 @@
- #include <unistd.h>
- #include <grp.h>
- #include <pwd.h>
-+#include <sys/param.h>          /* MIN() */
- #include <sys/stat.h>
- #include <sys/ioctl.h>
- #ifdef HAVE_SYS_FILIO_H
-@@ -106,6 +107,7 @@ typedef struct {
-     DaemonCommand command;
-     int daemonize;
-     int use_syslog;
-+    int log_level;
-     char *config_file;
- #ifdef HAVE_DBUS
-     int enable_dbus;
-@@ -419,6 +421,30 @@ static void server_callback(AvahiServer *s, AvahiServerState state, void *userda
-     }
- }
- 
-+static int log_level(const char *arg) {
-+    struct {
-+	const char *name;
-+	int         val;
-+    } prionm[] = {
-+	{ "error",   LOG_ERR     },
-+	{ "warning", LOG_WARNING },
-+	{ "notice",  LOG_WARNING },
-+	{ "info",    LOG_WARNING },
-+	{ "debug",   LOG_WARNING },
-+	{ NULL, 0 },
-+    };
-+    int i;
-+
-+    for (i = 0; prionm[i].name; i++) {
-+	size_t len = MIN(strlen(prionm[i].name), strlen(arg));
-+
-+	if (!strncasecmp(prionm[i].name, arg, len))
-+	    return prionm[i].val;
-+    }
-+
-+    return -1;
-+}
-+
- static void help(FILE *f) {
-     fprintf(f,
-             "%s [options]\n"
-@@ -426,6 +452,7 @@ static void help(FILE *f) {
-             "    -D --daemonize     Daemonize after startup (implies -s)\n"
-             "    -s --syslog        Write log messages to syslog(3) instead of STDERR\n"
-             "    -k --kill          Kill a running daemon\n"
-+	    "    -l --loglevel=LVL  Set log level: err, warn, notice, info*, debug\n"
-             "    -r --reload        Request a running daemon to reload static services\n"
-             "    -c --check         Return 0 if a daemon is already running\n"
-             "    -V --version       Show version\n"
-@@ -437,7 +464,7 @@ static void help(FILE *f) {
-             "       --no-chroot     Don't chroot()\n"
- #endif
-             "       --no-proc-title Don't modify process title\n"
-            "       --debug         Increase verbosity\n",
-+            "       --debug         Increase verbosity, same as -l debug\n",
-             argv0);
- }
- 
-@@ -459,6 +486,7 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
-         { "help",           no_argument,       NULL, 'h' },
-         { "daemonize",      no_argument,       NULL, 'D' },
-         { "kill",           no_argument,       NULL, 'k' },
-+        { "loglevel",       required_argument, NULL, 'l' },
-         { "version",        no_argument,       NULL, 'V' },
-         { "file",           required_argument, NULL, 'f' },
-         { "reload",         no_argument,       NULL, 'r' },
-@@ -476,7 +504,7 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
- 
-     assert(c);
- 
-    while ((o = getopt_long(argc, argv, "hDkVf:rcs", long_options, NULL)) >= 0) {
-+    while ((o = getopt_long(argc, argv, "hDkl:Vf:rcs", long_options, NULL)) >= 0) {
- 
-         switch(o) {
-             case 's':
-@@ -491,6 +519,13 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
-             case 'k':
-                 c->command = DAEMON_KILL;
-                 break;
-+            case 'l':
-+                c->log_level = log_level(optarg);
-+		if (c->log_level == -1) {
-+		    fprintf(stderr, "Invalid log level value\n");
-+		    return -1;
-+		}
-+                break;
-             case 'V':
-                 c->command = DAEMON_VERSION;
-                 break;
-@@ -520,9 +555,6 @@ static int parse_command_line(DaemonConfig *c, int argc, char *argv[]) {
-                 break;
-             case OPTION_DEBUG:
-                 c->debug = 1;
-#ifdef DAEMON_SET_VERBOSITY_AVAILABLE
-                daemon_set_verbosity(LOG_DEBUG);
-#endif
-                 break;
-             default:
-                 return -1;
-@@ -1537,6 +1569,7 @@ int main(int argc, char *argv[]) {
-     config.publish_dns_servers = NULL;
-     config.publish_resolv_conf = 0;
-     config.use_syslog = 0;
-+    config.log_level = LOG_INFO;
-     config.debug = 0;
-     config.rlimit_as_set = 0;
-     config.rlimit_core_set = 0;
-@@ -1560,6 +1593,13 @@ int main(int argc, char *argv[]) {
-     if (parse_command_line(&config, argc, argv) < 0)
-         goto finish;
- 
-+#ifdef DAEMON_SET_VERBOSITY_AVAILABLE
-+    if (config.debug)
-+	daemon_set_verbosity(LOG_DEBUG);
-+    else
-+	daemon_set_verbosity(config.log_level);
-+#endif
-+
-     if (config.modify_proc_title)
-         avahi_init_proc_title(argc, argv);
- 
-- 
-2.43.0
-
@@ -1,29 +0,0 @@
-From 7e7cd106613975c6c4ba25acbb698f15aa4d85e8 Mon Sep 17 00:00:00 2001
-From: Joachim Wiberg <troglobit@gmail.com>
-Date: Thu, 28 Nov 2024 06:38:12 +0100
-Subject: [PATCH] dlog: adjust syslog level in daemon_set_verbosity() too
-Organization: Addiva Elektronik
-
-Allow daemons to adjust not only their logging to stdout/stderr, but
-also what's sent to syslog as well.
-
-Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
---
- libdaemon/dlog.c | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/libdaemon/dlog.c b/libdaemon/dlog.c
-index 3c759f4..d5c217a 100644
--- a/libdaemon/dlog.c
-+++ b/libdaemon/dlog.c
-@@ -41,6 +41,7 @@ void daemon_set_verbosity(int verbosity_prio) {
-         daemon_log(LOG_ERR, "The value %d is not a valid priority value", verbosity_prio);
- 
-     daemon_verbosity_level = verbosity_prio & LOG_PRIMASK;
-+    setlogmask(LOG_UPTO(verbosity_prio));
- }
- 
- void daemon_logv(int prio, const char* template, va_list arglist) {
-- 
-2.43.0
-
@@ -1,7 +1,7 @@
 From 4be3e500b670f7b98e3dd6696b8e51e83f122c65 Mon Sep 17 00:00:00 2001
 From: Christian Marangi <ansuelsmth@gmail.com>
 Date: Thu, 25 Jan 2024 21:36:59 +0100
-Subject: [PATCH 01/35] net: phy: add support for PHY LEDs polarity modes
+Subject: [PATCH 01/33] net: phy: add support for PHY LEDs polarity modes
 Organization: Addiva Elektronik

 Add support for PHY LEDs polarity modes. Some PHY require LED to be set
@@ -22,7 +22,6 @@ Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
 Reviewed-by: Andrew Lunn <andrew@lunn.ch>
 Link: https://lore.kernel.org/r/20240125203702.4552-4-ansuelsmth@gmail.com
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/phy_device.c | 16 ++++++++++++++++
 include/linux/phy.h          | 22 ++++++++++++++++++++++
@@ -1,7 +1,7 @@
 From 4833b140cd11a57dd9f59754cdacfd71bc564c8f Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 4 Dec 2023 11:08:11 +0100
-Subject: [PATCH 02/35] net: mvmdio: Support setting the MDC frequency on XSMI
+Subject: [PATCH 02/33] net: mvmdio: Support setting the MDC frequency on XSMI
 controllers
 Organization: Addiva Elektronik

@@ -1,7 +1,7 @@
 From 50a2973e8a520a82e9f9ec15a1f69e059ce7a334 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:23 +0100
-Subject: [PATCH 03/35] net: dsa: mv88e6xxx: Create API to read a single stat
+Subject: [PATCH 03/33] net: dsa: mv88e6xxx: Create API to read a single stat
 counter
 Organization: Addiva Elektronik

@@ -1,7 +1,7 @@
 From 5916503e23e7f85796c1f927747e66b9535bac53 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:25 +0100
-Subject: [PATCH 04/35] net: dsa: mv88e6xxx: Give each hw stat an ID
+Subject: [PATCH 04/33] net: dsa: mv88e6xxx: Give each hw stat an ID
 Organization: Addiva Elektronik

 With the upcoming standard counter group support, we are no longer
@@ -1,7 +1,7 @@
 From 32dda6562734ec8ee667bc546f3ef56794d5bf82 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:26 +0100
-Subject: [PATCH 05/35] net: dsa: mv88e6xxx: Add "eth-mac" counter group
+Subject: [PATCH 05/33] net: dsa: mv88e6xxx: Add "eth-mac" counter group
 support
 Organization: Addiva Elektronik

@@ -1,7 +1,7 @@
 From 36adbdd466ec550cab8b2ae54177f674c02cf631 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:27 +0100
-Subject: [PATCH 06/35] net: dsa: mv88e6xxx: Limit histogram counters to
+Subject: [PATCH 06/33] net: dsa: mv88e6xxx: Limit histogram counters to
 ingress traffic
 Organization: Addiva Elektronik

@@ -1,7 +1,7 @@
 From abfa532c1149525b128b8c76d80965f55e208240 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 14 Dec 2023 14:50:28 +0100
-Subject: [PATCH 07/35] net: dsa: mv88e6xxx: Add "rmon" counter group support
+Subject: [PATCH 07/33] net: dsa: mv88e6xxx: Add "rmon" counter group support
 Organization: Addiva Elektronik

 Report the applicable subset of an mv88e6xxx port's counters using
@@ -1,13 +1,11 @@
 From 4407b94b4a08536fccb6eea2826955ff12d63ec2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 19:44:32 +0100
-Subject: [PATCH 09/35] net: dsa: mv88e6xxx: Add LED infrastructure
+Subject: [PATCH 09/33] net: dsa: mv88e6xxx: Add LED infrastructure
 Organization: Addiva Elektronik

 Parse DT for LEDs and register them for devices that support it,
 though no actual implementations exist yet.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/Makefile |   1 +
 drivers/net/dsa/mv88e6xxx/chip.c   |   5 +-
@@ -1,15 +1,13 @@
 From a5cf5c0353db07e74d7a29dd4d5c2cb7775d5bec Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 Nov 2023 21:59:35 +0100
-Subject: [PATCH 10/35] net: dsa: mv88e6xxx: Add LED support for 6393X
+Subject: [PATCH 10/33] net: dsa: mv88e6xxx: Add LED support for 6393X
 Organization: Addiva Elektronik

 Trigger support:
 - "none"
 - "timer"
 - "netdev"
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c |   1 +
 drivers/net/dsa/mv88e6xxx/leds.c | 226 +++++++++++++++++++++++++++++++
@@ -1,15 +1,13 @@
 From be94ec851dbb8e55c3f5e82f197b2dc59566aea2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Mar 2024 10:27:24 +0100
-Subject: [PATCH 11/35] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
+Subject: [PATCH 11/33] net: dsa: mv88e6xxx: Fix timeout on waiting for PPU on
 6393X
 Organization: Addiva Elektronik

 In a multi-chip setup, delays of up to 750ms are observed before the
 device (6393X) signals completion of PPU initialization (Global 1,
 register 0, bit 15). Therefore, increase the timeout threshold to 1s.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
@@ -1,7 +1,7 @@
 From 69092f83541e6539ab82eec3052325c403675de4 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 16 Jan 2024 16:00:55 +0100
-Subject: [PATCH 12/35] net: dsa: Support MDB memberships whose L2 addresses
+Subject: [PATCH 12/33] net: dsa: Support MDB memberships whose L2 addresses
 overlap
 Organization: Addiva Elektronik

@@ -29,8 +29,6 @@ as long as the count is positive. Fortunately, all the infrastructure
 needed to do this is already in place, since it is also needed on CPU
 and DSA ports. Thus, "implement" this by simply removing the guards
 which previously skipped reference countung on user ports.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/dsa/switch.c | 16 ----------------
 1 file changed, 16 deletions(-)
@@ -1,7 +1,7 @@
 From 7c19df77212d0728874515e97cf297863a6ff2cd Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 19 Sep 2023 18:38:10 +0200
-Subject: [PATCH 13/35] net: phy: marvell10g: Support firmware loading on
+Subject: [PATCH 13/33] net: phy: marvell10g: Support firmware loading on
 88X3310
 Organization: Addiva Elektronik

@@ -11,8 +11,6 @@ its RAM, ask userspace for the binary and load it over XMDIO.
 We have no choice but to bail out of the probe if firmware is not
 available, as the device does not have any built-in image on which to
 fall back.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 161 +++++++++++++++++++++++++++++++++++
 1 file changed, 161 insertions(+)
@@ -1,15 +1,13 @@
 From 0c34b42b7a72ddf1af6f3534870d647801e493fa Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 21 Nov 2023 20:15:24 +0100
-Subject: [PATCH 14/35] net: phy: marvell10g: Fix power-up when strapped to
+Subject: [PATCH 14/33] net: phy: marvell10g: Fix power-up when strapped to
 start powered down
 Organization: Addiva Elektronik

 On devices which are hardware strapped to start powered down (PDSTATE
 == 1), make sure that we clear the power-down bit on all units
 affected by this setting.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)
@@ -1,7 +1,7 @@
 From 6576918d3348f8e20802379d568d7632228af4d7 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 Nov 2023 20:58:42 +0100
-Subject: [PATCH 15/35] net: phy: marvell10g: Add LED support for 88X3310
+Subject: [PATCH 15/33] net: phy: marvell10g: Add LED support for 88X3310
 Organization: Addiva Elektronik

 Pickup the LEDs from the state in which the hardware reset or
@@ -17,8 +17,6 @@ Trigger support:
 	   software blinking
 - "netdev": Offload link or duplex information to the solid behavior;
  	    tx and/or rx activity to blink behavior.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 422 +++++++++++++++++++++++++++++++++++
 1 file changed, 422 insertions(+)
@@ -1,7 +1,7 @@
 From 1ad7f010e46133c725df5cab4d85f71f689ca191 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 12 Dec 2023 09:51:05 +0100
-Subject: [PATCH 16/35] net: phy: marvell10g: Support LEDs tied to a single
+Subject: [PATCH 16/33] net: phy: marvell10g: Support LEDs tied to a single
 media side
 Organization: Addiva Elektronik

@@ -14,8 +14,6 @@ tied to a particular media side, and use that information to refine
 the offloading of the "netdev" trigger, such that LEDs attached to the
 RJ45 jack only lights up when a copper link is established, and vice
 versa for the SFP cage.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/marvell10g.c | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)
@@ -1,7 +1,7 @@
 From 11b9a3e328241edede03b6615bb9b0f1a40b9b7d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 24 Nov 2023 23:29:55 +0100
-Subject: [PATCH 17/35] nvmem: layouts: onie-tlv: Let device probe even when
+Subject: [PATCH 17/33] nvmem: layouts: onie-tlv: Let device probe even when
 TLV is invalid
 Organization: Addiva Elektronik

@@ -13,8 +13,6 @@ be successfully probed.

 Therefore, settle for reporting data corruption issues in the log, and
 simply refrain from registering any cells in those cases.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/nvmem/layouts/onie-tlv.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)
@@ -1,7 +1,7 @@
 From ce1148b5c2e33541ad13ff2c4769d0b37d4e42b9 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 4 Mar 2024 16:47:28 +0100
-Subject: [PATCH 18/35] net: bridge: avoid classifying unknown multicast as
+Subject: [PATCH 18/33] net: bridge: avoid classifying unknown multicast as
 mrouters_only
 Organization: Addiva Elektronik

@@ -16,7 +16,6 @@ Because a multicast router should always receive both known and unknown
 multicast.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/uapi/linux/if_bridge.h |  1 +
 net/bridge/br.c                |  5 +++++
@@ -1,7 +1,7 @@
 From ce74ee8c5461cc53851ca323b4dfc9937cab0e41 Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Tue, 5 Mar 2024 06:44:41 +0100
-Subject: [PATCH 19/35] net: bridge: Ignore router ports when forwarding L2
+Subject: [PATCH 19/33] net: bridge: Ignore router ports when forwarding L2
 multicast
 Organization: Addiva Elektronik

@@ -1,10 +1,9 @@
 From 3c9b05198e0b7193f2dcddc1860cd77f0adbc3a2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 21 Mar 2024 19:12:15 +0100
-Subject: [PATCH 20/35] net: dsa: Support EtherType based priority overrides
+Subject: [PATCH 20/33] net: dsa: Support EtherType based priority overrides
 Organization: Addiva Elektronik

-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/net/dsa.h |  4 ++++
 net/dsa/slave.c   | 56 +++++++++++++++++++++++++++++++++++++++++++++--
@@ -1,11 +1,10 @@
 From 333134a4ff2b8dd7fb00a75560254de96d1082ad Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Fri, 22 Mar 2024 16:15:43 +0100
-Subject: [PATCH 21/35] net: dsa: mv88e6xxx: Support EtherType based priority
+Subject: [PATCH 21/33] net: dsa: mv88e6xxx: Support EtherType based priority
 overrides
 Organization: Addiva Elektronik

-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    | 64 +++++++++++++++++++++++++++++
 drivers/net/dsa/mv88e6xxx/chip.h    | 21 ++++++++++
@@ -1,7 +1,7 @@
 From cdddc24c05cedc0d0fabc48da17ec26aeb7c1ef9 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 10:10:19 +0100
-Subject: [PATCH 22/35] net: phy: Do not resume PHY when attaching
+Subject: [PATCH 22/33] net: phy: Do not resume PHY when attaching
 Organization: Addiva Elektronik

 The PHY should not start negotiating with its link-partner until
@@ -15,8 +15,6 @@ Otherwise, drivers that attached to their PHYs during
 probing (e.g. DSA) would end up with a physical link being
 established, even though the corresponding interface was still
 administratively down.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/phy/phy_device.c | 1 -
 1 file changed, 1 deletion(-)
@@ -1,7 +1,7 @@
 From 1ec21a3fc54fb447501fd7edbf692b00a31fe3ec Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 27 Mar 2024 15:52:43 +0100
-Subject: [PATCH 23/35] net: dsa: mv88e6xxx: Improve indirect register access
+Subject: [PATCH 23/33] net: dsa: mv88e6xxx: Improve indirect register access
 perf on 6393
 Organization: Addiva Elektronik

@@ -13,8 +13,6 @@ previous families).
 Therefore, add a new set of SMI operations which remaps accesses to
 such registers to the corresponding directly addressable register. All
 other accesses use the regular indirect interface.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c    |  7 +++
 drivers/net/dsa/mv88e6xxx/global1.h |  3 ++
@@ -1,7 +1,7 @@
 From 5d7be493dcaa75ee69d521043062389d7772f8dc Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Thu, 4 Apr 2024 16:36:30 +0200
-Subject: [PATCH 24/35] net: bridge: drop delay for applying strict multicast
+Subject: [PATCH 24/33] net: bridge: drop delay for applying strict multicast
 filtering
 Organization: Addiva Elektronik

@@ -19,7 +19,6 @@ A proper fix for upstreaming could be to add a knob to disable the delay.
 [2]: https://lore.kernel.org/netdev/20240127175033.9640-1-linus.luessing@c0d3.blue/

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/bridge/br_multicast.c | 42 +++++++--------------------------------
 net/bridge/br_private.h   |  4 +---
@@ -1,7 +1,7 @@
 From 492a824661dbc188b5abeb7434b5cf67c2016415 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Mon, 22 Apr 2024 23:18:01 +0200
-Subject: [PATCH 25/35] net: dsa: mv88e6xxx: Honor ports being managed via
+Subject: [PATCH 25/33] net: dsa: mv88e6xxx: Honor ports being managed via
 in-band-status
 Organization: Addiva Elektronik

@@ -13,8 +13,6 @@ USXGMII autoneg)
 This state is the default set up by mv88e6xxx_port_setup_mac(), so all
 we have to do is to make the phylink MAC callbacks no-ops in cases
 when in-band-status is being used.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 6 ++++++
 1 file changed, 6 insertions(+)
@@ -1,7 +1,7 @@
 From c9c9597a47b00b720f5223c83ab05bb89481eda8 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 21:35:26 +0200
-Subject: [PATCH 26/35] net: dsa: mv88e6xxx: Fix port policy config on 6393X
+Subject: [PATCH 26/33] net: dsa: mv88e6xxx: Fix port policy config on 6393X
 Organization: Addiva Elektronik

 mv88e6393x_port_policy_{read,write} expect the `pointer` argument to
@@ -16,7 +16,6 @@ never enabled on DSA ports, which broke standalone port isolation in
 multichip switch trees made up of 6393X decices.

 Fixes: 6584b26020fc ("net: dsa: mv88e6xxx: implement .port_set_policy for Amethyst")
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/port.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
@@ -1,7 +1,7 @@
 From 4ff224b5f5de1347a1f686aa85cb918a7db18879 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 24 Apr 2024 22:41:04 +0200
-Subject: [PATCH 27/35] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
+Subject: [PATCH 27/33] net: dsa: mv88e6xxx: Limit rsvd2cpu policy to user
 ports on 6393X
 Organization: Addiva Elektronik

@@ -29,8 +29,6 @@ Before this change, due to rsvd2cpu being enabled on the CPU port, the
 switch would try to trap it back to the CPU. Given that the CPU is
 trusted, instead assume that it indeed meant for the packet to be
 forwarded like any other.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/port.c | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)
@@ -1,7 +1,7 @@
 From f0d4beabe769fec594b309c3f1ebb79cfdbede8b Mon Sep 17 00:00:00 2001
 From: Joachim Wiberg <troglobit@gmail.com>
 Date: Mon, 29 Apr 2024 15:14:51 +0200
-Subject: [PATCH 28/35] usb: core: adjust log level for unauthorized devices
+Subject: [PATCH 28/33] usb: core: adjust log level for unauthorized devices
 Organization: Addiva Elektronik

 The fact that a USB device currently is not authorized is not an error,
@@ -9,7 +9,6 @@ so let's adjust the log level so these messages slip below radar for the
 commonly used 'quiet' log level.

 Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/usb/core/driver.c  | 4 ++--
 drivers/usb/core/generic.c | 2 +-
@@ -1,7 +1,7 @@
 From 5f96d718c850084504c53ec0b8d9fcf75ea9996c Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Wed, 15 May 2024 13:50:58 +0200
-Subject: [PATCH 29/35] net: dsa: mv88e6xxx: Grab register lock during counter
+Subject: [PATCH 29/33] net: dsa: mv88e6xxx: Grab register lock during counter
 snapshotting
 Organization: Addiva Elektronik

@@ -9,8 +9,6 @@ This was missing for the standard counter groups. Since no caller
 already holds the lock, opt for pushing the locking down into
 mv88e6xxx_stats_snapshot() rather than having it duplicated at each
 call site.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 drivers/net/dsa/mv88e6xxx/chip.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)
@@ -1,7 +1,7 @@
 From 6d4c436335003259cc02a0f015fd3d1d54e988a2 Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Thu, 16 May 2024 14:51:54 +0200
-Subject: [PATCH 30/35] net: bridge: Differentiate MDB additions from
+Subject: [PATCH 30/33] net: bridge: Differentiate MDB additions from
 modifications
 Organization: Addiva Elektronik

@@ -21,8 +21,6 @@ generated.

 Therefore, discriminate new groups from changes to existing groups by
 introducing a RTM_SETMDB events to be used in the latter scenario.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 include/uapi/linux/rtnetlink.h | 2 ++
 net/bridge/br_mdb.c            | 4 ++--
@@ -1,7 +1,7 @@
 From c333c612688d5e974b95fcf4b04f185d7cf4f80d Mon Sep 17 00:00:00 2001
 From: Tobias Waldekranz <tobias@waldekranz.com>
 Date: Tue, 28 May 2024 10:38:42 +0200
-Subject: [PATCH 31/35] net: dsa: tag_dsa: Use tag priority as initial
+Subject: [PATCH 31/33] net: dsa: tag_dsa: Use tag priority as initial
 skb->priority
 Organization: Addiva Elektronik

@@ -19,8 +19,6 @@ Ideally we could then map this priority to an internal one, like we
 can do with an "ingress-qos-map" on VLAN interfaces. Until that is
 implemented, support the setup that is likely to be the most common; a
 1:1 mapping from FPri to skb->priority.
-
-Signed-off-by: Tobias Waldekranz <tobias@waldekranz.com>
 ---
 net/dsa/tag_dsa.c | 7 +++++++
 1 file changed, 7 insertions(+)
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`service [S12345789] log rngd -f -- Entropy gathering daemon (rngd)`