Merge pull request #1184 from kernelkit/releng

Release prep for v25.08.1

.github/workflows/build-boot.yml

@@ -0,0 +1,143 @@
+name: Build Bootloaders
+
+on:
+  workflow_dispatch:
+    inputs:
+      branch:
+        description: 'Branch to build from'
+        default: 'main'
+        type: string
+
+jobs:
+  build:
+    name: Build ${{ matrix.defconfig }}
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        defconfig:
+          - fireant_boot
+          - cn9130_crb_boot
+          - aarch64_qemu_boot
+          - rpi4_boot
+    env:
+      MAKEFLAGS: -j5
+    steps:
+      - name: Cleanup Build Folder
+        run: |
+          ls -la ./
+          rm -rf ./* || true
+          rm -rf ./.??* || true
+          ls -la ./
+
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.branch || github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          defconfig=${{ matrix.defconfig }}
+          version=$(awk -F'"' '/BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE=/ {print $2}' configs/${defconfig}_defconfig)
+          version=${version:-git}
+          filename=$(echo "${defconfig}" | tr '_' '-')
+
+          # TODO: Replace hardcoded rev with actual revision stepping
+          rev="latest"
+
+          archive="${filename}-${version}-${rev}.tar.gz"
+          dirname="${filename}-${version}-${rev}"
+
+          echo "defconfig=${defconfig}" >> $GITHUB_OUTPUT
+          echo "version=${version}"     >> $GITHUB_OUTPUT
+          echo "rev=${rev}"             >> $GITHUB_OUTPUT
+          echo "archive=${archive}"     >> $GITHUB_OUTPUT
+          echo "dirname=${dirname}"     >> $GITHUB_OUTPUT
+
+          echo "Building ${defconfig}_defconfig, version ${version}-${rev}, artifact ${archive} ..."
+
+      - name: Restore Cache of dl/
+        uses: actions/cache@v4
+        with:
+          path: dl/
+          key: dl-boot-${{ hashFiles('.git/modules/buildroot/HEAD', 'configs/*', 'package/*/*.hash') }}
+          restore-keys: |
+            dl-boot-
+            dl-
+
+      - name: Restore Cache of .ccache/
+        uses: actions/cache@v4
+        with:
+          path: .ccache/
+          key: ccache-boot-${{ matrix.defconfig }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          restore-keys: |
+            ccache-boot-${{ matrix.defconfig }}-
+            ccache-boot-
+            ccache-
+
+      - name: Configure ${{ matrix.defconfig }}_defconfig
+        run: |
+          make ${{ matrix.defconfig }}_defconfig
+
+      - name: Build ${{ matrix.defconfig }}_defconfig
+        run: |
+          echo "Building ${{ matrix.defconfig }}_defconfig ..."
+          make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))
+
+      - name: Resulting size of build
+        run: |
+          printf "Size of output/images/: "
+          ls -l output/images/
+
+      - name: Prepare ${{ matrix.defconfig }} Artifact
+        run: |
+          cd output/
+          mv images ${{ steps.vars.outputs.dirname }}
+          tar cfz ${{ steps.vars.outputs.archive }} ${{ steps.vars.outputs.dirname }}/
+
+      - uses: actions/upload-artifact@v4
+        with:
+          path: output/${{ steps.vars.outputs.archive }}
+          name: artifact-${{ matrix.defconfig }}
+
+  publish:
+    name: Upload Bootloader Artifacts
+    runs-on: ubuntu-latest
+    needs: build
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest-boot"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Bootloader Build Complete! :rocket:
+
+          For the public download links of these bootloader artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest-boot>
+          EOF

.github/workflows/build.yml

@@ -1,26 +1,54 @@
-name: Bob the Builder
+name: Build
 
 on:
-  pull_request:
-    types: [opened, synchronize, reopened, labeled]
-  push:
-    branches:
-      - main
   workflow_dispatch:
     inputs:
-      minimal:
-        description: 'Build minimal defconfigs'
-        required: false
+      target:
+        description: "Build target (e.g. aarch64 or aarch64_minimal)"
+        default: "x86_64"
+        type: string
+      parallel:
+        description: 'Massive parallel build of each image'
         default: true
         type: boolean
+      name:
+        description: "Name (for spin overrides)"
+        default: "infix"
+        type: string
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      parallel:
+        required: false
+        type: boolean
+        default: false
+
+env:
+  NAME: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }}
+  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
 
 jobs:
   build:
-    name: Build Infix ${{ matrix.target }}
+    name: Build ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
     runs-on: [ self-hosted, latest ]
+    env:
+      PARALLEL: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.parallel == 'true' || github.event_name != 'workflow_dispatch' && inputs.parallel == true }}
     strategy:
-      matrix:
-        target: [aarch64, x86_64]
       fail-fast: false
     outputs:
       build_id: ${{ steps.vars.outputs.INFIX_BUILD_ID }}
@@ -32,8 +60,11 @@ jobs:
           rm -rf ./.??* || true
           ls -la ./
 
-      - uses: actions/checkout@v4
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
         with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
           clean: true
           fetch-depth: 0
           submodules: recursive
@@ -51,26 +82,13 @@ jobs:
                   "${{ github.event.number }}" "${{ github.event.pull_request.head.sha }}" \
                   | tee -a $GITHUB_OUTPUT $GITHUB_ENV
           fi
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-              if [ "${{ github.event.inputs.minimal }}" == "true" ]; then
-                  flavor="_minimal"
-              fi
-          else
-              # Ensure 'release' job get the proper image when building main
-              if [ "$GITHUB_REF_NAME" != "main" ]; then
-                  flavor="_minimal"
-              else
-                  flavor=""
-              fi
-              if ${{ contains(github.event.pull_request.labels.*.name, 'ci:main') }}; then
-                  flavor=""
-              fi
-          fi
-          target=${{ matrix.target }}
-          echo "dir=infix-$target"        >> $GITHUB_OUTPUT
-          echo "tgz=infix-$target.tar.gz" >> $GITHUB_OUTPUT
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-          echo "Building target ${target}${flavor}_defconfig"
+
+          target=${{ env.TARGET }}
+          name=${{ env.NAME }}
+          echo "dir=${name}-${target}"        >> $GITHUB_OUTPUT
+          echo "tgz=${name}-${target}.tar.gz" >> $GITHUB_OUTPUT
+          echo "Building target ${target}_defconfig"
+
       - name: Restore Cache of dl/
         uses: actions/cache@v4
         with:
@@ -83,23 +101,37 @@ jobs:
         uses: actions/cache@v4
         with:
           path: .ccache/
-          key: ccache-${{ matrix.target }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
+          key: ccache-${{ env.TARGET }}-${{ hashFiles('.git/modules/buildroot/HEAD', 'package/*/*.hash') }}
           restore-keys: |
-            ccache-${{ matrix.target }}-
+            ccache-${{ env.TARGET }}-
             ccache-
 
-      - name: Configure ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Configure ${{ env.TARGET }}
         run: |
-          make ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig
+          make ${{ env.TARGET }}_defconfig
 
-      - name: Unit Test ${{ matrix.target }}
+      - name: Unit Test ${{ env.TARGET }}
         run: |
           make test-unit
 
-      - name: Build ${{ matrix.target }}${{ steps.vars.outputs.flv }}
+      - name: Prepare parallel build
+        id: parallel
         run: |
-          echo "Building ${{ matrix.target }}${{ steps.vars.outputs.flv }}_defconfig ..."
-          make
+
+          if [ "$PARALLEL" == "true" ]; then
+             echo "BR2_PER_PACKAGE_DIRECTORIES=y" >> output/.config
+             MAKE="make -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+             echo "Building in parallel with -j$((`getconf _NPROCESSORS_ONLN` / 2 + 2))"
+          else
+             echo "Disabling parallel build"
+             MAKE="make"
+          fi
+          echo "MAKE=$MAKE" >> $GITHUB_OUTPUT
+
+      - name: Build ${{ env.TARGET }}
+        run: |
+          echo "Building ${{ env.TARGET }}_defconfig ..."
+          eval "${{ steps.parallel.outputs.MAKE }}"
 
       - name:  Check SBOM from Build
         run: |
@@ -120,121 +152,14 @@ jobs:
           printf "Size of output/images/: "
           ls -l output/images/
 
-      - name: Prepare ${{ matrix.target }} Artifact
+      - name: Prepare ${{ env.TARGET }} Artifact
         run: |
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
       - uses: actions/upload-artifact@v4
         with:
           path: output/${{ steps.vars.outputs.tgz }}
-          name: artifact-${{ matrix.target }}
-
-  test:
-    name: Regression Test of Infix x86_64
-    needs: build
-    runs-on: [ self-hosted, regression ]
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          clean: true
-          submodules: recursive
-
-      - name: Set Build Variables
-        id: vars
-        run: |
-          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
-              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
-                   >>$GITHUB_ENV
-          fi
-
-          if [ "$GITHUB_REF_NAME" != "main" ]; then
-              flavor="_minimal"
-          else
-              flavor=""
-          fi
-          echo "flv=$flavor"              >> $GITHUB_OUTPUT
-
-      - name: Configure x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make x86_64${{ steps.vars.outputs.flv }}_defconfig
-
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Restore x86-64${{ steps.vars.outputs.flv }} output/
-        run: |
-          ls -l
-          mkdir -p output
-          mv infix-x86_64.tar.gz output/
-          cd output/
-          tar xf infix-x86_64.tar.gz
-          ln -s infix-x86_64 images
-
-      - name: Regression Test x86_64${{ steps.vars.outputs.flv }}
-        run: |
-          make test
-
-      - name: Publish Test Result for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: cat test/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
-
-      - name: Generate Test Report for x86_64${{ steps.vars.outputs.flv }}
-        # Ensure this runs even if Regression Test fails
-        if: always()
-        run: |
-          asciidoctor-pdf \
-          --theme test/9pm/report/theme.yml \
-          -a pdf-fontsdir=test/9pm/report/fonts \
-          test/.log/last/report.adoc \
-          -o test/.log/last/report.pdf
-
-      - name: Upload Test Report as Artifact
-        uses: actions/upload-artifact@v4
-        with:
-          name: test-report
-          path: test/.log/last/report.pdf
-
-  release:
-    if: ${{github.repository_owner == 'kernelkit' && github.ref_name == 'main'}}
-    name: Upload Latest Build
-    needs: test
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-    steps:
-      - uses: actions/download-artifact@v4
-        with:
-          pattern: "artifact-*"
-          merge-multiple: true
-
-      - name: Create checksums ...
-        run: |
-          for file in *.tar.gz; do
-              sha256sum $file > $file.sha256
-          done
-
-      - uses: ncipollo/release-action@v1
-        with:
-          allowUpdates: true
-          omitName: true
-          omitBody: true
-          omitBodyDuringUpdate: true
-          prerelease: true
-          tag: "latest"
-          token: ${{ secrets.GITHUB_TOKEN }}
-          artifacts: "*.tar.gz*"
-
-      - name: Summary
-        run: |
-          cat <<EOF >> $GITHUB_STEP_SUMMARY
-          # Latest Build Complete! :rocket:
-
-          For the public download links of these build artifacts, please see:
-           <https://github.com/kernelkit/infix/releases/tag/latest>
-          EOF
+          name: artifact-${{ env.TARGET }}

.github/workflows/docs.yml

@@ -0,0 +1,67 @@
+name: User Guide Generator
+
+on:
+  push:
+    branches:
+      - doc
+      - main
+    tags:
+      - 'v*'
+    paths:
+      - 'doc/**'
+      - 'mkdocs.yml'
+      - '.github/workflows/docs.yml'
+
+permissions:
+  contents: write
+
+concurrency:
+  group: "docs-${{ github.ref }}"
+  cancel-in-progress: false
+
+jobs:
+  docs:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
+        with:
+          python-version: '3.x'
+
+      - name: Install dependencies
+        run: |
+          pipx install mkdocs
+          pipx inject mkdocs mkdocs-material
+          pipx inject mkdocs pymdown-extensions
+          pipx inject mkdocs mkdocs-callouts
+          pipx inject mkdocs mike
+          pipx inject mkdocs mkdocs-to-pdf
+          # Workaround, if pipx inject fails to install symlink
+          ln -s "$(pipx environment -V PIPX_LOCAL_VENVS)/mkdocs/bin/mike" \
+                "$(pipx environment -V PIPX_BIN_DIR)/mike" || true
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "github-actions[bot]@users.noreply.github.com"
+
+      - name: Deploy dev version
+        if: github.event_name == 'push' && (github.ref == 'refs/heads/doc' || github.ref == 'refs/heads/main')
+        run: |
+          mike deploy --push --update-aliases dev latest
+          mike set-default --push latest
+
+      - name: Deploy tagged version
+        if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
+        run: |
+          TAG=${GITHUB_REF#refs/tags/v}
+          # Extract YEAR.MONTH from tag (e.g., v25.06.0-beta1 -> 25.06)
+          VERSION=$(echo $TAG | sed -E 's/^([0-9]+\.[0-9]+)(\.[0-9]+)?(-.*)?$/\1/')
+          echo "Deploying tag $TAG as docs version $VERSION"
+          mike deploy --push --update-aliases $VERSION latest
+          mike set-default --push latest

.github/workflows/generic-x86-build.yml

@@ -0,0 +1,73 @@
+name: Generic X86 GitHub Build
+
+on:
+  push:
+
+jobs:
+  build:
+    if: github.repository != 'kernelkit/infix'
+    name: Infix x86_64
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            bc binutils build-essential bzip2 cpio \
+            diffutils file findutils git gzip \
+            libncurses-dev libssl-dev perl patch \
+            python3 rsync sed tar unzip wget \
+            autopoint bison flex autoconf automake \
+            mtools
+
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository }}
+          ref: ${{ github.ref }}
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          echo "INFIX_BUILD_ID=${{ github.run_id }}" >> $GITHUB_OUTPUT
+          echo "dir=Infix-x86_64" >> $GITHUB_OUTPUT
+          echo "tgz=Infix-x86_64.tar.gz" >> $GITHUB_OUTPUT
+
+      - name: Configure x86_64_minimal
+        run: |
+          make x86_64_minimal_defconfig
+
+      - name: Unit Test x86_64
+        run: |
+          make test-unit
+
+      - name: Build x86_64_minimal
+        run: |
+          make
+
+      - name: Check SBOM
+        run: |
+          make legal-info
+
+      - name: Report Build Size
+        run: |
+          du -sh .
+          du -sh output
+          du -sh dl || true
+          ls -l output/images/
+
+      - name: Prepare Artifact
+        run: |
+          cd output/
+          mv images Infix-x86_64
+          ln -s Infix-x86_64 images
+          tar cfz Infix-x86_64.tar.gz Infix-x86_64
+
+      - uses: actions/upload-artifact@v4
+        with:
+          path: output/Infix-x86_64.tar.gz
+          name: artifact-x86_64
+

.github/workflows/publish.yml

@@ -0,0 +1,44 @@
+name: Publish latest Infix
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+jobs:
+  publish:
+    name: Upload Latest Build
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Create checksums ...
+        run: |
+          for file in *.tar.gz; do
+              sha256sum $file > $file.sha256
+          done
+
+      - uses: ncipollo/release-action@v1
+        with:
+          allowUpdates: true
+          replacesArtifacts: true
+          omitName: true
+          omitBody: true
+          omitBodyDuringUpdate: true
+          prerelease: true
+          tag: "latest"
+          token: ${{ secrets.GITHUB_TOKEN }}
+          artifacts: "*.tar.gz*"
+
+      - name: Summary
+        run: |
+          cat <<EOF >> $GITHUB_STEP_SUMMARY
+          # Latest Build Complete! :rocket:
+
+          For the public download links of these build artifacts, please see:
+           <https://github.com/kernelkit/infix/releases/tag/latest>
+          EOF

.github/workflows/release.yml

@@ -85,16 +85,21 @@ jobs:
           cd output/
           mv images ${{ steps.vars.outputs.dir }}
           ln -s ${{ steps.vars.outputs.dir }} images
-          tar chfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
+          tar cfz ${{ steps.vars.outputs.tgz }} ${{ steps.vars.outputs.dir }}
 
           mv legal-info legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
-          tar chfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
+          tar cfz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}.tar.gz legal-info-${{ matrix.target }}-${{ steps.vars.outputs.ver }}
 
       - uses: actions/upload-artifact@v4
         with:
           name: artifact-${{ matrix.target }}
           path: output/*.tar.gz
 
+      - uses: actions/upload-artifact@v4
+        with:
+          name: artifact-disk-image-${{ matrix.target }}
+          path: output/images/*.qcow2
+
   release:
     name: Release Infix ${{ github.ref_name }}
     needs: build
@@ -141,6 +146,11 @@ jobs:
           for file in *.tar.gz; do
               sha256sum $file > $file.sha256
           done
+          if ls *.qcow2 &>/dev/null; then
+            for file in *.qcow2; do
+              sha256sum "$file" > "$file.sha256"
+            done
+          fi
 
       - name: Extract ChangeLog entry ...
         run: |
@@ -155,7 +165,7 @@ jobs:
           makeLatest: ${{ steps.rel.outputs.latest }}
           discussionCategory: ${{ steps.rel.outputs.cat }}
           bodyFile:  release.md
-          artifacts: "*.tar.gz*"
+          artifacts: "*.tar.gz*,*.qcow2*"
 
       - name: Summary
         run: |

.github/workflows/test.yml

@@ -0,0 +1,105 @@
+name: Test Infix
+
+on:
+  workflow_dispatch:
+    inputs:
+      infix_repo:
+        description: 'Repo to checkout (for spin overrides)'
+        required: false
+        default: kernelkit/infix
+        type: string
+
+  workflow_call:
+    inputs:
+      target:
+        required: true
+        type: string
+      name:
+        required: true
+        type: string
+      infix_repo:
+        required: false
+        type: string
+        default: kernelkit/infix
+      ninepm-conf:
+        required: false
+        type: string
+        default: ''
+      test-path:
+        required: false
+        type: string
+        default: 'test'
+
+env:
+  TARGET: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+  INFIX_REPO: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.infix_repo || inputs.infix_repo }}
+  NINEPM_CONF: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.ninepm-conf || inputs.ninepm-conf }}
+  TEST_PATH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.test-path || inputs.test-path }}
+
+jobs:
+  test:
+    name: Regression Test ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.name || inputs.name }} ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.target || inputs.target }}
+    runs-on: [self-hosted, regression]
+    steps:
+      - name: Checkout infix repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ env.INFIX_REPO }}
+          ref: ${{ github.ref }}
+          clean: true
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Set Build Variables
+        id: vars
+        run: |
+          if [ -n "${{ needs.build.outputs.build_id }}" ]; then
+              echo "INFIX_BUILD_ID=${{ needs.build.outputs.build_id }}" \
+                   >>$GITHUB_ENV
+          fi
+
+      - name: Configure ${{ env.TARGET }}
+        run: |
+          make ${{ env.TARGET }}_defconfig
+
+      - uses: actions/download-artifact@v4
+        with:
+          pattern: "artifact-*"
+          merge-multiple: true
+
+      - name: Restore ${{ env.TARGET }} output/
+        run: |
+          target=${{ env.TARGET }}
+          name=${{ inputs.name }}
+
+          ls -l
+          mkdir -p output
+          mv ${name}-${target}.tar.gz output/
+          cd output/
+          tar xf ${name}-${target}.tar.gz
+          ln -s ${name}-${target} images
+
+      - name: Regression Test ${{ env.TARGET }}
+        run: |
+          if [ -n "$NINEPM_CONF" ]; then
+            export NINEPM_PROJ_CONFIG="${GITHUB_WORKSPACE}/$NINEPM_CONF"
+            echo "DEBUG: NINEPM_PROJ_CONFIG is '$NINEPM_PROJ_CONFIG'"
+          fi
+          make test
+
+      - name: Publish Test Result for ${{ env.TARGET }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: cat $TEST_PATH/.log/last/result-gh.md >> $GITHUB_STEP_SUMMARY
+
+      - name: Generate Test Report for ${{ env.TARGET }}
+        # Ensure this runs even if Regression Test fails
+        if: always()
+        run: |
+          make test-dir="$(pwd)/$TEST_PATH" test-report
+
+      - name: Upload Test Report as Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-report
+          path: output/images/test-report.pdf

.github/workflows/trigger.yml

@@ -0,0 +1,42 @@
+name: Kernelkit Trigger
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, labeled]
+  push:
+    branches:
+      - main
+      - ci-work
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-x86_64:
+    if: startsWith(github.repository, 'kernelkit/')
+    uses: ./.github/workflows/build.yml
+    with:
+      name: "infix"
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+
+  build-aarch64:
+    if: startsWith(github.repository, 'kernelkit/')
+    uses: ./.github/workflows/build.yml
+    with:
+      name: "infix"
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'aarch64_minimal' || 'aarch64' }}
+
+  test-run-x86_64:
+    if: startsWith(github.repository, 'kernelkit/')
+    needs: build-x86_64
+    uses: ./.github/workflows/test.yml
+    with:
+      target: ${{ github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ci:main') && 'x86_64_minimal' || 'x86_64' }}
+      name: "infix"
+
+  test-publish-x86_64:
+    if: ${{ github.repository_owner == 'kernelkit' && github.ref_name == 'main' }}
+    needs: test-run-x86_64
+    uses: ./.github/workflows/publish.yml

Config.in

@@ -65,7 +65,7 @@ config INFIX_COMPATIBLE
 
 config INFIX_TAGLINE
 	string "Operating system tagline"
-	default "Infix -- a Network Operating System"
+	default "Infix OS — Immutable.Friendly.Secure"
 	help
 	  Mandatory. Used for identifying the OS, e.g. as PRETTY_NAME in
 	  /etc/os-release and description in the GNS3 appliance.

README.md

@@ -2,55 +2,69 @@
 
 <img align="right" src="doc/logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on [Buildroot][1], and [sysrepo][2].  A powerful mix that ease
-porting to different platforms, simplify long-term maintenance, and
-provide made-easy management using NETCONF, RESTCONF[^2], or the
-built-in command line interface (CLI) from a console or SSH login.
+Turn any ARM or x86 device into a powerful, manageable network appliance
+in minutes. From $35 Raspberry Pi boards to enterprise switches — deploy
+routers, IoT gateways, edge devices, or custom network solutions that
+just work.
 
-> Click the **▶ Example CLI Session** foldout below for an example, or
-> head on over to the [Infix Documentation](doc/README.md) for more
-> information on how to set up the system.
+## Our Values
 
-Although primarily focused on switches and routers, the core values
-may be appealing for other use-cases as well:
+**🔒 Immutable**  
+Your system never breaks.  Read-only filesystem with atomic upgrades
+means no configuration drift, no corrupted updates, and instant rollback
+if something goes wrong.  Deploy once, trust forever.
 
-- Runs from a squashfs image on a read-only partition
-- Single configuration file on a separate partition
-- Built around YANG with standard IETF models
-- Linux switchdev provides open switch APIs
-- Atomic upgrades to secondary partition
-- Highly security focused
+**🤝 Friendly**  
+Actually easy to use. Auto-generated CLI from standard YANG models comes
+with built-in help for every command — just hit `?` or TAB for
+context-aware assistance.  Familiar NETCONF/RESTCONF APIs and
+[comprehensive documentation][4] mean you're never stuck.  Whether
+you're learning networking or managing enterprise infrastructure.
 
-An immutable[^1] operating system enhances security and inherently makes
-it maintenance-free.  Configuration and data, e.g, containers, is stored
-on separate partitions to ensure complete separation from system files
-and allow for seamless backup, restore, and provisioning.
+**🛡️ Secure**  
+Built with security as a foundation, not an afterthought.  Minimal
+attack surface, separation between system and data, and container
+isolation.  Sleep better knowing your infrastructure is protected.
 
-In itself, Infix is perfectly suited for dedicated networking tasks, and
-with native support for Docker containers, the operating system provides
-a versatile platform that can easily be adapted to any customer need.
-Be it legacy applications, network protocols, process monitoring, or
-edge data analysis, it can run close to end equipment.  Either directly
-connected on dedicated Ethernet ports or indirectly using virtual
-network cables to exist on the same LAN as other connected equipment.
+## Why Choose Infix
 
-The simple design of Infix provides complete control over both system
-and data, minimal cognitive burden, and makes it incredibly easy to get
-started.
+**Hardware Flexibility**: Start with a $35 Raspberry Pi, scale to
+enterprise switching hardware.  Same OS, same tools, same reliability.
 
-<details><summary><b>Example CLI Session</b></summary>
+**Standards-Based**: Built around YANG models and IETF standards. Learn
+once, use everywhere - no vendor lock-in.
 
-The CLI configure context is automatically generated from the loaded
-YANG models and their corresponding [sysrepo][2] plugins.  The following
-is brief example of how to set the IP address of an interface:
+**Container Ready**: Run your applications alongside networking
+functions.  GPIO access, dedicated Ethernet ports, custom protocols —
+your device, your rules.
 
-```
+## Use Cases
+
+1. **Home Labs & Hobbyists**:  
+   Transform a Raspberry Pi into a full-featured router with WiFi  
+1. **IoT & Edge Computing**:  
+   Bridge devices to the cloud with reliable, updatable gateways  
+1. **Small Business Networks**:  
+   Enterprise-grade features without the complexity or cost  
+1. **Developers & Makers**:  
+   Test networking concepts, prototype IoT solutions, or build custom
+   appliances
+1. **Network Professionals**:  
+   Consistent tooling from development to production deployment.  
+   How about a digital twin using raw Qemu or [GNS3](https://gns3.com/infix)!
+
+## See It In Action
+
+Configure an interface in seconds - the CLI guides you with built-in help:
+
+<details><summary><b>Click Here for an example CLI Session</b></summary>
+
+```bash
 admin@infix-12-34-56:/> configure
 admin@infix-12-34-56:/config/> edit interface eth0
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 <TAB>
       address     autoconf bind-ni-name      enabled
-	  forwarding  mtu      neighbor
+      forwarding  mtu      neighbor
 admin@infix-12-34-56:/config/interface/eth0/> set ipv4 address 192.168.2.200 prefix-length 24
 admin@infix-12-34-56:/config/interface/eth0/> show
 type ethernet;
@@ -59,7 +73,6 @@ ipv4 {
     prefix-length 24;
   }
 }
-ipv6
 admin@infix-12-34-56:/config/interface/eth0/> diff
 interfaces {
   interface eth0 {
@@ -82,53 +95,65 @@ lo              ethernet   UP          00:00:00:00:00:00
 admin@infix-12-34-56:/> copy running-config startup-config
 ```
 
-[Click here][3] for more details.
+Notice how TAB completion shows available options, `show` displays
+current config, and `diff` shows exactly what changed before you
+commit your changes with the `leave` command.
+
 </details>
 
-Infix can run on many different types of architectures and boards, much
-thanks to Linux and Buildroot.  Currently the focus is on 64-bit ARM
-devices, optionally with switching fabric supported by Linux switchdev.
-The [following boards](board/aarch64/README.md) are fully supported:
+> [Full CLI documentation →][3]
 
- - Marvell CN9130 CRB
- - Marvell EspressoBIN
- - Microchip SparX-5i PCB135 (eMMC)
- - StarFive VisionFive2
- - NanoPi R2S
+## Get Started
 
-An x86_64 build is also available, primarily intended for development
-and testing, but can also be used for evaluation and demo purposes.  For
-more information, see: [Infix in Virtual Environments](doc/virtual.md).
+Get [pre-built images][5] for your hardware.  Use the CLI, web
+interface, or standard NETCONF/RESTCONF tools, e.g., `curl`.  Add
+containers for any custom functionality you need.
 
-> See the [GitHub Releases](https://github.com/kernelkit/infix/releases)
-> page for our pre-built images.  The *[Latest Build][]* has bleeding
-> edge images, if possible we recommend using a versioned release.
->
-> For *customer specific builds* of Infix, see your product repository.
+### Supported Platforms
 
+- **Raspberry Pi 4B** - Perfect for home labs, learning, and prototyping
+- **NanoPi R2S** - Compact dual-port router in a tiny package  
+- **x86_64** - Run in VMs or on mini PCs for development and testing
+- **Marvell CN9130 CRB, EspressoBIN** - High-performance ARM platforms
+- **Microchip SparX-5i, NXP i.MX8MP EVK** - Enterprise switching capabilities
+- **StarFive VisionFive2** - RISC-V architecture support
 
-----
+*Why start with Raspberry Pi?* It's affordable, widely available, has
+built-in WiFi + Ethernet, and runs the exact same Infix OS you'd deploy
+in production. Perfect for learning, prototyping, or even small-scale
+deployments.
+
+> 📖 **[Complete documentation][4]** • 💬 **[Join our Discord][discord-url]**
+
+## Technical Details
+
+Built on proven open-source foundations ([Buildroot][1] + [sysrepo][2])
+for reliability you can trust:
+
+- **Immutable OS**: Read-only filesystem, atomic updates, instant rollback
+- **YANG Configuration**: Industry-standard models with auto-generated tooling
+- **Hardware Acceleration**: Linux switchdev support for wire-speed packet processing
+- **Container Integration**: Docker support with flexible network and hardware access
+- **Memory Efficient**: Runs comfortably on devices with as little as 256 MB RAM
+
+Perfect for everything from resource-constrained edge devices to
+high-throughput network appliances.
+
+> Check the *[Latest Build][]* for bleeding-edge features.
+
+---
 
 <div align="center">
-  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/logo.png" width=300></a>
-  <br />Infix development is sponsored by <a href="https://wires.se">Wires<a>
+  <a href="https://github.com/wires-se"><img src="https://raw.githubusercontent.com/wires-se/.github/main/profile/play.svg" width=300></a>
+  <br />Infix development is sponsored by <a href="https://wires.se">Wires</a>
 </div>
 
-----
-
-[^1]: An immutable operating system is one with read-only file systems,
-    atomic updates, rollbacks, declarative configuration, and workload
-    isolation.  All to improve reliability, scalability, and security.
-    For more information, see <https://ceur-ws.org/Vol-3386/paper9.pdf>
-    and <https://www.zdnet.com/article/what-is-immutable-linux-heres-why-youd-run-an-immutable-linux-distro/>.
-
-[^2]: Partial RESTCONF support, features like HTTP PATCH, OPTIONS, HEAD,
-    and copying between datastores are still missing.
-
-[1]: https://buildroot.org/
-[2]: https://www.sysrepo.org/
-[3]: doc/cli/introduction.md
-[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest
+[1]: https://buildroot.org/ "Buildroot Homepage"
+[2]: https://www.sysrepo.org/ "Sysrepo Homepage"
+[3]: https://kernelkit.org/infix/latest/cli/introduction/
+[4]: https://kernelkit.org/infix/
+[5]: https://github.com/kernelkit/infix/releases
+[Latest Build]:    https://github.com/kernelkit/infix/releases/tag/latest "Latest build"
 [License]:         https://en.wikipedia.org/wiki/GPL_license
 [License Badge]:   https://img.shields.io/badge/License-GPL%20v2-blue.svg
 [GitHub]:          https://github.com/kernelkit/infix/actions/workflows/build.yml/

board/aarch64/README.md

@@ -7,3 +7,48 @@ Board Specific Documentation
 - [Marvell CN9130-CRB](cn9130-crb/)
 - [Microchip SparX-5i PCB135 (eMMC)](sparx5-pcb135/)
 - [NanoPi R2S](r2s/)
+- [Raspberry Pi 4 b](#raspberry-pi-4-b)
+
+# Raspberry Pi 4 b
+
+## Support level
+Full support for base board but not any extension board on the
+GPIOs.
+
+### Touch screen
+The [Raspberry Pi touch display v1][RPI-TOUCH] is supported, including
+touch functionality. There are multiple touchscreens on the market for
+Raspberry Pi, but only the official (first version with 800x480
+resolution) is currently supported. Infix supplies all drivers
+required to utilize the hardware, but you need to add the actual
+graphical application in a container.
+
+There are some important considerations you need to know about when
+using Infix for graphical applications. The container needs access to
+/dev/dri/ to be able to access the graphics card, and it also needs
+access to /run/udev to be able to find the input devices.
+
+Example of running Doom in Infix:
+
+```cli
+	admin@example:/> configure
+	admin@example:/config/> edit container doom
+	admin@example:/config/container/doom/> set image docker://mattiaswal/alpine-doom:latest
+	admin@example:/config/container/doom/> set privileged
+	admin@example:/config/container/doom/> edit mount udev
+	admin@example:/config/container/doom/mount/udev/> set type bind
+	admin@example:/config/container/doom/mount/udev/> set target /run/udev/
+	admin@example:/config/container/doom/mount/udev/> set source /run/udev/
+	admin@example:/config/container/doom/mount/udev/> end
+	admin@example:/config/container/doom/mount/xorg.conf/> set content U2VjdGlvbiAiT3V0cHV0Q2xhc3MiCiAgSWRlbnRpZmllciAidmM0IgogIE1hdGNoRHJpdmVyICJ2YzQiCiAgRHJpdmVyICJtb2Rlc2V0dGluZyIKICBPcHRpb24gIlByaW1hcnlHUFUiICJ0cnVlIgpFbmRTZWN0aW9uCg==
+	admin@example:/config/container/doom/mount/xorg.conf/> set target /etc/X11/xorg.conf
+	admin@example:/config/container/doom/mount/xorg.conf/> end
+	admin@example:/config/container/doom/> edit volume var
+	admin@example:/config/container/doom/volume/var/> set target /var
+	admin@example:/config/container/doom/volume/var/> leave
+	admin@example:/>
+
+```
+
+
+[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/

board/aarch64/qemu/uboot/extras.config

@@ -0,0 +1,3 @@
+# QEMU-specific U-Boot config
+# Enable PCI MMC for QEMU virtualized environment
+CONFIG_MMC_PCI=y

board/aarch64/r2s/linux_defconfig

@@ -230,7 +230,6 @@ CONFIG_MAC80211_LEDS=y
 CONFIG_RFKILL=y
 CONFIG_NET_9P=y
 CONFIG_NET_9P_VIRTIO=y
-# CONFIG_ETHTOOL_NETLINK is not set
 CONFIG_PCI=y
 CONFIG_PCIEPORTBUS=y
 CONFIG_PCI_IOV=y
@@ -481,7 +480,6 @@ CONFIG_I2C=y
 CONFIG_I2C_CHARDEV=y
 CONFIG_I2C_MUX=y
 CONFIG_I2C_MUX_PCA954x=y
-CONFIG_I2C_DESIGNWARE_PLATFORM=y
 CONFIG_I2C_GPIO=m
 CONFIG_I2C_RK3X=y
 CONFIG_I2C_SLAVE=y

board/common/README.txt

@@ -45,11 +45,11 @@ The default credentials for the demo builds is
     login: admin
     password: admin
 
-    Infix -- a Network Operating System v24.09.0-rc1 (hvc0)
+    Infix OS — Immutable.Friendly.Secure v24.09.0-rc1 (hvc0)
     infix-00-00-00 login: admin
     Password: 
     .-------.
-    |  . .  | Infix -- a Network Operating System
+    |  . .  | Infix OS — Immutable.Friendly.Secure
     |-. v .-| https://kernelkit.org
     '-'---'-'
 
@@ -122,9 +122,9 @@ There's a lot of tutorials and guides online, start here:
 About
 -----
 
-Infix is a free, Linux based, immutable Network Operating System (NOS)
-built on Buildroot, and sysrepo.  A powerful mix that ease porting to
-different platforms, simplify long-term maintenance, and provide easy
-management using NETCONF, RESTCONF, or the built-in command line
-interface (CLI) from a console or SSH login.
+Infix is a free, Linux-based, immutable operating system built around
+Buildroot, and sysrepo.  A powerful mix that ease porting to different
+platforms, simplify long-term maintenance, and provide easy management
+using NETCONF, RESTCONF, or the built-in command line interface (CLI)
+from a console or SSH login.
 

board/common/mkdisk.sh

@@ -83,7 +83,7 @@ genboot()
 {
     if [ -d "$bootdata" ]; then
 	bootimg=$(cat <<EOF
-image efi-part.vfat {
+image $BINARIES_DIR/efi-part.vfat {
 	size = $bootsize
 	vfat {
 		file EFI {
@@ -98,7 +98,7 @@ EOF
 		offset = $bootoffs
 		partition-type-uuid = U
 		bootable = true
-		image = efi-part.vfat
+		image = $BINARIES_DIR/efi-part.vfat
 	}
 EOF
 		  )
@@ -127,7 +127,7 @@ bootdata=
 diskimg=disk.img
 bootimg=
 bootpart=
-
+tmpimage=$(mktemp)
 while getopts "a:b:B:n:s:" opt; do
     case ${opt} in
 	a)
@@ -166,7 +166,7 @@ awk \
 	  -vimgsize=$imgsize \
 	  -vcfgsize=$cfgsize \
 	  -vvarsize=$varsize \
-	  -vdiskimg=$diskimg \
+	  -vdiskimg=$tmpimage \
 	  -vbootimg="$bootimg" -vbootpart="$bootpart" \
 	  '{
 		sub(/@TOTALSIZE@/, total);
@@ -211,5 +211,7 @@ genimage \
     --rootpath "$root" \
     --tmppath  "$tmp" \
     --inputpath "$BINARIES_DIR" \
-    --outputpath "$BINARIES_DIR" \
     --config "$root/genimage.cfg"
+
+qemu-img convert -c -O qcow2 "$tmpimage" "$BINARIES_DIR/$diskimg"
+rm "$tmpimage"

board/common/post-build.sh

@@ -114,6 +114,12 @@ grep -qsE '^/bin/true$$' "$TARGET_DIR/etc/shells" \
 grep -qsE '^/bin/false$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/false" >> "$TARGET_DIR/etc/shells"
 
+boards=$(${BR2_EXTERNAL_INFIX_PATH}/board/common/selected-boards.sh ${BR2_EXTERNAL_INFIX_PATH} ${O})
+
+for board in $boards; do
+	[ ! -f "${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh" ] && continue
+	${BR2_EXTERNAL_INFIX_PATH}/src/board/${board}/post-build.sh
+done
 # Allow clish (symlink to /usr/bin/klish) to be a login shell
 grep -qsE '^/bin/clish$$' "$TARGET_DIR/etc/shells" \
         || echo "/bin/clish" >> "$TARGET_DIR/etc/shells"

board/common/post-image.sh

@@ -23,7 +23,7 @@ if [ -n "$IMAGE_ID" ]; then
 else
     NAME="$INFIX_ID"-$(echo "$BR2_ARCH" | tr _ - | sed 's/x86-64/x86_64/')
 fi
-diskimg=disk.img
+diskimg=disk.qcow2
 
 ver()
 {
@@ -48,7 +48,7 @@ fi
 load_cfg DISK_IMAGE
 if [ "$DISK_IMAGE" = "y" ]; then
     ixmsg "Creating Disk Image"
-    diskimg="${NAME}-disk$(ver).img"
+    diskimg="${NAME}-disk$(ver).qcow2"
     bootcfg=
     if [ "$DISK_IMAGE_BOOT_DATA" ]; then
 	bootcfg="-b $DISK_IMAGE_BOOT_DATA -B $DISK_IMAGE_BOOT_OFFSET"
@@ -86,25 +86,27 @@ if [ "$FIT_IMAGE" = "y" ]; then
     $common/mkfit.sh
 fi
 
+# Only for regular builds, not bootloader-only builds
 if [ "$BR2_TARGET_ROOTFS_SQUASHFS" = "y" ]; then
     rel=$(ver)
     ln -sf rootfs.squashfs "$BINARIES_DIR/${NAME}${rel}.img"
     if [ -n "$rel" ]; then
-	ln -sf "$BINARIES_DIR/${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
+	ln -sf "${NAME}${rel}.img" "$BINARIES_DIR/${NAME}.img"
     fi
+
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
+
+    # Menuconfig support for modifying Qemu args in release tarballs
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
+    sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
+	-e "s/@DISK_IMG@/$diskimg/"   \
+	< "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
+	> "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg"
+    CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
+	   "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
+    rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
+
+    # Quick intro for beginners, with links to more information
+    cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"
 fi
-
-# Menuconfig support for modifying Qemu args in release tarballs
-cp "$BR2_EXTERNAL_INFIX_PATH/board/common/rootfs/usr/bin/onieprom" "$BINARIES_DIR/"
-cp "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/qemu.sh" "$BINARIES_DIR/"
-sed -e "s/@ARCH@/QEMU_$BR2_ARCH/" \
-    -e "s/@DISK_IMG@/$diskimg/"   \
-    < "$BR2_EXTERNAL_INFIX_PATH/board/common/qemu/Config.in.in" \
-    > "$BINARIES_DIR/Config.in"
-rm -f "$BINARIES_DIR/qemu.cfg"
-CONFIG_="CONFIG_" BR2_CONFIG="$BINARIES_DIR/qemu.cfg" \
-       "$O/build/buildroot-config/conf" --olddefconfig "$BINARIES_DIR/Config.in"
-rm -f "$BINARIES_DIR/qemu.cfg.old" "$BINARIES_DIR/.config.old"
-
-# Quick intro for beginners, with links to more information
-cp "$BR2_EXTERNAL_INFIX_PATH/board/common/README.txt" "$BINARIES_DIR/"

board/common/qemu/Config.in.in

@@ -78,7 +78,7 @@ config QEMU_MACHINE
 
 config QEMU_MACHINE_RAM
 	string "RAM size (k/M/G)"
-	default "384M"
+	default "448M"
 	help
 	  The default, 384 MiB, works for most configurations.  However,
 	  if you get kernel panic with: "System is deadlocked on memory",

board/common/qemu/qemu.sh

@@ -120,7 +120,7 @@ rootfs_args()
 	echo -n "-device sd-card,drive=mmc "
 	echo -n "-drive id=mmc,file=$CONFIG_QEMU_ROOTFS,if=none,format=raw "
     elif [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	echo -n "-drive file=$CONFIG_QEMU_ROOTFS.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
+	echo -n "-drive file=qemu.qcow2,if=virtio,format=qcow2,bus=0,unit=0 "
     fi
 }
 
@@ -316,13 +316,13 @@ gdb_args()
 run_qemu()
 {
     if [ "$CONFIG_QEMU_ROOTFS_VSCSI" = "y" ]; then
-	if ! qemu-img check "${CONFIG_QEMU_ROOTFS}.qcow2"; then
-	    rm -f "${CONFIG_QEMU_ROOTFS}.qcow2"
+	if ! qemu-img check "qemu.qcow2"; then
+	    rm -f "qemu.qcow2"
 	fi
-	if [ ! -f "${CONFIG_QEMU_ROOTFS}.qcow2" ]; then
+	if [ ! -f "qemu.qcow2" ]; then
 	    echo "Creating qcow2 disk image for Qemu ..."
 	    qemu-img create -f qcow2 -o backing_file="$CONFIG_QEMU_ROOTFS" \
-		     -F raw "${CONFIG_QEMU_ROOTFS}.qcow2" > /dev/null
+		     -F qcow2 "qemu.qcow2" > /dev/null
 	fi
     fi
 

board/common/rootfs/etc/finit.d/available/container@.conf

@@ -1,7 +1,7 @@
 # Start a container instance (%i) and redirect logs to /log/container
-# Give podman enough time to properly shut down the container.  Every
-# time we start a container we run the setup stage, disable the Finit
-# timeout to allow the setup stage to run to completion.
-sysv    log:prio:local1,tag:%i kill:10 pid:!/run/container:%i.pid \
-	pre:0,/usr/sbin/container cleanup:0,/usr/sbin/container   \
+# Give podman enough time to properly shut down the container, kill:30
+# The pre:script, which is responsibe for fetching a remote image, must
+# not have a timeout.  The cleanup should take no longer than a minute.
+sysv    log:prio:local1,tag:%i kill:30 pid:!/run/container:%i.pid \
+	pre:0,/usr/sbin/container cleanup:60,/usr/sbin/container   \
 	[2345] <!> :%i container -n %i -- container %i

board/common/rootfs/etc/finit.d/available/ttyd.conf

@@ -1 +1 @@
-service [2345] <!> ttyd -i lo -p 8001 login -- Web terminal daemon (ttyd)
+service [2345] <!> ttyd -i lo -W -p 8001 login -- Web terminal daemon (ttyd)

board/common/rootfs/etc/finit.d/available/wifi@.conf

@@ -0,0 +1,5 @@
+service name:wpa_supplicant :%i \
+			[2345] wpa_supplicant -s -i %i -c /etc/wpa_supplicant-%i.conf -P/var/run/wpa_supplicant-%i.pid \
+			       -- WPA supplicant @%i
+
+task name:wifi-scanner :%i [2345] <pid/wpa_supplicant:%i> /usr/libexec/infix/wifi-scanner %i -- Start scanning for SSID @ %i

board/common/rootfs/etc/motd

@@ -1,4 +1,4 @@
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'

board/common/rootfs/etc/udev/rules.d/70-rename-wifi.rules

@@ -0,0 +1 @@
+SUBSYSTEM=="net", ACTION=="add", TEST=="/sys/class/net/$name/wireless", NAME="wifi%n"

board/common/rootfs/etc/watchdogd.conf

@@ -0,0 +1,165 @@
+# /etc/watchdogd.conf sample
+# Commented out values are program defaults.
+#
+# The checker/monitor `warning` and `critical` levels are 0.00-1.00,
+# i.e. 0-100%, except for load average which can vary a lot between
+# systems and use-cases, not just because of the number of CPU cores.
+# Use the `script = ...` setting to call script when `warning` and
+# `critical` are reached for a monitor.  In `critical` the monitor
+# otherwise triggers an unconditional reboot.
+#
+# NOTE: `critical` is optional, omitting it disables the reboot action.
+#
+
+### Watchdogs ##########################################################
+# Global settings that can be overridden per watchdog
+
+# Do not set WDT timeout and kick interval too low, the daemon runs at
+# SCHED_OTHER level with all other tasks, unless the process supervisor
+# is enabled.  The monitor plugins (below) need CPU time as well.
+#timeout   = 20
+#interval  = 10
+
+# With safe-exit enabled (true) the daemon will ask the driver disable
+# the WDT before exiting (SIGINT).  However, some WDT drivers (or HW)
+# may not support this.
+#safe-exit = true
+
+# Multiple watchdogs can be kicked, the default, even if no .conf file
+# is found or device node given on the command line, is /dev/watchdog
+device /dev/watchdog {
+    timeout    = 60
+    interval   = 5
+    safe-exit  = true
+}
+
+#device /dev/watchdog2 {
+#    timeout    = 20
+#    interval   = 10
+#    safe-exit  = true
+#}
+
+### Supervisor #########################################################
+# Instrumented processes can have their main loop supervised.  Processes
+# subscribe to this service using the libwdog API, see the docs for more
+# on this.  When the supervisor is enabled and the priority is set to a
+# value > 0, watchdogd runs as a SCHED_RR process with elevated realtime
+# priority.  When disabled, or the priority is set to zero (0), it runs
+# as a regular SCHED_OTHER process, this is the default.
+#
+# When a supervised process fails to meet its deadline, the daemon will
+# perform an unconditional reset having saved the reset reason.  If a
+# script is provided in this section it will be called instead.  The
+# script is called as:
+#
+#    script.sh supervisor CODE PID LABEL
+#
+# Availabel CODEs for the reset reason are avilable in wdog.h
+#
+#supervisor {
+#    !!!REMEMBER TO ENABLE reset-reason (below) AS WELL!!!
+#    enabled  = true
+#    priority = 98
+#    script = "/path/to/supervisor-script.sh"
+#}
+
+### Reset reason #######################################################
+# The following section controls if/how the reset reason & reset counter
+# is tracked.  By default this is disabled, since not all systems allow
+# writing to disk, e.g. embedded systems using MTD devices with limited
+# number of write cycles.
+#
+# The default file setting is a non-volatile path, according to the FHS.
+# It can be changed to another location, but make sure that location is
+# writable first.
+reset-reason {
+    enabled = true
+    file    = "/var/lib/misc/watchdogd.state"
+}
+
+### Checkers/Monitors ##################################################
+#
+# Script or command to run instead of reboot when a monitor plugin
+# reaches any of its critical or warning level.  Setting this will
+# disable the built-in reboot on critical, it is therefore up to the
+# script to perform reboot, if needed.  The script is called as:
+#
+#    script.sh {filenr, fsmon, loadavg, meminfo} {crit, warn} VALUE
+#
+#script = "/path/to/reboot-action.sh"
+
+# Monitors file descriptor leaks based on /proc/sys/fs/file-nr
+filenr {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors a file system, blocks and inode usage against watermarks
+# The script is called with fsmon as the first argument and there
+# are two environment variables FSMON_NAME, for the monitored path,
+# and FSMON_TYPE indicating either 'blocks' or 'inodes'.
+#fsmon /var {
+#    enabled = true
+#    interval = 300
+#    logmark  = false
+#    warning  = 0.95
+#    critical = 1.0
+#    script = "/path/to/alt-reboot-action.sh"
+#}
+
+# Monitors load average based on sysinfo() from /proc/loadavg
+# The level is composed from the average of the 1 and 5 min marks.
+loadavg {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 1.0
+    critical = 2.0
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitors free RAM based on data from /proc/meminfo
+meminfo {
+#    enabled = true
+    interval = 300
+    logmark  = false
+    warning  = 0.9
+    critical = 0.95
+#    script = "/path/to/alt-reboot-action.sh"
+}
+
+# Monitor temperature.  The critical value is unset by default, so no
+# action is taken at that watermark (by default).  Both the critical and
+# warning watermarks are relative to the trip/critical/max value from
+# sysfs.  The warning is default 0.9, i.e., 90% of critical.  Use script
+# to to reset the fan controller or poweroff(8) the system.
+#
+# Each temp monitor caches the last 10 values, calculates the mean, and
+# compares that to the warning and critical levels.  Logging is only
+# done every 10 x interval (if enabled).
+#tempmon /sys/class/hwmon/hwmon0/temp1_input {
+#    enabled  = true
+#    interval = 30
+#    warning  = 0.9
+#    critical = 0.95
+#    logmark  = true
+#    script   = "/script/to/log/and/poweroff.sh"
+#}
+
+# Monitor a generic script, executes 'monitor-script' every 'interval'
+# seconds, with a max runtime of 'timeout' seconds.  When the exit code
+# of the monitor script is above the critical level watchdogd either
+# starts the reboot, or calls the alternate 'script' to determin the
+# next cause of action.
+#generic /path/to/monitor-script.sh {
+#    enabled = true
+#    interval = 300
+#    timeout = 60
+#    warning  = 1
+#    critical = 10
+#    script = "/path/to/alt-reboot-action.sh"
+#}

board/common/rootfs/usr/bin/dir

@@ -21,7 +21,11 @@ dir()
 if [ -d "$1" ]; then
     dir "$1"
 else
-    dir "$HOME"
+    if [ "$USER" = "root" ]; then
+	dir "$HOME"
+    else
+	dir "/home/$USER"
+    fi
     dir "/cfg"
     dir "/log"
 fi

board/common/rootfs/usr/libexec/infix/has-quirk

@@ -0,0 +1,12 @@
+#!/bin/sh
+if [ $# -lt 2 ]; then
+        echo "usage: $0 <quirk-name> <ifname>"
+        exit 1
+fi
+quirk=$1
+ifname=$2
+if [ -f "/etc/product/interface-quirks.json" ]; then
+        echo "$(jq -r --arg iface "$ifname" --arg quirk "$quirk" '.[$iface][$quirk] // "false"' /etc/product/interface-quirks.json)"
+else
+        echo "false"
+fi

board/common/rootfs/usr/libexec/infix/init.d/00-probe

@@ -308,16 +308,52 @@ def probe_qemusystem(out):
     subprocess.run("initctl -nbq cond set qemu".split(), check=False)
     return 0
 
+def rasberry_pi_4_usb_ports(out):
+    out["usb-ports"] = [
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/authorized_default"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-1/authorized",
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb1/1-0:1.0/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized"
+        },
+        {
+            "name": "USB",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/authorized_default"
+        },
+        {
+            "name": "USB3",
+            "path": "/sys/devices/platform/scb/fd500000.pcie/pci0000:00/0000:00:00.0/0000:01:00.0/usb2/2-0:1.0/authorized"
+        }
+    ]
 
 def probe_dtsystem(out):
     """Probe DTS based system, expects a VPD in ONIE PROM format."""
     dtsys = DTSystem()
     vpds = dtsys.infix_vpds()
-    dtsys.infix_usb_devices(out)
+
     model = dtsys.base.str("model")
     if model:
         out["product-name"] = model
 
+    # Since rpi4 has USB on PCIe, there is no phandle reference
+    if model and model.startswith("Raspberry Pi 4"):
+        rasberry_pi_4_usb_ports(out)
+    else:
+        dtsys.infix_usb_devices(out)
     out["compatible"] = dtsys.base.str_array("compatible")
 
     staticpw = dtsys.infix.str("factory-password-hash")

board/common/rootfs/usr/libexec/infix/init.d/05-product

@@ -39,8 +39,10 @@ fi
 # init scripts to prevent select services from starting.
 initctl -nbq cond set led
 
-note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
-/usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+if [ -d "$PRODUCT_INIT" ]; then
+    note "Calling runparts $PRODUCT_INIT/S[0-9]+.* start"
+    /usr/libexec/finit/runparts -bsp "$PRODUCT_INIT"
+fi
 
 # Product specific init done.
 initctl -nbq cond set product

board/common/rootfs/usr/libexec/infix/init.d/25-mqprio

@@ -43,6 +43,7 @@ while [ "$1" ]; do
     txqs="$2"
     shift 2
 
+    [ $(/usr/libexec/infix/has-quirk "broken-mqprio" "$iface") = "true" ] && echo "Skipping $iface, does not support mqprio" && continue
     [ $txqs -lt 2 ] && continue
     [ $txqs -gt 8 ] && txqs=8
 

board/common/rootfs/usr/libexec/infix/init.d/30-cfg-migrate

@@ -4,10 +4,14 @@
 # the migrate tool inserts old version in name before .cfg extension.
 CONFIG_FILE="/cfg/startup-config.cfg"
 BACKUP_FILE="/cfg/backup/startup-config.cfg"
-mkdir -p "$(dirname "$BACKUP_FILE")"
+BACKUP_DIR="$(dirname "$BACKUP_FILE")"
+
+mkdir -p         "$BACKUP_DIR"
+chown root:wheel "$BACKUP_DIR"
+chmod 0770       "$BACKUP_DIR"
 
 if [ ! -f "$CONFIG_FILE" ]; then
-    note "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
+    logger -I $$ -k -p user.notice -t $(basename "$0")  "No $(basename "$CONFIG_FILE" .cfg) yet, likely factory reset."
     exit 0
 elif migrate -cq "$CONFIG_FILE"; then
     exit 0

board/common/rootfs/usr/libexec/infix/wifi-scanner

@@ -0,0 +1,16 @@
+#!/bin/sh
+
+if [ $# -ne 1 ]; then
+	echo "usage: $0 <ifname>"
+	exit 1
+fi
+ifname=$1
+
+TIMEOUT=300
+status=$(wpa_cli -i $ifname scan)
+while [ "$status" != "OK" ]; do
+	status=$(wpa_cli -i $ifname scan)
+	TIMEOUT=$((TIMEOUT-1))
+	[ $TIMEOUT -eq 0 ] && logger -t wifi-scanner "Failed to start scanning $ifname" && exit 1
+	sleep 0.5
+done

board/common/rootfs/usr/sbin/container

@@ -8,7 +8,7 @@
 #
 DOWNLOADS=/var/lib/containers/oci
 BUILTIN=/lib/oci
-TMPDIR=/var/tmp
+BASEDIR=/var/tmp
 container=$0
 checksum=""
 extracted=
@@ -29,16 +29,21 @@ err()
     rc=$1; shift
     logger -I $PPID -t container -p local1.err -- "Error: $*"
 
-    if [ -n "$extracted" ]; then
-	if [ -d "$TMPDIR/$dir" ]; then
-	    log "Cleaning up extracted $dir"
-	    rm -rf "$dir"
+    if [ -n "$extracted" ] && [ -n "$tmpdir" ]; then
+	if [ -d "$tmpdir" ]; then
+	    log "Cleaning up temporary directory $tmpdir"
+	    rm -rf "$tmpdir"
 	fi
     fi
 
     [ "$rc" -eq 0 ] || exit "$rc"
 }
 
+pidfn()
+{
+    echo "/run/containers/${1}.pid"
+}
+
 check()
 {
     file=$1
@@ -105,10 +110,11 @@ EOF
     return 1
 }
 
-# Unpacks a given oci-archive.tar[.gz] in the current directory.  Sanity
-# checks, at least one index.json in the top-level dir of the archive.
-# If there are more index files, this function does not handle them.
-unpack_archive()
+# Extracts an oci-archive.tar[.gz] in a temporary directory.  Finds and
+# sanity checks that at least one index.json exist in the archive. This
+# is the OCI directory fed to `podman load` and also used as repo name.
+# NOTE: if there are >1 index.json, this function does not handle them.
+load_archive()
 {
     uri=$1
     tag=$2
@@ -153,49 +159,81 @@ unpack_archive()
 	fi
     fi
 
+    file=$(realpath "$file")
     if [ -d "$file" ]; then
 	index=$(find "$file" -name index.json)
 	if [ -z "$index" ]; then
 	    err 1 "cannot find index.json in OCI image $file"
 	fi
     else
-	cd "$TMPDIR" || err 0 "failed cd $TMPDIR, wiill use $(pwd) for OCI archive extraction."
+	# Extract files in a temporary directory, because most OCI
+	# archives are flat/bare, all files in the root w/o a dir/
+	tmpdir=$(mktemp -d -p "$BASEDIR") || err 1 "failed creating temporary directory"
+	cd "$tmpdir" || err 1 "failed cd to temporary directory $tmpdir"
 
-	index=$(tar tf "$file" |grep index.json)
+	index="$tmpdir/$(tar tf "$file" |grep index.json)"
 	if [ -z "$index" ]; then
 	    err 1 "invalid OCI archive, cannot find index.json in $file"
 	fi
 
 	[ -n "$quiet" ] || log "Extracting OCI archive $file ..."
-        tar xf "$file"  || err 1 "failed unpacking $file in $(pwd)"
+        tar xf "$file"  || err 1 "failed unpacking $file in $tmpdir"
 	extracted=true
+	cd - >/dev/null || err 0 "failed cd -"
     fi
 
     dir=$(dirname "$index")
-    if echo "$dir" | grep -q ":"; then
+
+    # Handle flat tarballs without a sub-directory, because
+    # the $dir name is used as fallback when retagging below.
+    if [ -n "$extracted" ] && [ "$dir" = "$tmpdir" ]; then
+	parent=$(dirname "$dir")
+	dirnam=$(echo "$img" | sed 's/\(.*\)\.tar.*/\1/')
+	tmpdir="${parent}/${dirnam}"
+	mv "$dir" "$tmpdir"
+	dir="$tmpdir"
+    fi
+
+    if basename "$dir" | grep -q ":"; then
         if [ -z "$tag" ]; then
-            tag="$dir"
+            tag=$(basename "$dir")
         fi
+
         sanitized_dir=$(echo "$dir" | cut -d':' -f1)
         mv "$dir" "$sanitized_dir" || err 1 "failed renaming $dir to $sanitized_dir"
         dir="$sanitized_dir"
     fi
 
     [ -n "$quiet" ] || log "Loading OCI image $dir ..."
-    podman load -qi "$dir"        >/dev/null
+    output=$(podman load -qi "$dir")
+
+    # Extract image ID from podman load output:
+    # "Loaded image: sha256:cd9d0aaf81be..."
+    if echo "$output" | grep -q "sha256:"; then
+	img_id="${output##*sha256:}"
+    else
+	# Fallback to directory name if no SHA found
+	img_id="$dir"
+    fi
+
+    # On podman < 4.7.0 we had to retag images from default $dir:latest
+    # From >= 4.7.0 we always tag since loads come in as <none>:<none>
+    if [ -z "$tag" ]; then
+	tag=$(basename "$dir")
+    fi
+
+    # Repo names must be lowercase, and only '[a-z0-9._/-]+' and ':tag'
+    tag=$(printf "%s" "$tag" | tr '[:upper:]' '[:lower:]' | tr -c 'a-z0-9._/:-' '-')
+
+    [ -n "$quiet" ] || log "Tagging loaded image $img_id as $tag"
+    if ! podman tag "$img_id" "$tag"; then
+	err 1 "failed tagging image as $tag"
+    fi
 
     # Clean up after ourselves
     if [ -n "$extracted" ]; then
 	log "Cleaning up extracted $dir"
-	rm -rf "$dir"
-    fi
-
-    # Retag image from podman default $dir:latest
-    if [ -n "$tag" ]; then
-	podman tag "$dir" "$tag" >/dev/null
-	podman rmi "$dir"        >/dev/null
-    else
-	tag=$dir
+	rm -rf "$tmpdir"
     fi
 
     echo "$tag"
@@ -223,7 +261,7 @@ create()
 
     # Unpack and load docker-archive/oci/oci-archive, returning image
     # name, or return docker:// URL for download.
-    if ! image=$(unpack_archive "$image"); then
+    if ! image=$(load_archive "$image"); then
 	exit 1
     fi
 
@@ -235,7 +273,7 @@ create()
     args="$args --read-only --replace --quiet --cgroup-parent=containers $caps"
     args="$args --restart=$restart --systemd=false --tz=local $privileged"
     args="$args $vol $mount $hostname $entrypoint $env $port $logging"
-    pidfn=/run/container:${name}.pid
+    pidfile=/run/container:${name}.pid
 
     [ -n "$quiet" ] || log "---------------------------------------"
     [ -n "$quiet" ] || log "Got name: $name image: $image"
@@ -258,8 +296,8 @@ create()
     fi
 
     # shellcheck disable=SC2048
-    log "podman create --name $name --conmon-pidfile=$pidfn $args $image $*"
-    if podman create --name "$name" --conmon-pidfile="$pidfn" $args "$image" $*; then
+    log "podman create --name $name --conmon-pidfile=$pidfile $args $image $*"
+    if podman create --name "$name" --conmon-pidfile="$pidfile" $args "$image" $*; then
 	[ -n "$quiet"  ] || log "Successfully created container $name from $image"
 	[ -n "$manual" ] || start "$name"
 
@@ -282,7 +320,6 @@ delete()
     fi
 
     # Should already be stopped, but if not ...
-    log "$name: should already be stopped, double checking ..."
     container stop "$name" >/dev/null
 
     while running "$name"; do
@@ -294,9 +331,11 @@ delete()
 	sleep 1
     done
 
-    log "$name: calling podman rm -vif ..."
     podman rm -vif "$name" >/dev/null 2>&1
     [ -n "$quiet" ] || log "Container $name has been removed."
+
+    cnt=$(podman image prune -af | wc -l)
+    log "Pruned $cnt image(s)"
 }
 
 waitfor()
@@ -340,6 +379,24 @@ wrap()
 {
     name=$1
     cmd=$2
+    pidfile=$(pidfn "$name")
+
+    # Containers have three phases: setup, running, and teardown.
+
+    # The setup phase may run forever in the background trying to fetch
+    # the image.  It saves its PID in /run/containers/${name}.pid
+    if [ "$cmd" = "stop" ] && [ -f "$pidfile" ]; then
+        pid=$(cat "$pidfile")
+
+	# Check if setup is still running ...
+	if kill -0 "$pid" 2>/dev/null; then
+            kill "$pid"
+            wait "$pid" 2>/dev/null
+        fi
+
+        rm -f "$pidfile"
+        return 0
+    fi
 
     # Skip "echo $name" from podman start in log
     podman "$cmd" "$name" >/dev/null
@@ -375,7 +432,14 @@ netrestart()
 
 cleanup()
 {
+    pidfile=$(pidfn "$name")
+
     log "Received signal, exiting."
+    if [ -n "$name" ] && [ -f "$pidfile" ]; then
+	log "$name: in setup phase, removing $pidfile ..."
+	rm -f "$pidfile"
+    fi
+
     exit 1
 }
 
@@ -412,7 +476,7 @@ options:
   -q, --quiet              Quiet operation, called from confd
   -r, --restart POLICY     One of "no", "always", or "on-failure:NUM"
   -s, --simple             Show output in simplified format
-  -t, --timeout SEC        Set timeout for delete/restart commands, default: 20
+  -t, --timeout SEC        Set timeout for delete/restart commands, default: 30
   -v, --volume NAME:PATH   Create named volume mounted inside container on PATH
 
 commands:
@@ -520,7 +584,7 @@ while [ "$1" != "" ]; do
 	    ;;
 	-m | --mount)
 	    shift
-	    mount="--mount=$1"
+	    mount="$mount --mount=$1"
 	    ;;
 	--manual)
 	    manual=true
@@ -574,7 +638,7 @@ if [ -n "$cmd" ]; then
     shift
 fi
 
-trap cleanup INT TERM
+trap cleanup INT HUP TERM
 
 case $cmd in
     # Does not work atm., cannot attach to TTY because
@@ -633,7 +697,7 @@ case $cmd in
 	;;
     load)
 	# shellcheck disable=SC2086
-	name=$(unpack_archive "$1" $2)
+	name=$(load_archive "$1" $2)
 	[ -n "$name" ] || exit 1
 
 	# Show resulting image(s) matching $name
@@ -666,7 +730,7 @@ case $cmd in
 	    oci)
 		find $BUILTIN $DOWNLOADS -type f 2>/dev/null
 		;;
-	    *)		
+	    *)
 		podman ps $all --format "{{.Names}}"
 		;;
 	esac
@@ -710,15 +774,29 @@ case $cmd in
 	[ -n "$name" ] || err 1 "setup: missing container name."
 	script=/run/containers/${name}.sh
 	[ -x "$script" ] || err 1 "setup: $script does not exist or is not executable."
+
+	# Save our PID in case we get stuck here and someone wants to
+	# stop us, e.g., due to reconfiguration or reboot.
+	pidfile=$(pidfn "${name}")
+	echo $$ > "$pidfile"
+
 	while ! "$script"; do
             log "${name}: setup failed, waiting for network changes ..."
-	    read -t 60 _ < <(ip monitor address route)
+
+	    # Timeout and retry after 60 seconds, on SIGTERM, or when
+	    # any network event is caught.
+	    timeout -s TERM -k 1 60 sh -c \
+		    'ip monitor address route 2>/dev/null | head -n1 >/dev/null' || true
 
 	    # On IP address/route changes, wait a few seconds more to ensure
 	    # the system has ample time to react and set things up for us.
 	    log "${name}: retrying ..."
 	    sleep 2
 	done
+
+	rm -f "$pidfile"
+	cnt=$(podman image prune -f | wc -l)
+	log "setup: pruned $cnt image(s)"
 	;;
     shell)
 	if [ -z "$name" ]; then

board/common/uboot/extras.config

@@ -20,7 +20,6 @@ CONFIG_CMD_SETEXPR_FMT=y
 
 CONFIG_MMC=y
 CONFIG_MMC_SDHCI=y
-CONFIG_MMC_PCI=y
 CONFIG_CMD_MMC=y
 
 CONFIG_FS_SQUASHFS=y

board/common/uboot/uboot.mk

@@ -17,14 +17,23 @@ endef
 # U-Boot build tree. This will then be built in to the final U-Boot
 # image's control DT via the CONFIG_DEVICE_TREE_INCLUDES option (see
 # extras.config).
+#
+# Some platforms, most notably Raspberry Pi, load the device tree
+# from the SPL, effectively overriding the built-in control DT.
+# For that we bundle an overlay that can be included instead.
 define UBOOT_PRE_BUILD_INSTALL_KEY
-	$(HOST_DIR)/bin/dtc <(echo '/dts-v1/; / { signature {}; };') >$(@D)/infix-key.dtb
+	$(HOST_DIR)/bin/dtc -a 1024 <(echo '/dts-v1/; / { signature {}; };') \
+		>$(@D)/infix-key.dtb
 	$(foreach key, \
 		$(call qstrip,$(TRUSTED_KEYS_DEVELOPMENT_PATH)) $(call qstrip,$(TRUSTED_KEYS_EXTRA_PATH)),\
 		$(call uboot-add-pubkey,$(key),$(@D)/infix-key.dtb))
 	$(HOST_DIR)/bin/dtc -I dtb -O dts \
 		<$(@D)/infix-key.dtb \
-	| sed -e 's:/dts-v[0-9]\+/;::' >$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi
+		| sed -e 's:/dts-v[0-9]\+/;::' \
+		| tee $(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtsi \
+		| sed -e '1i\/dts-v1/;\n/plugin/;\n' -e '/^$$/d' -e 's:/ {:\&{/} {:' \
+		>$(@D)/arch/$(UBOOT_ARCH)/dts/infix-key.dtso
+
 	rm $(@D)/infix-key.dtb
 endef
 UBOOT_PRE_BUILD_HOOKS += UBOOT_PRE_BUILD_INSTALL_KEY

board/x86_64/linux_defconfig

@@ -261,6 +261,7 @@ CONFIG_NLS_ISO8859_1=y
 CONFIG_CRYPTO_AES=y
 CONFIG_CRYPTO_GCM=y
 CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_INFO_DWARF_TOOLCHAIN_DEFAULT=y
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_DEBUG_FS=y
 CONFIG_PANIC_ON_OOPS=y

configs/aarch64_defconfig

@@ -13,8 +13,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.17"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -55,8 +56,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
+BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
@@ -119,12 +120,13 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -132,12 +134,14 @@ BR2_PACKAGE_ALDER_ALDER=y
 BR2_PACKAGE_MARVELL_CN9130_CRB=y
 BR2_PACKAGE_MARVELL_ESPRESSOBIN=y
 BR2_PACKAGE_STYX_DCP_SC_28P=y
+BR2_PACKAGE_RASPBERRY_PI_4=y
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -161,11 +165,14 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_LIBINPUT=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
-DISK_IMAGE_BOOT_BIN=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
+DISK_IMAGE_BOOT_BIN=y
 GNS3_APPLIANCE_RAM=512
 GNS3_APPLIANCE_IFNUM=10

configs/aarch64_minimal_defconfig

@@ -27,13 +27,14 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.17"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -107,7 +108,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -119,6 +120,7 @@ BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_CONFD_TEST_MODE=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -137,6 +139,8 @@ BR2_PACKAGE_MDNS_ALIAS=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 DISK_IMAGE_BOOT_BIN=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y

configs/aarch64_qemu_boot_defconfig

@@ -20,15 +20,11 @@ BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION=y
 BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2023.07.02"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="qemu_arm64"
-BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/qemu/uboot/extras.config"
 BR2_TARGET_UBOOT_FORMAT_DTB=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
-DISK_IMAGE_BOOT_OFFSET=0x00200000
+# GNS3_APPLIANCE is not set

configs/cn9130_crb_boot_defconfig

@@ -38,8 +38,4 @@ BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
-TRUSTED_KEYS=y
-TRUSTED_KEYS_DEVELOPMENT=y
-DISK_IMAGE_BOOT_BIN=y
-DISK_IMAGE_BOOT_DATA="${BINARIES_DIR}/flash-image.bin"
-DISK_IMAGE_BOOT_OFFSET=0x00200000
+# GNS3_APPLIANCE is not set

configs/fireant_boot_defconfig

@@ -11,6 +11,7 @@ BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
 BR2_INIT_NONE=y
 BR2_SYSTEM_BIN_SH_NONE=y
 # BR2_PACKAGE_BUSYBOX is not set
+BR2_PACKAGE_LIBBSD=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_UBOOT=y
@@ -20,3 +21,5 @@ BR2_TARGET_UBOOT_CUSTOM_REPO_URL="https://github.com/kernelkit/u-boot.git"
 BR2_TARGET_UBOOT_CUSTOM_REPO_VERSION="c3d9cdcc7d9e3eb490d4036f5eece3fb91a2485c"
 BR2_TARGET_UBOOT_BOARD_DEFCONFIG="mscc_fireant_pcb135_emmc"
 BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+# GNS3_APPLIANCE is not set

configs/r2s_defconfig

@@ -8,7 +8,6 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
-BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="infix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
@@ -30,7 +29,7 @@ BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image
 BR2_ROOTFS_POST_SCRIPT_ARGS="-c $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/genimage.cfg"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.10.3"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
 BR2_LINUX_KERNEL_PATCH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/r2s/rk3328-nanopi-r2s-dts.patch"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/r2s/linux_defconfig"
@@ -42,6 +41,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -74,7 +74,6 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBINPUT=y
 BR2_PACKAGE_LIBCURL_CURL=y
@@ -171,13 +170,14 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-r2s"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
 BR2_PACKAGE_CONFD=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -201,8 +201,10 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/riscv64_defconfig

@@ -39,6 +39,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
@@ -161,7 +162,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -169,6 +170,7 @@ BR2_PACKAGE_CONFD=y
 # BR2_PACKAGE_CONFD_TEST_MODE is not set
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -194,6 +196,8 @@ BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 # GNS3_APPLIANCE is not set

configs/rpi4_boot_defconfig

@@ -0,0 +1,37 @@
+BR2_aarch64=y
+BR2_cortex_a72=y
+BR2_TOOLCHAIN_EXTERNAL=y
+BR2_TOOLCHAIN_EXTERNAL_BOOTLIN=y
+BR2_DL_DIR="$(BR2_EXTERNAL_INFIX_PATH)/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="$(BR2_EXTERNAL_INFIX_PATH)/.ccache"
+BR2_ENABLE_DEBUG=y
+BR2_PACKAGE_OVERRIDE_FILE="$(BR2_EXTERNAL_INFIX_PATH)/local.mk"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_INFIX_PATH)/patches"
+BR2_SSP_NONE=y
+BR2_INIT_NONE=y
+BR2_SYSTEM_BIN_SH_NONE=y
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
+# BR2_PACKAGE_BUSYBOX is not set
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/config.txt"
+BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/cmdline.txt"
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BUILD_SYSTEM_KCONFIG=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION=y
+BR2_TARGET_UBOOT_CUSTOM_VERSION_VALUE="2025.01"
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="${BR2_EXTERNAL_INFIX_PATH}/board/common/uboot/extras.config ${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/extras.config"
+BR2_TARGET_UBOOT_NEEDS_DTC=y
+BR2_TARGET_UBOOT_FORMAT_DTB=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="${BR2_EXTERNAL_INFIX_PATH}/src/board/raspberry-pi-4/uboot/rpi-env.dtso"
+BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+# GNS3_APPLIANCE is not set

configs/x86_64_defconfig

@@ -12,8 +12,8 @@ BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +26,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.17"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +34,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -54,10 +55,8 @@ BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
 BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
-BR2_PACKAGE_LIBMNL=y
 BR2_PACKAGE_NETOPEER2_CLI=y
 BR2_PACKAGE_NSS_MDNS=y
 BR2_PACKAGE_LINUX_PAM=y
@@ -126,13 +125,14 @@ BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
+BR2_PACKAGE_HOST_GO_BIN=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -142,6 +142,7 @@ BR2_PACKAGE_CURIOS_HTTPD=y
 BR2_PACKAGE_CURIOS_NFTABLES=y
 BR2_PACKAGE_GENCERT=y
 BR2_PACKAGE_STATD=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_FACTORY=y
 BR2_PACKAGE_FINIT_PLUGIN_HOTPLUG=y
 BR2_PACKAGE_FINIT_PLUGIN_HOOK_SCRIPTS=y
@@ -165,8 +166,12 @@ BR2_PACKAGE_PODMAN_DRIVER_DEVICEMAPPER=y
 BR2_PACKAGE_PODMAN_DRIVER_VFS=y
 BR2_PACKAGE_TETRIS=y
 BR2_PACKAGE_ROUSETTE=y
-BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
+BR2_PACKAGE_FEATURE_WIFI=y
+BR2_PACKAGE_FEATURE_WIFI_DONGLE_REALTEK=y
+BR2_PACKAGE_HOST_PYTHON_YANGDOC=y
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
+BR2_PACKAGE_GETENT=y
 TRUSTED_KEYS=y
 TRUSTED_KEYS_DEVELOPMENT=y
 GNS3_APPLIANCE_RAM=512

configs/x86_64_minimal_defconfig

@@ -7,13 +7,14 @@ BR2_CCACHE=y
 BR2_CCACHE_DIR="${BR2_EXTERNAL_INFIX_PATH}/.ccache"
 BR2_ENABLE_DEBUG=y
 BR2_GLOBAL_PATCH_DIR="${BR2_EXTERNAL_INFIX_PATH}/patches"
+BR2_DOWNLOAD_FORCE_CHECK_HASHES=y
 BR2_TARGET_GENERIC_HOSTNAME="ix"
 BR2_TARGET_GENERIC_ISSUE="Infix by KernelKit"
 BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
-# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -26,7 +27,7 @@ BR2_ROOTFS_POST_BUILD_SCRIPT="board/qemu/x86_64/post-build.sh ${BR2_EXTERNAL_INF
 BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
-BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.17"
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.44"
 BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/x86_64/linux_defconfig"
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
@@ -34,6 +35,7 @@ BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_PACKAGE_BUSYBOX_CONFIG="${BR2_EXTERNAL_INFIX_PATH}/board/common/busybox_defconfig"
 BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
+BR2_PACKAGE_SYSREPO_GROUP="sys-cli"
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
 BR2_PACKAGE_DBUS_CXX=y
@@ -50,10 +52,7 @@ BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
 BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
-BR2_PACKAGE_LIBSSH_OPENSSL=y
 BR2_PACKAGE_LIBSSH2=y
-BR2_PACKAGE_LIBSSH2_OPENSSL=y
-BR2_PACKAGE_LIBXCRYPT=y
 BR2_PACKAGE_LIBOPENSSL_BIN=y
 BR2_PACKAGE_LIBCURL_CURL=y
 BR2_PACKAGE_LIBMNL=y
@@ -83,6 +82,7 @@ BR2_PACKAGE_TCPDUMP=y
 BR2_PACKAGE_WHOIS=y
 BR2_PACKAGE_BASH_COMPLETION=y
 BR2_PACKAGE_SUDO=y
+BR2_PACKAGE_GETENT=y
 BR2_PACKAGE_KMOD_TOOLS=y
 BR2_PACKAGE_PWGEN=y
 BR2_PACKAGE_RAUC=y
@@ -115,7 +115,7 @@ BR2_PACKAGE_HOST_UBOOT_TOOLS=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
 BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
-INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."
+INFIX_DESC="Infix is an operating system based on Linux and modeled with YANG.  It can be set up both as a switch, with offloading using switchdev, a router with firewalling, or a secure end device.  All while supporting advanced networking scenarios and running Docker containers."
 INFIX_HOME="https://github.com/kernelkit/infix/"
 INFIX_DOC="https://github.com/kernelkit/infix/tree/main/doc"
 INFIX_SUPPORT="mailto:kernelkit@googlegroups.com"
@@ -138,6 +138,7 @@ BR2_PACKAGE_KLISH_PLUGIN_INFIX=y
 BR2_PACKAGE_LOWDOWN=y
 BR2_PACKAGE_MCD=y
 BR2_PACKAGE_MDNS_ALIAS=y
+BR2_PACKAGE_SHOW=y
 BR2_PACKAGE_ROUSETTE=y
 BR2_PACKAGE_RAUC_INSTALLATION_STATUS=y
 TRUSTED_KEYS=y

doc/ChangeLog.md

@@ -3,12 +3,131 @@ Change Log
 
 All notable changes to the project are documented in this file.
 
+[v25.08.1][] - 2025-10-03
+-------------------------
+
+### Changes
+- N/A
+
+### Fixes
+- Fix #1150: `show-legacy` wrapper permissions
+- Fix #1155: `show ospf` commands regression
+- Fix #1169: Expected OSPF neighbors not shown in `sysrepocfg` when the
+  system has at least one non-OSPF interface
+
+[v25.08.0][] - 2025-09-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.5 (LTS)
+- Upgrade Linux kernel to 6.12.44 (LTS)
+- Raspberry Pi 4 is now a part of the aarch64 image.
+- Add support for [Raspberry Pi touch display][RPI-TOUCH] on Raspberry Pi 4
+
+### Fixes
+- Fix #1098: Prune dangling container images to reclaim disk space
+- Fix #1123: Disabling or removing a container may cause podman to hang
+- Fix #1124: Container setup with unreachable remote image spawns
+  excessive `ip monitor` processes
+- Fix #1127: Silence libyang Obsolete schema node warnings in log
+
+[RPI-TOUCH]: https://www.raspberrypi.com/products/raspberry-pi-touch-display/
+
+[v25.06.0][] - 2025-07-01
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.4 (LTS)
+- Upgrade Linux kernel to 6.12.35 (LTS)
+- Upgrade curiOS built-in containers to v25.06.0
+- Add support for setting mode of a container content mount, issue #1070
+- Add Wi-Fi client support and add support for some USB-Wi-Fi cards
+- New slogan: Infix OS — Immutable.Friendly.Secure
+
+### Fixes
+- cli: fix by-word movement, detect word barrier using non-alphanum chars
+- cli: fix delete word left/right, make sure to save word in kill buffer
+
+
+[v25.05.1][] - 2025-06-12
+-------------------------
+
+### Changes
+- Upgrade Linux kernel to 6.12.32 (LTS)
+
+### Fixes
+- Fix #1060: Restore of missing CLI commands, regression in Infix v25.05.0
+
+[v25.05.0][] - 2025-05-27
+-------------------------
+
+### Changes
+- Upgrade Buildroot to 2025.02.3 (LTS)
+- Upgrade Linux kernel to 6.12.30 (LTS)
+- Upgrade libyang to 3.12.2
+- Upgrade sysrepo to 3.6.11
+- Upgrade netopeer2 (NETCONF) to 2.4.1
+- New hardware support: Raspberry Pi 4B (aarch64)
+- Add documentation on Infix upgrading and downgrading, issue #1009
+- Add HDMI and USB support for iMX8MP-evk
+- Enforced strict format for LLDP destination MAC address:
+  - Only accepts colon-separated format: `01:80:C2:00:00:0E`
+- Add `show lldp` command to show discovered neighbors per interface.
+- Add configuration support for per-interface LLDP administrative status
+
+### Fixes
+- Fix containers with multiple mounts
+- Correct description for LAG LACP modes
+- Fix #1040: Add `mount` constraint for container config
+
+
+[v25.04.0][] - 2025-04-30
+-------------------------
+
+### Changes
+ - Upgrade Linux kernel to 6.12.25 (LTS)
+ - Upgrade Buildroot to 2025.02.1 (LTS)
+ - Format for disk image (for QEMU) has changed to `qcow2`
+
+### Fixes
+ - Fix #1002: Broken symlink in release package
+ - Fix #1006: NanoPi R2S corrupt startup, regression in Infix v25.02.0
+   - Bump R2S kernel, now same as tier one boards
+ - Fix #1015: Not possible to save custom SSH settings in startup-config
+ - Fix group owner and permissions of `/cfg/backup` directory
+ - Fix extraction of old version for `/cfg/backup/` files
+ - Fix configuration migration issues when upgrading
+
+[v25.03.0][] - 2025-03-31
+-------------------------
+
+> [!IMPORTANT]
+> This release is the first with the new Buildroot 2025.02 (LTS)
+
+### Changes
+ - Upgrade Linux kernel to 6.12.21 (LTS)
+ - Upgrade Buildroot to 2025.02.0 (LTS)
+
+### Fixes
+ - Fix #964: YANG schema warning in syslog: missing 'monitor' node for lag
+ - Fix #980: the system fails to reboot when a container is (stuck), for
+   whatever reason, in its 'setup' state
+ - Fix #990: web console, ttyd service, stopped working after upgrade to
+   Buildroot 2025.02, caused by new (missing) option `--writable`
+ - Fix TCAM memory corruption in `mvpp2` Ethernet controller
+ - Fix annoying (but harmless) usage message from the logger tool when
+   `startup-config` fails to load and the system reverts to failure mode
+ - Fix harmless log warning for product specific init when no product
+   specific init scripts are found
+ - Backport fixes for sysklogd, affecting hostname filtering and periods
+   in TAG names, pending official backport in Buildroot
+
 
 [v25.02.0][] - 2025-03-04
 -------------------------
 
 ### Changes
- - Upgrade Linux kernel to 6.12.17 (LTS)
+ - Upgrade Linux kernel to 6.12.18 (LTS)
  - Upgrade Buildroot to 2024.02.11 (LTS)
  - Add support for link aggregation (lag), static (balance-xor) and LACP
  - Add support for the [i.MX 8M Plus EVK][EVK]
@@ -31,6 +150,8 @@ All notable changes to the project are documented in this file.
  - Fix #956: CLI `copy` command complains it cannot change owner when
    copying `factory-config` to `running-config`.  Bogus error, the
    latter is not really a file
+ - Fix #977: "Operation not permitted" when saving `running-config` to
+   `startup-config` (harmless warning but annoying and concerning)
 
 [EVK]: https://www.nxp.com/design/design-center/development-boards-and-designs/8MPLUSLPD4-EVK
 
@@ -70,6 +191,7 @@ All notable changes to the project are documented in this file.
  - Add support for GRE/GRETAP tunnels
  - Add support for STP/RSTP on bridges
  - Add support for VXLAN tunnels
+ - Add support for configuring global LLDP `message-tx-interval`
 
 ### Fixes
 
@@ -1502,7 +1624,14 @@ Supported YANG models in addition to those used by sysrepo and netopeer:
  - N/A
 
 [buildroot]:  https://buildroot.org/
-[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.01.0...HEAD
+[UNRELEASED]: https://github.com/kernelkit/infix/compare/v25.08.0...HEAD
+[v25.08.1]:   https://github.com/kernelkit/infix/compare/v25.08.0...v26.08.1
+[v25.08.0]:   https://github.com/kernelkit/infix/compare/v25.06.1...v26.08.0
+[v25.06.0]:   https://github.com/kernelkit/infix/compare/v25.05.1...v26.06.0
+[v25.05.1]:   https://github.com/kernelkit/infix/compare/v25.05.0...v25.05.1
+[v25.05.0]:   https://github.com/kernelkit/infix/compare/v25.04.0...v25.05.0
+[v25.04.0]:   https://github.com/kernelkit/infix/compare/v25.03.0...v25.04.0
+[v25.03.0]:   https://github.com/kernelkit/infix/compare/v25.02.0...v25.03.0
 [v25.02.0]:   https://github.com/kernelkit/infix/compare/v25.01.0...v25.02.0
 [v25.01.0]:   https://github.com/kernelkit/infix/compare/v24.11.0...v25.01.0
 [v24.11.1]:   https://github.com/kernelkit/infix/compare/v24.11.0...v24.11.1

doc/README.md

@@ -1,7 +1,7 @@
 <img align="right" src="logo.png" alt="Infix - Linux <3 NETCONF" width=480 border=10>
 
-Welcome to Infix, your friendly Network Operating System!  On these
-pages you can find both user and developer documentation.
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.
 
 Most topics on configuring the system include CLI examples, but every
 setting, as well as status read-back from the operational datastore, is

doc/boot.md

@@ -1,37 +1,36 @@
-Boot Procedure
-==============
+# Boot Procedure
 
 Systems running Infix will typically boot in multiple phases, forming
 a boot chain. Each link in the chain has three main responsibilities:
 
 1. Ensuring the integrity of the next link before passing control to
    it. This avoids silent failures stemming from data corruption.
-
-2. Ensuring the authenticity of the next link before passing control
+1. Ensuring the authenticity of the next link before passing control
    to it, commonly referred to as _Secure Boot_. This protects against
    malicious attempts to modify a system's firmware.
-
-3. Preparing the system state according to the requirements of the
+1. Preparing the system state according to the requirements of the
    next link. E.g. the Linux kernel requires the system's RAM to be
    operational.
 
 A typical chain consists of four stages:
 
-        .---------.
-        |   ROM   >---.   Determine the location of and load the SPL
-        '---------'   |
-    .-----------------'
-    |   .---------.
-    '--->   SPL   >---.   Perform DDR training and load the TPL
-        '---------'   |
-    .-----------------'
-    |   .---------.
-    '--->   TPL   >---.   Load Linux kernel, device tree, and root filesystem
-        '---------'   |
-    .-----------------'
-    |   .---------.
-    '--->  Infix  |       Get down to business
-        '---------'
+```
+    .---------.
+    |   ROM   >---.   Determine the location of and load the SPL
+    '---------'   |
+.-----------------'
+|   .---------.
+'--->   SPL   >---.   Perform DDR training and load the TPL
+    '---------'   |
+.-----------------'
+|   .---------.
+'--->   TPL   >---.   Load Linux kernel, device tree, and root filesystem
+    '---------'   |
+.-----------------'
+|   .---------.
+'--->  Infix  |       Get down to business
+    '---------'
+```
 
 After a reset, hardware will pass control to a program (_ROM_) which
 is almost always programmed into the SoC by the vendor.  This program
@@ -52,9 +51,7 @@ This document's focus is to describe the final two phases of the boot
 chain, as the initial phases are very hardware dependent, better
 described by existing documentation provided by the SoC vendor.
 
-
-Bootloader
-----------
+## Bootloader
 
 ### Configuration
 
@@ -62,33 +59,42 @@ To mitigate the risk of a malicious user being able to circumvent the
 bootloader's validation procedure, user configuration is kept to a
 minimum.  Two settings are available:
 
-- **Boot order**: Since Infix maintains two copies of its software image,
-  and as some bootloaders support netbooting, the order in which boot
-  sources are considered can be configured. To select the active
-  source, use [RAUC][]:
+**Boot order**: Since Infix maintains two copies of its software image,
+and as some bootloaders support [netbooting][2], the order in which boot
+sources are considered can be configured. To select the active
+source, use [RAUC][]:
 
-  `rauc status mark-active <slot>`
+```
+root@example:~# rauc status mark-active <slot>
+...
+```
 
-  Where `<slot>` is one of:
+Where `<slot>` is one of:
 
-  | `<slot>` | Source                    |
-  |----------|---------------------------|
-  | rootfs.0 | Primary partition         |
-  | rootfs.1 | Secondary partition       |
-  | net.0    | Netboot (where supported) |
+| **`<slot>`** | **Source**                |
+|--------------|---------------------------|
+| `rootfs.0`   | Primary partition         |
+| `rootfs.1`   | Secondary partition       |
+| `net.0`      | Netboot (where supported) |
 
-- **Debug**: By default, the kernel will only output errors to the
-  console during boot. Optionally, this can be altered such that all
-  enabled messages are logged.
+**Debug**: By default, the kernel will only output errors to the
+console during boot. Optionally, this can be altered such that all
+enabled messages are logged.
 
-  On systems using _U-Boot_, this can be enabled by running `fw_setenv
-  DEBUG 1`. To restore the default behavior, run `fw_setenv DEBUG`.
+On systems using _U-Boot_, this can be enabled by running `fw_setenv
+DEBUG 1`. To restore the default behavior, run `fw_setenv DEBUG`.
 
-  On systems running _GRUB_, this can be enabled by running
-  `grub-editenv /mnt/aux/grub/grubenv set DEBUG=1`. To restore the
-  default behavior, run `grub-editenv /mnt/aux/grub/grubenv unset
-  DEBUG`
+On systems running _GRUB_, this can be enabled by running:
 
+```
+root@example:~# grub-editenv /mnt/aux/grub/grubenv set DEBUG=1
+```
+
+To restore the default behavior, run:
+
+```
+root@example:~# grub-editenv /mnt/aux/grub/grubenv unset DEBUG
+```
 
 ### U-Boot
 
@@ -107,8 +113,7 @@ and TFTP to transfer the image to the system's RAM.
 
 Access to U-Boot's shell is disabled to prevent side-loading of
 malicious software.  To configure the active boot partition, refer to
-the [Bootloader Interface](#bootloader-interface) section.
-
+the [Bootloader Configuration](#configuration) section.
 
 ### GRUB
 
@@ -119,14 +124,82 @@ standard [System Upgrade](#system-upgrade) can be performed on
 virtualized instances.
 
 Access to the GRUB shell is not limited in any way, and the boot
-partition can be selected interactively at boot using the arrow
-keys. It is also possible to permanently configure the default
-partition from Infix using the [Bootloader
-Interface](#bootloader-interface).
+partition can be selected interactively at boot using the arrow keys. It
+is also possible to permanently configure the default partition from
+Infix using the [Bootloader Configuration](#configuration).
 
+## System Boot
 
-System Upgrade
-==============
+After the system firmware (BIOS or and [boot loader](boot.md) start
+Linux the following happens.  The various failure modes, e.g., missing
+password in VPD, are detailed later in this section.
+
+![System boot flowchart](img/fail-secure.svg)
+
+1. Before mounting `/cfg` and `/var` partitions, hosting read-writable
+   data like `startup-config` and container images, the system first
+   checks if a factory reset has been requested by the user, if so it
+   wipes the contents of these partitions
+1. Linux boots with a device tree which is used for detecting generic
+   make and model of the device, e.g., number of interfaces.  It may
+   also reference an EEPROM with [Vital Product Data](vpd.md).  That is
+   where the base MAC address and per-device password hash is stored.
+   (Generic builds use the same MAC address and password)
+1. On every boot the system's `factory-config` and `failure-config` are
+   generated from the YANG[^2] models of the current firmware version.
+   This ensures that a factory reset device can always boot, and that
+   there is a working fail safe, or rather *fail secure*, mode
+1. On first power-on, and after a factory reset, the system does not
+   have a `startup-config`, in which case `factory-config` is copied
+   to `startup-config` -- if a per-product specific version exists it
+   is preferred over the generated one
+1. Provided the integrity of the `startup-config` is OK, a system
+   service loads and activates the configuration
+
+### Failure Modes
+
+So, what happens if any of the steps above fail?
+
+#### VPD Fail
+
+The per-device password cannot be read, or is corrupt, so the system
+`factory-config` and `failure-config` are not generated:
+
+1. First boot, or after factory reset: `startup-config` cannot be
+   created or loaded, and `failure-config` cannot be loaded.  The
+   system ends up in an unrecoverable state, i.e., **RMA[^3] Mode**
+1. The system has booted (at least) once with correct VPD and password
+   and already has a `startup-config`.  Provided the `startup-config`
+   is OK (see below), it is loaded and system boots successfully
+
+In both cases, external factory reset modes/button will not help, and
+in the second case will cause the device to fail on the next boot.
+
+> [!NOTE]
+> The second case does not yet have any warning or event that can be
+> detected from the outside.  This is planned for a later release.
+
+#### Broken startup-config
+
+If loading `startup-config` fails for some reason, e.g., invalid JSON
+syntax, failed validation against the system's YANG model, or a bug in
+the system's `confd` service, the *Fail Secure Mode* is triggered and
+`failure-config` is loaded (unless VPD Failure, see above).
+
+> [!TIP]
+> Please see the [Branding & Releases](branding.md) document for how to
+> provide per-product `failure-config`, or `factory-config` to suit your
+> product's preferences.
+
+*Fail Secure Mode* is a fail-safe mode provided for debugging the
+system.  The default[^4] creates a setup of isolated interfaces with
+communication only to the management CPU, SSH and console login using
+the device's factory reset password, IP connectivity only using IPv6
+link-local, and device discovery protocols: LLDP, mDNS-SD.  The login
+and shell prompt are set to `failure-c0-ff-ee`, the last three octets of
+the device's base MAC address.
+
+## System Upgrade
 
 Much of the minutiae of software upgrades is delegated to [RAUC][],
 which offers lots of benefits out-of-the-box:
@@ -134,21 +207,21 @@ which offers lots of benefits out-of-the-box:
 - Upgrade Bundles are always signed, such that their authenticity can
   be verified by the running operating system, before the new one is
   installed.
-
 - The bureaucracy of interfacing with different bootloaders, manage
   the boot order, is a simple matter of providing a compatible
   configuration.
-
 - Updates can be sourced from the local filesystem (including external
   media like USB sticks or SD-cards) and from remote servers using FTP
   or HTTP(S).
 
 To initiate a system upgrade from the shell[^1], run:
 
-    rauc install <file|url>
+```
+root@example:~# rauc install <file|url>
+...
+```
 
-Where the file or URL points to a [RAUC Upgrade
-Bundle](#rauc-upgrade-bundle).
+Where the file or URL points to a [RAUC Upgrade Bundle](#rauc-upgrade-bundle).
 
 This will upgrade the partition not currently running.  After a
 successful upgrade is completed, you can reboot your system, which
@@ -156,14 +229,9 @@ will then boot from the newly installed image.  Since the partition
 from which you were originally running is now inactive, running the
 same upgrade command again will bring both partitions into sync.
 
-[RAUC]: https://rauc.io
+## Image Formats
 
-
-Image Formats
-=============
-
-SquashFS Image
---------------
+### SquashFS Image
 
 **Canonical Name**: `rootfs.squashfs`
 
@@ -174,10 +242,7 @@ this image, or is dependent on it, in one way or another.
 On its own, it can be used as an [initrd][] to efficiently boot a
 virtual instance of Infix.
 
-[initrd]: https://docs.kernel.org/admin-guide/initrd.html
-
-FIT Framed Squash Image
------------------------
+### FIT Framed Squash Image
 
 **Canonical Name**: `rootfs.itb`
 
@@ -194,9 +259,9 @@ stored in the `/boot` directory of the filesystem.
 
 On disk, this image is then stored broken up into its two components;
 the _FIT header_ (`rootfs.itbh`) and the SquashFS image.  The header
-is stored on the [Auxiliary Data](#aux---auxiliary-data) partition of
+is stored on the [Auxiliary Data](#aux-auxiliary-data) partition of
 the [Disk Image](#disk-image), while the SquashFS image is stored in
-one of the [Root Filesystem](#primarysecondary---root-filesystems)
+one of the [Root Filesystem](#primarysecondary-root-filesystems)
 partitions.
 
 When the system boots, U-Boot will concatenate the two parts to
@@ -216,25 +281,20 @@ validate the SquashFS's contents. This path was chosen because:
 In its full form, it can be used to netboot Infix, as it contains all
 the information needed by U-Boot in a single file.
 
-[FIT]: https://u-boot.readthedocs.io/en/latest/usage/fit.html
-
-
-RAUC Upgrade Bundle
--------------------
+### RAUC Upgrade Bundle
 
 **Canonical Name**: `infix-${ARCH}.pkg`
 
-Itself a SquashFS image, it contains the Infix [SquashFS
-Image](#squashfs-image) along with the header of the [FIT Framed
-Squash Image](#fit-framed-squash-image), and some supporting files to
-let [RAUC][] know how install it on the target system.
+Itself a SquashFS image, this bundle (sometimes referred to package)
+contains the Infix [SquashFS Image](#squashfs-image) along with the
+header of the [FIT Framed Squash Image](#fit-framed-squash-image), and
+some supporting files to let [RAUC][] know how install it on the target
+system.
 
-When performing a [System Upgrade](#system-upgrade), this is the
-format to use.
+When performing a [System Upgrade](#system-upgrade), this is the format
+to use.
 
-
-Disk Image
-----------
+### Disk Image
 
 **Canonical Name**: `disk.img`
 
@@ -242,35 +302,37 @@ Infix runs from a block device (e.g. eMMC or virtio disk) with the
 following layout. The disk is expected to use the GPT partitioning
 scheme. Partitions marked with an asterisk are optional.
 
-    .-----------.
-    | GPT Table |
-    :-----------:
-    |    boot*  |
-    :-----------:
-    |    aux    |
-    :-----------:
-    |           |
-    |  primary  |
-    |           |
-    :-----------:
-    |           |
-    | secondary |
-    |           |
-    :-----------:
-    |    cfg    |
-    :-----------:
-    |           |
-    |    var*   |
-    |           |
-    '-----------'
+```
+.-----------.
+| GPT Table |
+:-----------:
+|    boot*  |
+:-----------:
+|    aux    |
+:-----------:
+|           |
+|  primary  |
+|           |
+:-----------:
+|           |
+| secondary |
+|           |
+:-----------:
+|    cfg    |
+:-----------:
+|           |
+|    var*   |
+|           |
+'-----------'
+```
 
-### `boot` - Bootloader
+#### `boot` - Bootloader
 
-| Parameter | Value                                   |
-|-----------|-----------------------------------------|
-| Required  | No                                      |
-| Size      | 4 MiB                                   |
-| Format    | Raw binary, as dictated by the hardware |
+| **Parameter** | **Value**                               |
+|---------------|-----------------------------------------|
+| Required      | No                                      |
+| Size          | 4 MiB                                   |
+| Format        | Raw binary, as dictated by the hardware |
 
 Optional partition containing the system's bootloader. May also reside
 in a separate storage device, e.g. a serial FLASH.
@@ -278,14 +340,13 @@ in a separate storage device, e.g. a serial FLASH.
 On x86_64, this partition holds the EFI system partition, containing
 the GRUB bootloader.
 
+#### `aux` - Auxiliary Data
 
-### `aux` - Auxiliary Data
-
-| Parameter | Value           |
-|-----------|-----------------|
-| Required  | Yes             |
-| Size      | 4 MiB           |
-| Format    | EXT4 filesystem |
+| **Parameter** | **Value**       |
+|---------------|-----------------|
+| Required      | Yes             |
+| Size          | 4 MiB           |
+| Format        | EXT4 filesystem |
 
 Holds information that is shared between Infix and its bootloader,
 such as image signatures required to validate the chain of trust,
@@ -293,10 +354,12 @@ bootloader configuration etc.
 
 Typical layout when using U-Boot bootloader:
 
-    /
-    ├ primary.itbh
-    ├ secondary.itbh
-    └ uboot.env
+```
+/
+├ primary.itbh
+├ secondary.itbh
+└ uboot.env
+```
 
 During boot, an ITB header along with the corresponding root
 filesystem image are concatenated in memory, by U-Boot, to form a
@@ -307,39 +370,36 @@ Note that the bootloader's primary environment is bundled in the
 binary - `uboot.env` is only used to import a few settings that is
 required to configure the boot order.
 
+#### `primary`/`secondary` - Root Filesystems
 
-### `primary`/`secondary` - Root Filesystems
-
-| Parameter | Value             |
-|-----------|-------------------|
-| Required  | Yes               |
-| Size      | >= 256 MiB        |
-| Format    | Squash filesystem |
+| **Parameter** | **Value**         |
+|---------------|-------------------|
+| Required      | Yes               |
+| Size          | >= 256 MiB        |
+| Format        | Squash filesystem |
 
 Holds the [SquashFS Image](#squashfs-image). Two copies exist so that
 an incomplete upgrade does not brick the system, and to allow fast
 rollbacks when upgrading to a new version.
 
+#### `cfg` - Configuration Data
 
-### `cfg` - Configuration Data
-
-| Parameter | Value           |
-|-----------|-----------------|
-| Required  | Yes             |
-| Size      | >= 16 MiB       |
-| Format    | EXT4 filesystem |
+| **Parameter** | **Value**       |
+|---------------|-----------------|
+| Required      | Yes             |
+| Size          | >= 16 MiB       |
+| Format        | EXT4 filesystem |
 
 Non-volatile storage of the system configuration and user data.
 Concretely, user data is everything stored under `/root` and `/home`.
 
+#### `var` - Variable Data
 
-### `var` - Variable Data
-
-| Parameter | Value           |
-|-----------|-----------------|
-| Required  | No              |
-| Size      | >= 16 MiB       |
-| Format    | EXT4 filesystem |
+| **Parameter** | **Value**       |
+|---------------|-----------------|
+| Required      | No              |
+| Size          | >= 16 MiB       |
+| Format        | EXT4 filesystem |
 
 Persistent storage for everything under `/var`. This is maintained as
 a separate filesystem from the data in `cfg`, because while the system
@@ -349,5 +409,20 @@ can funtion reasonably well without a persistent `/var`, loosing
 If `var` is not available, Infix will still persist `/var/lib` using
 `cfg` as the backing storage.
 
-[^1]: See [CLI Upgrade](cli/upgrade.md) for information on upgrading
-    via CLI.
+[^1]: See [Upgrade & Boot Order](upgrade.md) for more information.
+[^2]: YANG is a modeling language from IETF, replacing that used for
+    SNMP (MIB), used to describe the subsystems and properties of
+    the system.
+[^3]: Return Merchandise Authorization (RMA), i.e., broken beyond repair
+    by end-user and eligible for return to manufacturer.
+[^4]: Customer specific builds can define their own `failure-config`.
+    It may be the same as `factory-config`, with the hostname set to
+    `failure`, or a dedicated configuration that isolates interfaces, or
+    even disables ports, to ensure that the device does not cause any
+    security problems on the network.  E.g., start forwarding traffic
+    between previously isolated VLANs.
+
+[2]:      netboot.md
+[FIT]:    https://u-boot.readthedocs.io/en/latest/usage/fit.html
+[RAUC]:   https://rauc.io
+[initrd]: https://docs.kernel.org/admin-guide/initrd.html

doc/branding.md

@@ -1,11 +1,9 @@
-Branding & Releases
-===================
+# Branding & Releases
 
-This document is for projects using Infix as a br2-external, i.e., OEMs.
+This document is for projects using Infix as a br2-external, i.e., OEMs
+that want to create *their own "Spin"* of Infix.
 
-
-Branding
---------
+## Branding
 
 Branding is done in menuconfig, there are several settings affecting
 it, most are in the Infix external subsection called "Branding", but
@@ -24,25 +22,18 @@ check this for you and you may end up with odd results.
 
 Verify the result after a build by inspecting:
 
-  - `output/images/*`: names, missing prefix, etc.
-  - `output/target/etc/os-release`: this file is sourced by
-    other build scripts, e.g., `mkgns3a.sh`.  For reference, see
-	https://www.freedesktop.org/software/systemd/man/os-release.html
+- `output/images/*`: names, missing prefix, etc.
+- `output/target/etc/os-release`: this file is sourced by other build
+  scripts, e.g., `mkgns3a.sh`.  For reference, see [os-release(5)][]
 
-> **Note:** to get proper GIT revision (hash) from your composed OS,
-> remember in menuconfig to set `INFIX_OEM_PATH`.  When unset the
-> Infix `post-build.sh` script defaults to the Infix base path.  The
-> revision is stored in the file `/etc/os-release` as BUILD_ID and
-> is also in the file `/etc/version`.  See below for more info.
+> [!IMPORTANT]
+> To get a proper GIT revision (hash) from your OS spin, remember to set
+> in menuconfig `INFIX_OEM_PATH`.  When unset, the Infix `post-build.sh`
+> script defaults to the Infix base path.  The revision is stored in the
+> file `/etc/os-release` as `BUILD_ID`, also in the file `/etc/version`.
+> See below for more info.
 
-[^1]: The base MAC address is defined in the device's Vital Product
-    Data (VPD) EEPROM, or similar, which is used by the kernel to
-    create the system interfaces.  This MAC address is usually also
-    printed on a label on the device.
-
-
-Factory & Failure Config
-------------------------
+## Factory & Failure Config
 
 To support booting the same image (CPU architecture) on multiple boards,
 Infix by default generates the device's initial configuration every time
@@ -50,13 +41,12 @@ at boot.  This also ensures the device can always be restored to a known
 state after a factory reset, since the `factory-config` is guaranteed to
 be compatible with the YANG models for the given software version. (For
 more information on how the system boots, please see the section [Key
-Concepts](introduction.md#key-concepts) in the Introduction document.)
+Concepts](index.md#key-concepts) in the Introduction document.)
 
 However, for custom builds of Infix it is possible to override this with
 a single static `/etc/factory-config.cfg` (and failure-config) in your
 rootfs overlay -- with a [VPD](vpd.md) you can even support several!
 
-
 ### Variables & Format Specifiers
 
 Parts of the configuration you likely always want to generated, like the
@@ -65,22 +55,22 @@ unique (per-device with a VPD) password hash.  This section lists the
 available keywords, see the next section for examples of how to use
 them:
 
- - **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
-   XPath: `/ietf-system:system/authentication/user/password`
- - **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
-   XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
- - **Hostname format specifiers:**  
-   XPath: `/ietf-system:system/hostname`
+- **Default password hash:** `$factory$` (from VPD, .dtb, or built-in)  
+  XPath: `/ietf-system:system/authentication/user/password`
+- **Default SSH and NETCONF hostkey:** `genkey` (regenerated at factory reset)
+  XPath: `/ietf-keystore:keystore/asymmetric-keys/asymmetric-key[name='genkey']`
+- **Hostname format specifiers:**  
+  XPath: `/ietf-system:system/hostname`
    - `%i`: OS ID, from `/etc/os-release`, from Menuconfig branding
    - `%h`: Default hostname, from `/etc/os-release`, from branding
    - `%m`: NIC specific part of base MAC, e.g., to `c0-ff-ee`
    - `%%`: Literal %
 
-
 ### Static Files
 
-> **Caveat:** maintaining static a factory-config and failure-config may
-> seem like an obvious choice, but as YANG models evolve (even the IETF
+> [!CAUTION]
+> Maintaining a static `factory-config` and `failure-config` may seem
+> like an obvious choice, but as YANG models evolve (even the IETF
 > models get upgraded), you may need to upgrade your static files.
 
 First, for one-off builds (one image per product), the simplest way is
@@ -103,9 +93,8 @@ after `00-probe` has run. The lower case version of the string is used.
 
 I.e., create a rootfs overlay that provides any combination of:
 
- - `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
- - `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
-
+- `/usr/share/product/<PRODUCT>/etc/factory-config.cfg`
+- `/usr/share/product/<PRODUCT>/etc/failure-config.cfg`
 
 ### Dynamically Generated
 
@@ -113,14 +102,14 @@ The generated `factory-config` and `failure-config` files consist of
 both static JSON files and part generated files at runtime for each
 device.  The resulting files are written to the RAM disk in `/run`:
 
- - `/run/confd/factory-config.gen`
- - `/run/confd/failure-config.gen`
+- `/run/confd/factory-config.gen`
+- `/run/confd/failure-config.gen`
 
 Provided no custom overrides (see above) have been installed already,
 these files are then copied to:
 
- - `/etc/factory-config.cfg`
- - `/etc/failure-config.cfg`
+- `/etc/factory-config.cfg`
+- `/etc/failure-config.cfg`
 
 ... where the bootstrap process expects them to be in the next step.
 
@@ -132,29 +121,33 @@ base hostname, set `BR2_TARGET_GENERIC_HOSTNAME` in your defconfig.
 The static files are installed by Infix `confd` in `/usr/share/confd/`
 at build time.  It contains two subdirectories:
 
-    /usr/share/confd/
-     |- factory.d/
-     |  |- 10-foo.json
-     |  |- 10-bar.json
-     |  `- 10-qux.json
-     `- failure.d/
-        |- 10-xyzzy.json
-        `- 10-garply.json
+```
+/usr/share/confd/
+ |- factory.d/
+ |  |- 10-foo.json
+ |  |- 10-bar.json
+ |  `- 10-qux.json
+ `- failure.d/
+    |- 10-xyzzy.json
+    `- 10-garply.json
+```
 
 To override, or extend, these files in you br2-external, set up a rootfs
 overlay and add it last in `BR2_ROOTFS_OVERLAY`.  Your overlay can look
 something like this:
 
-    ./board/common/rootfs/
-      |- etc/
-      |  |- confdrc             # See below
-      |  `- confdrc.local
-      `- usr/
-         `- share/
-            `- confd/
-               |- 10-foo.json   # Override Infix foo
-               |- 30-bar.json   # Extend, probably 10-bar.json
-               `- 30-fred.json  # Extend, your own defaults
+```
+./board/common/rootfs/
+  |- etc/
+  |  |- confdrc             # See below
+  |  `- confdrc.local
+  `- usr/
+     `- share/
+        `- confd/
+           |- 10-foo.json   # Override Infix foo
+           |- 30-bar.json   # Extend, probably 10-bar.json
+           `- 30-fred.json  # Extend, your own defaults
+```
 
 Using the same filename in your overlay, here `10-foo.json`, completely
 replaces the contents of the same file provided by Infix.  If you just
@@ -168,17 +161,17 @@ provide a few custom ones that the `bootstrap` knows about, e.g.,
 `gen-ifs-custom` that overrides `20-interfaces.json`.  See the
 bootstrap script for more help, and up-to-date information.
 
-> **Note:** you may not need to provide your own `/etc/confdrc`.  The
-> one installed by `confd` is usually enough.  However, if you want to
-> adjust the behavior of `bootstrap` you may want to override it.  There
-> is also `confdrc.local`, which usually is enough to change arguments
-> to scripts like `gen-interfaces`, e.g., to create a bridge by default,
-> you may want to look into `GEN_IFACE_OPTS`.
-
+> [!TIP]
+> You may not need to provide your own `/etc/confdrc` for your spin.
+> The one installed by `confd` is usually enough.  However, if you want
+> to adjust the behavior of `bootstrap` you may want to override it.
+> There is also `confdrc.local`, which usually is enough to change
+> arguments to scripts like `gen-interfaces`, e.g., to create a bridge
+> by default, you may want to look into `GEN_IFACE_OPTS`.
 
 ### Example Snippets
 
-**IETF System:**
+#### IETF System
 
 ```hsib
   "ietf-system:system": {
@@ -211,15 +204,16 @@ bootstrap script for more help, and up-to-date information.
 The `motd-banner` is a binary type, which is basically a Base64 encoded
 text file without line breaks (`-w0`):
 
-```bash
-$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" |base64 -d
+```
+$ echo "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo=" \
+    | base64 -d
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.github.io
 '-'---'-'
 ```
 
-**IETF Keystore**
+#### IETF Keystore
 
 Notice how both the public and private keys are left empty here, this
 cause them to be always automatically regenerated after each factory reset.
@@ -245,7 +239,7 @@ use-case and not documented here.
   },
 ```
 
-**IETF NETCONF Server**
+#### IETF NETCONF Server
 
 ```json
   "ietf-netconf-server:netconf-server": {
@@ -278,7 +272,8 @@ use-case and not documented here.
   },
 ```
 
-**Infix Services**
+#### Infix Services
+
 ```json
   "infix-services:ssh": {
     "enabled": true,
@@ -300,10 +295,7 @@ use-case and not documented here.
   }
 ```
 
-
-
-Integration
------------
+## Integration
 
 When integrating your software stack with Infix there may be protocols
 that want to change system settings like hostname and dynamically set
@@ -330,7 +322,7 @@ root@infix-00-00-00:~# cat hostnm.xml
 </system>
 root@infix-00-00-00:~# edit hostnm.xml
 root@infix-00-00-00:~# sysrepocfg -Ehostnm.xml
-root@example:~# 
+root@example:~#
 ```
 
 Second, perform all changes on `running-config`, the running datastore.
@@ -344,8 +336,8 @@ activate all.)
 
 You can consider the system composed of two entities:
 
-  - NETCONF starts up the system using `startup-config`, then
-  - Hands over control to your application at runtime
+- NETCONF starts up the system using `startup-config`, then
+- Hands over control to your application at runtime
 
 Infix is prepared for this by already having two "runlevels" for these
 two states.  The `startup-config` is applied in runlevel S (bootstrap)
@@ -353,15 +345,13 @@ and the system then enters runlevel 2 for normal operation.
 
 This allow you to keep a set of functionality that is provided by the
 underlying system, and another managed by your application.  You can
-of course in your br2-external provide a sysrepo plugin that block 
+of course in your br2-external provide a sysrepo plugin that block
 operations on certain datastores when your application is enabled.
 E.g., to prevent changes to startup after initial deployment.  In
 that case a proper factory reset would be needed to get back to a
 "pre-deployment" state where you can reconfigure your baseline.
 
-
-Releases
---------
+## Releases
 
 A release build requires the global variable `INFIX_RELEASE` to be set.
 It can be derived from GIT, if the source tree is kept in GIT VCS.  First,
@@ -371,14 +361,14 @@ let us talk about versioning in general.
 
 Two popular scheme for versioning a product derived from Infix:
 
- 1. Track Infix major.minor, e.g. *Foobar v23.08.z*, where `z` is
-    your patch level.  I.e., Foobar v23.08.0 could be based on Infix
-    v23.08.0, or v23.08.12, it is up to you.  Maybe you based it on
-    v23.08.12 and then back ported changes from v23.10.0, but it was
-    the first release you made to your customer(s).
- 2. Start from v1.0.0 and step the major number every time you sync
-    with a new Infix release, or every time Infix bumps to the next
-    Buildroot LTS.
+1. Track Infix major.minor, e.g. *Foobar v23.08.z*, where `z` is
+   your patch level.  I.e., Foobar v23.08.0 could be based on Infix
+   v23.08.0, or v23.08.12, it is up to you.  Maybe you based it on
+   v23.08.12 and then back ported changes from v23.10.0, but it was
+   the first release you made to your customer(s).
+1. Start from v1.0.0 and step the major number every time you sync
+   with a new Infix release, or every time Infix bumps to the next
+   Buildroot LTS.
 
 The important thing is to be consistent, not only for your own sake,
 but also for your end customers.  The *major.minor.patch* style is
@@ -386,10 +376,10 @@ the most common and often recommended style, which usually maps well
 to other systems, e.g. PROFINET GSDML files require this (*VX.Y.Z*).
 But you can of course use only two numbers, *major.minor*, as well.
 
+> [!WARNING]
 > What could be confusing, however, is if you use the name *Infix*
 > with your own versioning scheme.
 
-
 ### Specifying Versioning Information
 
 Two optional environment variables control the version information
@@ -416,4 +406,10 @@ generated file names like disk images, etc.
 
 **Default:** `${INFIX_BUILD_ID}`
 
-[NanoPi R2S]: https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg
+[^1]: The base MAC address is defined in the device's Vital Product
+    Data (VPD) EEPROM, or similar, which is used by the kernel to
+    create the system interfaces.  This MAC address is usually also
+    printed on a label on the device.
+
+[NanoPi R2S]:    https://github.com/kernelkit/infix/blob/main/board/aarch64/r2s/rootfs/etc/factory-config.cfg
+[os-release(5)]: https://www.freedesktop.org/software/systemd/man/os-release.html

doc/cli/configure.md

@@ -1,5 +1,4 @@
-Configure Context
------------------
+# CLI Configure Context
 
 Enter the configure context from admin-exec by typing `configure`
 followed by Enter.  Available commands, press `?` at the prompt:
@@ -41,14 +40,17 @@ admin@host:/config/interface/eth0/> up
 admin@host:/config/>
 ```
 
-> **Note:** the tree structure in the configure context is automatically
-> generated from the system's supported NETCONF YANG models, which may
-> vary between products.  However, the `ietf-interfaces.yang` and
-> `ietf-ip.yang` models, for instance, that provide basic networking
+----
+
+> **Note:** commands in configure context are automatically generated
+> from the system's YANG models, hence different products likely have a
+> different set of commands.  However, both the `ietf-interfaces.yang`
+> and `ietf-ip.yang` models, for instance, that provide the networking
 > support are common to all systems.
 
+----
 
-### Set IP Address on an Interface
+## Set IP Address on an Interface
 
 ```
 admin@host:/config/> edit interface eth0
@@ -73,7 +75,7 @@ interfaces {
 ```
 
 
-### Saving Changes
+## Saving Changes
 
 Apply the changes (from candidate to `running-config`):
 
@@ -104,11 +106,14 @@ admin@host:/> copy running-config startup-config
 The `startup-config` can also be inspected with the `show` command to
 verify the changes are saved.
 
-> **Note:** most (all) commands need to be spelled out, no short forms
-> are allowed at the moment.  Use the `TAB` key to make this easier.
+----
 
+> **Note:** all commands need to be spelled out, no short forms are
+> allowed in the CLI.  Use the `TAB` key to make your life easier.
 
-### Changing Hostname
+----
+
+## Changing Hostname
 
 Settings like hostname are located in the `ietf-system.yang` model.
 Here is how it can be set.
@@ -123,11 +128,14 @@ admin@example:/>
 Notice how the hostname in the prompt does not change until the change
 is committed.
 
+----
+
 > **Note:** critical services like syslog, mDNS, LLDP, and similar that
 > advertise the hostname, are restarted when the hostname is changed.
 
+----
 
-### Changing Password
+## Changing Password
 
 User management, including passwords, is also a part of `ietf-system`.
 
@@ -149,12 +157,15 @@ the `do password encrypt` command.  This launches the admin-exec command
 to hash, and optionally salt, your password.  This encrypted string can
 then be used with `set password ...`.
 
+----
+
 > **Tip:** if you are having trouble thinking of a password, there is
 > also `do password generate`, which generates random but readable
 > strings using the UNIX command `pwgen`.
 
+----
 
-### SSH Authorized Key
+## SSH Authorized Key
 
 Logging in remotely with SSH is possible by adding a *public key* to a
 user.  Here we add the authorized key to the admin user, multiple keys
@@ -174,11 +185,15 @@ key-data AAAAB3NzaC1yc2EAAAADAQABAAABgQC8iBL42yeMBioFay7lty1C4ZDTHcHyo739gc91rTT
 admin@host:/config/system/authentication/user/admin/authorized-key/example@host/> leave
 ```
 
+----
+
 > **Note:** the `ssh-keygen` program already base64 encodes the public
 > key data, so there is no need to use the `text-editor` command, `set`
 > does the job.
 
-### Creating a VETH Pair
+----
+
+## Creating a VETH Pair
 
 The following example creates a `veth0a <--> veth0b` virtual Ethernet
 pair which is useful for connecting, e.g., a container to the physical
@@ -214,12 +229,15 @@ admin@host:/config/> leave
 
 See the bridging example below for more.
 
+----
+
 > **Note:** in the CLI you do not have to create the `veth0b` interface.
 > The system _infers_ this for you.  When setting up a VETH pair using
 > NETCONF, however, you must include the `veth0b` interface.
 
+----
 
-### Creating a Bridge
+## Creating a Bridge
 
 Building on the previous example, we now create a non-VLAN filtering
 bridge (`br0`) that forwards any, normally link-local, LLDP traffic
@@ -273,6 +291,10 @@ the VETH pair from the previous example) are now bridged.  Any traffic
 ingressing one port will egress the other.  Only reserved IEEE multicast
 is filtered, except LLDP frames as shown above.
 
+----
+
 > **Note:** the bridge can be named anything, provided the interface
 > name is not already taken.  However, for any name outside the pattern
 > `br[0-9]+`, you have to set the interface type manually to `bridge`.
+
+----

doc/cli/introduction.md

@@ -1,4 +1,4 @@
-# Introduction
+# CLI Introduction
 
 The command line interface (CLI, see-ell-aye) implements a CISCO-like,
 or Juniper Networks JunOS-like, CLI.  It is the traditional way of
@@ -10,8 +10,7 @@ Nevertheless, when it comes to initial deployment and debugging, it
 is very useful to know how to navigate and use the CLI.  This very
 short guide intends to help you with that.
 
-
-## About
+----
 
 New users usually get the CLI as the default "shell" when logging in,
 but the default `admin` user logs in to `bash`.  To access the CLI,
@@ -35,9 +34,12 @@ admin@host-12-34-56:/> show                   # Try: Tab or ?
 admin@host-12-34-56:/>                        # Try: Tab or ?
 ```
 
-> **Tip:** Even on an empty command line you can tap the Tab or ? keys.
-> See `help keybindings` for more tips!
+----
 
+> **Note:** even on an empty command line, you can tap the `Tab` or `?` keys.  
+> See [`help keybindings`](keybindings.md) for more tips!
+
+----
 
 ## Key Concepts
 
@@ -129,10 +131,15 @@ In *configure context* the following commands are available:
 | `do command`      | Call admin-exec command: `do show log`                 |
 | `commit`          |                                                        |
 
-### Example Session
 
-> Remember to use the `TAB` and `?` keys to speed up your navigation.
-> See `help keybindings` for more tips!
+## Example Session
+
+----
+
+> Remember to use the `TAB` and `?` keys to speed up your navigation.  
+> See [`help keybindings`](keybindings.md) for more tips!
+
+----
 
 In this example we enter configure context to add an IPv4 address to
 interface `eth0`, then we apply the changes using the `leave` command.
@@ -180,4 +187,3 @@ admin@host-12-34-56:/> copy startup-config running-config
 ```
 
 Or restarting the device.
-

doc/cli/keybindings.md

@@ -1,4 +1,4 @@
-# Keybindings
+# CLI Keybindings
 
 Writing CLI commands by hand is very tedious.  To make things easier the
 CLI has several keybindings, most significant first:
@@ -27,10 +27,12 @@ CLI has several keybindings, most significant first:
 | Ctrl-n  | Down arrow     | History, next command                            |
 | Ctrl-r  |                | History, reversed interactive search (i-search)  |
 
-> **Note:** the Meta key is called Alt on most modern keyboards.  If you
-> have neither, first tap the Esc key instead of holding down Alt/Meta.
+## What is Meta?
 
-## Examples
+The Meta key is called Alt on most modern keyboards.  If you have
+neither, first tap the Esc key instead of holding down Alt/Meta.
+
+## Usage
 
 Complete a word.  Start by typing a few characters, then tap the TAB key
 on your keyboard:

doc/cli/netcalc.md

@@ -1,4 +1,4 @@
-## Usage
+# Network Calculator
 
 ```
 netcalc <ADDRESS/LEN | NETWORK NETMASK> [split <1-32 | 64-128>]
@@ -12,8 +12,8 @@ information about the subnet.  Both IPv4 and IPv6 is supported.
 
 A subnet can be entered in two ways:
 
- - `192.168.2.0 255.255.255.0`: traditional IPv4 'address netmask' style
- - `192.168.2.0/24`: modern prefix length, same also for IPv6
+- `192.168.2.0 255.255.255.0`: traditional IPv4 'address netmask' style
+- `192.168.2.0/24`: modern prefix length, same also for IPv6
 
 An optional `split LEN` can be given as argument, the new length value
 must be bigger than the current prefix length.  See example below.

doc/cli/quick.md

@@ -1,4 +1,4 @@
-# Quick Overview
+# CLI Quickstart Guide
 
 The question mark `?` key along with the `Tab` key are your best friends
 in the command line interface.  They provide context help and completion
@@ -16,14 +16,17 @@ of commands you input.  See the table below for a handful of examples.
 Explore the following topics for more information.  Note, the
 keybindings are really useful to learn!
 
-| **Command**         | **Description**                            |
-|---------------------|--------------------------------------------|
-| `help introduction` | An introduction to the CLI                 |
-| `help configure`    | How to use configure context               |
-| `help text-editor`  | Help with the built-in text-editor command |
-| `help keybindings`  | Lists keybindings and other helpful tricks |
+| **Command**         | **Description**                                    |
+|---------------------|----------------------------------------------------|
+| `help introduction` | An introduction to the CLI                         |
+| `help configure`    | How to use configure context                       |
+| `help text-editor`  | Help with the built-in text-editor command         |
+| `help keybindings`  | Lists available keybindings & other helpful tricks |
+
+----
 
 > In `configure` context the `help setting` command shows the YANG
 > description text for each node and container.  To reach the admin
 > exec help from configure context, e.g., `do help text-editor`
 
+----

doc/cli/tcpdump.md

@@ -1,4 +1,4 @@
-## Network Traffic Inspection
+# Network Monitoring
 
 `tcpdump` is useful tool for analyzing and diagnosing network problems.
 This document presents the limited feature set that exposed is in the
@@ -10,7 +10,7 @@ A section called [Examples](#examples) follows that, which may be what
 you want to scroll down to.
 
 
-### Hardware Overview
+## Hardware Overview
 
 Using `tcpdump` effectively requires an understanding of how the
 underlying hardware works.  For a standard PC, or common single-board
@@ -57,17 +57,21 @@ up the switch core to mirror traffic ingressing and/or egressing a set
 of ports to another port.  On this *monitor port* you can then run your
 tcpdump, which means you need an external device (laptop).
 
+----
+
 > A planned feature is to support mirroring traffic to the CPU port,
 > which would be an effective way to log and monitor traffic over a
 > longer period of time.  Highly effective for diagnosing intermittent
 > and other rare network issues.
 
+----
+
 If only "proof of life" is required, then sometimes port counters, also
 called *RMON counters*, can be very useful too.  Seeing counters of a
 particular type increment means traffic is ingressing or egressing.
 
 
-### Examples
+## Examples
 
 Listen to all traffic on an interface:
 

doc/cli/text-editor.md

@@ -44,10 +44,13 @@ C-x i   insert    C-x g   goto-ln  C-x o other win   C-x C-x swap     M-q reform
   - tap `c`
   - release `Ctrl`
 
+----
+
 > The status field at the bottom asks if you are really sure, and/or if
 > you want to add a final Enter/newline to the file.  For binary content
 > that final newline may be important.
 
+----
 
 ## Changing the Editor
 

doc/cli/upgrade.md

@@ -1,5 +1,4 @@
-Upgrading the Software
-----------------------
+# Upgrading the System
 
 The admin-exec command `upgrade` can be used to install software images, or
 bundles.  A bundle is a signed and self-contained package that carries all the
@@ -39,6 +38,8 @@ The secondary partition (`rootfs.1`) has now been upgraded and will be used as
 the *active* partition on the next boot.  Leaving the primary partition, with
 the version we are currently running, intact in case of trouble.
 
+See [Upgrade & Boot Order](../upgrade.md) for more information on upgrading.
+
 [^1]: It is not possible to upgrade the partition we booted from.  Thankfully
     the underlying "rauc" subsystem keeps track of this.  Hence, to upgrade
     both partitions you must reboot to the new version (to verify it works)

doc/container.md

@@ -1,31 +1,7 @@
-Containers in Infix
-===================
-<img align="right" src="img/docker.webp" alt="Docker whale" width=360>
+Docker Container Support
+========================
 
-* [Introduction](#introduction)
-* [Caution](#caution)
-* [Getting Started](#getting-started)
-  * [Examples](#examples)
-* [Container Images](#container-images)
-* [Upgrading a Container Image](#upgrading-a-container-image)
-* [Networking and Containers](#networking-and-containers)
-  * [Container Bridge](#container-bridge)
-  * [Container Host Interface](#container-host-interface)
-  * [Host Networking](#host-networking)
-* [Mounts and Volumes](#mounts-and-volumes)
-  * [Content Mounts](#content-mounts)
-* [Example Containers](#example-containers)
-  * [System Container](#system-container)
-  * [Application Container: nftables](#application-container-nftables)
-  * [Application Container: ntpd](#application-container-ntpd)
-* [Advanced](#advanced)
-  * [Running Host Commands From Container](#running-host-commands-from-container)
-* [Container Requirements](#container-requirements)
-  * [Advanced Users](#advanced-users)
-
-
-Introduction
-------------
+![Docker whale](img/docker.webp){ align=right width="360" }
 
 Infix comes with native support for Docker containers using [podman][].
 The [YANG model][1] describes the current level of support, complete
@@ -110,10 +86,9 @@ your container image and application to run.
 > support the CPU architecture of your host system.  Remember, unlike
 > virtualization, containers reuse the host's CPU and kernel.
 
+![Hello World](img/docker-hello-world.svg){ align=right width="200" }
 
-<img align="right" src="img/docker-hello-world.svg" alt="Hello World" width=360>
-
-### Examples
+### Example: Hello World
 
 Classic Hello World:
 
@@ -129,6 +104,8 @@ Classic Hello World:
     Hello from Docker!
     This message shows that your installation appears to be working correctly.
 
+### Example: Web Server
+
 A web server with [nginx][], using standard docker bridge.  Podman will
 automatically create a VETH pair for us, connecting the container to the
 `docker0` bridge:
@@ -279,7 +256,7 @@ archive, which helps greatly with container upgrades (see below):
 
 Upgrading a Container Image
 ---------------------------
-<img align="right" src="img/shield-checkmark.svg" alt="Hello World" width=100>
+![Up-to-date Shield](img/shield-checkmark.svg){ align=right width="100" }
 
 The applications in your container are an active part of the system as a
 whole, so make it a routine to keep your container images up-to-date!

doc/developers-guide.md

@@ -14,6 +14,9 @@ the Buildroot `make menuconfig` system.
          -> System configuration
             -> [*]Enable root login with password
 
+> [!IMPORTANT]
+> Please see the [Contributing](#contributing) section, below, for
+> details on how to fork and clone when contributing to Infix.
 
 Cloning
 -------
@@ -25,14 +28,12 @@ tree to your PC:
 ```bash
 $ mkdir ~/Projects; cd ~/Projects
 $ git clone https://github.com/kernelkit/infix.git
+..
 $ cd infix/
 $ git submodule update --init
+..
 ```
 
-> Please see the [Contributing](#contributing) section, below, for
-> details on how to fork and clone when contributing to Infix.
-
-
 ### Customer Builds
 
 Customer builds add product specific device trees, more OSS packages,
@@ -57,6 +58,10 @@ Other caveats should be documented in the customer specific trees.
 Building
 --------
 
+> [!TIP]
+> For more details, see the Getting Started and System Requirements
+> sections of the [excellent Buildroot manual][1].
+
 Buildroot is almost stand-alone, it needs a few locally installed tools
 to bootstrap itself.  The most common ones are usually part of the base
 install of the OS, but specific ones for building need the following.
@@ -67,12 +72,10 @@ $ sudo apt install bc binutils build-essential bzip2 cpio \
                    diffutils file findutils git gzip      \
                    libncurses-dev libssl-dev perl patch   \
                    python3 rsync sed tar unzip wget       \
-                   autopoint bison flex autoconf automake
+                   autopoint bison flex autoconf automake \
+                   mtools
 ```
 
-> For details, see the Getting Started and System Requirements sections
-> of the [excellent manual][1].
-
 To build an Infix image; select the target and then make:
 
     make x86_64_defconfig
@@ -95,12 +98,43 @@ and services are required on your system:
 ```bash
 $ sudo apt install jq graphviz qemu-system-x86 qemu-system-arm \
 				   ethtool gdb-multiarch tcpdump tshark
+..
 ```
 
 To be able to build the test specification you also need:
 
 ```bash
 $ sudo apt-get install python3-graphviz ruby-asciidoctor-pdf
+..
+```
+
+### Documentation
+
+The documentation is written in Markdown, with GitHub extensions, and
+published using [MkDocs, material theme][11].  This means some features
+require MkDocs *hinting* which may not render fully when previewing on
+GitHub -- this is OK.
+
+MkDocs is packaged and available to install via `apt`, but not all of
+the plugins and extensions we rely on are available, so instead we do
+recommend using `pipx` to install the necessary tooling:
+
+```bash
+$ sudo apt install pipx
+$ pipx install mkdocs
+$ pipx inject mkdocs mkdocs-material pymdown-extensions mkdocs-callouts mike mkdocs-to-pdf
+```
+
+The last two packages, `mike` and `mkdocs-to-pdf`, are used for online
+versioning and PDF generation by GitHub Actions, but since they are in
+the `mkdocs.yml` file, everyone who wants to preview the documentation
+have to install all the tooling.
+
+Preview with:
+
+```
+$ cd ~/src/infix/
+$ mkdocs serve
 ```
 
 
@@ -131,6 +165,16 @@ This rebuilds (and installs) `foo` and `bar`, the `all` target calls
 on Buildroot to finalize the target filesystem and generate the images.
 The final `run` argument is explained below.
 
+
+### YANG Model
+
+When making changes to the `confd` and `statd` services, you will often
+need to update the YANG models.  If you are adding a new YANG module,
+it's best to follow the structure of an existing one.  However, before
+making any changes, **always discuss them with the Infix core team**.
+This helps avoid issues later in development and makes pull request
+reviews smoother.
+
 ### `confd`
 
 The Infix `src/confd/` is the engine of the system.  Currently it is a
@@ -166,36 +210,36 @@ Now you can rebuild `confd`, just as described above, and restart Infix:
 
 ### `statd`
 
-The Infix status daemon, `src/statd`, is responsible for populating the 
-sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions, 
-but unlike `confd`, it relies entirely on `yanger`, a Python script that 
+The Infix status daemon, `src/statd`, is responsible for populating the
+sysrepo `operational` datastore. Like `confd`, it uses XPath subscriptions,
+but unlike `confd`, it relies entirely on `yanger`, a Python script that
 gathers data from local linux services and feeds it into sysrepo.
 
 To apply changes, rebuild the image:
 
     make python-statd-rebuild statd-rebuild all
 
-Rebuilding the image and testing on target for every change during 
-development process can be tedious. Instead, `yanger` allows remote 
-execution, running the script directly on the host system (test 
+Rebuilding the image and testing on target for every change during
+development process can be tedious. Instead, `yanger` allows remote
+execution, running the script directly on the host system (test
 container):
 
     infamy0:test # ../src/statd/python/yanger/yanger -x "../utils/ixll -A ssh d3a" ieee802-dot1ab-lldp
 
 `ixll` is a utility script that lets you run network commands using an
-**interface name** instead of a hostname. It makes operations like 
+**interface name** instead of a hostname. It makes operations like
 `ssh`, `scp`, and network discovery easier.
 
-Normally, `yanger` runs commands **locally** to retrieve data 
-(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when 
-executed with `-x "../utils/ixll -A ssh d3a"` it redirects these 
-commands to a remote system connected to the local `d3a` interface via 
-SSH. This setup is used for running `yanger` in an 
+Normally, `yanger` runs commands **locally** to retrieve data
+(e.g., `lldpcli` when handling `ieee802-dot1ab-lldp`). However, when
+executed with `-x "../utils/ixll -A ssh d3a"` it redirects these
+commands to a remote system connected to the local `d3a` interface via
+SSH. This setup is used for running `yanger` in an
 [interactive test environment](testing.md#interactive-usage). The yanger
-script runs on the `host` system, but key commands are executed on the 
+script runs on the `host` system, but key commands are executed on the
 `target` system.
 
-For debugging or testing, you can capture system command output and 
+For debugging or testing, you can capture system command output and
 replay it later without needing a live system.
 
 To capture:
@@ -209,42 +253,187 @@ To replay:
 This is especially useful when working in isolated environments or debugging
 issues without direct access to the DUT.
 
-### Agree on YANG Model
 
-When making changes to the `confd` and `statd` services, you will often need to update
-the YANG models. If you are adding a new YANG module, it's best to follow the 
-structure of an existing one. However, before making any changes, **always discuss
-them with the Infix core team**. This helps avoid issues later in development and 
-makes pull request reviews smoother.
+## Upgrading Packages
+
+### Buildroot
+
+The Kernelkit team maintains an internal [fork of Buildroot][9], with
+branches following the naming scheme `YYYY.MM.patch-kkit`
+e.g. `2025.02.1-kkit`, which means a new branch should be created
+whenever Buildroot is updated. These branches should contain **only**
+changes to existing packages (but no new patches), modifications to
+Buildroot itself or upstream backports.
+
+The team tracks the latest Buildroot LTS (Long-Term Support) release and
+updates.  The impact of minor LTS release upgrades is expected to have a
+very low impact and should be done as soon there is a patch release of a
+Buildroot LTS available.
+
+> **Depending on your setup, follow the appropriate steps below.**
+
+#### Repo locally cloned already
+
+1. Navigate to the Buildroot directory
+
+        cd buildroot/
+
+1. Pull the latest changes from KernelKit
+
+        git pull
+
+1. Fetch the latest tags from upstream
+
+        git fetch upstream --tags
+
+#### No local repo yet
+
+1. Clone the Kernelkit Buildroot repository
+
+        git clone git@github.com:kernelkit/buildroot.git
+
+1. Add the upstream remote
+
+        git remote add upstream https://gitlab.com/buildroot.org/buildroot.git
+
+1. Checkout old KernelKit branch
+ 
+        git checkout 2025.02.1-kkit
+ 
+> [!NOTE] 
+> Below, it is **not** allowed to rebase the branch when bumped in Infix.
+
+#### Continue Here
+
+1. Create a new branch based on the **previous** KernelKit Buildroot
+   release (e.g.  `2025.02.1-kkit`) and name it according to the naming
+   scheme (e.g. `2025.02.2-kkit`)
+
+        git checkout -b 2025.02.2-kkit
+
+1. Rebase the new branch onto the corresponding upstream release
+
+        git rebase 2025.02.2
+
+1. Push the new branch and tags
+
+        git push origin 2025.02.2-kkit --tags
+
+1. In Infix, checkout new branch of Buildroot
+
+        cd buildroot
+        git fetch
+        git checkout 2025.02.2-kkit
+
+1. Commit and push the changes.  *Remember to update the ChangeLog!*
+
+1. Create a pull request.
+
+> [!NOTE] 
+> Remember to set the pull request label to `ci:main` to ensure full CI
+> coverage.
+
+
+### Linux kernel
+
+The KernelKit team maintains an internal [fork of Linux kernel][10],
+with branches following the naming scheme `kkit-linux-[version].y`,
+e.g. `kkit-6.12.y`, which means a new branch should be created whenever
+the major kernel version is updated. This branch should contain *all*
+kernel patches used by Infix.
+
+The team tracks the latest Linux kernel LTS (Long-Term Support) release
+and updates.  The upgrade of LTS minor releases is expected to have low
+impact and should be done as soon as a patch release of the LTS Linux
+kernel is available.
+
+#### Repo locally cloned already
+
+1. Navigate to the Linux kernel directory
+
+        cd linux
+
+1. Get latest changes from KernelKit
+
+        git pull
+
+1. Fetch the latest tags from upstream
+
+        git fetch upstream --tags
+
+#### No local repo yet
+
+1. Clone the KernelKit Linux kernel repository
+
+        git clone git@github.com:kernelkit/linux.git
+
+1. Add the upstream remote
+
+        git remote add upstream git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
+
+1. Checkout correct kernel branch
+
+        git checkout kkit-linux-6.12.y
+
+#### Continue Here
+
+1. Rebase on the upstream release
+
+        git rebase v6.12.29
+
+1. Push changes and the tags
+ 
+        git push -f origin kkit-linux-6.12.y --tags
+
+**Move to your Infix source tree**
+
+> [!NOTE] 
+> See help of `kernel-refresh.sh` script for more information.
+
+1. Generate patches
+
+        make x86_64_defconfig
+        cd output
+        ../utils/kernel-refresh.sh -k /path/to/linux -o 6.12.28 -t v6.12.29
+
+1. Commit and push the changes.  Remember to update the ChangeLog
+1. Create a pull request
+
+> [!NOTE] 
+> Remember to set the pull request label to `ci:main` to ensure full CI
+> coverage.
+
+
 
 Testing
 -------
 
 Manual testing can be done using Qemu by calling <kbd>make run</kbd>,
-see also [Infix in Virtual Environments](virtual.md).
+see also [Infix in Virtual Environments](virtual.md), or on a physical
+device by upgrading to the latest build or "[netbooting](netboot.md)"
+and running the image from RAM.  The latter is how most board porting
+work is done -- **much quicker** change-load-test cycles.
 
 The Infix automated test suite is built around Qemu and [Qeneth][2], see:
 
- * [Testing](testing.md)
- * [Docker Image](../test/docker/README.md)
+ * [Regression Testing with Infamy](testing.md)
+ * [Docker Image](https://github.com/kernelkit/infix/blob/main/test/docker/README.md)
 
-With any new feature added to Infix, it is essential to include a 
-relevant test case. See the 
-[Test Development](testing.md#test-development) section for guidance
-on adding test cases.
+With any new feature added to Infix, it is essential to include relevant
+test case(s).  See the [Test Development](testing.md#test-development)
+section for guidance on adding test cases.
 
 
 Reviewing
 ---------
 
-While reviewing a pull request, you might find yourself wanting to
-play around with a VM running that _exact_ version.  For such
-occations, [gh-dl-artifact.sh](../utils/gh-dl-artifact.sh) is your
-friend in need!  It will use the [GitHub CLI
-(gh)](https://cli.github.com) to locate a prebuilt image from our CI
+While reviewing a pull request, you might find yourself wanting to play
+around with a VM running that _exact_ version.  For such occasions,
+[gh-dl-artifact.sh][8] is your friend in need!  It employs the [GitHub
+CLI (gh)](https://cli.github.com) to locate a prebuilt image from our CI
 workflow, download it, and prepare a local output directory from which
-you can launch both `make run` instances, and run regression tests
-with `make test` and friends.
+you can launch both `make run` instances, and run regression tests with
+`make test` and friends.
 
 For example, if you are curious about how PR 666 behaves in some
 particular situation, you can use `gh` to switch to that branch, from
@@ -256,10 +445,10 @@ corresponding image for execution with our normal tooling:
     cd x-artifact-a1b2c3d4-x86_64
     make run
 
-> **Note:** CI artifacts are built from a merge commit of the source
-> and target branches.  Therefore, the version in the Infix banner
-> will not match the SHA of the commit you have checked out.
-
+> [!NOTE]
+> CI artifacts are built from a merge commit of the source and target
+> branches.  Therefore, the version in the Infix banner will not match
+> the SHA of the commit you have checked out.
 
 Contributing
 ------------
@@ -271,28 +460,32 @@ fork, and then use GitHub to create a *Pull Reqeuest*.
 For this to work as *painlessly as possible* for everyone involved:
 
  1. Fork Infix to your own user or organization[^1]
- 2. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
+ 1. Fork all the Infix submodules, e.g., `kernelkit/buildroot` to your
     own user or organization as well
- 3. Clone your fork of Infix to your laptop/workstation
- 4. [Deactivate the Actions][6] you don't want in your fork
- 5. Please read the [Contributing Guidelines][5] as well!
+ 1. Clone your fork of Infix to your laptop/workstation
+ 1. [Deactivate the Actions][6] you don't want in your fork
+ 1. Please read the [Contributing Guidelines][5] as well!
 
 ```bash
 $ cd ~/Projects
 $ git clone https://github.com/YOUR_USER_NAME/infix.git
+...
 $ cd infix/
 $ git submodule update --init
+...
 ```
-> **Note:** when updating/synchronizing with upstream Infix changes you
-> may have to synchronize your forks as well.  GitHub have a `Sync fork`
-> button in the GUI for your fork for this purpose.  A cronjob on your
-> server of choice can do this for you with the [GitHub CLI tool][7].
+
+> [!NOTE]
+> When updating/synchronizing with upstream Infix changes you may have
+> to synchronize your forks as well.  GitHub have a `Sync fork` button
+> in the GUI for your fork for this purpose.  A cronjob on your server
+> of choice can do this for you with the [GitHub CLI tool][7].
 
 [^1]: Organizations should make sure to lock the `main` (or `master`)
     branch of their clones to ensure members do not accidentally merge
     changes there.  Keeping these branches in sync with upstream Infix
     is highly recommended as a baseline and reference.  For integration
-	of local changes another company-specific branch can be used instead.
+    of local changes another company-specific branch can be used instead.
 
 [0]: https://github.com/kernelkit/infix/releases
 [1]: https://buildroot.org/downloads/manual/manual.html
@@ -302,3 +495,7 @@ $ git submodule update --init
 [5]: https://github.com/kernelkit/infix/blob/main/.github/CONTRIBUTING.md
 [6]: https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/disabling-and-enabling-a-workflow
 [7]: https://cli.github.com/
+[8]: https://github.com/kernelkit/infix/blob/main/utils/gh-dl-artifact.sh
+[9]: https://github.com/kernelkit/buildroot
+[10]: https://github.com/kernelkit/linux
+[11]: https://squidfunk.github.io/mkdocs-material/

doc/discovery.md

@@ -1,4 +1,4 @@
-# Discover Devices
+# Device Discovery
 
 Infix advertises itself via the [mDNS-SD](#mdns-sd) and [LLDP](#lldp)
 discovery protocols.  mDNS-SD has good client support in Windows, macOS
@@ -8,9 +8,9 @@ An even simpler method is available when directly attached to an Infix
 device:
 
 ```
-       .----.      Ethernet       .-------.
-       | PC +---------------------+ Infix |
-       '----' if1              e1 '-------'
+.----.       Ethernet      .--------.
+| PC +---------------------+ Device |
+'----' if1              e1 '--------'
 ```
 
 With IPv6 you can *ping the all-hosts* address (ff02::1), the device's
@@ -46,7 +46,7 @@ admin@infix-c0-ff-ee:~$
 
 ## LLDP
 
-Infix supports LLDP (IEEE 802.1AB).  For a device with factory default
+Infix supports LLDP (IEEE 802.1AB). For a device with factory default
 settings, the link-local IPv6 address can be read from the Management
 Address TLV using *tcpdump* or other sniffing tools[^1]:
 
@@ -131,6 +131,10 @@ tcpdump: listening on tap0, link-type EN10MB (Ethernet), snapshot length 262144
 linux-pc:#
 ```
 
+The following capabilities are available via NETCONF/RESTCONF or the Infix CLI.
+
+### LLDP Enable/Disable
+
 The LLDP service can be disabled using the following commands.
 
 ```
@@ -140,6 +144,59 @@ admin@infix-c0-ff-ee:/config/> leave
 admin@infix-c0-ff-ee:/> 
 ```
 
+To reenable it from the CLI config mode:
+
+```
+admin@test-00-01-00:/config/> set lldp enabled 
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Message Transmission Interval
+
+By default, LLDP uses a `message-tx-interval` of 30 seconds, as defined
+by the IEEE standard. Infix allows this value to be customized.
+To change it using the CLI:
+
+```
+admin@test-00-01-00:/config/> set lldp message-tx-interval 1
+admin@test-00-01-00:/config/> leave
+```
+
+### LLDP Administrative Status per Interface
+
+Infix supports configuring the LLDP administrative status on a per-port
+basis. The default mode is `tx-and-rx`, but the following options are 
+also supported:
+
+- `rx-only` – Receive LLDP packets only
+- `tx-only` – Transmit LLDP packets only
+- `disabled` – Disable LLDP on the interface
+
+Example configuration:
+
+```
+admin@test-00-01-00:/config/> set lldp port e8 dest-mac-address 01:80:C2:00:00:0E admin-status disabled
+admin@test-00-01-00:/config/> set lldp port e5 dest-mac-address 01:80:C2:00:00:0E admin-status rx-only 
+admin@test-00-01-00:/config/> set lldp port e6 dest-mac-address 01:80:C2:00:00:0E admin-status tx-only
+admin@test-00-01-00:/config/> leave
+```
+
+> [!NOTE]
+> The destination MAC address must be the standard LLDP multicast 
+> address: `01:80:C2:00:00:0E`.
+
+###  Displaying LLDP Neighbor Information
+
+In CLI mode, Infix also provides a convenient `show lldp` command to
+list LLDP neighbors detected on each interface:
+
+```
+admin@test-00-01-00:/> show lldp 
+INTERFACE       REM-IDX   TIME        CHASSIS-ID          PORT-ID             
+e5              1         902         00:a0:85:00:04:01   00:a0:85:00:04:07   
+e6              3         897         00:a0:85:00:03:01   00:a0:85:00:03:07   
+e8              2         901         00:a0:85:00:02:01   00:a0:85:00:02:05
+```
 
 ## mDNS-SD
 
@@ -237,7 +294,7 @@ rtt min/avg/max/mdev = 0.852/1.105/1.348/0.202 ms
 linux-pc:# ssh admin@infix-c0-ff-ee.local
 (admin@infix-c0-ff-ee.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-
 
@@ -277,7 +334,7 @@ rtt min/avg/max/mdev = 0.751/1.482/2.281/0.626 ms
 linux-pc:# ssh admin@infix.local
 (admin@infix.local) Password: 
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-
 

doc/eth-counters.md

@@ -1,41 +1,19 @@
-# YANG to Ethtool Mapping
+# RMON Counters
 
-This column contains the mapping between YANG and Linux / Ethtool counters.
+This document show the mapping between YANG and Linux / Ethtool counters.
 
-```
-┌─────────────────────────────────┬──────────────────────────────────┐
-│ YANG                            │ Linux / Ethtool                  │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-total-octets                 │ FramesReceivedOK,                │
-│                                 │ FrameCheckSequenceErrors         │
-│                                 │ FramesLostDueToIntMACRcvError    │
-│                                 │ AlignmentErrors                  │
-│                                 │ etherStatsOversizePkts           │
-│                                 │ etherStatsJabbers                │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-frames                       │ FramesReceivedOK                 │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-multicast-frames             │ MulticastFramesReceivedOK        │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-broadcast-frames             │ BroadcastFramesReceivedOK        │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-fcs-frames             │ FrameCheckSequenceErrors         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-undersize-frames       │ undersize_pkts                   │
-├─────────────────────────────────┼──────────────────────────────────┤
-| in-error-oversize-frames        | etherStatsJabbers,               |
-|                                 | etherStatsOversizePkts           |
-├─────────────────────────────────┼──────────────────────────────────┤
-│ in-error-mac-internal-frames    │ FramesLostDueToIntMACRcvError    │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-frames                      │ FramesTransmittedOK              │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-multicast-frames            │ MulticastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ out-broadcast-frames            │ BroadcastFramesXmittedOK         │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ infix-eth:out-good-octets       │ OctetsTransmittedOK              │
-├─────────────────────────────────┼──────────────────────────────────┤
-│ infix-eth:in-good-octets        │ OctetsReceivedOK                 │
-└─────────────────────────────────┴──────────────────────────────────┘
-```
+| **YANG**                       | **Linux / Ethtool**                                                                                                                               |
+|--------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------|
+| `in-total-octets`              | `FramesReceivedOK`, `FrameCheckSequenceErrors`, `FramesLostDueToIntMACRcvError`, `AlignmentErrors`, `etherStatsOversizePkts`, `etherStatsJabbers` |
+| `in-frames`                    | `FramesReceivedOK`                                                                                                                                |
+| `in-multicast-frames`          | `MulticastFramesReceivedOK`                                                                                                                       |
+| `in-broadcast-frames`          | `BroadcastFramesReceivedOK`                                                                                                                       |
+| `in-error-fcs-frames`          | `FrameCheckSequenceErrors`                                                                                                                        |
+| `in-error-undersize-frames`    | `undersize_pkts`                                                                                                                                  |
+| `in-error-oversize-frames`     | `etherStatsJabbers`, `etherStatsOversizePkts`                                                                                                     |
+| `in-error-mac-internal-frames` | `FramesLostDueToIntMACRcvError`                                                                                                                   |
+| `out-frames`                   | `FramesTransmittedOK`                                                                                                                             |
+| `out-multicast-frames`         | `MulticastFramesXmittedOK`                                                                                                                        |
+| `out-broadcast-frames`         | `BroadcastFramesXmittedOK`                                                                                                                        |
+| `infix-eth:out-good-octets`    | `OctetsTransmittedOK`                                                                                                                             |
+| `infix-eth:in-good-octets`     | `OctetsReceivedOK`                                                                                                                                |

doc/extra.css

@@ -0,0 +1,12 @@
+.md-header__title {
+    font-size: 1.1rem;
+    line-height: 2.6rem;
+}
+
+[data-md-color-primary="orange"] {
+    --md-primary-fg-color: #ff7f2a;
+    --md-primary-bg-color: #5c5f5c;
+}
+[data-md-color-primary="black"] {
+    --md-primary-bg-color: #5c5f5c;
+}

doc/hardware.md

@@ -51,9 +51,10 @@ Linux to use.
 
 ### Configure USB port
 
-> **Note:** You can only configure USB ports known to the system.  See
-> `show hardware` in admin-exec context.  (Use `do` prefix in configure
-> context.)
+> [!NOTE]
+> You can only configure USB ports known to the system.  See the CLI
+> command `show hardware` in admin-exec context.  (Use `do` prefix in
+> configure context.)
 
 ```
 admin@example:/> configure
@@ -84,5 +85,4 @@ cached data to disk before returning the prompt:
 admin@example:~$ sudo umount /media/log
 ```
 
-
 [1]:  https://www.rfc-editor.org/rfc/rfc8348.html

doc/index.md

@@ -0,0 +1,92 @@
+# Introduction
+
+![Infix - Linux <3 NETCONF](logo.png){ align=right  width="480" }
+
+Welcome to Infix, your immutable, friendly, and secure operating system!
+On these pages you can find both user and developer documentation.
+
+Most topics on configuring the system include CLI examples, but every
+setting, as well as status read-back from the operational datastore, is
+also possible to perform using NETCONF or RESTCONF.  In fact, the Infix
+regression test system solely relies on NETCONF and RESTCONF.
+
+> [!TIP]
+> The CLI documentation is also available from inside the CLI itself
+> using the `help` command in admin-exec mode.
+
+This document provides an introduction of key concepts, details how
+the system boots, including failure modes, and provides links to
+other documents for further study.
+
+## Command Line Interface
+
+The command line interface (CLI, see-ell-i) is the traditional way of
+interacting with single network equipment like switches and routers.
+Today users have come to expect more advanced graphical GUIs, like a web
+interface, to manage a device or NETCONF-based tools that allow for
+managing entire fleets of installed equipment.
+
+Nevertheless, when it comes to initial deployment and debugging, it
+is very useful to know how to navigate and use the CLI.
+
+> [!INFO]
+> For more information, see the [CLI Introduction](cli/introduction.md)
+> and the [CLI Configuration Tutorial](cli/configure.md).
+
+## Key Concepts
+
+The two modes in the CLI are the admin-exec and the configure context.
+
+However, when logging in to the system, from the console port or SSH,
+you land in a standard UNIX shell, Bash.  This is for advanced users
+and remote scripting purposes (production equipment):
+
+```
+    Run the command 'cli' for interactive OAM
+
+    admin@example:~$
+```
+
+To enter the CLI, follow the instructions, for interactive Operations,
+Administration, and Management (OAM), type:
+
+```
+    admin@example:~$ cli
+    admin@example:/>
+```
+
+The prompt, constructed from your username and the device's hostname,
+changes slightly.  You are now in the admin-exec context of the CLI.
+Here you can inspect system status and do operations to debug networking
+issues, e.g. ping.  You can also enter configure context by typing:
+`configure` followed by commands to `set`, `edit`, apply changes using
+`leave`, or `abort` and return to admin-exec.
+
+> [!TIP]
+> If you haven't already, the [CLI Introduction](cli/introduction.md)
+> would be useful to skim through at this point.
+
+## Datastores
+
+The system has several datastores (or files):
+
+ - `factory-config` consists of a set of default configurations, some
+   static and others generated per-device, e.g., a unique hostname and
+   number of ports/interfaces.   This file is generated at boot.
+ - `failure-config` is also generated at boot, from the same YANG models
+   as `factory-config`, and holds the system *Fail Secure Mode*
+ - `startup-config` is created from `factory-config` at boot if it does
+   not exist.  It is loaded as the system configuration on each boot.
+ - `running-config` is what is actively running on the system.  If no
+   changes have been made since the system booted, it is the same as
+   `startup-config`.
+ - `candidate-config` is created from `running-config` when entering the
+   configure context.  Any changes made here can be discarded (`abort`,
+   `rollback`) or committed (`commit`, `leave`) to `running-config`.
+
+> [!TIP]
+> Please see the [Branding & Releases](branding.md) document for more
+> in-depth information on how `factory-config` and `failure-config` can
+> be adapted to different customer requirements.  Including how you can
+> override the generated versions of these files with plain per-product
+> ones -- this may even protect against some of the failure modes below.

doc/introduction.md

@@ -1,152 +0,0 @@
-# Introduction
-
-This document provides an introduction of key concepts, details how
-the system boots, including failure modes, and provides links to
-other documents for further study.
-
-## CLI
-
-The command line interface (CLI, see-ell-i) is the traditional way of
-interacting with single network equipment like switches and routers.
-Today users have come to expect more advanced graphical GUIs, like a web
-interface, to manage a device or NETCONF-based tools that allow for
-managing entire fleets of installed equipment.
-
-Nevertheless, when it comes to initial deployment and debugging, it
-is very useful to know how to navigate and use the CLI.
-
-> Proceed to the [CLI Introduction](cli/introduction.md) or [CLI
-> Configuration Tutorial](cli/configure.md).
-
-
-## Key Concepts
-
-The two modes in the CLI are the admin-exec and the configure context.
-
-However, when logging in to the system, from the console port or SSH,
-you land in a standard UNIX shell, Bash.  This is for advanced users
-and remote scripting purposes (production equipment):
-
-    Run the command 'cli' for interactive OAM
-    
-    admin@example:~$
-
-To enter the CLI, follow the instructions, for interactive Operations,
-Administration, and Management (OAM), type:
-
-    admin@example:~$ cli
-    admin@example:/>
-
-The prompt, constructed from your username and the device's hostname,
-changes slightly.  You are now in the admin-exec context of the CLI.
-Here you can inspect system status and do operations to debug networking
-issues, e.g. ping.  You can also enter configure context by typing:
-`configure` followed by commands to `set`, `edit`, apply changes using
-`leave`, or `abort` and return to admin-exec.
-
-> The [CLI Introduction](cli/introduction.md) can be useful to skim
-> through at this point.
-
-The system has several datastores (or files):
-
- - `factory-config` consists of a set of default configurations, some
-   static and others generated per-device, e.g., a unique hostname and
-   number of ports/interfaces.   This file is generated at boot.
- - `failure-config` is also generated at boot, from the same YANG models
-   as `factory-config`, and holds the system *Fail Secure Mode*
- - `startup-config` is created from `factory-config` at boot if it does
-   not exist.  It is loaded as the system configuration on each boot.
- - `running-config` is what is actively running on the system.  If no
-   changes have been made since the system booted, it is the same as
-   `startup-config`.
- - `candidate-config` is created from `running-config` when entering the
-   configure context.  Any changes made here can be discarded (`abort`,
-   `rollback`) or committed (`commit`, `leave`) to `running-config`.
-
-> Please see the [Branding & Releases](branding.md) document for more
-> in-depth information on how `factory-config` and `failure-config` can
-> be adapted to different customer requirements.  Including how you can
-> override the generated versions of these files with plain per-product
-> ones -- this may even protect against some of the failure modes below.
-
-
-## System Boot
-
-After the system firmware (BIOS or and [boot loader](boot.md) start
-Linux the following happens.  The various failure modes, e.g., missing
-password in VPD, are detailed later in this section.
-
-![System boot flowchart](img/fail-secure.svg)
-
- 1. Before mounting `/cfg` and `/var` partitions, hosting read-writable
-    data like `startup-config` and container images, the system first
-    checks if a factory reset has been requested by the user, if so it
-    wipes the contents of these partitions
- 2. Linux boots with a device tree which is used for detecting generic
-    make and model of the device, e.g., number of interfaces.  It may
-    also reference an EEPROM with [Vital Product Data](vpd.md).  That is
-    where the base MAC address and per-device password hash is stored.
-    (Generic builds use the same MAC address and password)
- 3. On every boot the system's `factory-config` and `failure-config` are
-    generated from the YANG[^1] models of the current firmware version.
-    This ensures that a factory reset device can always boot, and that
-    there is a working fail safe, or rather *fail secure*, mode
- 4. On first power-on, and after a factory reset, the system does not
-    have a `startup-config`, in which case `factory-config` is copied
-    to `startup-config` -- if a per-product specific version exists it
-    is preferred over the generated one
- 5. Provided the integrity of the `startup-config` is OK, a system
-    service loads and activates the configuration
-
-### Failure Modes
-
-So, what happens if any of the steps above fail?
-
-**VPD Fail**
-
-The per-device password cannot be read, or is corrupt, so the system
-`factory-config` and `failure-config` are not generated:
-
- 1. First boot, or after factory reset: `startup-config` cannot be
-    created or loaded, and `failure-config` cannot be loaded.  The
-    system ends up in an unrecoverable state, i.e., **RMA[^2] Mode**
- 2. The system has booted (at least) once with correct VPD and password
-    and already has a `startup-config`.  Provided the `startup-config`
-    is OK (see below), it is loaded and system boots successfully
-
-In both cases, external factory reset modes/button will not help, and
-in the second case will cause the device to fail on the next boot.
-
-> The second case does not yet have any warning or event that can be
-> detected from the outside.  This is planned for a later release.
-
-**Broken startup-config**
-
-If loading `startup-config` fails for some reason, e.g., invalid JSON
-syntax, failed validation against the system's YANG model, or a bug in
-the system's `confd` service, the *Fail Secure Mode* is triggered and
-`failure-config` is loaded (unless VPD Failure, see above).
-
-> Again, please see the [Branding & Releases](branding.md) document for
-> how to provide a per-product hard-coded `failure-config` to suit your
-> products preferences.
-
-*Fail Secure Mode* is a fail-safe mode provided for debugging the
-system.  The default[^3] creates a setup of isolated interfaces with
-communication only to the management CPU, SSH and console login using
-the device's factory reset password, IP connectivity only using IPv6
-link-local, and device discovery protocols: LLDP, mDNS-SD.  The login
-and shell prompt are set to `failure-c0-ff-ee`, the last three octets of
-the device's base MAC address.
-
-[^1]: YANG is a modeling language from IETF, replacing that used for
-    SNMP (MIB), used to describe the subsystems and properties of
-	the system.
-[^2]: Return Merchandise Authorization (RMA), i.e., broken beyond repair
-    by end-user and eligible for return to manufacturer.
-[^3]: Customer specific builds can define their own `failure-config`.
-    It may be the same as `factory-config`, with the hostname set to
-    `failure`, or a dedicated configuration that isolates interfaces, or
-    even disables ports, to ensure that the device does not cause any
-    security problems on the network.  E.g., start forwarding traffic
-    between previously isolated VLANs.

doc/license.md

@@ -1,5 +1,5 @@
 Origin & Licensing
-------------------
+==================
 
 Infix is entirely built on Open Source components (packages).  Most of
 them, as well as the build system with its helper scripts and tools, is

doc/logo-small.svg

@@ -0,0 +1,338 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   width="81.545341mm"
+   height="26.582481mm"
+   viewBox="0 0 81.545341 26.582481"
+   version="1.1"
+   id="svg5"
+   inkscape:version="1.2.2 (b0a8486541, 2022-12-01)"
+   sodipodi:docname="datadatafinal2.svg"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <sodipodi:namedview
+     id="namedview7"
+     pagecolor="#ffffff"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:document-units="mm"
+     showgrid="false"
+     inkscape:zoom="4.1146545"
+     inkscape:cx="339.51818"
+     inkscape:cy="495.54586"
+     inkscape:window-width="2560"
+     inkscape:window-height="1385"
+     inkscape:window-x="1920"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="layer5" />
+  <defs
+     id="defs2" />
+  <g
+     inkscape:groupmode="layer"
+     id="layer6"
+     inkscape:label="bg"
+     style="display:none;fill:#ff0000;fill-opacity:1"
+     transform="matrix(1.2831201,0,0,3.2117929,-85.704829,-329.92383)">
+    <rect
+       style="fill:#22272e;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-miterlimit:0;stroke-dasharray:none;stroke-opacity:1"
+       id="rect10264"
+       width="163.66356"
+       height="92.471725"
+       x="20.800945"
+       y="69.866936"
+       inkscape:label="bg" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer5"
+     inkscape:label="tagline"
+     style="display:inline"
+     transform="translate(-59.014718,-105.5257)">
+    <g
+       aria-label="Immutable . Friendly . Secure"
+       transform="scale(0.95128779,1.0512066)"
+       id="text9503"
+       style="font-size:6.44339px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';stroke:#5c5f5c;stroke-width:0;stroke-miterlimit:0"
+       inkscape:label="linux-netconf"
+       inkscape:export-filename="minidata3.png"
+       inkscape:export-xdpi="191.95932"
+       inkscape:export-ydpi="191.95932">
+      <path
+         d="m 62.472956,124.15871 h -0.386604 v -4.61347 h 0.386604 z"
+         id="path2380" />
+      <path
+         d="m 67.144418,120.79526 q 0.573462,0 0.869857,0.4317 0.296396,0.43171 0.296396,1.10182 v 1.82993 h -0.386603 v -1.82348 q 0,-0.54125 -0.219075,-0.8763 -0.212632,-0.3415 -0.663669,-0.3415 -0.367274,0 -0.657226,0.28995 -0.289953,0.28995 -0.289953,0.65722 v 2.09411 h -0.386603 v -1.99745 q 0,-1.04383 -0.831197,-1.04383 -0.38016,0 -0.689443,0.32861 -0.309283,0.32861 -0.309283,0.71522 v 1.99745 H 63.491016 V 121.678 q 0,-0.28995 -0.06443,-0.81187 h 0.354386 q 0.06443,0.19975 0.07732,0.58635 0.373717,-0.65722 1.108263,-0.65722 0.670113,0 0.998725,0.73454 0.386604,-0.73454 1.179141,-0.73454 z"
+         id="path2382" />
+      <path
+         d="m 72.969238,120.79526 q 0.573462,0 0.869858,0.4317 0.296396,0.43171 0.296396,1.10182 v 1.82993 h -0.386604 v -1.82348 q 0,-0.54125 -0.219075,-0.8763 -0.212632,-0.3415 -0.663669,-0.3415 -0.367273,0 -0.657226,0.28995 -0.289953,0.28995 -0.289953,0.65722 v 2.09411 h -0.386603 v -1.99745 q 0,-1.04383 -0.831197,-1.04383 -0.38016,0 -0.689443,0.32861 -0.309283,0.32861 -0.309283,0.71522 v 1.99745 H 69.315836 V 121.678 q 0,-0.28995 -0.06443,-0.81187 h 0.354386 q 0.06443,0.19975 0.07732,0.58635 0.373717,-0.65722 1.108263,-0.65722 0.670113,0 0.998726,0.73454 0.386603,-0.73454 1.17914,-0.73454 z"
+         id="path2384" />
+      <path
+         d="m 78.078841,124.14582 -0.36083,0.0838 q -0.115981,-0.32861 -0.154641,-0.64434 -0.431707,0.66367 -1.237131,0.66367 -1.185584,0 -1.185584,-1.53352 v -1.84926 h 0.386604 v 1.77838 q 0,1.28223 0.882744,1.28223 0.457481,0 0.786094,-0.30928 0.328613,-0.31572 0.328613,-0.76032 v -1.99101 h 0.386603 v 2.48715 q 0,0.34795 0.167528,0.79254 z"
+         id="path2386" />
+      <path
+         d="m 79.973201,124.24891 q -0.39949,0 -0.625009,-0.29639 -0.219075,-0.30284 -0.219075,-0.76032 v -2.03611 h -0.657226 v -0.28996 h 0.657226 v -0.97939 l 0.386603,-0.17397 v 1.15336 h 1.050273 v 0.28996 H 79.51572 v 2.03611 q 0,0.73454 0.489698,0.73454 0.302839,0 0.444594,-0.058 l 0.03866,0.28996 q -0.199745,0.0902 -0.515471,0.0902 z"
+         id="path2388" />
+      <path
+         d="m 82.015758,124.24891 q -0.43815,0 -0.747433,-0.25129 -0.302839,-0.25773 -0.302839,-0.66367 0,-1.23068 2.190752,-1.23068 0,-0.47037 -0.225519,-0.72811 -0.225518,-0.25773 -0.663669,-0.25773 -0.354386,0 -1.050272,0.21907 l -0.0451,-0.36727 q 0.541245,-0.17397 1.12115,-0.17397 1.250018,0 1.250018,1.37888 v 1.17914 q 0,0.40594 0.115981,0.80543 l -0.335057,0.0709 -0.135311,-0.5348 q -0.444594,0.55413 -1.172697,0.55413 z m -0.663669,-0.97939 q 0,0.30284 0.186858,0.48325 0.186859,0.17397 0.489698,0.17397 0.386603,0 0.753876,-0.2384 0.373717,-0.24485 0.373717,-0.59279 v -0.67012 q -1.804149,0 -1.804149,0.84409 z"
+         id="path2390" />
+      <path
+         d="m 86.178189,120.79526 q 0.683,0 1.08249,0.47681 0.39949,0.47037 0.39949,1.19847 0,0.77965 -0.412377,1.28223 -0.412377,0.49614 -1.127593,0.49614 -0.766764,0 -1.224244,-0.67011 0,0.32861 -0.01933,0.57991 h -0.354387 q 0.02577,-0.22552 0.02577,-0.80543 v -4.09155 h 0.386603 v 2.22941 q 0.425264,-0.69588 1.243574,-0.69588 z m -1.243574,2.04255 q 0,0.46393 0.328613,0.77965 0.328613,0.30928 0.805424,0.30928 1.204914,0 1.204914,-1.44331 0,-0.61213 -0.30284,-0.98584 -0.302839,-0.38016 -0.863414,-0.38016 -0.489698,0 -0.831197,0.3415 -0.3415,0.3415 -0.3415,0.83119 z"
+         id="path2392" />
+      <path
+         d="m 89.696285,123.92674 -0.03866,0.32217 q -1.224244,-0.058 -1.224244,-1.74615 v -3.24103 h 0.386603 v 3.10571 q 0,0.36728 0.03222,0.61857 0.03222,0.25129 0.115981,0.48325 0.09021,0.23197 0.270623,0.34795 0.180415,0.10953 0.457481,0.10953 z"
+         id="path2394" />
+      <path
+         d="m 90.51459,122.54142 q 0.01933,0.625 0.373717,1.00516 0.36083,0.38016 0.960065,0.38016 0.560575,0 1.153367,-0.23196 l 0.03222,0.31573 q -0.573462,0.2384 -1.224245,0.2384 -0.740989,0 -1.211357,-0.45748 -0.470367,-0.46392 -0.470367,-1.19202 0,-0.77965 0.451037,-1.28868 0.457481,-0.51547 1.192027,-0.51547 1.385329,0 1.417546,1.74616 z m 2.287403,-0.32217 q -0.01289,-0.50259 -0.309282,-0.79898 -0.289953,-0.30284 -0.766764,-0.30284 -0.47681,0 -0.79898,0.31572 -0.322169,0.30929 -0.393047,0.7861 z"
+         id="path2396" />
+      <path
+         d="m 96.345854,123.54658 q 0.135311,0 0.238405,0.1031 0.103095,0.10309 0.103095,0.2384 0,0.13532 -0.103095,0.23197 -0.103094,0.0966 -0.238405,0.0966 -0.135311,0 -0.231962,-0.0966 -0.09665,-0.0967 -0.09665,-0.23197 0,-0.13531 0.09665,-0.2384 0.09665,-0.1031 0.231962,-0.1031 z"
+         id="path2398" />
+      <path
+         d="m 102.20934,121.94218 h -2.07477 v 2.21653 h -0.386608 v -4.61347 h 2.609578 v 0.32217 h -2.22297 v 1.7526 h 2.07477 z"
+         id="path2400" />
+      <path
+         d="m 104.6385,121.13031 q -0.0387,-0.0129 -0.11598,-0.0129 -0.42527,0 -0.72166,0.34794 -0.28996,0.3415 -0.28996,0.9214 v 1.77194 h -0.3866 v -2.21653 q 0,-0.7281 -0.0967,-1.07605 h 0.32861 q 0.1031,0.20619 0.1031,0.65723 0.30928,-0.7281 0.99228,-0.7281 0.0902,0 0.18686,0.0193 z"
+         id="path2402" />
+      <path
+         d="m 105.60501,124.15871 h -0.38661 v -3.29258 h 0.38661 z m -0.20619,-4.60058 q 0.13531,0 0.21907,0.0902 0.0902,0.0838 0.0902,0.21908 0,0.13531 -0.0902,0.21907 -0.0838,0.0773 -0.21907,0.0773 -0.13531,0 -0.21908,-0.0773 -0.0773,-0.0838 -0.0773,-0.21907 0,-0.13531 0.0773,-0.21908 0.0838,-0.0902 0.21908,-0.0902 z"
+         id="path2404" />
+      <path
+         d="m 106.75838,122.54142 q 0.0193,0.625 0.37371,1.00516 0.36083,0.38016 0.96007,0.38016 0.56057,0 1.15336,-0.23196 l 0.0322,0.31573 q -0.57346,0.2384 -1.22424,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47037,-0.46392 -0.47037,-1.19202 0,-0.77965 0.45104,-1.28868 0.45748,-0.51547 1.19203,-0.51547 1.38533,0 1.41754,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28996,-0.30284 -0.76677,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39304,0.7861 z"
+         id="path2406" />
+      <path
+         d="m 113.00202,124.15871 h -0.3866 v -1.86859 q 0,-1.17269 -0.9794,-1.17269 -0.3866,0 -0.70233,0.32861 -0.31572,0.32861 -0.31572,0.71522 v 1.99745 h -0.38661 V 121.678 q 0,-0.28995 -0.0644,-0.81187 h 0.36083 q 0.0644,0.19975 0.0773,0.58635 0.37372,-0.65722 1.10826,-0.65722 1.28868,0 1.28868,1.49486 z"
+         id="path2408" />
+      <path
+         d="m 113.77523,122.47054 q 0,-0.72166 0.39949,-1.19847 0.40593,-0.47681 1.08249,-0.47681 0.81831,0 1.24357,0.69588 v -2.22941 h 0.38661 v 4.09155 q 0,0.57991 0.0258,0.80543 h -0.35439 q -0.0193,-0.2513 -0.0193,-0.57991 -0.45748,0.67011 -1.22424,0.67011 -0.72166,0 -1.13404,-0.49614 -0.40593,-0.50258 -0.40593,-1.28223 z m 1.59152,1.4562 q 0.47681,0 0.80542,-0.30928 0.32861,-0.31572 0.32861,-0.77965 v -0.54769 q 0,-0.49614 -0.3415,-0.83119 -0.33505,-0.3415 -0.83119,-0.3415 -0.56058,0 -0.86342,0.38016 -0.30284,0.38016 -0.30284,0.98584 0,1.44331 1.20492,1.44331 z"
+         id="path2410" />
+      <path
+         d="m 119.15547,123.92674 -0.0387,0.32217 q -1.22424,-0.058 -1.22424,-1.74615 v -3.24103 h 0.3866 v 3.10571 q 0,0.36728 0.0322,0.61857 0.0322,0.25129 0.11598,0.48325 0.0902,0.23197 0.27062,0.34795 0.18042,0.10953 0.45749,0.10953 z"
+         id="path2412" />
+      <path
+         d="m 121.10781,124.15871 q -0.57346,1.28867 -1.52064,1.51419 l -0.0902,-0.30284 q 0.82476,-0.18685 1.25002,-1.32089 0,-0.058 -0.0258,-0.11598 l -1.366,-3.06706 h 0.40593 l 1.23069,2.78999 1.15337,-2.78999 h 0.41237 z"
+         id="path2414" />
+      <path
+         d="m 125.44421,123.54658 q 0.13531,0 0.2384,0.1031 0.1031,0.10309 0.1031,0.2384 0,0.13532 -0.1031,0.23197 -0.10309,0.0966 -0.2384,0.0966 -0.13531,0 -0.23196,-0.0966 -0.0966,-0.0967 -0.0966,-0.23197 0,-0.13531 0.0966,-0.2384 0.0966,-0.1031 0.23196,-0.1031 z"
+         id="path2416" />
+      <path
+         d="m 131.42367,122.95379 q 0,0.59924 -0.45103,0.94718 -0.4446,0.34794 -1.11471,0.34794 -0.76032,0 -1.26935,-0.35438 l 0.15464,-0.32862 q 0.47681,0.36083 1.15337,0.36083 0.50903,0 0.82475,-0.24484 0.31573,-0.24485 0.31573,-0.69589 0,-0.43815 -0.25129,-0.65723 -0.2513,-0.22551 -0.75388,-0.38016 -1.28868,-0.41882 -1.28868,-1.30156 0,-0.54125 0.41238,-0.85697 0.41238,-0.32217 1.01805,-0.32217 0.64434,0 1.05672,0.24485 -0.0129,0.0258 -0.0773,0.14175 -0.058,0.10954 -0.0838,0.16109 -0.41882,-0.22552 -0.90208,-0.22552 -0.45104,0 -0.74743,0.21263 -0.28995,0.21263 -0.28995,0.59924 0,0.63789 0.99872,0.98583 0.32217,0.11599 0.51547,0.21264 0.19975,0.0902 0.39949,0.24484 0.19975,0.15465 0.28995,0.38016 0.0902,0.22552 0.0902,0.52836 z"
+         id="path2418" />
+      <path
+         d="m 132.38373,122.54142 q 0.0193,0.625 0.37372,1.00516 0.36083,0.38016 0.96006,0.38016 0.56058,0 1.15337,-0.23196 l 0.0322,0.31573 q -0.57347,0.2384 -1.22425,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47036,-0.46392 -0.47036,-1.19202 0,-0.77965 0.45103,-1.28868 0.45749,-0.51547 1.19203,-0.51547 1.38533,0 1.41755,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28995,-0.30284 -0.76676,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39305,0.7861 z"
+         id="path2420" />
+      <path
+         d="m 137.3387,121.11743 q -0.61212,0 -0.97295,0.3866 -0.36083,0.3866 -0.36083,1.01806 0,0.625 0.36727,1.01805 0.36727,0.3866 0.96651,0.3866 0.54124,0 0.90207,-0.23196 l 0.13531,0.31573 q -0.42526,0.2384 -1.01805,0.2384 -0.79898,0 -1.26935,-0.46392 -0.47037,-0.47037 -0.47037,-1.2629 0,-0.79254 0.47037,-1.25647 0.47037,-0.47036 1.26935,-0.47036 0.59923,0 1.01805,0.23196 l -0.13531,0.32217 q -0.36083,-0.23196 -0.90207,-0.23196 z"
+         id="path2422" />
+      <path
+         d="m 141.99727,124.14582 -0.36083,0.0838 q -0.11598,-0.32861 -0.15464,-0.64434 -0.4317,0.66367 -1.23713,0.66367 -1.18558,0 -1.18558,-1.53352 v -1.84926 h 0.3866 v 1.77838 q 0,1.28223 0.88275,1.28223 0.45748,0 0.78609,-0.30928 0.32861,-0.31572 0.32861,-0.76032 v -1.99101 h 0.38661 v 2.48715 q 0,0.34795 0.16752,0.79254 z"
+         id="path2424" />
+      <path
+         d="m 144.34911,121.13031 q -0.0387,-0.0129 -0.11598,-0.0129 -0.42526,0 -0.72166,0.34794 -0.28995,0.3415 -0.28995,0.9214 v 1.77194 h -0.38661 v -2.21653 q 0,-0.7281 -0.0967,-1.07605 h 0.32862 q 0.10309,0.20619 0.10309,0.65723 0.30928,-0.7281 0.99228,-0.7281 0.0902,0 0.18686,0.0193 z"
+         id="path2426" />
+      <path
+         d="m 145.08366,122.54142 q 0.0193,0.625 0.37372,1.00516 0.36083,0.38016 0.96006,0.38016 0.56058,0 1.15337,-0.23196 l 0.0322,0.31573 q -0.57346,0.2384 -1.22424,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47036,-0.46392 -0.47036,-1.19202 0,-0.77965 0.45103,-1.28868 0.45748,-0.51547 1.19203,-0.51547 1.38533,0 1.41755,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28995,-0.30284 -0.76676,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39305,0.7861 z"
+         id="path2428" />
+    </g>
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 223.38329,484.15901 v -9.03246 h 0.58274 0.58274 v 9.03246 9.03245 h -0.58274 -0.58274 z"
+       id="path1834"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 228.43253,488.38386 c -6.4e-4,-2.64417 -0.0579,-5.53584 -0.12713,-6.42592 l -0.12597,-1.61833 0.56419,0.0644 c 0.53405,0.0609 0.56732,0.11883 0.6229,1.08415 0.0323,0.56089 0.12967,1.01979 0.21639,1.01979 0.0867,0 0.38929,-0.33422 0.67238,-0.74271 0.91393,-1.3188 2.66926,-2.00044 4.13506,-1.60574 0.86092,0.23182 2.04111,1.29757 2.40217,2.16924 0.12933,0.31224 0.2901,0.56535 0.35727,0.56248 0.0672,-0.003 0.34006,-0.35837 0.60644,-0.78999 1.62805,-2.638 5.25262,-2.76519 6.73464,-0.23631 0.85471,1.45845 1.03015,2.6805 1.03347,7.19885 l 0.003,4.12773 h -0.58274 -0.58274 v -3.85841 c 0,-4.04906 -0.16272,-5.48953 -0.74837,-6.62489 -0.97524,-1.89066 -3.35323,-2.11305 -4.92303,-0.4604 -1.03875,1.09356 -1.12722,1.60138 -1.12722,6.4698 v 4.4739 h -0.56535 -0.56534 l -0.0723,-4.8076 c -0.0781,-5.19309 -0.16625,-5.68505 -1.188,-6.62687 -0.5343,-0.49249 -1.87288,-0.75083 -2.74992,-0.53071 -0.72522,0.18202 -2.04937,1.44652 -2.46084,2.34999 -0.30871,0.67784 -0.35441,1.34084 -0.35813,5.19609 l -0.004,4.4191 h -0.58274 -0.58274 z"
+       id="path1836"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 249.39406,488.57811 c -0.01,-2.53734 -0.0756,-5.42192 -0.14569,-6.41017 l -0.12744,-1.79683 0.53048,5e-5 c 0.57465,5e-5 0.68172,0.2256 0.77747,1.63776 l 0.0518,0.76361 0.5691,-0.82445 c 1.00313,-1.45322 2.80602,-2.19608 4.33232,-1.78509 0.80947,0.21797 1.99805,1.32577 2.42291,2.25823 0.11908,0.26135 0.26804,0.47242 0.33102,0.46905 0.063,-0.003 0.34597,-0.38783 0.62888,-0.85432 0.7501,-1.23686 2.06363,-1.95451 3.57903,-1.95541 1.33872,-8e-4 2.22364,0.46503 2.97983,1.56862 0.89814,1.31075 1.04718,2.23303 1.13543,7.02607 l 0.0831,4.51623 h -0.60091 -0.60092 l -0.006,-3.44787 c -0.007,-4.03899 -0.2174,-5.95631 -0.77305,-7.04547 -1.0695,-2.09639 -3.90894,-2.05963 -5.38561,0.0697 l -0.53685,0.77414 -0.0581,4.82474 -0.0581,4.82474 h -0.54937 -0.54937 l -0.0848,-4.71047 c -0.0769,-4.27252 -0.12307,-4.79578 -0.49627,-5.62796 -1.17692,-2.62436 -4.42294,-2.20832 -5.94644,0.76215 -0.26842,0.52335 -0.31884,1.32971 -0.31884,5.09897 v 4.47731 h -0.58274 -0.58274 z"
+       id="path1838"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 273.01323,493.28817 c -0.42734,-0.15111 -1.05549,-0.57696 -1.3959,-0.94634 -1.08415,-1.17645 -1.27314,-2.18958 -1.37243,-7.35728 l -0.0886,-4.61335 h 0.60294 0.60294 l 0.003,3.15651 c 0.004,3.91414 0.25019,6.36807 0.73168,7.3013 1.13174,2.19355 4.30257,2.12242 5.93754,-0.1332 l 0.61157,-0.84373 0.0582,-4.74044 0.0582,-4.74044 h 0.67021 0.67021 l 0.005,5.48746 c 0.003,3.0181 0.0937,5.87338 0.20243,6.34505 0.15249,0.66158 0.14031,0.89461 -0.0533,1.01955 -0.55281,0.35673 -0.83165,0.0557 -1.09962,-1.18733 -0.24582,-1.14025 -0.29208,-1.21548 -0.53608,-0.87175 -1.45497,2.04964 -3.5618,2.84756 -5.60816,2.12399 z"
+       id="path1840"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 287.30474,493.62291 c -0.5234,-0.0325 -0.99929,-0.2067 -1.39355,-0.51007 -0.0711,-0.0547 -0.21266,-0.18756 -0.31455,-0.2952 -0.51237,-0.54129 -0.84906,-1.32221 -1.01656,-2.35786 l -0.0518,-0.32009 -0.007,-4.39554 -0.007,-4.39554 h -1.17681 -1.17681 v -0.56016 -0.56016 h 1.17748 1.17748 v -1.94931 -1.9493 l 0.67458,-0.33706 c 0.37102,-0.18538 0.67968,-0.33706 0.68591,-0.33706 0.006,0 0.0113,1.02886 0.0113,2.28637 v 2.28636 h 1.88625 1.88625 v 0.56016 0.56016 h -1.88681 -1.8868 l 0.007,4.42983 c 0.008,4.76198 0.003,4.54099 0.11952,5.05219 0.16032,0.70049 0.47404,1.17713 0.91502,1.3902 0.25035,0.12096 0.40253,0.14734 0.85223,0.14773 0.56364,4.8e-4 1.01334,-0.0544 1.32518,-0.16168 0.0702,-0.0241 0.13023,-0.0412 0.13351,-0.0379 0.003,0.003 0.0357,0.2528 0.072,0.5545 l 0.066,0.54854 -0.0472,0.0278 c -0.0785,0.0463 -0.33404,0.13919 -0.51588,0.18759 -0.42382,0.11279 -1.01712,0.16607 -1.509,0.13551 z"
+       id="path1842"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 294.5861,493.62213 c -1.33382,-0.0703 -2.53644,-0.82061 -3.09275,-1.92964 -0.24094,-0.48033 -0.34819,-0.94143 -0.36461,-1.5675 -0.0163,-0.62035 0.0506,-1.12228 0.21568,-1.62005 0.34649,-1.04458 1.07298,-1.83524 2.204,-2.3987 1.19263,-0.59414 2.78564,-0.91132 4.79719,-0.95516 l 0.64935,-0.0142 -0.0145,-0.368 c -0.0763,-1.94209 -0.90557,-3.17288 -2.34847,-3.4855 -0.11953,-0.0259 -0.35827,-0.0588 -0.53054,-0.0732 -0.83261,-0.0693 -2.06866,0.17313 -3.73081,0.73187 -0.18772,0.0631 -0.34391,0.11214 -0.34708,0.10897 -0.003,-0.003 -0.0374,-0.29372 -0.0761,-0.64564 -0.0386,-0.35192 -0.0755,-0.67149 -0.0819,-0.71015 l -0.0116,-0.0703 0.37182,-0.11744 c 1.20391,-0.38027 2.32736,-0.55784 3.54986,-0.5611 0.7727,-0.002 1.23902,0.0602 1.77856,0.23734 1.46594,0.48137 2.35205,1.64256 2.66841,3.49679 0.12045,0.70598 0.11904,0.66437 0.1383,4.08126 0.01,1.7605 0.0238,3.23692 0.0308,3.28093 0.007,0.044 0.0291,0.23435 0.0491,0.42298 0.0465,0.43878 0.14592,1.02673 0.2474,1.4631 0.0438,0.18852 0.0764,0.34605 0.0724,0.35005 -0.01,0.01 -1.16361,0.2786 -1.16815,0.2723 -0.002,-0.003 -0.10844,-0.46785 -0.23669,-1.03372 -0.12825,-0.56588 -0.23848,-1.0443 -0.24496,-1.06316 -0.009,-0.0258 -0.0241,-0.0174 -0.0616,0.0341 -0.24974,0.34282 -0.61859,0.73947 -0.92993,1.00003 -0.98835,0.82713 -2.1679,1.2056 -3.53328,1.13367 z m 0.93086,-1.28687 c 0.65714,-0.0991 1.29513,-0.35128 1.90495,-0.7531 0.81304,-0.53573 1.28846,-1.12731 1.48996,-1.85402 l 0.0634,-0.22864 0.008,-1.55251 0.008,-1.55252 -0.63565,0.0142 c -3.56014,0.0798 -5.51289,1.02626 -5.8264,2.82409 -0.0446,0.25589 -0.0441,0.85092 10e-4,1.11538 0.18522,1.08602 0.8607,1.80366 1.87004,1.98675 0.22689,0.0412 0.84543,0.0413 1.1175,3.3e-4 z"
+       id="path1844"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 309.32244,493.62288 c -0.96944,-0.0469 -1.85038,-0.37861 -2.65218,-0.99851 -0.41295,-0.31926 -0.94289,-0.9117 -1.28908,-1.44113 l -0.1399,-0.21394 -0.005,0.14535 c -0.003,0.0799 -0.0158,0.50031 -0.0286,0.93415 -0.0128,0.43384 -0.03,0.88911 -0.0382,1.01172 l -0.0148,0.22292 h -0.62644 -0.62644 l 0.0136,-0.13147 c 0.0609,-0.58676 0.0652,-1.17336 0.0733,-10.07144 l 0.008,-9.2312 h 0.68506 0.68507 l 7.2e-4,4.42983 c 5.8e-4,3.48836 0.007,4.42158 0.0286,4.39101 0.0153,-0.0214 0.0947,-0.14835 0.17647,-0.28221 0.23909,-0.39153 0.48968,-0.7084 0.83324,-1.05364 0.79409,-0.79798 1.61045,-1.19749 2.77922,-1.36008 0.2959,-0.0412 1.07923,-0.0347 1.40611,0.0117 1.32147,0.18728 2.34057,0.79358 3.15682,1.87808 0.76131,1.0115 1.19388,2.16861 1.36296,3.64582 0.0403,0.35233 0.0407,1.83298 6e-4,2.20634 -0.11974,1.1141 -0.37776,2.05613 -0.79532,2.90368 -1.03324,2.09723 -2.72255,3.11307 -4.99399,3.00306 z m 0.86193,-1.2892 c 1.76169,-0.22995 2.85867,-1.28108 3.34269,-3.20299 0.30067,-1.19391 0.35369,-2.89198 0.12825,-4.108 -0.29692,-1.60162 -1.09958,-2.84593 -2.19579,-3.40403 -0.57991,-0.29523 -1.09671,-0.4111 -1.83985,-0.41248 -0.63377,-0.001 -1.01616,0.0697 -1.55843,0.28899 -0.58207,0.23535 -1.2143,0.72589 -1.6676,1.29385 -0.44764,0.56087 -0.77863,1.27537 -0.92145,1.98914 -0.0992,0.49576 -0.10972,0.74403 -0.0998,2.35496 0.0101,1.63879 0.0104,1.64172 0.15709,2.19491 0.35782,1.34881 1.39583,2.46469 2.66595,2.86592 0.16235,0.0513 0.55199,0.13409 0.74972,0.15934 0.19748,0.0252 0.99214,0.0126 1.23918,-0.0196 z"
+       id="path1846"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 321.87459,493.58992 c -0.8696,-0.12637 -1.59301,-0.47045 -2.17909,-1.03646 -1.03984,-1.00425 -1.58419,-2.59401 -1.70723,-4.98593 -0.0142,-0.27698 -0.023,-2.95931 -0.0231,-7.08202 l -2.2e-4,-6.63618 h 0.68513 0.68513 l 0.009,6.87625 c 0.009,7.02584 0.008,7.00928 0.0967,7.81365 0.10578,0.96416 0.35005,1.9335 0.62093,2.46402 0.44664,0.87476 1.13121,1.30724 2.15714,1.36279 l 0.26385,0.0143 -0.0674,0.62303 -0.0674,0.62304 -0.12782,-0.002 c -0.0703,-0.001 -0.22557,-0.0167 -0.34503,-0.034 z"
+       id="path1848"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 329.71682,493.62332 c -0.82899,-0.0372 -1.61396,-0.23055 -2.30398,-0.56754 -0.37825,-0.18472 -0.54944,-0.28931 -0.89693,-0.54795 -1.01662,-0.7567 -1.78269,-1.89329 -2.17055,-3.22039 -0.0777,-0.26591 -0.16487,-0.69455 -0.21981,-1.08101 -0.0576,-0.40513 -0.0709,-1.55129 -0.0238,-2.04475 0.11581,-1.21225 0.35793,-2.09011 0.8324,-3.01808 0.61749,-1.20767 1.53413,-2.14784 2.59917,-2.66589 0.77538,-0.37715 1.4905,-0.53207 2.44641,-0.52996 0.56508,0.001 0.9552,0.047 1.4181,0.16637 1.6679,0.43005 2.77783,1.70533 3.2916,3.78196 0.19164,0.7746 0.29118,1.5435 0.34432,2.65973 l 0.0144,0.30294 h -4.81566 -4.81566 l 0.0115,0.1086 c 0.006,0.0597 0.0176,0.21149 0.025,0.33724 0.0636,1.07931 0.381,2.14843 0.87454,2.9463 0.31378,0.50727 0.79874,1.03354 1.23804,1.3435 0.55763,0.39346 1.23414,0.64767 1.97432,0.74188 0.37368,0.0476 1.35758,0.0353 1.79434,-0.0224 0.9694,-0.12807 2.04082,-0.42013 2.89393,-0.78886 0.0608,-0.0263 0.11819,-0.0478 0.1276,-0.0478 0.0179,0 0.13106,1.20581 0.11442,1.21964 -0.005,0.004 -0.11245,0.0518 -0.2382,0.10527 -1.16468,0.49571 -2.41589,0.77766 -3.61246,0.81404 -0.21378,0.007 -0.42469,0.0143 -0.46871,0.0174 -0.044,0.003 -0.23949,-0.002 -0.43441,-0.0103 z m 3.95534,-8.11924 c -2.5e-4,-0.30965 -0.0819,-0.91311 -0.17265,-1.27644 -0.21244,-0.85027 -0.58191,-1.49481 -1.19286,-2.08098 -0.59602,-0.57184 -1.29064,-0.86751 -2.19852,-0.93583 -1.41629,-0.10657 -2.61061,0.44344 -3.51878,1.62047 -0.52227,0.67689 -0.89262,1.54618 -1.04384,2.45013 -0.02,0.11931 -0.0415,0.24008 -0.0478,0.26838 l -0.0115,0.0514 h 4.09303 4.09303 l -7e-5,-0.0972 z"
+       id="path1850"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 358.63935,484.12654 v -9.15689 h 4.68705 4.68705 v 0.62875 0.62875 h -4.00114 -4.00114 v 3.49814 3.49814 h 3.72678 3.72678 v 0.62875 0.62875 h -3.72678 -3.72678 v 4.40126 4.40125 h -0.68591 -0.68591 z"
+       id="path1852"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 370.77972,488.3849 c -2.5e-4,-5.30842 -0.0101,-5.84482 -0.12715,-6.89911 -0.0383,-0.34527 -0.13012,-0.92558 -0.17819,-1.12641 l -0.0315,-0.13185 0.58559,0.006 0.58559,0.006 0.0735,0.21721 c 0.15373,0.45451 0.2441,1.0906 0.27609,1.94333 l 0.0167,0.44577 0.11057,-0.26286 c 0.36692,-0.87227 0.86854,-1.56026 1.46921,-2.01506 0.22423,-0.16978 0.70767,-0.41064 0.98068,-0.48859 0.44934,-0.1283 1.03347,-0.17067 1.45783,-0.10575 l 0.20005,0.0306 v 0.61599 0.61599 l -0.0857,-0.0182 c -0.13914,-0.0295 -0.64614,-0.0138 -0.8626,0.0268 -0.61492,0.11523 -1.11795,0.37837 -1.59623,0.83501 -0.69911,0.66749 -1.13847,1.50376 -1.35187,2.57318 -0.14099,0.70651 -0.13497,0.50782 -0.144,4.74916 l -0.008,3.88111 h -0.68498 -0.68498 z"
+       id="path1854"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 378.32496,486.75587 v -6.52758 h 0.67448 0.67448 v 6.52758 6.52757 h -0.67448 -0.67448 z"
+       id="path1856"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 388.12204,493.62228 c -1.25745,-0.0534 -2.37679,-0.45935 -3.33031,-1.20766 -0.24611,-0.19314 -0.70076,-0.64519 -0.89683,-0.89168 -1.00908,-1.26862 -1.47423,-2.80387 -1.42354,-4.69848 0.0143,-0.53323 0.0346,-0.79039 0.0969,-1.22321 0.23095,-1.60525 0.88593,-2.99875 1.90618,-4.05551 0.84662,-0.87693 1.87353,-1.39202 3.11031,-1.5601 0.38666,-0.0525 1.16134,-0.0519 1.56251,0.001 2.18606,0.29027 3.51464,1.7209 4.04732,4.35822 0.13263,0.65663 0.24325,1.71374 0.24325,2.32446 v 0.18901 h -4.80137 -4.80136 l 4.6e-4,0.1429 c 6.4e-4,0.19414 0.0574,0.76627 0.10322,1.03965 0.36981,2.20844 1.63422,3.74849 3.43951,4.18933 0.48183,0.11766 0.80028,0.14581 1.48681,0.13141 1.20975,-0.0254 2.2518,-0.2443 3.51863,-0.73929 0.20618,-0.0806 0.37851,-0.14284 0.38295,-0.1384 0.0189,0.0189 0.11827,1.19481 0.10234,1.21087 -0.0372,0.0375 -0.75552,0.31882 -1.09377,0.42834 -1.19108,0.38565 -2.40723,0.55167 -3.65322,0.49872 z m 3.93653,-8.32397 c -0.0603,-1.26072 -0.4967,-2.31101 -1.28476,-3.09231 -0.61702,-0.61174 -1.3169,-0.92024 -2.25737,-0.99504 -0.82674,-0.0657 -1.6698,0.12102 -2.31532,0.51292 -0.68961,0.41867 -1.32032,1.12589 -1.72724,1.93675 -0.26734,0.53273 -0.48183,1.23016 -0.56034,1.82199 l -0.0157,0.11863 h 4.08763 4.08763 z"
+       id="path1858"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 396.33573,487.92763 c -0.007,-4.85115 -0.0113,-5.40106 -0.0474,-5.83595 -0.0419,-0.50482 -0.14345,-1.56986 -0.16734,-1.75479 l -0.014,-0.1086 h 0.64122 0.64123 l 0.0468,0.20006 c 0.0992,0.42383 0.17468,1.04371 0.20039,1.64553 0.0218,0.50978 0.0231,0.51241 0.14388,0.29078 0.59123,-1.08475 1.43569,-1.84809 2.4257,-2.19269 1.10461,-0.38449 2.66603,-0.27883 3.70071,0.25042 0.8891,0.45479 1.5357,1.23968 1.9221,2.3332 0.1634,0.46242 0.3086,1.13494 0.37746,1.74821 0.0675,0.60122 0.0799,1.38673 0.0803,5.07001 l 3.9e-4,3.70963 h -0.68487 -0.68486 l -0.009,-4.08688 c -0.009,-4.35633 -0.007,-4.24692 -0.11966,-4.90345 -0.28126,-1.6339 -1.06832,-2.63359 -2.33622,-2.96739 -0.50206,-0.13217 -1.2151,-0.16247 -1.65293,-0.0702 -0.60486,0.12742 -1.12382,0.4215 -1.65451,0.9376 -0.72158,0.70173 -1.17829,1.50047 -1.36742,2.39144 l -0.0532,0.25081 -0.006,4.22406 -0.006,4.22406 h -0.68464 -0.68464 z"
+       id="path1860"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 414.26664,493.62294 c -1.83788,-0.0825 -3.26746,-1.00338 -4.2008,-2.70589 -0.3807,-0.69442 -0.68091,-1.57878 -0.82789,-2.43875 -0.32417,-1.89678 -0.14434,-3.83422 0.49126,-5.29275 0.72289,-1.65881 1.92778,-2.75033 3.42854,-3.10596 0.98187,-0.23267 2.13233,-0.17008 3.02943,0.16481 0.9147,0.34146 1.69547,0.97787 2.32066,1.89159 0.088,0.12864 0.2012,0.30739 0.2515,0.39721 0.0503,0.0898 0.0992,0.16355 0.10861,0.16384 0.009,2.9e-4 0.0171,-1.99033 0.0171,-4.42359 v -4.42412 h 0.68591 0.68591 l 5e-5,8.92254 c 5e-5,8.49944 0.007,9.65931 0.0654,10.32295 l 0.0165,0.18862 h -0.62082 -0.62083 l -0.014,-0.12003 c -0.0166,-0.14264 -0.0605,-1.34328 -0.0674,-1.84624 l -0.005,-0.35439 -0.11162,0.17148 c -0.3375,0.51847 -0.89762,1.15186 -1.29751,1.46724 -0.83405,0.65779 -1.75585,0.99446 -2.82064,1.03019 -0.1006,0.003 -0.3321,-5.6e-4 -0.51443,-0.009 z m 1.3558,-1.32012 c 0.35926,-0.0732 0.62876,-0.16658 0.96486,-0.33421 0.37422,-0.18665 0.66148,-0.3911 0.97956,-0.69717 0.53286,-0.51277 0.9243,-1.15698 1.12209,-1.84669 0.17991,-0.62736 0.20239,-0.94624 0.18986,-2.69281 -0.0111,-1.54266 -0.0188,-1.64719 -0.16426,-2.21467 -0.22385,-0.8734 -0.6468,-1.57951 -1.34393,-2.24368 -0.60411,-0.57555 -1.26473,-0.90366 -2.07518,-1.0307 -0.31902,-0.05 -0.99883,-0.0499 -1.32396,3e-4 -0.46296,0.0714 -0.93142,0.22332 -1.26637,0.41064 -1.12396,0.62855 -1.91578,1.9733 -2.16607,3.67865 -0.15488,1.05527 -0.10279,2.50934 0.12831,3.58196 0.36088,1.67489 1.20542,2.76253 2.49248,3.20992 0.54115,0.18811 0.93885,0.24428 1.66696,0.23545 0.45707,-0.006 0.58998,-0.0151 0.79565,-0.057 z"
+       id="path1862"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 427.79049,493.5892 c -1.40617,-0.21864 -2.4022,-0.95029 -3.05109,-2.24123 -0.40773,-0.81115 -0.64172,-1.72903 -0.79471,-3.1174 -0.0358,-0.3249 -0.0396,-0.93786 -0.0463,-7.36781 l -0.007,-7.01343 h 0.67359 0.6736 l 0.009,6.70477 c 0.01,6.82326 0.0118,7.00237 0.0974,7.84795 0.12779,1.26122 0.41372,2.29884 0.79658,2.89067 0.13134,0.20304 0.44038,0.52728 0.61719,0.64753 0.38213,0.25992 0.95533,0.42813 1.46027,0.42851 0.12463,9e-5 0.1772,0.008 0.1772,0.0282 0,0.0501 -0.11612,1.12498 -0.12726,1.17801 -0.01,0.0465 -0.0234,0.0512 -0.14183,0.0489 -0.0721,-0.001 -0.22363,-0.017 -0.3368,-0.0346 z"
+       id="path1864"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 429.95866,499.23186 c -0.008,-0.0336 -0.0795,-0.29767 -0.15796,-0.58689 -0.0785,-0.28923 -0.14107,-0.52669 -0.13906,-0.52769 0.002,-10e-4 0.1333,-0.0436 0.29174,-0.0947 1.13222,-0.36509 2.10503,-1.1714 2.90787,-2.41017 0.43294,-0.66802 0.86412,-1.56618 1.19488,-2.489 0.0949,-0.26487 0.10313,-0.37893 0.0425,-0.59175 -0.0193,-0.0677 -1.09304,-2.74786 -2.38612,-5.95598 -1.29307,-3.20811 -2.39757,-5.94868 -2.45443,-6.09015 l -0.10338,-0.25722 h 0.71428 0.71428 l 1.18482,2.96656 c 0.65166,1.63161 1.64529,4.11889 2.20807,5.52729 0.56279,1.4084 1.032,2.55843 1.0427,2.55562 0.0107,-0.003 0.94775,-2.4864 2.08233,-5.5191 1.13458,-3.0327 2.06671,-5.51783 2.07139,-5.52251 0.005,-0.005 0.33206,-0.006 0.72749,-0.002 l 0.71899,0.006 -1.49381,3.74964 c -3.35876,8.43093 -3.81479,9.57116 -3.95489,9.88854 -1.3015,2.94837 -2.97284,4.73642 -5.00775,5.35742 l -0.18866,0.0576 z"
+       id="path1866"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 466.4758,493.62314 c -1.45181,-0.0518 -2.74209,-0.444 -3.79537,-1.15362 -0.13832,-0.0932 -0.27004,-0.18378 -0.29271,-0.20131 -0.0388,-0.03 -0.0255,-0.0688 0.22467,-0.65706 0.14623,-0.34386 0.26967,-0.62899 0.27431,-0.63362 0.005,-0.005 0.10416,0.0634 0.22117,0.1512 0.67232,0.50442 1.34476,0.82699 2.15829,1.03532 0.54738,0.14018 0.89369,0.18432 1.55671,0.19842 0.63362,0.0135 0.92514,-0.007 1.3677,-0.0968 1.32858,-0.26911 2.35262,-1.09378 2.72806,-2.19693 0.18459,-0.54239 0.26064,-1.19762 0.2121,-1.82751 -0.0878,-1.1388 -0.41159,-1.84567 -1.11432,-2.4323 -0.61331,-0.51197 -1.2819,-0.86992 -2.3653,-1.26634 -1.26557,-0.46308 -2.05129,-0.86777 -2.82085,-1.4529 -0.28325,-0.21536 -0.82457,-0.75065 -1.01574,-1.00442 -0.65231,-0.86591 -0.952,-1.83625 -0.90894,-2.94301 0.0533,-1.37071 0.52091,-2.37763 1.48963,-3.20783 0.644,-0.55192 1.4352,-0.94552 2.25611,-1.12235 0.46021,-0.0991 0.66417,-0.12051 1.26489,-0.13258 1.07258,-0.0215 1.99133,0.11405 2.81436,0.41535 0.24038,0.088 0.79477,0.35451 0.974,0.46822 l 0.1073,0.0681 -0.2759,0.56664 c -0.15175,0.31165 -0.28315,0.57464 -0.292,0.58442 -0.009,0.01 -0.10274,-0.0303 -0.20865,-0.089 -0.72347,-0.40119 -1.56973,-0.65953 -2.43295,-0.74271 -0.35408,-0.0341 -1.16128,-0.0144 -1.45209,0.0356 -0.86066,0.14772 -1.5369,0.47184 -2.04917,0.98215 -0.42088,0.41927 -0.65249,0.86296 -0.77831,1.491 -0.0586,0.2927 -0.0587,1.06224 -1.6e-4,1.33409 0.19406,0.90065 0.66802,1.58854 1.54586,2.24356 0.50705,0.37834 1.11699,0.69785 2.07057,1.08465 1.7404,0.70595 2.67043,1.24813 3.40775,1.98661 0.43957,0.44027 0.68634,0.84041 0.87774,1.42329 0.21093,0.64235 0.28583,1.22039 0.26905,2.07638 -0.0123,0.62679 -0.0378,0.85377 -0.1452,1.2918 -0.28152,1.14819 -0.97439,2.0959 -2.04295,2.79439 -1.06152,0.69388 -2.2618,0.98509 -3.82966,0.92913 z"
+       id="path1868"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 480.25115,493.62391 c -1.76943,-0.0824 -3.28993,-0.87015 -4.32828,-2.24257 -0.2674,-0.35344 -0.42444,-0.60902 -0.62244,-1.01302 -0.33343,-0.68033 -0.52948,-1.35217 -0.64384,-2.20634 -0.0591,-0.44104 -0.0584,-1.736 0.001,-2.22921 0.1851,-1.53321 0.63888,-2.7246 1.44812,-3.802 0.22897,-0.30485 0.71268,-0.81249 0.97864,-1.02706 0.75983,-0.61301 1.63095,-0.98187 2.64075,-1.11816 0.34389,-0.0464 1.1342,-0.0519 1.47471,-0.0103 1.60517,0.19621 2.76041,0.99424 3.47192,2.39837 0.53771,1.06112 0.81782,2.35304 0.89687,4.13649 l 0.0155,0.34867 h -4.81007 -4.81008 l 0.0166,0.31284 c 0.1063,2.00432 0.90234,3.6062 2.23549,4.49853 0.52294,0.35002 1.20005,0.58817 1.92006,0.67532 0.251,0.0304 1.0811,0.03 1.41814,-6e-4 1.00947,-0.0917 2.10982,-0.3665 3.10524,-0.77539 0.12971,-0.0533 0.23905,-0.0933 0.24296,-0.0888 0.004,0.004 0.0321,0.27911 0.0627,0.61042 l 0.0556,0.60239 -0.1271,0.0563 c -1.16017,0.51427 -2.50008,0.82649 -3.7167,0.86607 -0.2012,0.007 -0.41211,0.0147 -0.4687,0.0182 -0.0566,0.003 -0.26236,-10e-4 -0.45728,-0.0102 z m 3.95517,-8.15413 c -3.8e-4,-0.20384 -0.0628,-0.7459 -0.11648,-1.01171 -0.19744,-0.97746 -0.63711,-1.77073 -1.32584,-2.39213 -0.6974,-0.62923 -1.67691,-0.93541 -2.73725,-0.85562 -0.56747,0.0427 -0.96231,0.14731 -1.43321,0.37975 -0.40065,0.19776 -0.67408,0.39776 -1.02924,0.75282 -0.60261,0.60243 -0.9847,1.22701 -1.25817,2.05663 -0.11691,0.35465 -0.26189,0.97972 -0.26189,1.12908 v 0.0727 h 4.08116 4.08117 l -2.5e-4,-0.13147 z"
+       id="path1870"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 493.46635,493.62321 c -2.04371,-0.0792 -3.6873,-0.97429 -4.73803,-2.58041 -0.19454,-0.29736 -0.48014,-0.86462 -0.60714,-1.20589 -0.36186,-0.97241 -0.53611,-2.1313 -0.49935,-3.32111 0.0624,-2.02032 0.59394,-3.50094 1.69299,-4.71605 0.80338,-0.88822 1.84034,-1.47099 3.05407,-1.71638 1.36434,-0.27584 3.03495,-0.14656 4.22978,0.32732 0.23352,0.0926 0.69485,0.31495 0.8358,0.4028 l 0.0699,0.0435 -0.23456,0.61435 c -0.12902,0.33789 -0.23782,0.6176 -0.24179,0.62157 -0.004,0.004 -0.079,-0.0396 -0.16683,-0.0969 -0.23026,-0.15027 -0.71251,-0.37932 -1.01699,-0.48303 -1.18521,-0.40372 -2.66961,-0.4219 -3.74881,-0.0459 -1.39343,0.48545 -2.47138,1.75971 -2.89099,3.41748 -0.15698,0.62019 -0.2079,1.09369 -0.20616,1.91704 0.002,0.71863 0.0298,1.03925 0.13792,1.56474 0.41693,2.02586 1.72207,3.48002 3.48881,3.88718 0.68218,0.15721 1.7335,0.15662 2.52189,-10e-4 0.63562,-0.12742 1.28939,-0.38719 1.73463,-0.68923 0.10289,-0.0698 0.13852,-0.084 0.15283,-0.0608 0.0491,0.0794 0.45768,1.17263 0.44786,1.19824 -0.019,0.0494 -0.83248,0.43882 -1.12355,0.53787 -0.91263,0.31054 -1.79248,0.42769 -2.89225,0.38508 z"
+       id="path1872"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 503.93791,493.62356 c -2.07746,-0.096 -3.36279,-1.42647 -3.78398,-3.91681 -0.16081,-0.95079 -0.17097,-1.28755 -0.17122,-5.67738 l -2.2e-4,-3.80108 h 0.6849 0.6849 l 0.009,3.99543 c 0.01,4.29399 0.006,4.17411 0.12928,4.93283 0.20902,1.29048 0.65545,2.18782 1.34885,2.71126 0.22059,0.16652 0.57424,0.33239 0.88637,0.41571 0.26636,0.0711 0.27564,0.0719 0.81814,0.0723 0.60452,3.7e-4 0.79632,-0.0264 1.23464,-0.17254 0.98027,-0.32675 1.85898,-1.11843 2.34438,-2.11214 0.22207,-0.45462 0.35237,-0.91771 0.40987,-1.45666 0.0154,-0.14456 0.0237,-1.64625 0.0237,-4.30408 v -4.08207 h 0.68539 0.68539 l 0.007,5.25293 c 0.007,4.8294 0.0106,5.27483 0.0469,5.52463 0.09,0.61989 0.24915,1.3115 0.43807,1.90345 0.0554,0.17357 0.0987,0.31745 0.0962,0.31975 -0.002,0.002 -0.27202,0.0726 -0.59897,0.15629 -0.32695,0.0837 -0.61099,0.15692 -0.63119,0.16279 -0.0837,0.0243 -0.40863,-1.27913 -0.53383,-2.14145 -0.0314,-0.2163 -0.0614,-0.39756 -0.0666,-0.4028 -0.005,-0.005 -0.0427,0.0484 -0.0832,0.11926 -0.19471,0.34032 -0.67239,0.94143 -0.95894,1.20673 -0.73586,0.68127 -1.55316,1.08244 -2.52759,1.24065 -0.29945,0.0486 -0.79251,0.0708 -1.17747,0.053 z"
+       id="path1874"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 513.56348,488.56781 c -3e-5,-5.43156 -0.016,-6.15699 -0.16068,-7.29922 -0.0428,-0.33756 -0.14488,-0.93016 -0.17285,-1.00305 -0.013,-0.0338 0.0394,-0.0372 0.56954,-0.0372 h 0.58382 l 0.0498,0.13147 c 0.0757,0.19985 0.17257,0.60415 0.21498,0.8974 0.0351,0.24236 0.0545,0.49597 0.0991,1.29179 l 0.0167,0.29723 0.0661,-0.17148 c 0.10456,-0.27115 0.39165,-0.82502 0.56014,-1.08066 0.60146,-0.91256 1.36468,-1.43844 2.33457,-1.60862 0.26524,-0.0465 0.87847,-0.0489 1.09746,-0.004 l 0.14861,0.0303 0.006,0.61334 0.006,0.61333 -0.0633,-0.0124 c -0.26434,-0.0519 -0.73294,-0.0272 -1.07303,0.0566 -0.79128,0.19479 -1.48057,0.7114 -2.0224,1.51578 -0.37454,0.556 -0.62369,1.1928 -0.76406,1.95278 -0.12391,0.67092 -0.12487,0.70772 -0.12487,4.77523 v 3.7574 h -0.68591 -0.68591 l -3e-5,-4.71563 z"
+       id="path1876"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 525.93275,493.62391 c -1.65452,-0.0715 -3.07447,-0.7456 -4.11474,-1.9535 -0.83427,-0.9687 -1.30115,-2.06319 -1.50149,-3.51986 -0.0581,-0.42251 -0.0589,-1.70686 -10e-4,-2.18348 0.0779,-0.64501 0.16884,-1.09602 0.32509,-1.61225 0.51873,-1.71385 1.6463,-3.14863 3.02432,-3.84831 0.84066,-0.42683 1.82792,-0.61855 2.85487,-0.55438 1.07584,0.0672 1.89386,0.35168 2.60276,0.90508 0.20635,0.16109 0.56637,0.52552 0.72259,0.73147 0.72056,0.94989 1.15786,2.26485 1.32302,3.97828 0.0318,0.32999 0.0691,0.94289 0.0692,1.13746 l 8e-5,0.15433 h -4.80491 -4.80491 l 0.0146,0.30473 c 0.0472,0.98364 0.27777,1.91316 0.66744,2.69041 0.2357,0.47015 0.50073,0.85081 0.83361,1.19731 0.63858,0.66471 1.37965,1.06361 2.30458,1.24049 0.26668,0.051 0.39656,0.0617 0.86587,0.0714 0.33057,0.007 0.67463,7.4e-4 0.85739,-0.0151 1.01661,-0.0883 1.99119,-0.32316 3.01133,-0.72583 0.20569,-0.0812 0.37732,-0.14428 0.3814,-0.1402 0.004,0.004 0.0286,0.2439 0.0545,0.53294 0.0259,0.28904 0.0517,0.55935 0.0574,0.60069 0.01,0.0723 0.005,0.0774 -0.11982,0.13367 -1.12856,0.5072 -2.5105,0.82826 -3.73119,0.86686 -0.20749,0.007 -0.41326,0.0145 -0.45728,0.0175 -0.044,0.003 -0.23949,-0.001 -0.4344,-0.01 z m 3.92525,-8.30586 c -0.0373,-0.73639 -0.22124,-1.47872 -0.50762,-2.04889 -0.28846,-0.57429 -0.77842,-1.14091 -1.28138,-1.48185 -0.64227,-0.43537 -1.49807,-0.64373 -2.37308,-0.57777 -0.56959,0.0429 -0.99582,0.15659 -1.46652,0.39103 -0.3711,0.18484 -0.65462,0.39226 -0.98382,0.71975 -0.65559,0.65217 -1.08507,1.38337 -1.34693,2.29315 -0.0801,0.27833 -0.19568,0.82804 -0.19568,0.93077 v 0.057 h 4.08469 4.08469 z"
+       id="path1878"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#ff7f2a;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.00390625;stroke-linejoin:bevel"
+       d="m 346.33008,493.51692 c -0.19105,-0.0158 -0.34947,-0.0666 -0.4961,-0.15884 -0.0726,-0.0457 -0.13623,-0.0975 -0.20933,-0.17041 -0.1413,-0.14094 -0.23085,-0.27268 -0.30043,-0.44196 -0.11571,-0.28148 -0.132,-0.6355 -0.0434,-0.94224 0.0788,-0.27256 0.25714,-0.54021 0.47695,-0.71562 0.25991,-0.20741 0.58983,-0.27683 0.91602,-0.19276 0.13845,0.0357 0.27496,0.10481 0.40429,0.20471 0.0575,0.0444 0.19,0.1766 0.24059,0.24004 0.1757,0.22033 0.27037,0.44545 0.30308,0.72071 0.007,0.0569 0.007,0.25165 0,0.30859 -0.0388,0.32638 -0.16923,0.58254 -0.41682,0.81856 -0.20563,0.19601 -0.44692,0.30676 -0.71433,0.32786 -0.0469,0.004 -0.12443,0.004 -0.16056,0.001 z"
+       id="path2003"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#ff7f2a;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.00692709;stroke-linejoin:bevel"
+       d="m 450.94689,493.51322 c -0.32583,-0.0199 -0.61424,-0.18585 -0.83574,-0.48077 -0.15606,-0.2078 -0.23824,-0.43252 -0.26022,-0.71159 -0.0326,-0.41326 0.11286,-0.81204 0.4093,-1.12247 0.16176,-0.16939 0.36357,-0.28049 0.58322,-0.32108 0.0889,-0.0164 0.2697,-0.0166 0.35975,-3.6e-4 0.24158,0.0436 0.45295,0.16241 0.64304,0.3615 0.25309,0.26509 0.38491,0.56712 0.40054,0.91773 0.0166,0.37248 -0.10928,0.7059 -0.36849,0.97597 -0.26495,0.27604 -0.57497,0.40288 -0.9314,0.38107 z"
+       id="path2005"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0142009;stroke-linejoin:bevel"
+       d="m 378.70973,477.38924 c -0.30862,-0.0605 -0.54776,-0.23712 -0.67364,-0.49739 -0.10967,-0.22674 -0.12982,-0.3282 -0.12944,-0.65164 2.8e-4,-0.24333 0.004,-0.29156 0.0328,-0.39763 0.10884,-0.40416 0.38122,-0.69509 0.74078,-0.79124 0.11521,-0.0308 0.41144,-0.0341 0.52544,-0.006 0.11426,0.0283 0.29411,0.1165 0.38193,0.18723 0.19583,0.15773 0.3649,0.41716 0.42983,0.65955 0.0444,0.16582 0.0446,0.53239 3.3e-4,0.69584 -0.11118,0.41058 -0.39121,0.69673 -0.7709,0.78775 -0.128,0.0307 -0.41275,0.0378 -0.53716,0.0134 z"
+       id="path2161"
+       transform="scale(0.26458333)" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer3"
+     inkscape:label="heading"
+     transform="translate(-59.014718,-105.5257)">
+    <g
+       aria-label="Infix"
+       id="text1160"
+       style="font-size:25.4px;font-family:'URW Bookman';-inkscape-font-specification:'URW Bookman, Normal';fill:#5c5f5c;stroke-width:1.029"
+       inkscape:label="infix">
+      <path
+         d="m 85.532731,107.6593 0.508,0.0762 c 1.3462,0.1778 1.6256,0.635 1.651,2.794 v 9.9822 c -0.0254,2.159 -0.3048,2.6162 -1.651,2.794 l -0.508,0.0762 v 0.7874 h 6.858 v -0.7874 l -0.508,-0.0762 c -1.3462,-0.1778 -1.6256,-0.635 -1.651,-2.794 v -9.9822 c 0.0254,-2.159 0.3048,-2.6162 1.651,-2.794 l 0.508,-0.0762 v -0.7874 h -6.858 z"
+         id="path2431" />
+      <path
+         d="m 98.588334,111.8503 h -0.8636 c -1.5748,0.3048 -2.413,0.4064 -3.8354,0.508 v 0.762 l 0.6096,0.0508 c 1.3462,0.1524 1.6764,0.5588 1.6764,2.1082 v 5.969 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.832596 v -0.762 l -0.635,-0.0508 c -1.117596,-0.1016 -1.574796,-0.7112 -1.574796,-2.1082 v -6.2738 c 1.574796,-1.4224 3.073396,-2.1336 4.495796,-2.1336 1.397,0 2.159,0.889 2.159,2.54 v 5.8674 c 0,1.397 -0.4826,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -6.2738 c 0,-2.1082 -1.4224,-3.3528 -3.8354,-3.3528 -1.9558,0 -3.429,0.635 -5.232396,2.2352 z"
+         id="path2433" />
+      <path
+         d="m 115.27613,111.8503 v -1.5748 c 0,-1.651 0.0508,-1.9812 0.4064,-2.5908 0.4826,-0.8382 1.4986,-1.3462 2.6416,-1.3462 1.27,0 2.4638,0.762 2.4638,1.6256 0.0254,1.0414 0.0254,1.0414 0.2286,1.397 0.2286,0.4064 0.635,0.635 1.143,0.635 0.762,0 1.27,-0.5334 1.27,-1.27 0,-0.5842 -0.2286,-1.0668 -0.762,-1.6256 -1.016,-1.0414 -2.413,-1.5748 -4.191,-1.5748 -1.9558,0 -3.7338,0.6604 -4.6482,1.7272 -0.6858,0.8128 -0.9652,1.8542 -0.9652,3.6322 v 0.9652 h -2.159 v 0.8382 h 2.159 v 8.5598 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -8.5598 h 3.3782 c 1.8288,0 2.3368,0.5842 2.3114,2.667 v 5.8928 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -9.398 z"
+         id="path2435" />
+      <path
+         d="m 134.09755,117.0827 2.2098,-2.3622 c 1.397,-1.3716 2.1082,-1.778 3.81,-2.1082 v -0.762 h -5.3594 v 0.762 c 0.9144,0.1016 1.143,0.2286 1.143,0.6604 0,0.2032 -0.0762,0.4064 -0.254,0.6096 l -2.159,2.4384 -2.0066,-2.4384 c -0.1778,-0.254 -0.3048,-0.4826 -0.3048,-0.635 0,-0.3556 0.3048,-0.5334 1.0414,-0.6096 l 0.254,-0.0254 v -0.762 h -6.2992 v 0.762 c 1.2192,0.1778 1.7018,0.4826 2.5908,1.5494 l 2.9718,3.7338 -3.2258,3.6322 c -1.143,1.2954 -1.8034,1.7018 -3.0226,1.8796 v 0.762 h 5.6896 v -0.762 c -0.889,-0.1524 -1.0922,-0.2032 -1.27,-0.3048 -0.254,-0.1524 -0.4318,-0.4064 -0.4318,-0.6604 0,-0.254 0.1778,-0.5842 0.4572,-0.9144 l 2.54,-2.8448 2.286,3.2004 c 0.1524,0.2286 0.254,0.4826 0.254,0.6858 0,0.4826 -0.3048,0.6604 -1.524,0.8382 v 0.762 h 7.0358 v -0.762 c -1.3716,-0.2286 -1.8288,-0.5334 -2.9464,-1.8796 z"
+         id="path2437" />
+    </g>
+  </g>
+  <g
+     inkscape:label="tux"
+     inkscape:groupmode="layer"
+     id="layer1"
+     style="display:inline"
+     transform="translate(-59.014718,-105.5257)">
+    <path
+       id="rect1698"
+       style="fill:#f9f9f9;stroke:#5c5f5c;stroke-width:1.029;stroke-linejoin:round"
+       inkscape:label="body"
+       d="M 59.529221,107.02922 H 82 V 124 H 59.529221 Z" />
+    <path
+       id="rect184-3"
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-linejoin:round"
+       inkscape:label="foot-r"
+       d="m 76,120 h 6 v 4 h -6 z" />
+    <path
+       id="rect184"
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-linejoin:round"
+       inkscape:label="foot-l"
+       d="m 59.529221,120 h 6 v 4 h -6 z" />
+    <path
+       id="path11801"
+       style="fill:#ff7f2a"
+       inkscape:label="nose"
+       inkscape:transform-center-y="0.49151511"
+       transform="translate(28.350554,16.321792)"
+       d="m 42.414055,100.66737 -1.702663,-2.949101 h 3.405325 z" />
+    <path
+       id="path6519-5"
+       style="display:inline;fill:#5c5f5c;stroke-width:4.99999"
+       inkscape:label="eye-r"
+       d="m 73.711082,111.02191 a 0.5,0.5 0 0 1 -0.5,0.5 0.5,0.5 0 0 1 -0.5,-0.5 0.5,0.5 0 0 1 0.5,-0.5 0.5,0.5 0 0 1 0.5,0.5 z" />
+    <path
+       id="path6519"
+       style="fill:#5c5f5c;stroke-width:4.99999"
+       inkscape:label="eye-l"
+       d="m 68.81813,111.02191 a 0.5,0.5 0 0 1 -0.5,0.5 0.5,0.5 0 0 1 -0.5,-0.5 0.5,0.5 0 0 1 0.5,-0.5 0.5,0.5 0 0 1 0.5,0.5 z" />
+  </g>
+</svg>

doc/logo2.svg

@@ -0,0 +1,187 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   width="210mm"
+   height="297mm"
+   viewBox="0 0 210 297"
+   version="1.1"
+   id="svg5"
+   inkscape:version="1.2.2 (b0a8486541, 2022-12-01)"
+   sodipodi:docname="logo2.svg"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <sodipodi:namedview
+     id="namedview7"
+     pagecolor="#ffffff"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:document-units="mm"
+     showgrid="false"
+     inkscape:zoom="5.1481021"
+     inkscape:cx="371.01052"
+     inkscape:cy="472.98985"
+     inkscape:window-width="2560"
+     inkscape:window-height="1385"
+     inkscape:window-x="1920"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="layer1" />
+  <defs
+     id="defs2">
+    <rect
+       x="505.95288"
+       y="579.6032"
+       width="127.6438"
+       height="127.94966"
+       id="rect1266" />
+    <rect
+       x="309.92126"
+       y="404.51989"
+       width="483.77954"
+       height="358.02926"
+       id="rect600" />
+    <inkscape:path-effect
+       effect="bspline"
+       id="path-effect5591"
+       is_visible="true"
+       lpeversion="1"
+       weight="33.333333"
+       steps="2"
+       helper_size="0"
+       apply_no_weight="true"
+       apply_with_weight="true"
+       only_selected="false" />
+  </defs>
+  <g
+     inkscape:groupmode="layer"
+     id="layer6"
+     inkscape:label="bg"
+     style="display:none;fill:#ff0000;fill-opacity:1"
+     transform="matrix(1.2831201,0,0,3.2117929,-26.690111,-224.39813)">
+    <rect
+       style="fill:#22272e;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-miterlimit:0;stroke-dasharray:none;stroke-opacity:1"
+       id="rect10264"
+       width="163.66356"
+       height="92.471725"
+       x="20.800945"
+       y="69.866936"
+       inkscape:label="bg" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer5"
+     inkscape:label="tagline"
+     style="display:inline">
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:6.77333px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#000000;fill-opacity:1;stroke:#5c5f5c;stroke-width:0;stroke-miterlimit:0;stroke-dasharray:none;stroke-opacity:1"
+       x="85.018883"
+       y="131.54915"
+       id="text9503"
+       inkscape:label="linux-netconf"
+       inkscape:export-filename="logo.png"
+       inkscape:export-xdpi="191.95932"
+       inkscape:export-ydpi="191.95932"><tspan
+         sodipodi:role="line"
+         id="tspan9519"
+         x="85.018883"
+         y="131.54915"><tspan
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:6.77333px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-opacity:1"
+   id="tspan11822">Linux</tspan> <tspan
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:6.77333px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#ff7f2a;fill-opacity:1;stroke:#5c5f5c;stroke-opacity:1"
+   id="tspan9929">♥</tspan> <tspan
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:6.77333px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-opacity:1"
+   id="tspan11824">NETCONF</tspan></tspan></text>
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer3"
+     inkscape:label="heading">
+    <text
+       xml:space="preserve"
+       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:25.4px;font-family:'URW Bookman';-inkscape-font-specification:'URW Bookman, Normal';font-variant-ligatures:normal;font-variant-caps:normal;font-variant-numeric:normal;font-variant-east-asian:normal;fill:#5c5f5c;stroke-width:1.029;fill-opacity:1"
+       x="84.745331"
+       y="124.1693"
+       id="text1160"
+       inkscape:label="infix"
+       inkscape:export-filename="logo-plain.png"
+       inkscape:export-xdpi="191.95932"
+       inkscape:export-ydpi="191.95932"><tspan
+         sodipodi:role="line"
+         id="tspan1272"
+         x="84.745331"
+         y="124.1693">Infix</tspan></text>
+  </g>
+  <g
+     inkscape:label="tux"
+     inkscape:groupmode="layer"
+     id="layer1"
+     style="display:inline">
+    <rect
+       style="fill:#f9f9f9;stroke:#5c5f5c;stroke-width:1.029;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1;fill-opacity:1"
+       id="rect1698"
+       width="22.470779"
+       height="16.970779"
+       x="59.529221"
+       y="107.02922"
+       inkscape:label="body"
+       inkscape:export-filename="jack.png"
+       inkscape:export-xdpi="191.95932"
+       inkscape:export-ydpi="191.95932" />
+    <rect
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1"
+       id="rect184-3"
+       width="6"
+       height="4"
+       x="76"
+       y="120"
+       inkscape:label="foot-r" />
+    <rect
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-width:1;stroke-linejoin:round;stroke-dasharray:none;stroke-opacity:1"
+       id="rect184"
+       width="6"
+       height="4"
+       x="59.529221"
+       y="120"
+       inkscape:label="foot-l" />
+    <path
+       sodipodi:type="star"
+       style="fill:#ff7f2a;stroke:none;stroke-width:1;stroke-dasharray:none;stroke-opacity:1"
+       id="path11801"
+       inkscape:flatsided="true"
+       sodipodi:sides="3"
+       sodipodi:cx="42.414055"
+       sodipodi:cy="98.701302"
+       sodipodi:r1="1.9660654"
+       sodipodi:r2="0.9830327"
+       sodipodi:arg1="1.5707963"
+       sodipodi:arg2="2.6179939"
+       inkscape:rounded="0"
+       inkscape:randomized="0"
+       d="m 42.414055,100.66737 -1.702663,-2.949101 3.405325,0 z"
+       inkscape:transform-center-y="0.49151511"
+       transform="translate(28.350554,16.321792)"
+       inkscape:label="nose" />
+    <circle
+       style="display:inline;fill:#5c5f5c;stroke:none;stroke-width:4.99999;stroke-dasharray:none;stroke-opacity:1;fill-opacity:1"
+       id="path6519-5"
+       cx="73.211082"
+       cy="111.02191"
+       r="0.5"
+       inkscape:label="eye-r" />
+    <circle
+       style="fill:#5c5f5c;stroke:none;stroke-width:4.99999;stroke-dasharray:none;stroke-opacity:1;fill-opacity:1"
+       id="path6519"
+       cx="68.31813"
+       cy="111.02191"
+       r="0.5"
+       inkscape:label="eye-l" />
+  </g>
+</svg>

doc/logo3.svg

@@ -0,0 +1,359 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!-- Created with Inkscape (http://www.inkscape.org/) -->
+
+<svg
+   width="210mm"
+   height="297mm"
+   viewBox="0 0 210 297"
+   version="1.1"
+   id="svg5"
+   inkscape:version="1.2.2 (b0a8486541, 2022-12-01)"
+   sodipodi:docname="datadatafinal2.svg"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg">
+  <sodipodi:namedview
+     id="namedview7"
+     pagecolor="#ffffff"
+     bordercolor="#000000"
+     borderopacity="0.25"
+     inkscape:showpageshadow="2"
+     inkscape:pageopacity="0.0"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1"
+     inkscape:document-units="mm"
+     showgrid="false"
+     inkscape:zoom="4.1146545"
+     inkscape:cx="339.51818"
+     inkscape:cy="495.54586"
+     inkscape:window-width="2560"
+     inkscape:window-height="1385"
+     inkscape:window-x="1920"
+     inkscape:window-y="0"
+     inkscape:window-maximized="1"
+     inkscape:current-layer="layer5" />
+  <defs
+     id="defs2">
+    <rect
+       x="505.95288"
+       y="579.6032"
+       width="127.6438"
+       height="127.94966"
+       id="rect1266" />
+    <rect
+       x="309.92126"
+       y="404.51989"
+       width="483.77954"
+       height="358.02926"
+       id="rect600" />
+    <inkscape:path-effect
+       effect="bspline"
+       id="path-effect5591"
+       is_visible="true"
+       lpeversion="1"
+       weight="33.333333"
+       steps="2"
+       helper_size="0"
+       apply_no_weight="true"
+       apply_with_weight="true"
+       only_selected="false" />
+  </defs>
+  <g
+     inkscape:groupmode="layer"
+     id="layer6"
+     inkscape:label="bg"
+     style="display:none;fill:#ff0000;fill-opacity:1"
+     transform="matrix(1.2831201,0,0,3.2117929,-26.690111,-224.39813)">
+    <rect
+       style="fill:#22272e;fill-opacity:1;stroke:#000000;stroke-width:0;stroke-miterlimit:0;stroke-dasharray:none;stroke-opacity:1"
+       id="rect10264"
+       width="163.66356"
+       height="92.471725"
+       x="20.800945"
+       y="69.866936"
+       inkscape:label="bg" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer5"
+     inkscape:label="tagline"
+     style="display:inline">
+    <g
+       aria-label="Immutable . Friendly . Secure"
+       transform="scale(0.95128779,1.0512066)"
+       id="text9503"
+       style="font-size:6.44339px;font-family:Laksaman;-inkscape-font-specification:'Laksaman, Normal';stroke:#5c5f5c;stroke-width:0;stroke-miterlimit:0"
+       inkscape:label="linux-netconf"
+       inkscape:export-filename="minidata3.png"
+       inkscape:export-xdpi="191.95932"
+       inkscape:export-ydpi="191.95932">
+      <path
+         d="m 62.472956,124.15871 h -0.386604 v -4.61347 h 0.386604 z"
+         id="path2380" />
+      <path
+         d="m 67.144418,120.79526 q 0.573462,0 0.869857,0.4317 0.296396,0.43171 0.296396,1.10182 v 1.82993 h -0.386603 v -1.82348 q 0,-0.54125 -0.219075,-0.8763 -0.212632,-0.3415 -0.663669,-0.3415 -0.367274,0 -0.657226,0.28995 -0.289953,0.28995 -0.289953,0.65722 v 2.09411 h -0.386603 v -1.99745 q 0,-1.04383 -0.831197,-1.04383 -0.38016,0 -0.689443,0.32861 -0.309283,0.32861 -0.309283,0.71522 v 1.99745 H 63.491016 V 121.678 q 0,-0.28995 -0.06443,-0.81187 h 0.354386 q 0.06443,0.19975 0.07732,0.58635 0.373717,-0.65722 1.108263,-0.65722 0.670113,0 0.998725,0.73454 0.386604,-0.73454 1.179141,-0.73454 z"
+         id="path2382" />
+      <path
+         d="m 72.969238,120.79526 q 0.573462,0 0.869858,0.4317 0.296396,0.43171 0.296396,1.10182 v 1.82993 h -0.386604 v -1.82348 q 0,-0.54125 -0.219075,-0.8763 -0.212632,-0.3415 -0.663669,-0.3415 -0.367273,0 -0.657226,0.28995 -0.289953,0.28995 -0.289953,0.65722 v 2.09411 h -0.386603 v -1.99745 q 0,-1.04383 -0.831197,-1.04383 -0.38016,0 -0.689443,0.32861 -0.309283,0.32861 -0.309283,0.71522 v 1.99745 H 69.315836 V 121.678 q 0,-0.28995 -0.06443,-0.81187 h 0.354386 q 0.06443,0.19975 0.07732,0.58635 0.373717,-0.65722 1.108263,-0.65722 0.670113,0 0.998726,0.73454 0.386603,-0.73454 1.17914,-0.73454 z"
+         id="path2384" />
+      <path
+         d="m 78.078841,124.14582 -0.36083,0.0838 q -0.115981,-0.32861 -0.154641,-0.64434 -0.431707,0.66367 -1.237131,0.66367 -1.185584,0 -1.185584,-1.53352 v -1.84926 h 0.386604 v 1.77838 q 0,1.28223 0.882744,1.28223 0.457481,0 0.786094,-0.30928 0.328613,-0.31572 0.328613,-0.76032 v -1.99101 h 0.386603 v 2.48715 q 0,0.34795 0.167528,0.79254 z"
+         id="path2386" />
+      <path
+         d="m 79.973201,124.24891 q -0.39949,0 -0.625009,-0.29639 -0.219075,-0.30284 -0.219075,-0.76032 v -2.03611 h -0.657226 v -0.28996 h 0.657226 v -0.97939 l 0.386603,-0.17397 v 1.15336 h 1.050273 v 0.28996 H 79.51572 v 2.03611 q 0,0.73454 0.489698,0.73454 0.302839,0 0.444594,-0.058 l 0.03866,0.28996 q -0.199745,0.0902 -0.515471,0.0902 z"
+         id="path2388" />
+      <path
+         d="m 82.015758,124.24891 q -0.43815,0 -0.747433,-0.25129 -0.302839,-0.25773 -0.302839,-0.66367 0,-1.23068 2.190752,-1.23068 0,-0.47037 -0.225519,-0.72811 -0.225518,-0.25773 -0.663669,-0.25773 -0.354386,0 -1.050272,0.21907 l -0.0451,-0.36727 q 0.541245,-0.17397 1.12115,-0.17397 1.250018,0 1.250018,1.37888 v 1.17914 q 0,0.40594 0.115981,0.80543 l -0.335057,0.0709 -0.135311,-0.5348 q -0.444594,0.55413 -1.172697,0.55413 z m -0.663669,-0.97939 q 0,0.30284 0.186858,0.48325 0.186859,0.17397 0.489698,0.17397 0.386603,0 0.753876,-0.2384 0.373717,-0.24485 0.373717,-0.59279 v -0.67012 q -1.804149,0 -1.804149,0.84409 z"
+         id="path2390" />
+      <path
+         d="m 86.178189,120.79526 q 0.683,0 1.08249,0.47681 0.39949,0.47037 0.39949,1.19847 0,0.77965 -0.412377,1.28223 -0.412377,0.49614 -1.127593,0.49614 -0.766764,0 -1.224244,-0.67011 0,0.32861 -0.01933,0.57991 h -0.354387 q 0.02577,-0.22552 0.02577,-0.80543 v -4.09155 h 0.386603 v 2.22941 q 0.425264,-0.69588 1.243574,-0.69588 z m -1.243574,2.04255 q 0,0.46393 0.328613,0.77965 0.328613,0.30928 0.805424,0.30928 1.204914,0 1.204914,-1.44331 0,-0.61213 -0.30284,-0.98584 -0.302839,-0.38016 -0.863414,-0.38016 -0.489698,0 -0.831197,0.3415 -0.3415,0.3415 -0.3415,0.83119 z"
+         id="path2392" />
+      <path
+         d="m 89.696285,123.92674 -0.03866,0.32217 q -1.224244,-0.058 -1.224244,-1.74615 v -3.24103 h 0.386603 v 3.10571 q 0,0.36728 0.03222,0.61857 0.03222,0.25129 0.115981,0.48325 0.09021,0.23197 0.270623,0.34795 0.180415,0.10953 0.457481,0.10953 z"
+         id="path2394" />
+      <path
+         d="m 90.51459,122.54142 q 0.01933,0.625 0.373717,1.00516 0.36083,0.38016 0.960065,0.38016 0.560575,0 1.153367,-0.23196 l 0.03222,0.31573 q -0.573462,0.2384 -1.224245,0.2384 -0.740989,0 -1.211357,-0.45748 -0.470367,-0.46392 -0.470367,-1.19202 0,-0.77965 0.451037,-1.28868 0.457481,-0.51547 1.192027,-0.51547 1.385329,0 1.417546,1.74616 z m 2.287403,-0.32217 q -0.01289,-0.50259 -0.309282,-0.79898 -0.289953,-0.30284 -0.766764,-0.30284 -0.47681,0 -0.79898,0.31572 -0.322169,0.30929 -0.393047,0.7861 z"
+         id="path2396" />
+      <path
+         d="m 96.345854,123.54658 q 0.135311,0 0.238405,0.1031 0.103095,0.10309 0.103095,0.2384 0,0.13532 -0.103095,0.23197 -0.103094,0.0966 -0.238405,0.0966 -0.135311,0 -0.231962,-0.0966 -0.09665,-0.0967 -0.09665,-0.23197 0,-0.13531 0.09665,-0.2384 0.09665,-0.1031 0.231962,-0.1031 z"
+         id="path2398" />
+      <path
+         d="m 102.20934,121.94218 h -2.07477 v 2.21653 h -0.386608 v -4.61347 h 2.609578 v 0.32217 h -2.22297 v 1.7526 h 2.07477 z"
+         id="path2400" />
+      <path
+         d="m 104.6385,121.13031 q -0.0387,-0.0129 -0.11598,-0.0129 -0.42527,0 -0.72166,0.34794 -0.28996,0.3415 -0.28996,0.9214 v 1.77194 h -0.3866 v -2.21653 q 0,-0.7281 -0.0967,-1.07605 h 0.32861 q 0.1031,0.20619 0.1031,0.65723 0.30928,-0.7281 0.99228,-0.7281 0.0902,0 0.18686,0.0193 z"
+         id="path2402" />
+      <path
+         d="m 105.60501,124.15871 h -0.38661 v -3.29258 h 0.38661 z m -0.20619,-4.60058 q 0.13531,0 0.21907,0.0902 0.0902,0.0838 0.0902,0.21908 0,0.13531 -0.0902,0.21907 -0.0838,0.0773 -0.21907,0.0773 -0.13531,0 -0.21908,-0.0773 -0.0773,-0.0838 -0.0773,-0.21907 0,-0.13531 0.0773,-0.21908 0.0838,-0.0902 0.21908,-0.0902 z"
+         id="path2404" />
+      <path
+         d="m 106.75838,122.54142 q 0.0193,0.625 0.37371,1.00516 0.36083,0.38016 0.96007,0.38016 0.56057,0 1.15336,-0.23196 l 0.0322,0.31573 q -0.57346,0.2384 -1.22424,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47037,-0.46392 -0.47037,-1.19202 0,-0.77965 0.45104,-1.28868 0.45748,-0.51547 1.19203,-0.51547 1.38533,0 1.41754,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28996,-0.30284 -0.76677,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39304,0.7861 z"
+         id="path2406" />
+      <path
+         d="m 113.00202,124.15871 h -0.3866 v -1.86859 q 0,-1.17269 -0.9794,-1.17269 -0.3866,0 -0.70233,0.32861 -0.31572,0.32861 -0.31572,0.71522 v 1.99745 h -0.38661 V 121.678 q 0,-0.28995 -0.0644,-0.81187 h 0.36083 q 0.0644,0.19975 0.0773,0.58635 0.37372,-0.65722 1.10826,-0.65722 1.28868,0 1.28868,1.49486 z"
+         id="path2408" />
+      <path
+         d="m 113.77523,122.47054 q 0,-0.72166 0.39949,-1.19847 0.40593,-0.47681 1.08249,-0.47681 0.81831,0 1.24357,0.69588 v -2.22941 h 0.38661 v 4.09155 q 0,0.57991 0.0258,0.80543 h -0.35439 q -0.0193,-0.2513 -0.0193,-0.57991 -0.45748,0.67011 -1.22424,0.67011 -0.72166,0 -1.13404,-0.49614 -0.40593,-0.50258 -0.40593,-1.28223 z m 1.59152,1.4562 q 0.47681,0 0.80542,-0.30928 0.32861,-0.31572 0.32861,-0.77965 v -0.54769 q 0,-0.49614 -0.3415,-0.83119 -0.33505,-0.3415 -0.83119,-0.3415 -0.56058,0 -0.86342,0.38016 -0.30284,0.38016 -0.30284,0.98584 0,1.44331 1.20492,1.44331 z"
+         id="path2410" />
+      <path
+         d="m 119.15547,123.92674 -0.0387,0.32217 q -1.22424,-0.058 -1.22424,-1.74615 v -3.24103 h 0.3866 v 3.10571 q 0,0.36728 0.0322,0.61857 0.0322,0.25129 0.11598,0.48325 0.0902,0.23197 0.27062,0.34795 0.18042,0.10953 0.45749,0.10953 z"
+         id="path2412" />
+      <path
+         d="m 121.10781,124.15871 q -0.57346,1.28867 -1.52064,1.51419 l -0.0902,-0.30284 q 0.82476,-0.18685 1.25002,-1.32089 0,-0.058 -0.0258,-0.11598 l -1.366,-3.06706 h 0.40593 l 1.23069,2.78999 1.15337,-2.78999 h 0.41237 z"
+         id="path2414" />
+      <path
+         d="m 125.44421,123.54658 q 0.13531,0 0.2384,0.1031 0.1031,0.10309 0.1031,0.2384 0,0.13532 -0.1031,0.23197 -0.10309,0.0966 -0.2384,0.0966 -0.13531,0 -0.23196,-0.0966 -0.0966,-0.0967 -0.0966,-0.23197 0,-0.13531 0.0966,-0.2384 0.0966,-0.1031 0.23196,-0.1031 z"
+         id="path2416" />
+      <path
+         d="m 131.42367,122.95379 q 0,0.59924 -0.45103,0.94718 -0.4446,0.34794 -1.11471,0.34794 -0.76032,0 -1.26935,-0.35438 l 0.15464,-0.32862 q 0.47681,0.36083 1.15337,0.36083 0.50903,0 0.82475,-0.24484 0.31573,-0.24485 0.31573,-0.69589 0,-0.43815 -0.25129,-0.65723 -0.2513,-0.22551 -0.75388,-0.38016 -1.28868,-0.41882 -1.28868,-1.30156 0,-0.54125 0.41238,-0.85697 0.41238,-0.32217 1.01805,-0.32217 0.64434,0 1.05672,0.24485 -0.0129,0.0258 -0.0773,0.14175 -0.058,0.10954 -0.0838,0.16109 -0.41882,-0.22552 -0.90208,-0.22552 -0.45104,0 -0.74743,0.21263 -0.28995,0.21263 -0.28995,0.59924 0,0.63789 0.99872,0.98583 0.32217,0.11599 0.51547,0.21264 0.19975,0.0902 0.39949,0.24484 0.19975,0.15465 0.28995,0.38016 0.0902,0.22552 0.0902,0.52836 z"
+         id="path2418" />
+      <path
+         d="m 132.38373,122.54142 q 0.0193,0.625 0.37372,1.00516 0.36083,0.38016 0.96006,0.38016 0.56058,0 1.15337,-0.23196 l 0.0322,0.31573 q -0.57347,0.2384 -1.22425,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47036,-0.46392 -0.47036,-1.19202 0,-0.77965 0.45103,-1.28868 0.45749,-0.51547 1.19203,-0.51547 1.38533,0 1.41755,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28995,-0.30284 -0.76676,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39305,0.7861 z"
+         id="path2420" />
+      <path
+         d="m 137.3387,121.11743 q -0.61212,0 -0.97295,0.3866 -0.36083,0.3866 -0.36083,1.01806 0,0.625 0.36727,1.01805 0.36727,0.3866 0.96651,0.3866 0.54124,0 0.90207,-0.23196 l 0.13531,0.31573 q -0.42526,0.2384 -1.01805,0.2384 -0.79898,0 -1.26935,-0.46392 -0.47037,-0.47037 -0.47037,-1.2629 0,-0.79254 0.47037,-1.25647 0.47037,-0.47036 1.26935,-0.47036 0.59923,0 1.01805,0.23196 l -0.13531,0.32217 q -0.36083,-0.23196 -0.90207,-0.23196 z"
+         id="path2422" />
+      <path
+         d="m 141.99727,124.14582 -0.36083,0.0838 q -0.11598,-0.32861 -0.15464,-0.64434 -0.4317,0.66367 -1.23713,0.66367 -1.18558,0 -1.18558,-1.53352 v -1.84926 h 0.3866 v 1.77838 q 0,1.28223 0.88275,1.28223 0.45748,0 0.78609,-0.30928 0.32861,-0.31572 0.32861,-0.76032 v -1.99101 h 0.38661 v 2.48715 q 0,0.34795 0.16752,0.79254 z"
+         id="path2424" />
+      <path
+         d="m 144.34911,121.13031 q -0.0387,-0.0129 -0.11598,-0.0129 -0.42526,0 -0.72166,0.34794 -0.28995,0.3415 -0.28995,0.9214 v 1.77194 h -0.38661 v -2.21653 q 0,-0.7281 -0.0967,-1.07605 h 0.32862 q 0.10309,0.20619 0.10309,0.65723 0.30928,-0.7281 0.99228,-0.7281 0.0902,0 0.18686,0.0193 z"
+         id="path2426" />
+      <path
+         d="m 145.08366,122.54142 q 0.0193,0.625 0.37372,1.00516 0.36083,0.38016 0.96006,0.38016 0.56058,0 1.15337,-0.23196 l 0.0322,0.31573 q -0.57346,0.2384 -1.22424,0.2384 -0.74099,0 -1.21136,-0.45748 -0.47036,-0.46392 -0.47036,-1.19202 0,-0.77965 0.45103,-1.28868 0.45748,-0.51547 1.19203,-0.51547 1.38533,0 1.41755,1.74616 z m 2.2874,-0.32217 q -0.0129,-0.50259 -0.30928,-0.79898 -0.28995,-0.30284 -0.76676,-0.30284 -0.47681,0 -0.79898,0.31572 -0.32217,0.30929 -0.39305,0.7861 z"
+         id="path2428" />
+    </g>
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 223.38329,484.15901 v -9.03246 h 0.58274 0.58274 v 9.03246 9.03245 h -0.58274 -0.58274 z"
+       id="path1834"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 228.43253,488.38386 c -6.4e-4,-2.64417 -0.0579,-5.53584 -0.12713,-6.42592 l -0.12597,-1.61833 0.56419,0.0644 c 0.53405,0.0609 0.56732,0.11883 0.6229,1.08415 0.0323,0.56089 0.12967,1.01979 0.21639,1.01979 0.0867,0 0.38929,-0.33422 0.67238,-0.74271 0.91393,-1.3188 2.66926,-2.00044 4.13506,-1.60574 0.86092,0.23182 2.04111,1.29757 2.40217,2.16924 0.12933,0.31224 0.2901,0.56535 0.35727,0.56248 0.0672,-0.003 0.34006,-0.35837 0.60644,-0.78999 1.62805,-2.638 5.25262,-2.76519 6.73464,-0.23631 0.85471,1.45845 1.03015,2.6805 1.03347,7.19885 l 0.003,4.12773 h -0.58274 -0.58274 v -3.85841 c 0,-4.04906 -0.16272,-5.48953 -0.74837,-6.62489 -0.97524,-1.89066 -3.35323,-2.11305 -4.92303,-0.4604 -1.03875,1.09356 -1.12722,1.60138 -1.12722,6.4698 v 4.4739 h -0.56535 -0.56534 l -0.0723,-4.8076 c -0.0781,-5.19309 -0.16625,-5.68505 -1.188,-6.62687 -0.5343,-0.49249 -1.87288,-0.75083 -2.74992,-0.53071 -0.72522,0.18202 -2.04937,1.44652 -2.46084,2.34999 -0.30871,0.67784 -0.35441,1.34084 -0.35813,5.19609 l -0.004,4.4191 h -0.58274 -0.58274 z"
+       id="path1836"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 249.39406,488.57811 c -0.01,-2.53734 -0.0756,-5.42192 -0.14569,-6.41017 l -0.12744,-1.79683 0.53048,5e-5 c 0.57465,5e-5 0.68172,0.2256 0.77747,1.63776 l 0.0518,0.76361 0.5691,-0.82445 c 1.00313,-1.45322 2.80602,-2.19608 4.33232,-1.78509 0.80947,0.21797 1.99805,1.32577 2.42291,2.25823 0.11908,0.26135 0.26804,0.47242 0.33102,0.46905 0.063,-0.003 0.34597,-0.38783 0.62888,-0.85432 0.7501,-1.23686 2.06363,-1.95451 3.57903,-1.95541 1.33872,-8e-4 2.22364,0.46503 2.97983,1.56862 0.89814,1.31075 1.04718,2.23303 1.13543,7.02607 l 0.0831,4.51623 h -0.60091 -0.60092 l -0.006,-3.44787 c -0.007,-4.03899 -0.2174,-5.95631 -0.77305,-7.04547 -1.0695,-2.09639 -3.90894,-2.05963 -5.38561,0.0697 l -0.53685,0.77414 -0.0581,4.82474 -0.0581,4.82474 h -0.54937 -0.54937 l -0.0848,-4.71047 c -0.0769,-4.27252 -0.12307,-4.79578 -0.49627,-5.62796 -1.17692,-2.62436 -4.42294,-2.20832 -5.94644,0.76215 -0.26842,0.52335 -0.31884,1.32971 -0.31884,5.09897 v 4.47731 h -0.58274 -0.58274 z"
+       id="path1838"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.194246;stroke-linejoin:bevel"
+       d="m 273.01323,493.28817 c -0.42734,-0.15111 -1.05549,-0.57696 -1.3959,-0.94634 -1.08415,-1.17645 -1.27314,-2.18958 -1.37243,-7.35728 l -0.0886,-4.61335 h 0.60294 0.60294 l 0.003,3.15651 c 0.004,3.91414 0.25019,6.36807 0.73168,7.3013 1.13174,2.19355 4.30257,2.12242 5.93754,-0.1332 l 0.61157,-0.84373 0.0582,-4.74044 0.0582,-4.74044 h 0.67021 0.67021 l 0.005,5.48746 c 0.003,3.0181 0.0937,5.87338 0.20243,6.34505 0.15249,0.66158 0.14031,0.89461 -0.0533,1.01955 -0.55281,0.35673 -0.83165,0.0557 -1.09962,-1.18733 -0.24582,-1.14025 -0.29208,-1.21548 -0.53608,-0.87175 -1.45497,2.04964 -3.5618,2.84756 -5.60816,2.12399 z"
+       id="path1840"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 287.30474,493.62291 c -0.5234,-0.0325 -0.99929,-0.2067 -1.39355,-0.51007 -0.0711,-0.0547 -0.21266,-0.18756 -0.31455,-0.2952 -0.51237,-0.54129 -0.84906,-1.32221 -1.01656,-2.35786 l -0.0518,-0.32009 -0.007,-4.39554 -0.007,-4.39554 h -1.17681 -1.17681 v -0.56016 -0.56016 h 1.17748 1.17748 v -1.94931 -1.9493 l 0.67458,-0.33706 c 0.37102,-0.18538 0.67968,-0.33706 0.68591,-0.33706 0.006,0 0.0113,1.02886 0.0113,2.28637 v 2.28636 h 1.88625 1.88625 v 0.56016 0.56016 h -1.88681 -1.8868 l 0.007,4.42983 c 0.008,4.76198 0.003,4.54099 0.11952,5.05219 0.16032,0.70049 0.47404,1.17713 0.91502,1.3902 0.25035,0.12096 0.40253,0.14734 0.85223,0.14773 0.56364,4.8e-4 1.01334,-0.0544 1.32518,-0.16168 0.0702,-0.0241 0.13023,-0.0412 0.13351,-0.0379 0.003,0.003 0.0357,0.2528 0.072,0.5545 l 0.066,0.54854 -0.0472,0.0278 c -0.0785,0.0463 -0.33404,0.13919 -0.51588,0.18759 -0.42382,0.11279 -1.01712,0.16607 -1.509,0.13551 z"
+       id="path1842"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 294.5861,493.62213 c -1.33382,-0.0703 -2.53644,-0.82061 -3.09275,-1.92964 -0.24094,-0.48033 -0.34819,-0.94143 -0.36461,-1.5675 -0.0163,-0.62035 0.0506,-1.12228 0.21568,-1.62005 0.34649,-1.04458 1.07298,-1.83524 2.204,-2.3987 1.19263,-0.59414 2.78564,-0.91132 4.79719,-0.95516 l 0.64935,-0.0142 -0.0145,-0.368 c -0.0763,-1.94209 -0.90557,-3.17288 -2.34847,-3.4855 -0.11953,-0.0259 -0.35827,-0.0588 -0.53054,-0.0732 -0.83261,-0.0693 -2.06866,0.17313 -3.73081,0.73187 -0.18772,0.0631 -0.34391,0.11214 -0.34708,0.10897 -0.003,-0.003 -0.0374,-0.29372 -0.0761,-0.64564 -0.0386,-0.35192 -0.0755,-0.67149 -0.0819,-0.71015 l -0.0116,-0.0703 0.37182,-0.11744 c 1.20391,-0.38027 2.32736,-0.55784 3.54986,-0.5611 0.7727,-0.002 1.23902,0.0602 1.77856,0.23734 1.46594,0.48137 2.35205,1.64256 2.66841,3.49679 0.12045,0.70598 0.11904,0.66437 0.1383,4.08126 0.01,1.7605 0.0238,3.23692 0.0308,3.28093 0.007,0.044 0.0291,0.23435 0.0491,0.42298 0.0465,0.43878 0.14592,1.02673 0.2474,1.4631 0.0438,0.18852 0.0764,0.34605 0.0724,0.35005 -0.01,0.01 -1.16361,0.2786 -1.16815,0.2723 -0.002,-0.003 -0.10844,-0.46785 -0.23669,-1.03372 -0.12825,-0.56588 -0.23848,-1.0443 -0.24496,-1.06316 -0.009,-0.0258 -0.0241,-0.0174 -0.0616,0.0341 -0.24974,0.34282 -0.61859,0.73947 -0.92993,1.00003 -0.98835,0.82713 -2.1679,1.2056 -3.53328,1.13367 z m 0.93086,-1.28687 c 0.65714,-0.0991 1.29513,-0.35128 1.90495,-0.7531 0.81304,-0.53573 1.28846,-1.12731 1.48996,-1.85402 l 0.0634,-0.22864 0.008,-1.55251 0.008,-1.55252 -0.63565,0.0142 c -3.56014,0.0798 -5.51289,1.02626 -5.8264,2.82409 -0.0446,0.25589 -0.0441,0.85092 10e-4,1.11538 0.18522,1.08602 0.8607,1.80366 1.87004,1.98675 0.22689,0.0412 0.84543,0.0413 1.1175,3.3e-4 z"
+       id="path1844"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 309.32244,493.62288 c -0.96944,-0.0469 -1.85038,-0.37861 -2.65218,-0.99851 -0.41295,-0.31926 -0.94289,-0.9117 -1.28908,-1.44113 l -0.1399,-0.21394 -0.005,0.14535 c -0.003,0.0799 -0.0158,0.50031 -0.0286,0.93415 -0.0128,0.43384 -0.03,0.88911 -0.0382,1.01172 l -0.0148,0.22292 h -0.62644 -0.62644 l 0.0136,-0.13147 c 0.0609,-0.58676 0.0652,-1.17336 0.0733,-10.07144 l 0.008,-9.2312 h 0.68506 0.68507 l 7.2e-4,4.42983 c 5.8e-4,3.48836 0.007,4.42158 0.0286,4.39101 0.0153,-0.0214 0.0947,-0.14835 0.17647,-0.28221 0.23909,-0.39153 0.48968,-0.7084 0.83324,-1.05364 0.79409,-0.79798 1.61045,-1.19749 2.77922,-1.36008 0.2959,-0.0412 1.07923,-0.0347 1.40611,0.0117 1.32147,0.18728 2.34057,0.79358 3.15682,1.87808 0.76131,1.0115 1.19388,2.16861 1.36296,3.64582 0.0403,0.35233 0.0407,1.83298 6e-4,2.20634 -0.11974,1.1141 -0.37776,2.05613 -0.79532,2.90368 -1.03324,2.09723 -2.72255,3.11307 -4.99399,3.00306 z m 0.86193,-1.2892 c 1.76169,-0.22995 2.85867,-1.28108 3.34269,-3.20299 0.30067,-1.19391 0.35369,-2.89198 0.12825,-4.108 -0.29692,-1.60162 -1.09958,-2.84593 -2.19579,-3.40403 -0.57991,-0.29523 -1.09671,-0.4111 -1.83985,-0.41248 -0.63377,-0.001 -1.01616,0.0697 -1.55843,0.28899 -0.58207,0.23535 -1.2143,0.72589 -1.6676,1.29385 -0.44764,0.56087 -0.77863,1.27537 -0.92145,1.98914 -0.0992,0.49576 -0.10972,0.74403 -0.0998,2.35496 0.0101,1.63879 0.0104,1.64172 0.15709,2.19491 0.35782,1.34881 1.39583,2.46469 2.66595,2.86592 0.16235,0.0513 0.55199,0.13409 0.74972,0.15934 0.19748,0.0252 0.99214,0.0126 1.23918,-0.0196 z"
+       id="path1846"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 321.87459,493.58992 c -0.8696,-0.12637 -1.59301,-0.47045 -2.17909,-1.03646 -1.03984,-1.00425 -1.58419,-2.59401 -1.70723,-4.98593 -0.0142,-0.27698 -0.023,-2.95931 -0.0231,-7.08202 l -2.2e-4,-6.63618 h 0.68513 0.68513 l 0.009,6.87625 c 0.009,7.02584 0.008,7.00928 0.0967,7.81365 0.10578,0.96416 0.35005,1.9335 0.62093,2.46402 0.44664,0.87476 1.13121,1.30724 2.15714,1.36279 l 0.26385,0.0143 -0.0674,0.62303 -0.0674,0.62304 -0.12782,-0.002 c -0.0703,-0.001 -0.22557,-0.0167 -0.34503,-0.034 z"
+       id="path1848"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 329.71682,493.62332 c -0.82899,-0.0372 -1.61396,-0.23055 -2.30398,-0.56754 -0.37825,-0.18472 -0.54944,-0.28931 -0.89693,-0.54795 -1.01662,-0.7567 -1.78269,-1.89329 -2.17055,-3.22039 -0.0777,-0.26591 -0.16487,-0.69455 -0.21981,-1.08101 -0.0576,-0.40513 -0.0709,-1.55129 -0.0238,-2.04475 0.11581,-1.21225 0.35793,-2.09011 0.8324,-3.01808 0.61749,-1.20767 1.53413,-2.14784 2.59917,-2.66589 0.77538,-0.37715 1.4905,-0.53207 2.44641,-0.52996 0.56508,0.001 0.9552,0.047 1.4181,0.16637 1.6679,0.43005 2.77783,1.70533 3.2916,3.78196 0.19164,0.7746 0.29118,1.5435 0.34432,2.65973 l 0.0144,0.30294 h -4.81566 -4.81566 l 0.0115,0.1086 c 0.006,0.0597 0.0176,0.21149 0.025,0.33724 0.0636,1.07931 0.381,2.14843 0.87454,2.9463 0.31378,0.50727 0.79874,1.03354 1.23804,1.3435 0.55763,0.39346 1.23414,0.64767 1.97432,0.74188 0.37368,0.0476 1.35758,0.0353 1.79434,-0.0224 0.9694,-0.12807 2.04082,-0.42013 2.89393,-0.78886 0.0608,-0.0263 0.11819,-0.0478 0.1276,-0.0478 0.0179,0 0.13106,1.20581 0.11442,1.21964 -0.005,0.004 -0.11245,0.0518 -0.2382,0.10527 -1.16468,0.49571 -2.41589,0.77766 -3.61246,0.81404 -0.21378,0.007 -0.42469,0.0143 -0.46871,0.0174 -0.044,0.003 -0.23949,-0.002 -0.43441,-0.0103 z m 3.95534,-8.11924 c -2.5e-4,-0.30965 -0.0819,-0.91311 -0.17265,-1.27644 -0.21244,-0.85027 -0.58191,-1.49481 -1.19286,-2.08098 -0.59602,-0.57184 -1.29064,-0.86751 -2.19852,-0.93583 -1.41629,-0.10657 -2.61061,0.44344 -3.51878,1.62047 -0.52227,0.67689 -0.89262,1.54618 -1.04384,2.45013 -0.02,0.11931 -0.0415,0.24008 -0.0478,0.26838 l -0.0115,0.0514 h 4.09303 4.09303 l -7e-5,-0.0972 z"
+       id="path1850"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 358.63935,484.12654 v -9.15689 h 4.68705 4.68705 v 0.62875 0.62875 h -4.00114 -4.00114 v 3.49814 3.49814 h 3.72678 3.72678 v 0.62875 0.62875 h -3.72678 -3.72678 v 4.40126 4.40125 h -0.68591 -0.68591 z"
+       id="path1852"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 370.77972,488.3849 c -2.5e-4,-5.30842 -0.0101,-5.84482 -0.12715,-6.89911 -0.0383,-0.34527 -0.13012,-0.92558 -0.17819,-1.12641 l -0.0315,-0.13185 0.58559,0.006 0.58559,0.006 0.0735,0.21721 c 0.15373,0.45451 0.2441,1.0906 0.27609,1.94333 l 0.0167,0.44577 0.11057,-0.26286 c 0.36692,-0.87227 0.86854,-1.56026 1.46921,-2.01506 0.22423,-0.16978 0.70767,-0.41064 0.98068,-0.48859 0.44934,-0.1283 1.03347,-0.17067 1.45783,-0.10575 l 0.20005,0.0306 v 0.61599 0.61599 l -0.0857,-0.0182 c -0.13914,-0.0295 -0.64614,-0.0138 -0.8626,0.0268 -0.61492,0.11523 -1.11795,0.37837 -1.59623,0.83501 -0.69911,0.66749 -1.13847,1.50376 -1.35187,2.57318 -0.14099,0.70651 -0.13497,0.50782 -0.144,4.74916 l -0.008,3.88111 h -0.68498 -0.68498 z"
+       id="path1854"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 378.32496,486.75587 v -6.52758 h 0.67448 0.67448 v 6.52758 6.52757 h -0.67448 -0.67448 z"
+       id="path1856"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 388.12204,493.62228 c -1.25745,-0.0534 -2.37679,-0.45935 -3.33031,-1.20766 -0.24611,-0.19314 -0.70076,-0.64519 -0.89683,-0.89168 -1.00908,-1.26862 -1.47423,-2.80387 -1.42354,-4.69848 0.0143,-0.53323 0.0346,-0.79039 0.0969,-1.22321 0.23095,-1.60525 0.88593,-2.99875 1.90618,-4.05551 0.84662,-0.87693 1.87353,-1.39202 3.11031,-1.5601 0.38666,-0.0525 1.16134,-0.0519 1.56251,0.001 2.18606,0.29027 3.51464,1.7209 4.04732,4.35822 0.13263,0.65663 0.24325,1.71374 0.24325,2.32446 v 0.18901 h -4.80137 -4.80136 l 4.6e-4,0.1429 c 6.4e-4,0.19414 0.0574,0.76627 0.10322,1.03965 0.36981,2.20844 1.63422,3.74849 3.43951,4.18933 0.48183,0.11766 0.80028,0.14581 1.48681,0.13141 1.20975,-0.0254 2.2518,-0.2443 3.51863,-0.73929 0.20618,-0.0806 0.37851,-0.14284 0.38295,-0.1384 0.0189,0.0189 0.11827,1.19481 0.10234,1.21087 -0.0372,0.0375 -0.75552,0.31882 -1.09377,0.42834 -1.19108,0.38565 -2.40723,0.55167 -3.65322,0.49872 z m 3.93653,-8.32397 c -0.0603,-1.26072 -0.4967,-2.31101 -1.28476,-3.09231 -0.61702,-0.61174 -1.3169,-0.92024 -2.25737,-0.99504 -0.82674,-0.0657 -1.6698,0.12102 -2.31532,0.51292 -0.68961,0.41867 -1.32032,1.12589 -1.72724,1.93675 -0.26734,0.53273 -0.48183,1.23016 -0.56034,1.82199 l -0.0157,0.11863 h 4.08763 4.08763 z"
+       id="path1858"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 396.33573,487.92763 c -0.007,-4.85115 -0.0113,-5.40106 -0.0474,-5.83595 -0.0419,-0.50482 -0.14345,-1.56986 -0.16734,-1.75479 l -0.014,-0.1086 h 0.64122 0.64123 l 0.0468,0.20006 c 0.0992,0.42383 0.17468,1.04371 0.20039,1.64553 0.0218,0.50978 0.0231,0.51241 0.14388,0.29078 0.59123,-1.08475 1.43569,-1.84809 2.4257,-2.19269 1.10461,-0.38449 2.66603,-0.27883 3.70071,0.25042 0.8891,0.45479 1.5357,1.23968 1.9221,2.3332 0.1634,0.46242 0.3086,1.13494 0.37746,1.74821 0.0675,0.60122 0.0799,1.38673 0.0803,5.07001 l 3.9e-4,3.70963 h -0.68487 -0.68486 l -0.009,-4.08688 c -0.009,-4.35633 -0.007,-4.24692 -0.11966,-4.90345 -0.28126,-1.6339 -1.06832,-2.63359 -2.33622,-2.96739 -0.50206,-0.13217 -1.2151,-0.16247 -1.65293,-0.0702 -0.60486,0.12742 -1.12382,0.4215 -1.65451,0.9376 -0.72158,0.70173 -1.17829,1.50047 -1.36742,2.39144 l -0.0532,0.25081 -0.006,4.22406 -0.006,4.22406 h -0.68464 -0.68464 z"
+       id="path1860"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 414.26664,493.62294 c -1.83788,-0.0825 -3.26746,-1.00338 -4.2008,-2.70589 -0.3807,-0.69442 -0.68091,-1.57878 -0.82789,-2.43875 -0.32417,-1.89678 -0.14434,-3.83422 0.49126,-5.29275 0.72289,-1.65881 1.92778,-2.75033 3.42854,-3.10596 0.98187,-0.23267 2.13233,-0.17008 3.02943,0.16481 0.9147,0.34146 1.69547,0.97787 2.32066,1.89159 0.088,0.12864 0.2012,0.30739 0.2515,0.39721 0.0503,0.0898 0.0992,0.16355 0.10861,0.16384 0.009,2.9e-4 0.0171,-1.99033 0.0171,-4.42359 v -4.42412 h 0.68591 0.68591 l 5e-5,8.92254 c 5e-5,8.49944 0.007,9.65931 0.0654,10.32295 l 0.0165,0.18862 h -0.62082 -0.62083 l -0.014,-0.12003 c -0.0166,-0.14264 -0.0605,-1.34328 -0.0674,-1.84624 l -0.005,-0.35439 -0.11162,0.17148 c -0.3375,0.51847 -0.89762,1.15186 -1.29751,1.46724 -0.83405,0.65779 -1.75585,0.99446 -2.82064,1.03019 -0.1006,0.003 -0.3321,-5.6e-4 -0.51443,-0.009 z m 1.3558,-1.32012 c 0.35926,-0.0732 0.62876,-0.16658 0.96486,-0.33421 0.37422,-0.18665 0.66148,-0.3911 0.97956,-0.69717 0.53286,-0.51277 0.9243,-1.15698 1.12209,-1.84669 0.17991,-0.62736 0.20239,-0.94624 0.18986,-2.69281 -0.0111,-1.54266 -0.0188,-1.64719 -0.16426,-2.21467 -0.22385,-0.8734 -0.6468,-1.57951 -1.34393,-2.24368 -0.60411,-0.57555 -1.26473,-0.90366 -2.07518,-1.0307 -0.31902,-0.05 -0.99883,-0.0499 -1.32396,3e-4 -0.46296,0.0714 -0.93142,0.22332 -1.26637,0.41064 -1.12396,0.62855 -1.91578,1.9733 -2.16607,3.67865 -0.15488,1.05527 -0.10279,2.50934 0.12831,3.58196 0.36088,1.67489 1.20542,2.76253 2.49248,3.20992 0.54115,0.18811 0.93885,0.24428 1.66696,0.23545 0.45707,-0.006 0.58998,-0.0151 0.79565,-0.057 z"
+       id="path1862"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 427.79049,493.5892 c -1.40617,-0.21864 -2.4022,-0.95029 -3.05109,-2.24123 -0.40773,-0.81115 -0.64172,-1.72903 -0.79471,-3.1174 -0.0358,-0.3249 -0.0396,-0.93786 -0.0463,-7.36781 l -0.007,-7.01343 h 0.67359 0.6736 l 0.009,6.70477 c 0.01,6.82326 0.0118,7.00237 0.0974,7.84795 0.12779,1.26122 0.41372,2.29884 0.79658,2.89067 0.13134,0.20304 0.44038,0.52728 0.61719,0.64753 0.38213,0.25992 0.95533,0.42813 1.46027,0.42851 0.12463,9e-5 0.1772,0.008 0.1772,0.0282 0,0.0501 -0.11612,1.12498 -0.12726,1.17801 -0.01,0.0465 -0.0234,0.0512 -0.14183,0.0489 -0.0721,-0.001 -0.22363,-0.017 -0.3368,-0.0346 z"
+       id="path1864"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 429.95866,499.23186 c -0.008,-0.0336 -0.0795,-0.29767 -0.15796,-0.58689 -0.0785,-0.28923 -0.14107,-0.52669 -0.13906,-0.52769 0.002,-10e-4 0.1333,-0.0436 0.29174,-0.0947 1.13222,-0.36509 2.10503,-1.1714 2.90787,-2.41017 0.43294,-0.66802 0.86412,-1.56618 1.19488,-2.489 0.0949,-0.26487 0.10313,-0.37893 0.0425,-0.59175 -0.0193,-0.0677 -1.09304,-2.74786 -2.38612,-5.95598 -1.29307,-3.20811 -2.39757,-5.94868 -2.45443,-6.09015 l -0.10338,-0.25722 h 0.71428 0.71428 l 1.18482,2.96656 c 0.65166,1.63161 1.64529,4.11889 2.20807,5.52729 0.56279,1.4084 1.032,2.55843 1.0427,2.55562 0.0107,-0.003 0.94775,-2.4864 2.08233,-5.5191 1.13458,-3.0327 2.06671,-5.51783 2.07139,-5.52251 0.005,-0.005 0.33206,-0.006 0.72749,-0.002 l 0.71899,0.006 -1.49381,3.74964 c -3.35876,8.43093 -3.81479,9.57116 -3.95489,9.88854 -1.3015,2.94837 -2.97284,4.73642 -5.00775,5.35742 l -0.18866,0.0576 z"
+       id="path1866"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 466.4758,493.62314 c -1.45181,-0.0518 -2.74209,-0.444 -3.79537,-1.15362 -0.13832,-0.0932 -0.27004,-0.18378 -0.29271,-0.20131 -0.0388,-0.03 -0.0255,-0.0688 0.22467,-0.65706 0.14623,-0.34386 0.26967,-0.62899 0.27431,-0.63362 0.005,-0.005 0.10416,0.0634 0.22117,0.1512 0.67232,0.50442 1.34476,0.82699 2.15829,1.03532 0.54738,0.14018 0.89369,0.18432 1.55671,0.19842 0.63362,0.0135 0.92514,-0.007 1.3677,-0.0968 1.32858,-0.26911 2.35262,-1.09378 2.72806,-2.19693 0.18459,-0.54239 0.26064,-1.19762 0.2121,-1.82751 -0.0878,-1.1388 -0.41159,-1.84567 -1.11432,-2.4323 -0.61331,-0.51197 -1.2819,-0.86992 -2.3653,-1.26634 -1.26557,-0.46308 -2.05129,-0.86777 -2.82085,-1.4529 -0.28325,-0.21536 -0.82457,-0.75065 -1.01574,-1.00442 -0.65231,-0.86591 -0.952,-1.83625 -0.90894,-2.94301 0.0533,-1.37071 0.52091,-2.37763 1.48963,-3.20783 0.644,-0.55192 1.4352,-0.94552 2.25611,-1.12235 0.46021,-0.0991 0.66417,-0.12051 1.26489,-0.13258 1.07258,-0.0215 1.99133,0.11405 2.81436,0.41535 0.24038,0.088 0.79477,0.35451 0.974,0.46822 l 0.1073,0.0681 -0.2759,0.56664 c -0.15175,0.31165 -0.28315,0.57464 -0.292,0.58442 -0.009,0.01 -0.10274,-0.0303 -0.20865,-0.089 -0.72347,-0.40119 -1.56973,-0.65953 -2.43295,-0.74271 -0.35408,-0.0341 -1.16128,-0.0144 -1.45209,0.0356 -0.86066,0.14772 -1.5369,0.47184 -2.04917,0.98215 -0.42088,0.41927 -0.65249,0.86296 -0.77831,1.491 -0.0586,0.2927 -0.0587,1.06224 -1.6e-4,1.33409 0.19406,0.90065 0.66802,1.58854 1.54586,2.24356 0.50705,0.37834 1.11699,0.69785 2.07057,1.08465 1.7404,0.70595 2.67043,1.24813 3.40775,1.98661 0.43957,0.44027 0.68634,0.84041 0.87774,1.42329 0.21093,0.64235 0.28583,1.22039 0.26905,2.07638 -0.0123,0.62679 -0.0378,0.85377 -0.1452,1.2918 -0.28152,1.14819 -0.97439,2.0959 -2.04295,2.79439 -1.06152,0.69388 -2.2618,0.98509 -3.82966,0.92913 z"
+       id="path1868"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 480.25115,493.62391 c -1.76943,-0.0824 -3.28993,-0.87015 -4.32828,-2.24257 -0.2674,-0.35344 -0.42444,-0.60902 -0.62244,-1.01302 -0.33343,-0.68033 -0.52948,-1.35217 -0.64384,-2.20634 -0.0591,-0.44104 -0.0584,-1.736 0.001,-2.22921 0.1851,-1.53321 0.63888,-2.7246 1.44812,-3.802 0.22897,-0.30485 0.71268,-0.81249 0.97864,-1.02706 0.75983,-0.61301 1.63095,-0.98187 2.64075,-1.11816 0.34389,-0.0464 1.1342,-0.0519 1.47471,-0.0103 1.60517,0.19621 2.76041,0.99424 3.47192,2.39837 0.53771,1.06112 0.81782,2.35304 0.89687,4.13649 l 0.0155,0.34867 h -4.81007 -4.81008 l 0.0166,0.31284 c 0.1063,2.00432 0.90234,3.6062 2.23549,4.49853 0.52294,0.35002 1.20005,0.58817 1.92006,0.67532 0.251,0.0304 1.0811,0.03 1.41814,-6e-4 1.00947,-0.0917 2.10982,-0.3665 3.10524,-0.77539 0.12971,-0.0533 0.23905,-0.0933 0.24296,-0.0888 0.004,0.004 0.0321,0.27911 0.0627,0.61042 l 0.0556,0.60239 -0.1271,0.0563 c -1.16017,0.51427 -2.50008,0.82649 -3.7167,0.86607 -0.2012,0.007 -0.41211,0.0147 -0.4687,0.0182 -0.0566,0.003 -0.26236,-10e-4 -0.45728,-0.0102 z m 3.95517,-8.15413 c -3.8e-4,-0.20384 -0.0628,-0.7459 -0.11648,-1.01171 -0.19744,-0.97746 -0.63711,-1.77073 -1.32584,-2.39213 -0.6974,-0.62923 -1.67691,-0.93541 -2.73725,-0.85562 -0.56747,0.0427 -0.96231,0.14731 -1.43321,0.37975 -0.40065,0.19776 -0.67408,0.39776 -1.02924,0.75282 -0.60261,0.60243 -0.9847,1.22701 -1.25817,2.05663 -0.11691,0.35465 -0.26189,0.97972 -0.26189,1.12908 v 0.0727 h 4.08116 4.08117 l -2.5e-4,-0.13147 z"
+       id="path1870"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 493.46635,493.62321 c -2.04371,-0.0792 -3.6873,-0.97429 -4.73803,-2.58041 -0.19454,-0.29736 -0.48014,-0.86462 -0.60714,-1.20589 -0.36186,-0.97241 -0.53611,-2.1313 -0.49935,-3.32111 0.0624,-2.02032 0.59394,-3.50094 1.69299,-4.71605 0.80338,-0.88822 1.84034,-1.47099 3.05407,-1.71638 1.36434,-0.27584 3.03495,-0.14656 4.22978,0.32732 0.23352,0.0926 0.69485,0.31495 0.8358,0.4028 l 0.0699,0.0435 -0.23456,0.61435 c -0.12902,0.33789 -0.23782,0.6176 -0.24179,0.62157 -0.004,0.004 -0.079,-0.0396 -0.16683,-0.0969 -0.23026,-0.15027 -0.71251,-0.37932 -1.01699,-0.48303 -1.18521,-0.40372 -2.66961,-0.4219 -3.74881,-0.0459 -1.39343,0.48545 -2.47138,1.75971 -2.89099,3.41748 -0.15698,0.62019 -0.2079,1.09369 -0.20616,1.91704 0.002,0.71863 0.0298,1.03925 0.13792,1.56474 0.41693,2.02586 1.72207,3.48002 3.48881,3.88718 0.68218,0.15721 1.7335,0.15662 2.52189,-10e-4 0.63562,-0.12742 1.28939,-0.38719 1.73463,-0.68923 0.10289,-0.0698 0.13852,-0.084 0.15283,-0.0608 0.0491,0.0794 0.45768,1.17263 0.44786,1.19824 -0.019,0.0494 -0.83248,0.43882 -1.12355,0.53787 -0.91263,0.31054 -1.79248,0.42769 -2.89225,0.38508 z"
+       id="path1872"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 503.93791,493.62356 c -2.07746,-0.096 -3.36279,-1.42647 -3.78398,-3.91681 -0.16081,-0.95079 -0.17097,-1.28755 -0.17122,-5.67738 l -2.2e-4,-3.80108 h 0.6849 0.6849 l 0.009,3.99543 c 0.01,4.29399 0.006,4.17411 0.12928,4.93283 0.20902,1.29048 0.65545,2.18782 1.34885,2.71126 0.22059,0.16652 0.57424,0.33239 0.88637,0.41571 0.26636,0.0711 0.27564,0.0719 0.81814,0.0723 0.60452,3.7e-4 0.79632,-0.0264 1.23464,-0.17254 0.98027,-0.32675 1.85898,-1.11843 2.34438,-2.11214 0.22207,-0.45462 0.35237,-0.91771 0.40987,-1.45666 0.0154,-0.14456 0.0237,-1.64625 0.0237,-4.30408 v -4.08207 h 0.68539 0.68539 l 0.007,5.25293 c 0.007,4.8294 0.0106,5.27483 0.0469,5.52463 0.09,0.61989 0.24915,1.3115 0.43807,1.90345 0.0554,0.17357 0.0987,0.31745 0.0962,0.31975 -0.002,0.002 -0.27202,0.0726 -0.59897,0.15629 -0.32695,0.0837 -0.61099,0.15692 -0.63119,0.16279 -0.0837,0.0243 -0.40863,-1.27913 -0.53383,-2.14145 -0.0314,-0.2163 -0.0614,-0.39756 -0.0666,-0.4028 -0.005,-0.005 -0.0427,0.0484 -0.0832,0.11926 -0.19471,0.34032 -0.67239,0.94143 -0.95894,1.20673 -0.73586,0.68127 -1.55316,1.08244 -2.52759,1.24065 -0.29945,0.0486 -0.79251,0.0708 -1.17747,0.053 z"
+       id="path1874"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 513.56348,488.56781 c -3e-5,-5.43156 -0.016,-6.15699 -0.16068,-7.29922 -0.0428,-0.33756 -0.14488,-0.93016 -0.17285,-1.00305 -0.013,-0.0338 0.0394,-0.0372 0.56954,-0.0372 h 0.58382 l 0.0498,0.13147 c 0.0757,0.19985 0.17257,0.60415 0.21498,0.8974 0.0351,0.24236 0.0545,0.49597 0.0991,1.29179 l 0.0167,0.29723 0.0661,-0.17148 c 0.10456,-0.27115 0.39165,-0.82502 0.56014,-1.08066 0.60146,-0.91256 1.36468,-1.43844 2.33457,-1.60862 0.26524,-0.0465 0.87847,-0.0489 1.09746,-0.004 l 0.14861,0.0303 0.006,0.61334 0.006,0.61333 -0.0633,-0.0124 c -0.26434,-0.0519 -0.73294,-0.0272 -1.07303,0.0566 -0.79128,0.19479 -1.48057,0.7114 -2.0224,1.51578 -0.37454,0.556 -0.62369,1.1928 -0.76406,1.95278 -0.12391,0.67092 -0.12487,0.70772 -0.12487,4.77523 v 3.7574 h -0.68591 -0.68591 l -3e-5,-4.71563 z"
+       id="path1876"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0228637;stroke-linejoin:bevel"
+       d="m 525.93275,493.62391 c -1.65452,-0.0715 -3.07447,-0.7456 -4.11474,-1.9535 -0.83427,-0.9687 -1.30115,-2.06319 -1.50149,-3.51986 -0.0581,-0.42251 -0.0589,-1.70686 -10e-4,-2.18348 0.0779,-0.64501 0.16884,-1.09602 0.32509,-1.61225 0.51873,-1.71385 1.6463,-3.14863 3.02432,-3.84831 0.84066,-0.42683 1.82792,-0.61855 2.85487,-0.55438 1.07584,0.0672 1.89386,0.35168 2.60276,0.90508 0.20635,0.16109 0.56637,0.52552 0.72259,0.73147 0.72056,0.94989 1.15786,2.26485 1.32302,3.97828 0.0318,0.32999 0.0691,0.94289 0.0692,1.13746 l 8e-5,0.15433 h -4.80491 -4.80491 l 0.0146,0.30473 c 0.0472,0.98364 0.27777,1.91316 0.66744,2.69041 0.2357,0.47015 0.50073,0.85081 0.83361,1.19731 0.63858,0.66471 1.37965,1.06361 2.30458,1.24049 0.26668,0.051 0.39656,0.0617 0.86587,0.0714 0.33057,0.007 0.67463,7.4e-4 0.85739,-0.0151 1.01661,-0.0883 1.99119,-0.32316 3.01133,-0.72583 0.20569,-0.0812 0.37732,-0.14428 0.3814,-0.1402 0.004,0.004 0.0286,0.2439 0.0545,0.53294 0.0259,0.28904 0.0517,0.55935 0.0574,0.60069 0.01,0.0723 0.005,0.0774 -0.11982,0.13367 -1.12856,0.5072 -2.5105,0.82826 -3.73119,0.86686 -0.20749,0.007 -0.41326,0.0145 -0.45728,0.0175 -0.044,0.003 -0.23949,-0.001 -0.4344,-0.01 z m 3.92525,-8.30586 c -0.0373,-0.73639 -0.22124,-1.47872 -0.50762,-2.04889 -0.28846,-0.57429 -0.77842,-1.14091 -1.28138,-1.48185 -0.64227,-0.43537 -1.49807,-0.64373 -2.37308,-0.57777 -0.56959,0.0429 -0.99582,0.15659 -1.46652,0.39103 -0.3711,0.18484 -0.65462,0.39226 -0.98382,0.71975 -0.65559,0.65217 -1.08507,1.38337 -1.34693,2.29315 -0.0801,0.27833 -0.19568,0.82804 -0.19568,0.93077 v 0.057 h 4.08469 4.08469 z"
+       id="path1878"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#ff7f2a;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.00390625;stroke-linejoin:bevel"
+       d="m 346.33008,493.51692 c -0.19105,-0.0158 -0.34947,-0.0666 -0.4961,-0.15884 -0.0726,-0.0457 -0.13623,-0.0975 -0.20933,-0.17041 -0.1413,-0.14094 -0.23085,-0.27268 -0.30043,-0.44196 -0.11571,-0.28148 -0.132,-0.6355 -0.0434,-0.94224 0.0788,-0.27256 0.25714,-0.54021 0.47695,-0.71562 0.25991,-0.20741 0.58983,-0.27683 0.91602,-0.19276 0.13845,0.0357 0.27496,0.10481 0.40429,0.20471 0.0575,0.0444 0.19,0.1766 0.24059,0.24004 0.1757,0.22033 0.27037,0.44545 0.30308,0.72071 0.007,0.0569 0.007,0.25165 0,0.30859 -0.0388,0.32638 -0.16923,0.58254 -0.41682,0.81856 -0.20563,0.19601 -0.44692,0.30676 -0.71433,0.32786 -0.0469,0.004 -0.12443,0.004 -0.16056,0.001 z"
+       id="path2003"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#ff7f2a;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.00692709;stroke-linejoin:bevel"
+       d="m 450.94689,493.51322 c -0.32583,-0.0199 -0.61424,-0.18585 -0.83574,-0.48077 -0.15606,-0.2078 -0.23824,-0.43252 -0.26022,-0.71159 -0.0326,-0.41326 0.11286,-0.81204 0.4093,-1.12247 0.16176,-0.16939 0.36357,-0.28049 0.58322,-0.32108 0.0889,-0.0164 0.2697,-0.0166 0.35975,-3.6e-4 0.24158,0.0436 0.45295,0.16241 0.64304,0.3615 0.25309,0.26509 0.38491,0.56712 0.40054,0.91773 0.0166,0.37248 -0.10928,0.7059 -0.36849,0.97597 -0.26495,0.27604 -0.57497,0.40288 -0.9314,0.38107 z"
+       id="path2005"
+       transform="scale(0.26458333)" />
+    <path
+       style="fill:#5c5f5c;fill-opacity:1;stroke:#5c5f5c;stroke-width:0.0142009;stroke-linejoin:bevel"
+       d="m 378.70973,477.38924 c -0.30862,-0.0605 -0.54776,-0.23712 -0.67364,-0.49739 -0.10967,-0.22674 -0.12982,-0.3282 -0.12944,-0.65164 2.8e-4,-0.24333 0.004,-0.29156 0.0328,-0.39763 0.10884,-0.40416 0.38122,-0.69509 0.74078,-0.79124 0.11521,-0.0308 0.41144,-0.0341 0.52544,-0.006 0.11426,0.0283 0.29411,0.1165 0.38193,0.18723 0.19583,0.15773 0.3649,0.41716 0.42983,0.65955 0.0444,0.16582 0.0446,0.53239 3.3e-4,0.69584 -0.11118,0.41058 -0.39121,0.69673 -0.7709,0.78775 -0.128,0.0307 -0.41275,0.0378 -0.53716,0.0134 z"
+       id="path2161"
+       transform="scale(0.26458333)" />
+  </g>
+  <g
+     inkscape:groupmode="layer"
+     id="layer3"
+     inkscape:label="heading">
+    <g
+       aria-label="Infix"
+       id="text1160"
+       style="font-size:25.4px;font-family:'URW Bookman';-inkscape-font-specification:'URW Bookman, Normal';fill:#5c5f5c;stroke-width:1.029"
+       inkscape:label="infix">
+      <path
+         d="m 85.532731,107.6593 0.508,0.0762 c 1.3462,0.1778 1.6256,0.635 1.651,2.794 v 9.9822 c -0.0254,2.159 -0.3048,2.6162 -1.651,2.794 l -0.508,0.0762 v 0.7874 h 6.858 v -0.7874 l -0.508,-0.0762 c -1.3462,-0.1778 -1.6256,-0.635 -1.651,-2.794 v -9.9822 c 0.0254,-2.159 0.3048,-2.6162 1.651,-2.794 l 0.508,-0.0762 v -0.7874 h -6.858 z"
+         id="path2431" />
+      <path
+         d="m 98.588334,111.8503 h -0.8636 c -1.5748,0.3048 -2.413,0.4064 -3.8354,0.508 v 0.762 l 0.6096,0.0508 c 1.3462,0.1524 1.6764,0.5588 1.6764,2.1082 v 5.969 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.832596 v -0.762 l -0.635,-0.0508 c -1.117596,-0.1016 -1.574796,-0.7112 -1.574796,-2.1082 v -6.2738 c 1.574796,-1.4224 3.073396,-2.1336 4.495796,-2.1336 1.397,0 2.159,0.889 2.159,2.54 v 5.8674 c 0,1.397 -0.4826,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -6.2738 c 0,-2.1082 -1.4224,-3.3528 -3.8354,-3.3528 -1.9558,0 -3.429,0.635 -5.232396,2.2352 z"
+         id="path2433" />
+      <path
+         d="m 115.27613,111.8503 v -1.5748 c 0,-1.651 0.0508,-1.9812 0.4064,-2.5908 0.4826,-0.8382 1.4986,-1.3462 2.6416,-1.3462 1.27,0 2.4638,0.762 2.4638,1.6256 0.0254,1.0414 0.0254,1.0414 0.2286,1.397 0.2286,0.4064 0.635,0.635 1.143,0.635 0.762,0 1.27,-0.5334 1.27,-1.27 0,-0.5842 -0.2286,-1.0668 -0.762,-1.6256 -1.016,-1.0414 -2.413,-1.5748 -4.191,-1.5748 -1.9558,0 -3.7338,0.6604 -4.6482,1.7272 -0.6858,0.8128 -0.9652,1.8542 -0.9652,3.6322 v 0.9652 h -2.159 v 0.8382 h 2.159 v 8.5598 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -8.5598 h 3.3782 c 1.8288,0 2.3368,0.5842 2.3114,2.667 v 5.8928 c 0,1.397 -0.4572,2.0066 -1.5748,2.1082 l -0.635,0.0508 v 0.762 h 6.8326 v -0.762 l -0.635,-0.0508 c -1.1176,-0.1016 -1.5748,-0.7112 -1.5748,-2.1082 v -9.398 z"
+         id="path2435" />
+      <path
+         d="m 134.09755,117.0827 2.2098,-2.3622 c 1.397,-1.3716 2.1082,-1.778 3.81,-2.1082 v -0.762 h -5.3594 v 0.762 c 0.9144,0.1016 1.143,0.2286 1.143,0.6604 0,0.2032 -0.0762,0.4064 -0.254,0.6096 l -2.159,2.4384 -2.0066,-2.4384 c -0.1778,-0.254 -0.3048,-0.4826 -0.3048,-0.635 0,-0.3556 0.3048,-0.5334 1.0414,-0.6096 l 0.254,-0.0254 v -0.762 h -6.2992 v 0.762 c 1.2192,0.1778 1.7018,0.4826 2.5908,1.5494 l 2.9718,3.7338 -3.2258,3.6322 c -1.143,1.2954 -1.8034,1.7018 -3.0226,1.8796 v 0.762 h 5.6896 v -0.762 c -0.889,-0.1524 -1.0922,-0.2032 -1.27,-0.3048 -0.254,-0.1524 -0.4318,-0.4064 -0.4318,-0.6604 0,-0.254 0.1778,-0.5842 0.4572,-0.9144 l 2.54,-2.8448 2.286,3.2004 c 0.1524,0.2286 0.254,0.4826 0.254,0.6858 0,0.4826 -0.3048,0.6604 -1.524,0.8382 v 0.762 h 7.0358 v -0.762 c -1.3716,-0.2286 -1.8288,-0.5334 -2.9464,-1.8796 z"
+         id="path2437" />
+    </g>
+  </g>
+  <g
+     inkscape:label="tux"
+     inkscape:groupmode="layer"
+     id="layer1"
+     style="display:inline">
+    <path
+       id="rect1698"
+       style="fill:#f9f9f9;stroke:#5c5f5c;stroke-width:1.029;stroke-linejoin:round"
+       inkscape:label="body"
+       d="M 59.529221,107.02922 H 82 V 124 H 59.529221 Z" />
+    <path
+       id="rect184-3"
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-linejoin:round"
+       inkscape:label="foot-r"
+       d="m 76,120 h 6 v 4 h -6 z" />
+    <path
+       id="rect184"
+       style="fill:#ff7f2a;stroke:#5c5f5c;stroke-linejoin:round"
+       inkscape:label="foot-l"
+       d="m 59.529221,120 h 6 v 4 h -6 z" />
+    <path
+       id="path11801"
+       style="fill:#ff7f2a"
+       inkscape:label="nose"
+       inkscape:transform-center-y="0.49151511"
+       transform="translate(28.350554,16.321792)"
+       d="m 42.414055,100.66737 -1.702663,-2.949101 3.405325,0 z" />
+    <path
+       id="path6519-5"
+       style="display:inline;fill:#5c5f5c;stroke-width:4.99999"
+       inkscape:label="eye-r"
+       d="m 73.711082,111.02191 a 0.5,0.5 0 0 1 -0.5,0.5 0.5,0.5 0 0 1 -0.5,-0.5 0.5,0.5 0 0 1 0.5,-0.5 0.5,0.5 0 0 1 0.5,0.5 z" />
+    <path
+       id="path6519"
+       style="fill:#5c5f5c;stroke-width:4.99999"
+       inkscape:label="eye-l"
+       d="m 68.81813,111.02191 a 0.5,0.5 0 0 1 -0.5,0.5 0.5,0.5 0 0 1 -0.5,-0.5 0.5,0.5 0 0 1 0.5,-0.5 0.5,0.5 0 0 1 0.5,0.5 z" />
+  </g>
+</svg>

doc/management.md

@@ -1,4 +1,4 @@
-# Management
+# System Management
 
 The system utilizes YANG models for keeping configuration and operational
 data. These databases can be managed through different interfaces such
@@ -79,11 +79,11 @@ typically setup to run at 115200 baud, 8N1.
 
 
 ```
-Infix -- a Network Operating System v24.11.1 (ttyS0)
+Infix OS — Immutable.Friendly.Secure v24.11.1 (ttyS0)
 example login: admin
 Password:
 .-------.
-|  . .  | Infix -- a Network Operating System
+|  . .  | Infix OS — Immutable.Friendly.Secure
 |-. v .-| https://kernelkit.org
 '-'---'-'
 
@@ -193,3 +193,7 @@ admin@example:/config/web/> edit restconf
 admin@example:/config/web/restconf/> no enabled
 admin@example:/config/web/restconf/>
 ```
+
+## System Upgrade
+
+See [Upgrade & Boot Order](upgrade.md) for information on upgrading.

doc/netboot.md

@@ -0,0 +1,130 @@
+Netboot HowTo
+=============
+
+This document describes how to set up network booting U-Boot devices on
+a LAN, e.g., when working with an evaluation board or other embedded
+system.  The most secure way to do this is with a local LAN between a PC
+and the device.
+
+Instead of setting up everything in U-Boot to download the Linux Image,
+device tree, and initramfs, we will let U-Boot download a script with
+instructions to run.  When you have multiple systems (boards) this
+quickly becomes a lot easier to manage.
+
+> [!NOTE]
+> Instructions in this HowTo assume a Debian based development system,
+> e.g., Ubuntu or Linux Mint.
+
+
+## Network Interface Setup
+
+For two dedicated network interfaces, here `eth2` and `eth3` (ymmv), we
+create an old-style interfaces config[^1] with the following content:
+
+```
+# /etc/network/interfaces.d/gimli
+auto eth2
+iface eth2 inet static
+        address 192.168.0.1
+        netmask 255.255.255.0
+
+auto eth3
+iface eth3 inet manual
+```
+
+> [!TIP]
+> Use configuration file names in `.d/` directories that make sense and
+> can easily be remembered.  Here we use the hostname of the PC.
+
+
+## DHCP/TFTP Server Setup
+
+The examples given here use `dnsmasq`, which provides both DHCP and TFTP
+server support.  The same can be achieved with other implementations.
+
+Similar to `interfaces.d`, dnsmasq has an `/etc/dnsmasq.d` directory so
+we can use "snippets" instead of modifying `/etc/dnsmasq.conf` directly.
+Add a file called `/etc/dnsmasq.d/gimli`.
+
+Initial content:
+
+```
+# Remember IP address handed out to BOOTP clients
+bootp-dynamic
+# Disable check-if-ip-address-is-already-used
+no-ping
+
+# Enable TFTP server, use /srv/ftp, same as any FTP server, useful
+# when using the same images for system upgrade as for netbooting.
+enable-tftp
+tftp-root=/srv/ftp
+```
+
+> [!CAUTION]
+> First of all, make sure you DO NOT accidentally set up dnsmasq so that
+> it starts acting as a DHCP server also on your office LAN!  Follow the
+> instructions below for more details.
+
+If you have many interfaces used for lab equipment and only one office
+LAN interface, then use something like this:
+
+```
+# Disable DHCP server on loopback and office LAN (eth0)
+except-interface=lo
+except-interface=eth0
+```
+
+To further lock this down, we only run the DHCP server on each of the
+interfaces used for lab equipment, with a dedicated IP range as well:
+
+```
+# Currently I have an imx8mp-evk on eth2, so on my system I have a
+# symlink bootfile-eth2 -> netboot.scr
+interface=eth2
+dhcp-range=192.168.0.100,192.168.0.199,1h
+dhcp-boot=tag:eth2,bootfile-eth2
+```
+
+## Bootfile netboot.scr
+
+The bootfile U-Boot retrieves from the TFTP server is a script that
+looks like this, `netboot.sh`:
+
+```sh
+setenv ramdisk_addr_r 0x58000000
+setenv fdt_addr_r     0x50400000
+
+setenv autoboot off
+tftp ${fdt_addr_r}     imx8mp-evk/imx8mp-evk.dtb
+tftp ${kernel_addr_r}  imx8mp-evk/Image
+tftp ${ramdisk_addr_r} imx8mp-evk/rootfs.squashfs
+
+setenv bootargs console=ttymxc1,115200 root=/dev/ram0 brd.rd_size=500000 rauc.slot=net
+booti ${kernel_addr_r} ${ramdisk_addr_r}:${filesize} ${fdt_addr_r}
+```
+
+U-Boot cannot read script files directly, so we need to wrap it with a
+FIT format header, this is done by first converting it on the PC:
+
+```
+$ mkimage -T script -d netboot.sh netboot.scr
+```
+
+The output is `netboot.scr` which we symlink to above in the dnsmasq
+setup step.
+
+
+## U-Boot Commands
+
+U-Boot is a maze of environment variables, some with values, some wrap
+commands, and most are undocumented.  We will use a prefix for our
+variables to ensure we do not overwrite anything you may want to use
+later.
+
+```sh
+==> setenv ixboot 'dhcp && source \${fileaddr}'
+==> saveenv
+```
+
+
+[^1]: To prevent NetworkManager from automatically managing the interfaces.

doc/networking.md

@@ -238,7 +238,7 @@ Multicast filtering in the bridge is handled by the bridge itself.  It
 can filter both IP multicast and MAC multicast.  For IP multicast it
 also supports "snooping", i.e., IGMP and MLD, to automatically reduce
 the broadcast effects of multicast.  See the next section for a summary
-of the [terminology used](#terminology--abbreviations).
+of the [terminology used](#terminology-abbreviations).
 
 > [!IMPORTANT]
 > Currently there is no way to just enable multicast filtering without
@@ -1253,7 +1253,7 @@ router 192.168.1.1, using the highest possible distance:
     admin@example:/>
 
 > [!TIP]
-> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for the
+> Remember to enable [IPv4 forwarding](#ipv4-forwarding) for the
 > interfaces you want to route between.
 
 
@@ -1277,7 +1277,7 @@ enable OSPF and set one active interface in area 0:
     admin@example:/>
 
 > [!TIP]
-> Remember to enable [IPv4 forwarding](#IPv4-forwarding) for all the
+> Remember to enable [IPv4 forwarding](#ipv4-forwarding) for all the
 > interfaces you want to route between.
 
 

doc/override-package.md

@@ -2,9 +2,11 @@ Package Override
 ================
 
 This guide demonstrates how the `local.mk` file is utilized to override
-a Linux Buildroot package.  As an example we use `tcpdump` to illustrate
-this process.
+a Buildroot package, which can be very useful when fixing bugs, adding
+features, or evaluating new releases of packages.  As an example we use
+`tcpdump` to illustrate this process.
 
+> [!TIP]
 > For a comprehensive guide to utilizing Buildroot during development,
 > including the `<pkg>_OVERRIDE_SRCDIR` mechanism, shown below, please
 > see [Using Buildroot during development][1] in the official docs.
@@ -67,9 +69,10 @@ drwxr-xr-x   7 group user 12288 Nov 10 18:28 tcpdump-custom/
 As long as your local override is in place, Buildroot will use your
 custom version.
 
-> **Remember:** the build directory is ephemeral, so be careful to
-> change any of the files therein.  It can be useful though during
-> debugging, but just make sure to learn the difference between the
-> various Buildroot commands to build, clean, reconfigure, etc.
+> [!NOTE]
+> Remember, the build directory is ephemeral, so be careful to change
+> any of the files therein.  It can be useful though during debugging,
+> but just make sure to learn the difference between the various
+> Buildroot commands to build, clean, reconfigure, etc.
 
 [1]: https://buildroot.org/downloads/manual/manual.html#_using_buildroot_during_development

doc/scripting-prod.md

@@ -0,0 +1,354 @@
+# Scripting for Production Tests
+
+This document shows how to set up and remotely script devices with a
+focus on production testing.
+
+## VLAN Snake
+
+As part of production tests, verification of Ethernet ports is usually
+expected.  A common way for devices with multiple bridged Ethernet ports
+is to connect a test PC to two ports and send a *ping* traversing all
+ports.  This can be achieved by using VLANs, on the switch, as described
+in this section.  The resulting configuration file can be applied to the
+running configuration of the produced unit, e.g, use config file restore
+as [described previously][2].
+
+In this example we assume a 10 port switch, with ports e1-e10.  The
+following VLAN configuration and cable connections will be used:
+
+| VLAN & Ports      | Connect   |
+|:------------------|:----------|
+| VLAN 10: e1 & e2  | e2 <=> e3 |
+| VLAN 20: e3 & e4  | e4 <=> e5 |
+| VLAN 30: e5 & e6  | e6 <=> e7 |
+| VLAN 40: e7 & e8  | e8 <=> e9 |
+| VLAN 50: e9 & e10 |           |
+
+The test PC is connected to e1 and e10 via different interfaces
+(alternatively, two different PCs are used).
+
+> [!TIP]
+> Configuration here is done via console. When configuring remotely
+> over SSH, remember to keep one IP address (the one used for the SSH
+> connection)! I.e., set a static IP address first, then perform the
+> VLAN configuration step.
+
+## Configuration at Start
+
+Starting out, we assume a configuration where all ports are network
+interfaces (possibly with IPv6 enabled).
+
+```
+admin@example:/> show interfaces
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   LOWER-DOWN  00:53:00:06:11:01
+e2              ethernet   LOWER-DOWN  00:53:00:06:11:02
+e3              ethernet   LOWER-DOWN  00:53:00:06:11:03
+e4              ethernet   LOWER-DOWN  00:53:00:06:11:04
+e5              ethernet   LOWER-DOWN  00:53:00:06:11:05
+e6              ethernet   LOWER-DOWN  00:53:00:06:11:06
+e7              ethernet   LOWER-DOWN  00:53:00:06:11:07
+e8              ethernet   LOWER-DOWN  00:53:00:06:11:08
+e9              ethernet   LOWER-DOWN  00:53:00:06:11:09
+e10             ethernet   UP          00:53:00:06:11:0a
+                ipv6                   fe80::0053:00ff:fe06:110a/64 (link-layer)
+admin@example:/>
+```
+
+## Creating Bridge and Adding Ports
+
+The following example [creates a bridge][8] and adds all Ethernet ports
+to it.  On a device with layer-2 offloading (switch fabric), this sets
+all ports in the same VLAN.  The next section sets up VLAN isolation.
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface br0
+admin@example:/config/interface/br0/> end
+admin@example:/config/> set interface e1 bridge-port bridge br0
+admin@example:/config/> set interface e2 bridge-port bridge br0
+admin@example:/config/> set interface e3 bridge-port bridge br0
+admin@example:/config/> set interface e4 bridge-port bridge br0
+admin@example:/config/> set interface e5 bridge-port bridge br0
+admin@example:/config/> set interface e6 bridge-port bridge br0
+admin@example:/config/> set interface e7 bridge-port bridge br0
+admin@example:/config/> set interface e8 bridge-port bridge br0
+admin@example:/config/> set interface e9 bridge-port bridge br0
+admin@example:/config/> set interface e10 bridge-port bridge br0
+admin@example:/config/>
+```
+
+The interface status can be viewed using `show interfaces` after leaving
+configuration context.  When configuring via SSH, first assign an IP
+address to `br0` *before leaving* configuration context, e.g.
+
+```
+admin@example:/config/> set interface br0 ipv6 enabled
+```
+
+This enables IPv6 SLAAC, auto-configured address.  Or skip `leave` and
+stay in configuration context until you have completed all the device
+setup, including [setting IP address](#set-ip-address).
+
+```
+admin@example:/config/> leave
+admin@example:/>
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+br0             bridge
+│               ethernet   UP          00:53:00:06:11:01
+├ e1            bridge     LOWER-DOWN
+├ e2            bridge     LOWER-DOWN
+├ e3            bridge     LOWER-DOWN
+├ e4            bridge     LOWER-DOWN
+├ e5            bridge     LOWER-DOWN
+├ e6            bridge     LOWER-DOWN
+├ e7            bridge     LOWER-DOWN
+├ e8            bridge     LOWER-DOWN
+├ e9            bridge     LOWER-DOWN
+└ e10           bridge     FORWARDING
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+admin@example:/>
+```
+
+## Assign VLANs to Ports
+
+Now, configure VLANs as outlined [previously](#vlan-snake): default VID
+for ingress (PVID), which is done per port, and egress mode (untagged),
+which is done at the bridge level. See the [VLAN bridges][9] section for
+more information.
+
+```
+admin@example:/>
+admin@example:/> configure
+admin@example:/config/> set interface e1 bridge-port pvid 10
+admin@example:/config/> set interface e2 bridge-port pvid 10
+admin@example:/config/> set interface e3 bridge-port pvid 20
+admin@example:/config/> set interface e4 bridge-port pvid 20
+admin@example:/config/> set interface e5 bridge-port pvid 30
+admin@example:/config/> set interface e6 bridge-port pvid 30
+admin@example:/config/> set interface e7 bridge-port pvid 40
+admin@example:/config/> set interface e8 bridge-port pvid 40
+admin@example:/config/> set interface e9 bridge-port pvid 50
+admin@example:/config/> set interface e10 bridge-port pvid 50
+admin@example:/config/> edit interface br0
+admin@example:/config/interface/br0/> edit bridge vlans
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e1
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 untagged e2
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e3
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 20 untagged e4
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e5
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 30 untagged e6
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e7
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 40 untagged e8
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e9
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 50 untagged e10
+admin@example:/config/interface/br0/bridge/vlans/> leave
+admin@example:/>
+```
+
+Interface status would now should something like the following
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+br0             bridge
+│               ethernet   UP          00:53:00:06:11:01
+├ e1            bridge     LOWER-DOWN  vlan:10u pvid:10
+├ e2            bridge     LOWER-DOWN  vlan:10u pvid:10
+├ e3            bridge     LOWER-DOWN  vlan:20u pvid:20
+├ e4            bridge     LOWER-DOWN  vlan:20u pvid:20
+├ e5            bridge     LOWER-DOWN  vlan:30u pvid:30
+├ e6            bridge     LOWER-DOWN  vlan:30u pvid:30
+├ e7            bridge     LOWER-DOWN  vlan:40u pvid:40
+├ e8            bridge     LOWER-DOWN  vlan:40u pvid:40
+├ e9            bridge     LOWER-DOWN  vlan:50u pvid:50
+└ e10           bridge     FORWARDING  vlan:50u pvid:50
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+admin@example:/>
+```
+
+## Connect Cables and Test
+
+We can now connect the PC to e1 and e10, while the other ports are
+patched according to [above](#vlan-snake).  We should see link up and
+*FORWARDING* on all ports in the bridge.
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+br0             bridge
+│               ethernet   UP          00:53:00:06:11:01
+├ e1            bridge     FORWARDING  vlan:10u pvid:10
+├ e2            bridge     FORWARDING  vlan:10u pvid:10
+├ e3            bridge     FORWARDING  vlan:20u pvid:20
+├ e4            bridge     FORWARDING  vlan:20u pvid:20
+├ e5            bridge     FORWARDING  vlan:30u pvid:30
+├ e6            bridge     FORWARDING  vlan:30u pvid:30
+├ e7            bridge     FORWARDING  vlan:40u pvid:40
+├ e8            bridge     FORWARDING  vlan:40u pvid:40
+├ e9            bridge     FORWARDING  vlan:50u pvid:50
+└ e10           bridge     FORWARDING  vlan:50u pvid:50
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+admin@example:/>
+```
+
+Here we use IPv6 ping all hosts (ff02::1) on PC interface eth1 to
+check reachability to the other interface of the PC.
+
+> [!TIP]
+> We recommend using network namespaces (Linux only) on the PC to ensure
+> that traffic is actually sent out to the switch, rather than being
+> looped back internally. Alternatively, use two separate PCs.
+
+```
+~ $ ping -L ff02::1%eth1
+PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.496 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.514 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.473 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.736 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.563 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.507 ms
+^C
+--- ff02::1%eth1 ping statistics ---
+6 packets transmitted, 6 received, 0% packet loss, time 5108ms
+rtt min/avg/max/mdev = 0.473/0.548/0.736/0.088 ms
+~ $
+```
+
+We can verify that traffic goes through the switch by disconnecting
+one of the patch cables, e.g., between e4 and e5
+
+```
+~ $ ping -L ff02::1%eth1
+PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.510 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.448 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.583 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.515 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=5 ttl=64 time=0.521 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=6 ttl=64 time=0.495 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=7 ttl=64 time=0.743 ms
+... Disconnecting patch cable, thus losing packets
+... and reconnecting again. Connectivity resumes.
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=16 ttl=64 time=0.961 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=17 ttl=64 time=0.513 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=18 ttl=64 time=0.794 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=19 ttl=64 time=0.755 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=20 ttl=64 time=0.779 ms
+^C
+--- ff02::1%eth1 ping statistics ---
+20 packets transmitted, 12 received, 40% packet loss, time 19432ms
+rtt min/avg/max/mdev = 0.448/0.634/0.961/0.156 ms
+~ $
+```
+
+## Set IP Address
+
+The configuration so far does not provide a means to connect to the
+switch management via SSH or NETCONF, as the switch has no IP address.
+The example below shows how to add the switch to VLAN 10 (as used for
+ports e1 and e2) and enables IPv6.
+
+```
+admin@example:/config/> edit interface vlan10
+admin@example:/config/interface/vlan10/> set vlan lower-layer-if br0
+admin@example:/config/interface/vlan10/> set ipv6 enabled
+admin@example:/config/interface/vlan10/> show
+type vlan;
+ipv6 {
+  enabled true;
+}
+vlan {
+  tag-type c-vlan;
+  id 10;
+  lower-layer-if br0;
+}
+admin@example:/config/interface/vlan10/>
+admin@example:/config/interface/vlan10/> end
+admin@example:/config/> edit interface br0 bridge vlans
+admin@example:/config/interface/br0/bridge/vlans/> set vlan 10 tagged br0
+admin@example:/config/interface/br0/bridge/vlans/> leave
+admin@example:/>
+```
+
+Interface *vlan10* with an auto-configured IPv6 address should appear.
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+br0             bridge                 vlan:10t
+│               ethernet   UP          00:53:00:06:11:01
+├ e1            bridge     FORWARDING  vlan:10u pvid:10
+├ e2            bridge     FORWARDING  vlan:10u pvid:10
+├ e3            bridge     FORWARDING  vlan:20u pvid:20
+├ e4            bridge     FORWARDING  vlan:20u pvid:20
+├ e5            bridge     FORWARDING  vlan:30u pvid:30
+├ e6            bridge     FORWARDING  vlan:30u pvid:30
+├ e7            bridge     FORWARDING  vlan:40u pvid:40
+├ e8            bridge     FORWARDING  vlan:40u pvid:40
+├ e9            bridge     FORWARDING  vlan:50u pvid:50
+└ e10           bridge     FORWARDING  vlan:50u pvid:50
+lo              ethernet   UP          00:00:00:00:00:00
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+vlan10          ethernet   UP          00:53:00:06:11:01
+│               ipv6                   fe80::0053:00ff:fe06:1101/64 (link-layer)
+└ br0           ethernet   UP          00:53:00:06:11:01
+admin@example:/>
+```
+
+When pinging "IPv6 all hosts" from the PC, there should be two
+responses for every ping, one from the switch and one from the PC
+attached to e10.
+
+```
+~ $ ping -L ff02::1%eth1
+PING ff02::1%eth1(ff02::1%eth1) 56 data bytes
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=1 ttl=64 time=0.508 ms
+64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=1 ttl=64 time=0.968 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=2 ttl=64 time=0.866 ms
+64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=2 ttl=64 time=0.867 ms
+64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=3 ttl=64 time=0.467 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=3 ttl=64 time=0.469 ms
+64 bytes from fe80::488a:a35f:9d41:ac9c%eth1: icmp_seq=4 ttl=64 time=0.452 ms
+64 bytes from fe80::0053:00ff:fe06:1101%eth1: icmp_seq=4 ttl=64 time=0.453 ms
+^C
+--- ff02::1%eth1 ping statistics ---
+4 packets transmitted, 4 received, +4 duplicates, 0% packet loss, time 3031ms
+rtt min/avg/max/mdev = 0.452/0.631/0.968/0.211 ms
+~ $
+```
+
+It should now be possible to access the switch from the PC via SSH (or NETCONF).
+
+```
+~ $ ssh admin@fe80::0053:00ff:fe06:1101%eth1
+admin@fe80::0053:00ff:fe06:1101%eth1's password:
+.-------.
+|  . .  | Infix OS — Immutable.Friendly.Secure
+|-. v .-| https://kernelkit.org
+'-'---'-'
+
+Run the command 'cli' for interactive OAM
+
+admin@example:~$ exit
+~ $
+```
+
+See previous sections on [backup][1] and [restore][2] of
+the created configuration.
+
+[1]: scripting-sysrepocfg.md#backup-configuration
+[2]: scripting-sysrepocfg.md#restore-configuration
+[8]: networking.md#bridging
+[9]: networking.md#vlan-filtering-bridge

doc/scripting-restconf.md

@@ -0,0 +1,82 @@
+# Examples using RESTCONF
+
+## Factory Reset
+
+```
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+        https://example.local/restconf/operations/ietf-factory-default:factory-reset
+curl: (56) OpenSSL SSL_read: error:0A000126:SSL routines::unexpected eof while reading, errno 0
+```
+
+## System Reboot
+
+```
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+        https://example.local/restconf/operations/ietf-system:system-restart
+```
+
+## Set Date and Time
+
+Here's an example of an RPC that takes input/argument:
+
+```
+~$ curl -kX POST -u admin:admin \
+        -H "Content-Type: application/yang-data+json" \
+        -d '{"ietf-system:input": {"current-datetime": "2024-04-17T13:48:02-01:00"}}' \
+        https://example.local/restconf/operations/ietf-system:set-current-datetime
+```
+
+You can verify that the changes took by a remote SSH command:
+
+```
+~$ ssh admin@example.local 'date'
+Wed Apr 17 14:48:12 UTC 2024
+~$
+```
+
+## Read Hostname
+
+Example of fetching JSON configuration data to stdout:
+
+```
+~$ curl -kX GET -u admin:admin \
+        -H 'Accept: application/yang-data+json' \
+        https://example.local/restconf/data/ietf-system:system/hostname
+{
+  "ietf-system:system": {
+    "hostname": "foo"
+  }
+}
+```
+
+## Set Hostname
+
+Example of inline JSON data:
+
+```
+~$ curl -kX PATCH -u admin:admin \
+     -H 'Content-Type: application/yang-data+json' \
+     -d '{"ietf-system:system":{"hostname":"bar"}}' \
+     https://example.local/restconf/data/ietf-system:system
+```
+
+## Copy Running to Startup
+
+No copy command available yet to copy between datastores, and the
+Rousette back-end also does not support "write-through" to the
+startup datastore.
+
+To save running-config to startup-config, use the following example to
+fetch running to a local file and then update startup with it:
+
+```
+~$ curl -kX GET -u admin:admin -o running-config.json \
+        -H 'Accept: application/yang-data+json'       \
+         https://example.local/restconf/ds/ietf-datastores:running
+
+~$ curl -kX PUT -u admin:admin -d @running-config.json \
+        -H 'Content-Type: application/yang-data+json'  \
+        https://example.local/restconf/ds/ietf-datastores:startup
+```

doc/scripting-sysrepocfg.md

@@ -0,0 +1,467 @@
+> [!NOTE]
+> This method is a legacy "simple and human-friendly" way to manage the
+> system.  These days we strongly recommend using [RESTCONF][1] instead.
+
+# Legacy Scripting
+
+Although not the primary interface for Infix, it is possible to interact
+with the system using raw [sysrepocfg][0] commands.  This way you get to
+interact directly with the YANG models when logged in to Infix.  Thus, a
+*set config*, *read config*, *read status* and an *RPC* can be conducted
+using `sysrepocfg` for any supported YANG model.
+
+See [sysrepocfg][0] for more information.  Examples below will utilize:
+
+- `sysrepocfg -I FILE -fjson -d DATABASE` to import/write a JSON
+  formatted configuration file to the specified database.
+- `sysrepocfg -E FILE -fjson -d DATABASE` to edit/merge JSON formatted
+  configuration in FILE with the specified database.
+- `sysrepocfg -R FILE -fjson` to execute remote procedure call (RPC)
+   defined in FILE (JSON formatted).
+- `sysrepocfg -X -fjson -d DATABASE -x xpath` to read configuration or
+  status from specified database.
+
+For importing (-I) and editing (-E), `-d running` is typically used in
+examples below. Specify `-d startup` to apply changes to startup
+configuration. Exporting (-X) could operate on configuration (e.g.,
+`-d running`) or status (`-d operational`).
+
+Some commands require a file as input.  In the examples below we assume
+it has been transferred to the device in advance, e.g. using `scp`:
+
+```
+~$ cat file.json
+{
+   "ietf-factory-default:factory-reset": {
+   }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$
+```
+
+## Factory Reset
+
+```
+~$ cat file.json
+{
+   "ietf-factory-default:factory-reset": {
+   }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
+^C
+~$
+```
+
+See [Factory Reset](scripting.md#factory-reset) for another (simpler)
+alternative.
+
+If it is only wished to copy factory config to running config the
+following RPC is available
+
+```
+~$ cat file.json
+{
+   "infix-factory-default:factory-default": {
+   }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
+^C
+~$
+```
+
+## System Reboot
+
+```
+~$ cat /tmp/file.json
+{
+   "ietf-system:system-restart": {
+   }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
+~$
+```
+
+See [System Reboot](scripting.md#system-reboot) for another (simpler)
+alternative.
+
+## Set Date and Time
+
+```
+~$ ssh admin@example.local 'date'
+Sun Nov 20 10:20:23 UTC 2005
+~$ cat file.json
+{
+   "ietf-system:set-current-datetime": {
+      "current-datetime": "2024-04-17T13:48:02-01:00"
+   }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -fjson -R /tmp/file.json'
+~$ ssh admin@example.local 'date'
+Wed Apr 17 14:48:12 UTC 2024
+~$
+```
+
+See [Set Date and Time](scripting.md#set-date-and-time) for another
+(simpler) alternative.
+
+## Remote Control of Ethernet Ports
+
+Reading administrative status of interface *e0* of running configuration.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running -e report-all \
+       -x \"/ietf-interfaces:interfaces/interface[name='e0']/enabled\"'
+{
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "e0",
+        "enabled": true
+      }
+    ]
+  }
+}
+~$
+```
+
+> [!NOTE]
+> Without `-e report-all` argument the line `"enabled: true` would not
+> be shown as `true` is default.
+
+```
+~$ ssh admin@example.local "sysrepocfg -X -fjson -d running \
+       -x \"/ietf-interfaces:interfaces/interface[name='e0']/enabled\""
+{
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "e0"
+      }
+    ]
+  }
+}
+~$
+```
+
+Setting the administrative status of interface *e0* of running configuration.
+
+```
+$ cat file.json
+{
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "e0",
+        "enabled": false
+      }
+    ]
+  }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running'
+~$
+```
+
+## Enable/Disable DHCPv4 client
+
+Enabling DHCPv4 client on interface *e0*, with current default options.
+
+```
+~$ cat /tmp/file.json
+{
+  "infix-dhcp-client:dhcp-client": {
+    "enabled": true,
+    "client-if": [
+      {
+        "if-name": "e0"
+      }
+    ]
+  }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running'
+~$
+```
+
+Disabling DHCPv4 client.
+
+```
+~$ cat /tmp/file.json
+{
+  "infix-dhcp-client:dhcp-client": {
+    "enabled": false
+  }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running'
+~$
+```
+
+Configuration for client interface *e0* remains, but does not apply as
+DHCPv4 is disabled.
+
+```
+admin@example:~$ sysrepocfg -X -fjson -d running -x "/infix-dhcp-client:dhcp-client"
+{
+  "infix-dhcp-client:dhcp-client": {
+    "enabled": false,
+    "client-if": [
+      {
+        "if-name": "e0"
+      }
+    ]
+  }
+}
+admin@example:~$
+```
+
+To fully remove the DHCPv4 client configuration or a specific
+*client-if* with sysrepocfg, one would need to read out the full
+configuration, remove relevant parts and read back.
+
+## Enable/Disable IPv6
+
+IPv6 is typically enabled on all interfaces by default. The example
+below shows IPv4 and IPv6 addresses assigned on *e0*.
+
+```
+~$ ssh admin@example.local 'ip addr show dev e0'
+2: e0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
+    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
+    inet 10.0.2.15/24 scope global proto dhcp e0
+       valid_lft forever preferred_lft forever
+    inet6 fec0::ff:fe00:0/64 scope site dynamic mngtmpaddr proto kernel_ra
+       valid_lft 86380sec preferred_lft 14380sec
+    inet6 fe80::ff:fe00:0/64 scope link proto kernel_ll
+       valid_lft forever preferred_lft forever
+~$
+```
+
+IPv6 is enabled/disabled per interface. The example below disables IPv6
+on interface *e0*.
+
+```
+~$ cat /tmp/file.json
+{
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "e0",
+        "ietf-ip:ipv6": {
+          "enabled": false
+        }
+      }
+    ]
+  }
+}
+~$ scp file.json admin@example.local:/tmp/file.json
+~$ ssh admin@example.local 'sysrepocfg -E /tmp/file.json -fjson -d running'
+~$ ssh admin@example.local 'ip addr show dev e0'
+2: e0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
+    link/ether 02:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff
+    inet 10.0.2.15/24 scope global proto dhcp e0
+       valid_lft forever preferred_lft forever
+~$
+```
+
+## Change a Binary Setting
+
+A YANG `binary` type setting is Base64 encoded and requires a little bit
+more tricks.  We take the opportunity to showcase a shell script helper:
+`/usr/bin/text-editor`, which works just like the `text-editor` command
+in the CLI, but this one takes an XPath argument to the binary leaf to
+edit.
+
+Stripped down, it looks something like this:
+
+```bash
+if tmp=$(sysrepocfg -G "$xpath"); then
+    file=$(mktemp)
+
+    echo "$tmp" | base64 -d > "$file"
+    if edit "$file"; then
+        tmp=$(base64 -w0 < "$file")
+        sysrepocfg -S "$xpath" -u "$tmp"
+    fi
+
+    rm -f "$file"
+else
+    echo "Failed to retrieve value for $xpath"
+    exit 1
+fi
+```
+
+An example container configuration, with an embedded file that is
+mounted to `/var/www/index.html` can look like this:
+
+```json
+  "infix-containers:containers": {
+    "container": [
+      {
+        "name": "web",
+        "image": "oci-archive:/lib/oci/curios-httpd-latest.tar.gz",
+        "hostname": "web",
+        "network": {
+          "interface": [
+            {
+              "name": "veth-sys0"
+            }
+          ]
+        },
+        "mount": [
+          {
+            "name": "index.html",
+            "content": "PCFET0NUWVBFIGh0bWwjibberish.shortened.down==",
+            "target": "/var/www/index.html"
+          }
+        ]
+      }
+    ]
+  }
+```
+
+The command to edit this file, and restart the container with the new
+contents, look like this:
+
+```
+admin@infix:~$ cfg edit "/infix-containers:containers/container[name='web']/mount[name='index.html']/content"
+```
+
+## Backup Configuration
+
+Displaying running or startup configuration is possible with
+`sysrepocfg -X`, as shown below.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running'
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+...
+~$
+```
+
+An example for backing up startup configuration from remote PC.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d startup > /tmp/backup.json'
+~$ scp admin@example.local:/tmp/backup.json .
+~$
+```
+
+Or possibly skip intermediate storage of file
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d startup' > backup.json
+~$
+```
+
+A final example is to only use `scp`. This is simpler, but only works to
+backup the startup configuration (not running).
+
+```
+~$ scp admin@example.local:/cfg/startup-config.cfg backup.json
+~$
+```
+
+## Restore Configuration
+
+To restore a backup configuration to startup, the simplest way is to use
+`scp` and reboot as shown below
+
+```
+~$ scp admin@example.local:/cfg/startup-config.cfg backup.json
+~$ ssh admin@example.local 'reboot'
+Connection to switch.local closed by remote host.
+~$
+```
+
+An alternative method to restore a backup configuration is to use the
+`sysrepocfg -I FILE` (import) command.
+
+The example below imports the backup configuration to startup, and
+reboots the unit.
+
+```
+~$ scp backup.json admin@example.local:/tmp/
+~$ ssh admin@example.local 'sudo sysrepocfg -I /tmp/backup.json -fjson -d startup'
+~$ ssh admin@example.local 'reboot'
+Connection to switch.local closed by remote host.
+~$
+```
+
+> [!NOTE]
+> The login credentials (hash) for the `admin` user are stored as part
+> of the configuration file.  When replacing a switch and applying the
+> backed up configuration from the former switch, the password on the
+> replacement unit will also change.
+
+## Copy Running to Startup
+
+The following command reads out the running config via `sysrepocfg -X`
+and writes the result to the startup configuration.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running > /cfg/startup-config.cfg'
+~$
+```
+
+An alternative is to write it to a temporary file, and use `sysrepocfg
+-I` to import it to startup.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d running > /tmp/running.json'
+~$ ssh admin@example.local 'sysrepocfg -I /tmp/running.json -fjson -d startup'
+~$
+```
+
+## Read Hardware Information
+
+The IETF Hardware YANG model has been augmented for ONIE formatted
+production data stored in EEPROMs, if available.  For details, see the
+[VPD documentation][2] and the *ietf-hardware* and *infix-hardware*
+YANG models.
+
+```
+~$ ssh admin@example.local 'sysrepocfg -X -fjson -d operational -x /ietf-hardware:hardware'
+{
+  "ietf-hardware:hardware": {
+    "component": [
+      {
+        "name": "product",
+        "class": "infix-hardware:vpd",
+        "serial-num": "12345",
+        "model-name": "Switch2010",
+        "mfg-date": "2024-01-30T16:42:37+00:00",
+        "infix-hardware:vpd-data": {
+          "product-name": "Switch2010",
+          "part-number": "ABC123-001",
+          "serial-number": "007",
+          "mac-address": "00:53:00:01:23:45",
+          "manufacture-date": "01/30/2024 16:42:37",
+          "num-macs": 11,
+          "manufacturer": "ACME Production",
+          "vendor": "SanFran Networks"
+        }
+      },
+      {
+        "name": "USB",
+        "class": "infix-hardware:usb",
+        "state": {
+          "admin-state": "unlocked",
+          "oper-state": "enabled"
+        }
+      }
+    ]
+  }
+}
+~$
+```
+
+[0]: https://netopeer.liberouter.org/doc/sysrepo/libyang1/html/sysrepocfg.html
+[1]: scripting-restconf.md
+[2]: vpd.md

doc/syslog.md

@@ -1,4 +1,4 @@
-## Syslog Support
+# Syslog Support
 
 The system comes with native logging to internal storage, `/var/log/`,
 or `/log` for a shortcut.  Depending on the device, this may be a RAM
@@ -8,12 +8,12 @@ details how to log to external media or remote syslog servers.
 It is also possible to set up the device to act as a syslog server (log
 sink), this is covered briefly at the very end of this document.
 
-> **Note:** the native logging cannot be modified, only the log file
-> rotation can be changed.  Please see the `dir` admin-exec command for
-> a listing of existing native log files.
+> [!NOTE]
+> The default logging setup in the system cannot be modified, only the
+> log file rotation.  Please see the `dir` admin-exec command for a
+> listing of existing log files.
 
-
-### Log to File
+## Log to File
 
 Logging to a local file is useful when combined with an external media.
 E.g., a USB stick with a log partition (named/labeled: "log").  Below is
@@ -21,7 +21,7 @@ an example.
 
 For a list of available log facilities, see the table in a later section.
 
-```bash
+```
 admin@example:/> configure
 admin@example:/config/> edit syslog
 admin@example:/config/syslog/> edit actions log-file file:/media/log/mylog
@@ -37,13 +37,13 @@ admin@example:/config/syslog/actions/log-file/file:/media/log/mylog/> leave
 admin@example:/>
 ```
 
-> **Note:** the `log-file` syntax requires the leading prefix `file:`.
-> If the path is not absolute, e.g., `file:mylog`, the file is saved to
-> the system default path, i.e., `/log/mylog`.  In this case, verify
-> that the filename is not already in use.
+> [!IMPORTANT]
+> The `log-file` syntax requires the leading prefix `file:`.  If the
+> path is not absolute, e.g., `file:mylog`, the file is saved to the
+> system default path, i.e., `/log/mylog`.  In this case, verify that
+> the filename is not already in use.
 
-
-### Log Rotation
+## Log Rotation
 
 By default log files are allowed to grow to a size of 1 MiB after which
 they are "rotated".  The whole reason for this is to not fill up the
@@ -51,13 +51,16 @@ disk with outdated logs.  A rotated file is saved in stages and older
 ones are also compressed (using `gzip`).  Use the `show log` command in
 admin-exec context to start the log file viewer:
 
-    admin@example:/config/syslog/> do show log
-    log  log.0  log.1.gz  log.2.gz  log.3.gz  log.4.gz  log.5.gz
-    admin@example:/config/syslog/> do show log log.1.gz
+```
+admin@example:/config/syslog/> do show log
+log  log.0  log.1.gz  log.2.gz  log.3.gz  log.4.gz  log.5.gz
+admin@example:/config/syslog/> do show log log.1.gz
+```
 
-> **Tip:** use the Tab key on your keyboard list available log files.
-> The `do` prefix is also very useful in configure context to access
-> commands from admin-exec context.
+> [!TIP]
+> Use the Tab key on your keyboard list available log files.  The `do`
+> prefix is also very useful in configure context to access commands
+> from admin-exec context.
 
 By default 10 compressed older files are saved.  Here the oldest is
 `log.5.gz` and the most recently rotated one is `log.0`.
@@ -66,8 +69,8 @@ Log file rotation can be configured both globally and per log file.
 Here we show the global settings, the set up is the same for per log
 file, which if unset inherit the global settings:
 
-```bash
-admin@example:/> configure 
+```
+admin@example:/> configure
 admin@example:/config/> edit syslog file-rotation
 admin@example:/config/syslog/file-rotation/> show
 admin@example:/config/syslog/file-rotation/>
@@ -76,7 +79,7 @@ admin@example:/config/syslog/file-rotation/>
 The defaults are not shown.  We can inspect them by asking the YANG
 model for the help texts:
 
-```bash
+```
 admin@example:/config/syslog/file-rotation/> help
    max-file-size    number-of-files
 admin@example:/config/syslog/file-rotation/> help max-file-size 
@@ -102,18 +105,17 @@ DEFAULT
 To change the defaults to something smaller, 512 kiB and 20 (remember
 everything after .0 is compressed, and text compresses well):
 
-```bash
+```
 admin@example:/config/syslog/file-rotation/> set max-file-size 512
 admin@example:/config/syslog/file-rotation/> set number-of-files 20
 admin@example:/config/syslog/file-rotation/> show
 number-of-files 20;
 max-file-size 512;
 admin@example:/config/syslog/file-rotation/> leave
-admin@example:/> 
+admin@example:/>
 ```
 
-
-### Log Format
+## Log Format
 
 There are three major syslog log formats, the default is [RFC3164][] for
 log files and BSD for remote logging.  Depending on time synchronization
@@ -121,9 +123,11 @@ and remote log server capabilities, or policies, the [RFC5424][] format
 is often preferred since it not only has better time resolution but also
 supports structured logging:
 
-	BSD     : myproc[8710]: Kilroy was here.
-	RFC3164 : Aug 24 05:14:15 192.0.2.1 myproc[8710]: Kilroy was here.
-	RFC5424 : 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - Kilroy was here.
+```
+BSD     : myproc[8710]: Kilroy was here.
+RFC3164 : Aug 24 05:14:15 192.0.2.1 myproc[8710]: Kilroy was here.
+RFC5424 : 2003-08-24T05:14:15.000003-07:00 192.0.2.1 myproc 8710 - - Kilroy was here.
+```
 
 The BSD format is only applicable to remote logging.  It remains the
 default for compatibility reasons, and is recommended since the device
@@ -132,7 +136,7 @@ perform time stamping at the time of arrival.
 
 Configuring the log format is the same for log files and remotes:
 
-```bash
+```
 admin@example:/config/> edit syslog actions log-file file:foobar 
 admin@example:/config/syslog/actions/log-file/file:foobar/> set log-format 
                   bsd               rfc3164              rfc5424
@@ -141,10 +145,7 @@ admin@example:/config/syslog/actions/log-file/file:foobar/> leave
 admin@example:/>
 ```
 
-[RFC3164]: https://datatracker.ietf.org/doc/html/rfc3164
-[RFC5424]: https://datatracker.ietf.org/doc/html/rfc5424
-
-### Log to Remote Server
+## Log to Remote Server
 
 Logging to a remote syslog server is the recommended way of supervising
 the system.  This way all login attempts (console, SSH, or web) and any
@@ -158,7 +159,7 @@ remote syslog servers do not support receiving time stamped log messages
 -- this is of course entirely dependent on how the remote server is set
 up, as well as local policy.
 
-```bash
+```
 admin@example:/config/> edit syslog
        actions file-rotation        server
 admin@example:/config/> edit syslog actions destination moon
@@ -172,16 +173,16 @@ admin@example:/config/syslog/actions/destination/moon/> leave
 admin@example:/>
 ```
 
-> **Note:** the alternatives shown below each prompt in the example
-> above can be found by tapping the Tab key.
+> [!TIP]
+> The alternatives shown below each prompt in the example above can be
+> found by tapping the Tab key.
 
-
-### Acting as a Log Server
+## Acting as a Log Server
 
 The syslog server can act as a log sink for other devices on a LAN.  For
 this to work you need a static IP address, here we use 10.0.0.1/24.
 
-```bash
+```
 admin@example:/> configure
 admin@example:/config/> edit syslog server
 admin@example:/config/syslog/server/> set enabled true
@@ -194,7 +195,6 @@ See the above [Log to File](#log-to-file) section on how to set up
 filtering of received logs to local files.  Please note, filtering based
 on property, e.g., hostname, is not supported yet.
 
-
 ### Facilities
 
 | **Code** | **Facility** | **Description**                           |
@@ -225,3 +225,6 @@ on property, e.g., hostname, is not supported yet.
 | 23       | web*         | local7, reserved for nginx web server     |
 
 Facilities marked `*` are local augments to the model.
+
+[RFC3164]: https://datatracker.ietf.org/doc/html/rfc3164
+[RFC5424]: https://datatracker.ietf.org/doc/html/rfc5424

doc/templates/cover.html

@@ -0,0 +1,23 @@
+<article id="doc-cover">
+    {% if cover_logo is defined %}
+        <div class="wrapper upper">
+            <img src="{{ cover_logo | to_url }}" alt="Logo" class="logo">
+        </div>
+    {% else %}
+        <div class="wrapper"></div>
+    {% endif %}
+
+    <div class="wrapper">
+        <h2>{{ cover_subtitle | e }}</h2>
+        <div class="divider"></div>
+        <h1>{{ cover_title | e }}</h1>
+    </div>
+
+    <div class="properties">
+        <address>
+            {% if copyright is defined %}
+                <p id="copyright">{{ copyright | e }}</p>
+	    {% endif %}
+        </address>
+    </div>
+</article>

doc/templates/styles.scss

@@ -0,0 +1,148 @@
+// Override plugin defaults with !important to ensure our styles take precedence
+article#doc-cover {
+    display: flex !important;
+    flex-direction: column !important;
+    height: 100vh !important;
+    text-align: center !important;
+    padding: 20px !important;
+}
+
+article#doc-cover > .wrapper.upper {
+    flex: 0 0 120px !important;
+    text-align: center !important;
+    margin-bottom: 20px !important;
+    max-height: none !important;
+}
+
+// Simple img tag approach for centered logo
+article#doc-cover > .wrapper.upper > img.logo {
+    width: 360px !important;
+    height: auto !important;  // Maintains aspect ratio automatically
+    display: block !important;
+    margin: 250px auto 0 auto !important;
+    padding: 0;
+}
+
+article#doc-cover > .wrapper h1 {
+    font-size: 52px !important;
+    margin: 0 auto 0 auto !important;
+    color: #808080 !important;
+    border-bottom: none !important;
+}
+
+// Copyright text on cover page should match logo grey color
+article#doc-cover .properties address p#copyright {
+    color: #808080 !important;
+}
+
+article#doc-cover > .wrapper h2 {
+    font-size: 28px !important;
+    color: #808080 !important;
+    margin: 0 !important;
+}
+
+article#doc-cover .divider {
+    width: 150px !important;
+    height: 3px !important;
+    background: #ff7f2a !important;
+    margin: 20px auto !important;
+    border: none !important;
+}
+
+// Proper heading hierarchy for 12pt base text (print standards)
+h1 {
+    color: black !important;
+    font-size: 24pt !important;  // 2.0x base text
+    line-height: 1.2 !important;
+    margin-top: 24pt !important;
+    margin-bottom: 12pt !important;
+}
+
+h2 {
+    color: black !important;
+    font-size: 20pt !important;  // 1.67x base text
+    line-height: 1.3 !important;
+    margin-top: 20pt !important;
+    margin-bottom: 10pt !important;
+}
+
+h3 {
+    color: black !important;
+    font-size: 16pt !important;  // 1.33x base text
+    line-height: 1.3 !important;
+    margin-top: 16pt !important;
+    margin-bottom: 8pt !important;
+}
+
+h4 {
+    color: black !important;
+    font-size: 14pt !important;  // 1.17x base text
+    line-height: 1.4 !important;
+    margin-top: 14pt !important;
+    margin-bottom: 7pt !important;
+}
+
+h5, h6 {
+    color: black !important;
+    font-size: 13pt !important;  // 1.08x base text
+    line-height: 1.4 !important;
+    margin-top: 12pt !important;
+    margin-bottom: 6pt !important;
+}
+
+article h1 {
+    border-bottom: 2px solid #ff7f2a;
+}
+
+article h2 {
+    border-bottom: 1px solid #ff7f2a;
+}
+
+article h3 {
+    border-bottom: 0.5px solid #ff7f2a;
+}
+
+// Set base font size to 12pt for all content
+body, article {
+    font-size: 12pt !important;
+    line-height: 1.6 !important;
+}
+
+// Ensure paragraphs use 12pt
+p {
+    font-size: 12pt !important;
+    line-height: 1.6 !important;
+}
+
+// Code blocks and inline code should be 10pt
+pre, code, var, samp, kbd, tt {
+    font-size: 10pt !important;
+}
+
+// Override any nested code font sizes
+pre code, pre var, pre samp, pre kbd, pre tt {
+    font-size: 10pt !important;
+}
+
+// Lists should also use 12pt
+ul, ol, li {
+    font-size: 12pt !important;
+}
+
+// Table content can be smaller to fit all details
+table, td, th {
+    font-size: 10pt !important;
+}
+
+// Override the tiny @page header/footer fonts to be more readable
+@page {
+    @top-right {
+        font-size: 10pt !important;
+    }
+    @bottom-center {
+        font-size: 10pt !important;
+    }
+    @bottom-right {
+        font-size: 10pt !important;
+    }
+}

doc/testing.md

@@ -1,19 +1,16 @@
-Regression Testing with Infamy
-==============================
+# Regression Testing with Infamy
 
 Infix comes with a test suite that is intended to provide end-to-end
-verification of supported features.  Generally speaking, this means
-that one or more DUTs are configured over NETCONF; the resulting
+verification of supported features.  Generally speaking, this means that
+one or more DUTs are configured over NETCONF or RESTCONF; the resulting
 network is then black-box tested by injecting and inspecting network
 traffic at various points.
 
-This document is intended to be a practical guide on how to run,
-develop and debug tests. There is a separate document describing the
-[Test System Architecture](test-arch.md).
+This document is intended to be a practical guide on how to run, develop
+and debug tests.  There is a separate document describing the [Test
+System Architecture](test-arch.md).
 
-
-Modes of Testing
-----------------
+## Modes of Testing
 
 ### Virtual Devices
 
@@ -21,23 +18,33 @@ By default, tests are run on a topology made up of virtual Infix nodes
 using [Qeneth][]. To run the full regression test suite: build Infix
 for `x86_64`:
 
-    $ make x86_64_defconfig
-    $ make
-    $ make test
+```
+$ make x86_64_defconfig
+...
+$ make
+...
+$ make test
+...
+```
 
 ### Physical Devices
 
 To run the tests on a preexisting topology from the host's network
 namespace, specify the `host` `TEST_MODE`:
 
-    $ make TEST_MODE=host test
+```
+$ make TEST_MODE=host test
+...
+```
 
 This typically used when testing on physical hardware. By default the
 topology will be sourced from `/etc/infamy.dot`, but this can be
 overwritten by setting the `TOPOLOGY` variable:
 
-    $ make TEST_MODE=host TOPOLOGY=~/my-topology.dot test
-
+```
+$ make TEST_MODE=host TOPOLOGY=~/my-topology.dot test
+...
+```
 
 ### `make run` Devices
 
@@ -48,26 +55,29 @@ instance is configured to use TAP networking.
 When the instance is running, you can open a separate terminal and run
 the subset of the test suite that can be mapped to it:
 
-    $ make TEST_MODE=run test
+```
+$ make TEST_MODE=run test
+...
+```
 
-
-Interactive Usage
------------------
+## Interactive Usage
 
 When developing and debugging tests, the overhead of repeatedly
 setting up and tearing down the test environment can quickly start to
 weigh you down. In these situation, you can start an interactive test
 environment:
 
-    $ make test-sh
-    Info: Generating topology
-    Info: Generating node YAML
-    Info: Generating executables
-    Info: Launching dut1
-    Info: Launching dut2
-    Info: Launching dut3
-    Info: Launching dut4
-    11:42:52 infamy0:test #
+```
+$ make test-sh
+Info: Generating topology
+Info: Generating node YAML
+Info: Generating executables
+Info: Launching dut1
+Info: Launching dut2
+Info: Launching dut3
+Info: Launching dut4
+11:42:52 infamy0:test #
+```
 
 The example above uses the default mode (`qeneth`), but the `host` and
 `run` modes also support the `test-sh` target.
@@ -77,22 +87,27 @@ inside the container running Infamy.  It's a very limited environment,
 but it has enough to easily run single tests, connect to the virtual
 devices, and *step* your code.
 
-
 ### Running Subsets of Tests
 
 Each test case is a separate executable, which can be run without
 arguments:
 
-    11:42:53 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+```
+11:42:53 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+```
 
 To run a suite of tests, e.g., only the DHCP client tests, pass the
 suite as an argument to [9PM][]:
 
-    11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml
+```
+11:42:53 infamy0:test # ./9pm/9pm.py case/infix_dhcp/infix_dhcp.yaml
+```
 
 To run the suite of all tests:
 
-    11:42:53 infamy0:test # ./9pm/9pm.py case/all.yaml
+```
+11:42:53 infamy0:test # ./9pm/9pm.py case/all.yaml
+```
 
 ### Connecting to Infamy
 
@@ -100,65 +115,76 @@ The test system runs in a Docker container, so to get a shell prompt in
 *another terminal* you need to connect to that container.  Infamy comes
 with a helper script for this:
 
-    $ ./test/shell
-    11:42:53 infamy0:test #
+```
+$ ./test/shell
+11:42:53 infamy0:test #
+```
 
 By default it connect to the latest started Infamy instance.  If you for
 some reason run multiple instances of Infamy the `shell` script takes an
 optional argument "system", which is the hostname of the container you
 want to connect to:
 
-    $ ./test/shell infamy2
-    11:42:53 infamy2:test #
-
+```
+$ ./test/shell infamy2
+11:42:53 infamy2:test #
+```
 
 ### Connecting to a DUT
 
+> [!TIP]
+> The `console` script uses `telnet` to connect to a port forwarded to
+> `localhost` by the Docker container.  To exit Telnet, use Ctrl-] and
+> then 'q' followed by enter.  This can be customized in `~/.telnetrc`
+
 All DUTs in a virtual Infamy topology are emulated in Qemu instances
 managed by qeneth.  If you want to watch what's happening on one of the
 target systems, e.g., tail a log file or run `tcpdump` during the test,
 there is another helper script in Infamy for this:
 
-    $ ./test/console 1
-    Trying 127.0.0.1...
-    Connected to 127.0.0.1.
+```
+$ ./test/console 1
+Trying 127.0.0.1...
+Connected to 127.0.0.1.
 
-    Infix -- a Network Operating System v23.11.0-226-g0c144da (console)
-    infix-00-00-00 login: admin
-    Password:
-    .-------.
-    |  . .  | Infix -- a Network Operating System
-    |-. v .-| https://kernelkit.org
-    '-'---'-'
+Infix OS — Immutable.Friendly.Secure v23.11.0-226-g0c144da (console)
+infix-00-00-00 login: admin
+Password:
+.-------.
+|  . .  | Infix OS — Immutable.Friendly.Secure
+|-. v .-| https://kernelkit.org
+'-'---'-'
 
-    Run the command 'cli' for interactive OAM
+Run the command 'cli' for interactive OAM
 
-    admin@infix-00-00-00:~$
+admin@infix-00-00-00:~$
+```
 
 From here we can observe `dut1` freely while running tests.
 
-> The `console` script uses `telnet` to connect to a port forwarded to
-> `localhost` by the Docker container.  To exit Telnet, use Ctrl-] and
-> then 'q' followed by enter.  This can be customized in `~/.telnetrc`
-
 Like the `shell` script, `console` takes an optional "system" argument
 in case you run multiple instances of Infamy:
 
-    $ ./test/console 1 infamy2
+```
+$ ./test/console 1 infamy2
+...
+```
 
 You can also connect to the console of a DUT from within a `shell`:
 
-    $ ./test/shell
-    11:42:54 infamy0:test # qeneth status
-    11:42:54 infamy0:test # qeneth console dut1
-    login: admin
-    password: *****
-    admin@infix-00-00-00:~$
-
-> **Note:** disconnect from the qeneth console by using bringing up the
-> old Telnet "menu" using Ctrl-], compared to standard Telnet this is
-> the BusyBox version so you press 'e' + enter instead of 'q' to quit.
+```
+$ ./test/shell
+11:42:54 infamy0:test # qeneth status
+11:42:54 infamy0:test # qeneth console dut1
+login: admin
+password: *****
+admin@infix-00-00-00:~$
+```
 
+> [!TIP]
+> Disconnect from the qeneth console by bringing up the old Telnet
+> "menu" using Ctrl-], compared to standard Telnet this is the BusyBox
+> version so you press 'e' + enter instead of 'q' to quit.
 
 ### Attaching to MACVLANs
 
@@ -171,27 +197,32 @@ interactively inject traffic into the test setup.
 
 First, connect to the Infamy instance in question:
 
-    $ ./test/shell
-    11:43:19 infamy0:test #
+```
+$ ./test/shell
+11:43:19 infamy0:test #
+```
 
 Then, attach to the MACVLAN namespace by running the `nsenter` helper
 script from the test directory, supplying the base interface name as
 the first argument:
 
-    11:43:19 infamy0:test # ./nsenter d1b
-    11:43:20 infamy0(d1b):test #
+```
+11:43:19 infamy0:test # ./nsenter d1b
+11:43:20 infamy0(d1b):test #
+```
 
 By default, an interactive shell is started, but you can also supply
 another command:
 
-    11:43:19 infamy0:test # ./nsenter d1b ip -br addr
-    lo               UNKNOWN        127.0.0.1/8 ::1/128
-    iface@if7        UP             10.0.0.1/24 fe80::38d0:88ff:fe77:b7cd/64
+```
+11:43:19 infamy0:test # ./nsenter d1b ip -br addr
+lo               UNKNOWN        127.0.0.1/8 ::1/128
+iface@if7        UP             10.0.0.1/24 fe80::38d0:88ff:fe77:b7cd/64
+```
 
 You can now freely debug the network activity of your test and the
 responses from the DUT.
 
-
 ### Using the Python Debugger
 
 The built in `breakpoint()` function in Python is very useful when you
@@ -202,13 +233,15 @@ Simply insert a call to `breakpoint()` at the point of interest in
 your test and run it as normal. Once Python executes the call, it will
 drop you into the Python debugger:
 
-    11:42:58 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
-    # Starting (2024-02-10 11:42:59)
-    # Probing dut1 on port d1a for IPv6LL mgmt address ...
-    # Connecting to mgmt IP fe80::ff:fe00:0%d1a:830 ...
-    ok 1 - Initialize
-    > /home/jocke/src/infix/test/case/infix_dhcp/dhcp_basic.py(44)<module>()
-    (Pdb)
+```
+11:42:58 infamy0:test # ./case/infix_dhcp/dhcp_basic.py
+# Starting (2024-02-10 11:42:59)
+# Probing dut1 on port d1a for IPv6LL mgmt address ...
+# Connecting to mgmt IP fe80::ff:fe00:0%d1a:830 ...
+ok 1 - Initialize
+> /home/jocke/src/infix/test/case/infix_dhcp/dhcp_basic.py(44)<module>()
+(Pdb)
+```
 
 At this point you have full access to the test's state, but it is also
 an opportunity to inspect the state of the DUTs (e.g. via their
@@ -218,8 +251,9 @@ It is also possible to run a test under Pdb from the get-go, if you
 want to setup breakpoints without modifying the source, or simply step
 through the code:
 
-    11:42:58 infamy0:test # python -m pdb case/infix_dhcp/dhcp_basic.py
-
+```
+11:42:58 infamy0:test # python -m pdb case/infix_dhcp/dhcp_basic.py
+```
 
 ### Deterministic Topology Mappings
 
@@ -230,34 +264,40 @@ between phyical nodes. In such cases, supplying a `PYTHONHASHSEED`
 variable (set to any 32-bit unsigned integer) when launching the test
 environment will make sure that topology mappings are deterministic:
 
-    $ make PYTHONHASHSEED=0 test-sh
+```
+$ make PYTHONHASHSEED=0 test-sh
+```
 
 If a seed is not supplied, a random value is chosen. This seed is
 logged by the `meta/reproducible.py` test case when running a test
 suite:
 
-    $ make test
-    Info: Generating topology
-    Info: Generating node YAML
-    Info: Generating executables
-    Info: Launching dut1
-    Info: Launching dut2
-    Info: Launching dut3
-    Info: Launching dut4
-    9PM - Simplicity is the ultimate sophistication
+```
+$ make test
+Info: Generating topology
+Info: Generating node YAML
+Info: Generating executables
+Info: Launching dut1
+Info: Launching dut2
+Info: Launching dut3
+Info: Launching dut4
+9PM - Simplicity is the ultimate sophistication
 
-    Starting test 0002-reproducible.py
-    2024-05-03 10:40:30 # Starting (2024-05-03 10:40:30)
-    2024-05-03 10:40:30 # Specify PYTHONHASHSEED=3773822171 to reproduce this test environment
-    2024-05-03 10:40:30 ok 1 - $PYTHONHASHSEED is set
-    2024-05-03 10:40:30 # Exiting (2024-05-03 10:40:30)
-    2024-05-03 10:40:30 1..1
-    ...
+Starting test 0002-reproducible.py
+2024-05-03 10:40:30 # Starting (2024-05-03 10:40:30)
+2024-05-03 10:40:30 # Specify PYTHONHASHSEED=3773822171 to reproduce this test environment
+2024-05-03 10:40:30 ok 1 - $PYTHONHASHSEED is set
+2024-05-03 10:40:30 # Exiting (2024-05-03 10:40:30)
+2024-05-03 10:40:30 1..1
+...
+```
 
 This is useful because this value can then be used to rerun a test (or
 the whole suite) with identical topology mappings:
 
-    $ make PYTHONHASHSEED=3773822171 TESTS=case/ietf_system/hostname.py test
+```
+$ make PYTHONHASHSEED=3773822171 TESTS=case/ietf_system/hostname.py test
+```
 
 ### Deterministic Transport Protocol
 
@@ -266,13 +306,16 @@ chosen randomly.  If you supply a `PYTHONHASHSEED` as described above,
 you get the same protocol used for that hash.  But if you want to choose
 the protocol, add extra arguments to Infamy:
 
-    $ make INFAMY_EXTRA_ARGS="--transport=restconf" TESTS=case/ietf_system/hostname.py test
+```
+$ make INFAMY_EXTRA_ARGS="--transport=restconf" TESTS=case/ietf_system/hostname.py test
+```
 
 or, when running interactively:
 
-    $ make test-sh
-    09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/ietf_system/hostname.py
-
+```
+$ make test-sh
+09:08:17 infamy0:test # ./9pm/9pm.py -o"--transport=restconf" case/ietf_system/hostname.py
+```
 
 ### Test specification
 
@@ -287,13 +330,13 @@ for example:
 ```python
 test.step("Set IPv4 address on the interface dut:cross")
 test.step("Verify the IP address is set on dut:cross")
-
 ```
-where dut, cross and the IPv4 address could be found inside the
+
+where *dut*, *cross* and the IPv4 address could be found inside the
 logical topology for the test.
 
-Each test case must begin with the test name followed by a empty line and
-the description of the test. For example:
+Each test case must begin with the test name followed by a empty line
+and the description of the test. For example:
 
 ```
 """
@@ -305,32 +348,35 @@ Verify that it it possible to change hostname
 
 The test specifaction can be genererated with:
 
-	$ make test-spec
+```
+$ make test-spec
+...
+```
 
 ### Test Development
 
 For adding a new test to the automated regression test suite, it's best
 to start by reviewing an existing test case.
 
-All tests are located in the `infix/test/case` repository and are 
-grouped by the features they verify. For example, 
-`infix/test/case/infix_services` contains tests for various Infix 
+All tests are located in the `infix/test/case` repository and are
+grouped by the features they verify. For example,
+`infix/test/case/infix_services` contains tests for various Infix
 services, such as LLDP and mDNS.
 
-While test grouping is flexible, each test should be placed in a 
+While test grouping is flexible, each test should be placed in a
 logically relevant category.
 
-When creating a new test group, add it to `infix/test/case/all.yaml`,
-to enable it to run as a 
-[subset of the test suite](#running-subsets-of-tests):
+When creating a new test group, add it to `infix/test/case/all.yaml`, to
+enable it to run as a [subset of the test
+suite](#running-subsets-of-tests):
 
 ```
 - name:  infix-services
   suite: infix_services/infix_services.yaml
 ```
 
-A new test (e.g., lldp_enable_disable) should be added to the 
-corresponding test group .yaml file, such as 
+A new test (e.g., lldp_enable_disable) should be added to the
+corresponding test group .yaml file, such as
 `infix/test/cases/infix_services.yaml`:
 
 ```
@@ -338,21 +384,22 @@ corresponding test group .yaml file, such as
   case: lldp_enable_disable/test.py
 ```
 
-It is necessary to include the test in 
-`infix/test/case/infix_services/Readme.adoc` to ensure proper test 
+It is necessary to include the test in
+`infix/test/case/infix_services/Readme.adoc` to ensure proper test
 specification generation:
 
 ```
 include::lldp_enable_disable/Readme.adoc[]
 ```
 
-Each test case should have its own directory under, 
-`infix/test/case/infix_services`, containing: 
-  - `test.py` - the test script
-  - `topology.dot` - the logical topology definition.
+Each test case should have its own directory under,
+`infix/test/case/infix_services`, containing:
 
-When the [test specification](#test-specification) is generated, 
-`topology.svg` and `Readme.adoc` should also be created. 
+- `test.py` - the test script
+- `topology.dot` - the logical topology definition.
+
+When the [test specification](#test-specification) is generated,
+`topology.svg` and `Readme.adoc` should also be created.
 
 [9PM]:    https://github.com/rical/9pm
 [Qeneth]: https://github.com/wkz/qeneth

doc/upgrade.md

@@ -0,0 +1,429 @@
+# Upgrading & Boot Order
+
+For resilience purposes, Infix maintains two software images referred to
+as the _primary_ and _secondary_ partition image.  In addition, some
+bootloaders support [netbooting][1].
+
+The _boot order_ defines which image is tried first, and is listed with
+the CLI `show software` command. It also shows Infix version installed
+per partition, and which image was used when booting (`STATE booted`).
+
+```
+admin@example:/> show software
+BOOT ORDER
+primary secondary net
+
+NAME      STATE     VERSION                DATE
+primary   booted    v25.01.0               2025-04-25T10:15:00+00:00
+secondary inactive  v25.01.0               2025-04-25T10:07:20+00:00
+admin@example:/>
+```
+
+YANG support for upgrading Infix, inspecting and _modifying_ the
+boot-order, is defined in [infix-system-software][2].
+
+
+## Upgrading
+
+Upgrading Infix is done one partition at a time. If the system has
+booted from one partition, an `upgrade` will apply to the other
+(inactive) partition.
+
+1. Download and unpack the release to install. Make the image *pkg*
+   bundle available at some URL[^2]
+2. (Optional) Backup the startup configuration
+3. Assume the unit has booted the `primary` image. Then running the
+   `upgrade` command installs a new image on the `secondary` partition
+4. As part of a successful upgrade, the boot-order is implictly
+   changed to boot the newly installed image
+5. Reboot the unit
+6. The unit now runs the new image. To upgrade the remaining partition
+   (`primary`), run the same upgrade command again, and (optionally)
+   reboot to verify the upgrade
+
+> [!CAUTION]
+> During boot (step 5), the unit may [migrate](#configuration-migration)
+> the startup configuration for any syntax changes.  It is therefore
+> important that you make sure to upgrade the other partition as well
+> after reboot, of course after having verified your setup.
+
+The CLI example below shows steps 2-5.
+
+*Backup startup configuration:* It is recommended to backup the startup
+configuration before performing an upgrade. The backup is useful if the
+upgrade fails, and makes a later [downgrade](#downgrading) a smoother
+process.
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg
+
+admin@example:/> copy /cfg/startup-config.cfg /cfg/v25.01.0-startup-config.cfg
+admin@example:/> dir /cfg
+/cfg directory
+backup/             ssl/                startup-config.cfg           v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+*Upgrade:* Here the image *pkg bundle* was made available via TFTP.
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.03.1.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+...
+ 98% Copying image to rootfs.1
+ 99% Copying image to rootfs.1
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.03.1.pkg` succeeded
+admin@example:/>
+```
+
+*Reboot:* The unit will boot on the other partition, with the newly
+installed image. The `Loading startup-config` step conducts migration
+of startup configuration if applicable.
+
+```
+admin@example:/> reboot
+[ OK ] Stopping Static routing daemon
+[ OK ] Stopping Zebra routing daemon
+...
+[ OK ] Loading startup-config
+[ OK ] Verifying self-signed https certificate
+[ OK ] Update DNS configuration
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.03.1 (ttyS0)
+example login: admin
+Password:
+.-------.
+|  . .  | Infix OS — Immutable.Friendly.Secure
+|-. v .-| https://kernelkit.org
+'-'---'-'
+
+Run the command 'cli' for interactive OAM
+
+admin@example:~$ cli
+
+See the 'help' command for an introduction to the system
+
+admin@example:/> show software
+BOOT ORDER
+secondary primary net
+
+NAME      STATE     VERSION                DATE
+primary   inactive  v25.01.0               2025-04-25T10:15:00+00:00
+secondary booted    v25.03.1               2025-04-25T10:24:31+00:00
+admin@example:/>
+```
+
+As shown, the *boot order* has been updated, so that *secondary* is
+now the preferred boot source.
+
+To upgrade the remaining partition (`primary`), run the `upgrade URL`
+command again, and (optionally) reboot.
+
+## Configuration Migration
+
+The example above illustrated an upgrade from Infix v25.01.0 to
+v25.03.1. Inbetween these versions, YANG configuration definitions
+changed slightly (more details given below).
+
+During boot, Infix inspects the `version` meta information within the
+startup configuration file to determine if configuration migration is
+needed. In this specific case, the configuration file has version
+`1.4` while the booted software expects version `1.5` (the
+configuration version numbering differs from the Infix image version
+numbering).  The startup configuration is migrated to `1.5`
+definitions and stored, while a backup previous startup configuration
+is stored in directory `/cfg/backup/`.
+
+```
+admin@example:/> dir /cfg/backup/
+/cfg/backup/ directory
+startup-config-1.4.cfg
+
+admin@example:/>
+```
+
+The modifications made to the startup configuration can be viewed by
+comparing the files from the *shell*. An example is shown below.
+
+```
+admin@example:/> exit
+admin@example:~$ diff /cfg/backup/startup-config-1.4.cfg /cfg/startup-config.cfg
+--- /cfg/backup/startup-config-1.4.cfg
++++ /cfg/startup-config.cfg
+...
+-          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
++          "public-key-format": "infix-crypto-types:ssh-public-key-format",
+...
+-          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
++          "private-key-format": "infix-crypto-types:rsa-private-key-format",
+...
+-    "version": "1.4"
++    "version": "1.5"
+...
+admin@example:~$
+```
+
+## Downgrading
+
+Downgrading to an earlier version is possible, however, downgrading is
+**not** guaranteed to work smoothly.  In particular, when the unit boots
+up with the downgraded version, it may fail to apply the *startup
+config*, and instead apply its [failure config][3].
+
+We consider two cases: downgrading with and without applying a backup
+startup configuration before rebooting.
+
+In both cases we start out with a unit running Infix v25.03.1, and
+wish to downgrade to v25.01.0.
+
+```
+admin@example:/> show software
+BOOT ORDER
+primary secondary net
+
+NAME      STATE     VERSION                DATE
+primary   booted    v25.03.1               2025-04-25T11:36:26+00:00
+secondary inactive  v25.03.1               2025-04-25T10:24:31+00:00
+admin@example:/>
+```
+
+### With Backup `startup-config`
+
+This is the recommended approach to downgrade, given that you have a
+backup configuration available.  The objective is to avoid ending up
+with the unit in *failure config*.
+
+1. Find the backup configuration file
+1. Run `upgrade URL` to install Infix image to downgrade to
+1. Copy backup startup configuration to current startup configuration
+   (from shell)
+1. Reboot
+
+*Find the backup configuration file:*
+
+Assume you have a backup startup config for the Infix version to
+downgrade to (here Infix v25.01.0, config `version 1.4`).
+
+The preferred approach is to use a startup configuration backed up when
+running Infix v25.01.0 on the unit.  See section [Upgrading](#upgrading)
+above for more information.  In the following example, there is a backup
+file available named `v25.01.0-startup-config.cfg`:
+
+```
+admin@example:/> dir /cfg
+/cfg directory
+backup/       ssl/       startup-config.cfg    v25.01.0-startup-config.cfg
+
+admin@example:/> 
+```
+
+The alternative is to use a startup config implicitly backed up by the
+system as part of [Configuration Migration](#configuration-migration).
+
+```
+admin@example:/> dir /cfg/backup/
+/cfg/backup/ directory
+startup-config-1.4.cfg
+
+admin@example:/>
+```
+
+> [!CAUTION]
+> Using a backup configuration file stored when the unit was running the
+> old version (e.g., v25.01.0-startup-config.cfg) is preferred.  Although
+> backup files stored due to configuration migration (e.g.,
+> `startup-config-1.4.cfg`) usually works too if the configuration file
+> version (`1.4`) matches, there are situations when the system may fail
+> to apply it as described below.
+
+The *configuration file version* (`1.4`) is only incremented when
+changes in YANG configuration syntax mandates it to handle *upgrading*.
+Say the next Infix version includes a new feature setting, it can still
+have version `1.4`, as upgrading to it would not need migration. If a
+user then enables the new feature setting, the new configuration will no
+longer be compatible with the previous *Infix version*. A downgrade
+after enabling new features risks ending up with the unit in *failure
+config*.
+
+*Use `upgrade` command to downgrade:*
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.01.0.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+ ...
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.01.0.pkg` succeeded
+admin@example:/>
+```
+
+*Apply the backup configuration file:*
+
+It is recommended to use a backup configuration file for the Infix version to
+downgrade to, if there is one available.
+
+```
+admin@example:/> copy /cfg/v25.01.0-startup-config.cfg /cfg/startup-config.cfg
+Overwrite existing file /cfg/startup-config.cfg (y/N)? y
+admin@example:/>
+```
+
+An alternative is to use a backup file stored when the system
+conducted a [configuration migration](#configuration-migration). See
+the *caution* note above.
+
+```
+admin@example:/> copy /cfg/backup/startup-config-1.4.cfg /cfg/startup-config.cfg
+Overwrite existing file /cfg/startup-config.cfg (y/N)? y
+admin@example:/>
+```
+
+*Reboot:*
+
+The unit will come up with the applied backup configuration.
+
+```
+admin@example:/> reboot
+[ OK ] Saving system clock to file
+[ OK ] Stopping Software update service
+[ OK ] Stopping Status daemon
+...
+[ OK ] Bootstrapping YANG datastore
+[ OK ] Starting Configuration daemon
+[ OK ] Loading startup-config
+[ OK ] Update DNS configuration
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+example login:
+```
+
+> [!NOTE]
+> If the unit despite these measures ends up in *failure config*, see
+> the next section for more information on how to recover.
+
+### Without a Backup `startup-config`
+
+This procedure assumes you have access to the unit's console port and
+its default login credentials[^1].
+
+1. Downgrade
+1. Reboot
+1. Login with unit's default credentials
+1. Conduct factory reset
+1. (Then go on configure the unit as you wish)
+
+*Use `upgrade` command to downgrade:*
+
+```
+admin@example:/> upgrade tftp://198.18.117.1/infix-aarch64-25.01.0.pkg
+installing
+  0% Installing
+  0% Determining slot states
+ 10% Determining slot states done.
+ ...
+ 99% Copying image to rootfs.1 done.
+ 99% Updating slots done.
+100% Installing done.
+Installing `tftp://198.18.117.1/infix-aarch64-25.01.0.pkg` succeeded
+admin@example:/>
+```
+
+*Reboot:*
+
+Conduct a reboot. During boot, the unit fails to apply the existing
+startup configuration (config version `1.5` while software expects
+version `1.4` or earlier), and instead applies its [failure
+config][3]. This is what is seen on the console when this situation
+occurs. Note that the login prompt displays `failed` as part of the
+*hostname*.
+
+```
+admin@example:/> reboot
+[ OK ] Saving system clock to file
+[ OK ] Stopping Software update service
+[ OK ] Stopping Status daemon
+...
+[ OK ] Verifying SSH host keys
+[ OK ] Bootstrapping YANG datastore
+[ OK ] Starting Configuration daemon
+[FAIL] Loading startup-config
+[ OK ] Loading failure-config
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+
+ERROR: Corrupt startup-config, system has reverted to default login credentials
+failed-00-00-00 login:
+```
+
+To remedy a situation like this, you can login with the unit's *default
+login credentials*, preferrably via a [console port][4].
+The unit's default credentials are typically printed on a sticker on
+the unit.
+
+```
+failed-00-00-00 login: admin
+Password:
+
+Run the command 'cli' for interactive OAM
+
+admin@failed-00-00-00:~$
+```
+
+When it is *safe* from a network operations perspective, you can
+conduct a factory reset and reboot. It is recommended to remove the
+unit from any production network before doing this, as a factory reset
+may enable undesired connectivity between the unit's ports.
+
+```
+admin@failed-00-00-00:~$ factory
+Factory reset device (y/N)? y
+factory: scheduled factory reset on next boot.
+Reboot now to perform reset, (y/N)? y
+[ OK ] Saving system time (UTC) to RTC
+[ OK ] Stopping mDNS alias advertiser
+...
+[ OK ] Starting Configuration daemon
+[ OK ] Loading startup-config
+[ OK ] Update DNS configuration
+[ OK ] Verifying self-signed https certificate
+[ OK ] Starting Status daemon
+[ OK ] Starting Status daemon
+
+
+Please press Enter to activate this console.
+
+Infix OS — Immutable.Friendly.Secure v25.01.0 (ttyS0)
+example login:
+```
+
+Continued configuration is done as with any unit after factory reset.
+
+[1]: netboot.md
+[2]: https://github.com/kernelkit/infix/blob/main/src/confd/yang/confd/infix-system-software.yang
+[3]: boot.md#system-boot
+[4]: management.md#console-port
+[5]: scripting.md#-backup-configuration-using-sysrepocfg-and-scp
+
+[^1]: In failure config, Infix puts all Ethernet ports as individual
+    interfaces. With direct access, one can connect with e.g., SSH,
+    using link local IPv6 addresses. This as an alternative to
+    connecting via a console port.
+[^2]: Set up an FTP/TFTP/SFTP or HTTP/HTTPS server on the same LAN.

doc/virtual.md

@@ -1,5 +1,5 @@
-Infix in Virtual Environments
-=============================
+Virtual Environments
+=====================
 
 Infix primarily targets real hardware, deployment to the cloud is not a
 priority at the moment.  However, for development and testing purposes
@@ -9,33 +9,38 @@ These images also work with the Graphical Network Simulator ([GNS3][]),
 which is a very user-friendly tool for playing around with simple to
 complex network setups, verifying interoperability between vendors, etc.
 
-
 QEMU
 ----
 
-> **Note:** installation for Debian/Ubuntu based systems: <kbd>sudo apt
-> install virt-manager</kbd> -- dependencies ensure the relevant Qemu
-> packages are pulled in as well.  Installing [virt-manager][virt] helps
-> set up Qemu networking on your system.
+> [!TIP]
+> Installation for Debian/Ubuntu based systems can be done by "simply":
+> <kbd>sudo apt install virt-manager</kbd> -- dependencies ensure the
+> relevant Qemu packages are pulled in as well.  This trick, installing
+> [virt-manager][virt], helps set up Qemu networking on your system.
 
 A virtualized Infix x86_64 instance can easily be launched from a Linux
 system, with [Qemu][] installed, by issuing:
 
-    ./qemu.sh
+```
+$ ./qemu.sh
+...
+```
 
 from an unpacked [release tarball][rels].  From a built source tree of
 Infix the same functionality is bundled as:
 
-    make run
+```
+$ make run
+...
+```
 
 To change settings, e.g. networking, <kbd>make run-menuconfig</kbd>, or
 from a pre-built Infix release tarball, using <kbd>./qemu.sh -c</kbd>
 
 The Infix test suite is built around Qemu and [Qeneth][qeth], see:
 
- * [Testing](testing.md)
- * [Docker Image](../test/docker/README.md)
-
+* [Regression Testing with Infamy](testing.md)
+* [Infamy Docker Image](https://github.com/kernelkit/infix/blob/main/test/docker/README.md)
 
 GNS3
 ----

doc/vpd.md

@@ -74,12 +74,13 @@ encoded strings is a decision imposed by Infix; the ONIE specification
 allows for arbitrary binary data.
 
 **Example**:
+
 ```json
 {
-	...
-	"vendor-extension": [
-		[ 12345, "my extension data" ]
-	]
+    ...
+    "vendor-extension": [
+        [ 12345, "my extension data" ]
+    ]
 }
 ```
 
@@ -102,12 +103,13 @@ Since the extension is itself stored in a JSON document, it has to be
 appropriately quoted.
 
 **Example**:
+
 ```json
 {
-	...
-	"vendor-extension": [
-		[ 61046, "{\"pwhash\":\"$6$9rufAxdqCrxrwfQR$G0l9cTVlu/vOhxgo/uMKfRDOmZRd5XWF3vKr5da6qYoxuTJBS/Pl9K.5lrabWoWFFc.71yFMaSlZz0O8FtAtl.\"}" ]
-	]
+    ...
+    "vendor-extension": [
+        [ 61046, "{\"pwhash\":\"$6$9rufAxdqCrxrwfQR$G0l9cTVlu/vOhxgo/uMKfRDOmZRd5XWF3vKr5da6qYoxuTJBS/Pl9K.5lrabWoWFFc.71yFMaSlZz0O8FtAtl.\"}" ]
+    ]
 }
 ```
 
@@ -152,9 +154,8 @@ binary in its equivalent JSON representation:
 }
 ```
 
-
 [oniespec]: https://opencomputeproject.github.io/onie/design-spec/hw_requirements.html
-[onieprom]: ../board/common/rootfs/bin/onieprom
+[onieprom]: https://github.com/kernelkit/infix/blob/main/board/common/rootfs/usr/bin/onieprom
 [driver]: https://elixir.bootlin.com/linux/latest/source/drivers/nvmem/layouts/onie-tlv.c
 [pens]: https://www.iana.org/assignments/enterprise-numbers/
 [kkit]: https://github.com/kernelkit

doc/wifi.md

@@ -0,0 +1,152 @@
+# Wi-Fi (Wireless LAN)
+
+Infix includes built-in Wi-Fi client support for connecting to
+wireless networks. When a compatible Wi-Fi adapter is detected, the
+system automatically begins scanning for available networks.
+
+## Current Limitations
+
+- Only client mode is supported (no access point functionality)
+- USB hotplug is not supported - adapters must be present at boot
+- Interface naming may be inconsistent with multiple USB Wi-Fi adapters
+
+## Supported Wi-Fi Adapters
+
+Wi-Fi support is primarily tested with Realtek chipset-based adapters.
+
+### Known Working Chipsets
+
+- RTL8821CU
+- Other Realtek chipsets may work but are not guaranteed
+
+
+> [!NOTE]  Some Realtek chipsets require proprietary drivers not included in the standard kernel
+>          Firmware requirements vary by chipset
+>          Check kernel logs if your adapter is not detected
+
+## Configuration
+
+Add a supported Wi-Fi network device. To verify that it has been
+detected, look for `wifi0` in `show interfaces`
+
+```
+admin@example:/>  show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   DOWN        f0:09:0d:36:5f:86
+                wifi                   ssid: ------, signal: ------
+
+```
+Add the new Wi-Fi interface to the configuration to start scanning.
+```
+admin@example:/config/> set interface wifi0
+admin@example:/config/> leave
+```
+Now the system will now start scanning in the background. To
+see the result read the operational datastore for interface `wifi0` or
+use the CLI
+
+```
+admin@infix-00-00-00:/> show interfaces name wifi0
+name                : wifi0
+type                : wifi
+index               : 3
+mtu                 : 1500
+operational status  : down
+physical address    : f0:09:0d:36:5f:86
+ipv4 addresses      :
+ipv6 addresses      :
+SSID                : ----
+Signal              : ----
+
+SSID                                    ENCRYPTION                    SIGNAL
+ssid1                                   WPA2-Personal                 excellent
+ssid2                                   WPA2-Personal                 excellent
+ssid3                                   WPA2-Personal                 excellent
+ssid4                                   WPA2-Personal                 good
+ssid5                                   WPA2-Personal                 good
+ssid6                                   WPA2-Personal                 good
+```
+
+In the CLI, signal strength is reported as: excellent, good, poor or
+bad. For precise values, use NETCONF or RESTCONF, where the RSSI (in
+dBm) is available in the operational datastore.
+
+Configure your Wi-Fi secret in the keystore, it should be between 8
+and 63 characters
+
+```
+admin@example:/> configure
+admin@example:/config/> edit keystore symmetric-key example
+admin@example:/config/keystore/symmetric-key/example/> set key-format wifi-preshared-key-format
+admin@example:/config/keystore/symmetric-key/example/> set cleartext-key mysecret
+admin@example:/config/keystore/symmetric-key/example/> leave
+admin@example:/>
+```
+
+Configure the Wi-Fi settings, set secret to the name selected above
+for the symmetric key, in this case `example`.
+
+WPA2 or WPA3 encryption will be automatically selected based on what
+the access point supports. No manual selection is required unless
+connecting to an open network. No support for certificate based
+authentication yet.
+
+Unencrypted network is also supported, to connect to an unencrypted
+network (generally not recommended):
+```
+admin@example:/config/interface/wifi0/> set wifi encryption disabled
+```
+
+A valid `country-code` is also required for regulatory compliance, the
+valid codes are documented in the YANG model `infix-wifi-country-codes`
+
+
+```
+admin@example:/> configure
+admin@example:/config/> edit interface wifi0
+admin@example:/config/interface/wifi0/>
+admin@example:/config/interface/wifi0/> set wifi ssid ssid1
+admin@example:/config/interface/wifi0/> set wifi secret example
+admin@example:/config/interface/wifi0/> set wifi country-code SE
+admin@example:/config/interface/wifi0/> leave
+```
+
+The Wi-Fi negotiation should now start immediately, provided that the
+SSID and pre-shared key are correct. You can verify the connection by
+running `show interfaces` again.
+
+
+```
+admin@example:/> show interfaces
+INTERFACE       PROTOCOL   STATE       DATA
+lo              loopback   UP
+                ipv4                   127.0.0.1/8 (static)
+                ipv6                   ::1/128 (static)
+e1              ethernet   UP          02:00:00:00:00:01
+                ipv6                   fe80::ff:fe00:1/64 (link-layer)
+                ipv6                   fec0::ff:fe00:1/64 (link-layer)
+wifi0           ethernet   UP          f0:09:0d:36:5f:86
+                wifi                   ssid: ssid1, signal: excellent
+
+admin@example:/>
+```
+
+## Troubleshooting Connection Issues
+
+Use `show wifi scan wifi0` and `show interfaces` to verify signal strength
+and connection status. If issues arise, try the following
+troubleshooting steps:
+
+1. **Verify signal strength**: Check that the target network shows "good" or "excellent" signal
+2. **Check credentials**: Verify the preshared key in `ietf-keystore`
+3. **Review logs**: Check system logs with `show log` for Wi-Fi related errors
+4. **Regulatory compliance**: Ensure the country-code matches your location
+5. **Hardware detection**: Confirm the adapter appears in `show interfaces`
+
+If issues persist, check the system log for specific error messages that can help identify the root cause.

mkdocs.yml

@@ -0,0 +1,135 @@
+site_name: User's Guide
+site_description: Infix Documentation
+site_url: https://kernelkit.github.io/infix/
+repo_url: https://github.com/kernelkit/infix/
+repo_name: kernelkit/infix
+copyright: Copyright © 2022-2025 The KernelKit Team
+docs_dir: doc/
+edit_uri: edit/master/doc/
+extra_css:
+  - extra.css
+
+exclude_docs: |
+  ChangeLog.md
+  cli/README.md
+  README.md
+  TODO.org
+
+nav:
+  - Introduction: index.md
+  - CLI:
+      - Introduction: cli/introduction.md
+      - Configuration: cli/configure.md
+      - Keybindings: cli/keybindings.md
+      - Network Calculator: cli/netcalc.md
+      - Network Monitoring: cli/tcpdump.md
+      - Quickstart Guide:  cli/quick.md
+      - Text Editor: cli/text-editor.md
+      - Upgrading: cli/upgrade.md
+  - Docker Containers: container.md
+  - Networking:
+      - Network Configuration: networking.md
+      - Quality of Service: qos.md
+      - RMON Counters: eth-counters.md
+      - Tunneling (L2/L3): tunnels.md
+      - Wireless LAN (WiFi): wifi.md
+  - Services:
+      - Device Discovery: discovery.md
+      - DHCP Server: dhcp.md
+  - System:
+      - Boot Procedure: boot.md
+      - Configuration: system.md
+      - Hardware Info & Status: hardware.md
+      - Management: management.md
+      - Syslog Support: syslog.md
+      - Upgrade: upgrade.md
+  - Scripting:
+      - Introduction: scripting.md
+      - Legacy Scripting: scripting-sysrepocfg.md
+      - Production Testing: scripting-prod.md
+      - Remote RESTCONF: scripting-restconf.md
+  - Developer's Corner:
+      - Branding & Releases: branding.md
+      - Developer's Guide: developers-guide.md
+      - Developing with Buildroot: override-package.md
+      - Netboot HowTo: netboot.md
+      - Regression Testing: testing.md
+      - Test System Architecture: test-arch.md
+      - Virtual Environments: virtual.md
+      - Vital Product Data (VPD): vpd.md
+  - Origin & Licensing: license.md
+
+theme:
+  logo: logo-plain.png
+  name: material
+  features:
+    - toc.follow
+#    - toc.integrate
+    - navigation.path
+    - navigation.instant
+    - navigation.instant.progress
+    - navigation.tracking
+    - navigation.indexes
+#    - navigation.tabs
+#    - navigation.sections
+#    - navigation.expand
+#    - navigation.top
+#    - navigation.footer
+    - search.highlight
+    - search.share
+#    - content.action.edit
+    - content.code.copy
+    - content.code.annotate
+    - content.footnote.tooltips
+  palette:
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      primary: orange
+      accent: orange
+      toggle:
+        icon: material/weather-night
+        name: Switch to dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      primary: black
+      accent: orange
+      toggle:
+        icon: material/weather-sunny
+        name: Switch to light mode
+
+markdown_extensions:
+  - admonition
+  - attr_list
+  - footnotes
+  - pymdownx.details
+  - pymdownx.superfences
+  - pymdownx.highlight:
+      anchor_linenums: true
+  - pymdownx.inlinehilite
+  - pymdownx.snippets
+  - pymdownx.tabbed:
+      alternate_style: true
+  - tables
+  - toc:
+      permalink: true
+
+plugins:
+  - search
+  - callouts
+  - mike
+  - to-pdf:
+      cover: true
+      enabled_if_env: PDF_EXPORT
+      cover_logo: logo-plain.png
+      cover_subtitle: Immutable.Friendly.Secure
+      custom_template_path: doc/templates
+      output_path: pdf/infix-user-guide.pdf
+      toc_level: 2
+      ordered_chapter_level: 3
+      heading_shift: false
+
+extra:
+  generator: false
+  homepage: https://kernelkit.org/
+  version:
+    provider: mike

package/Config.in

@@ -2,6 +2,7 @@ menu "Packages"
 
 comment "Hardware Support"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/feature-wifi/Config.in"
 
 comment "Software Packages"
 source "$BR2_EXTERNAL_INFIX_PATH/package/bin/Config.in"
@@ -9,7 +10,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/confd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/confd-test-mode/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/curios-httpd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/curios-nftables/Config.in"
-source "$BR2_EXTERNAL_INFIX_PATH/package/execd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/gencert/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/factory/Config.in"
@@ -34,6 +34,7 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/python-libyang/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-statd/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/python-yangdoc/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/skeleton-init-finit/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/show/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/tetris/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/libyang-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/sysrepo-cpp/Config.in"
@@ -41,5 +42,4 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/rousette/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/nghttp2-asio/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/date-cpp/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/rauc-installation-status/Config.in"
-
 endmenu

package/board/Config.in

@@ -6,5 +6,6 @@ source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-cn9130-crb/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/marvell-espressobin/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/microchip-sparx5-pcb135/Config.in"
 source "$BR2_EXTERNAL_INFIX_PATH/package/board/styx-dcp-sc-28p/Config.in"
+source "$BR2_EXTERNAL_INFIX_PATH/package/board/raspberry-pi-4/Config.in"
 
 endmenu

package/board/board.mk

@@ -1,53 +1,2 @@
-define inner-ix-board
-
-$(2)_VERSION = ix-board
-$(2)_LICENSE = BSD-3-Clause
-$(2)_LICENSE_FILES = LICENSE
-$(2)_SITE_METHOD = local
-$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
-$(2)_REDISTRIBUTE = NO
-
-# The kernel must be built first.
-$(2)_DEPENDENCIES += \
-	linux \
-	$$(BR2_MAKE_HOST_DEPENDENCY)
-
-# This is only defined in some infrastructures (e.g. autotools, cmake),
-# but not in others (e.g. generic). So define it here as well.
-$(2)_MAKE ?= $$(BR2_MAKE)
-
-define $(2)_DTBS_BUILD
-	@$$(call MESSAGE,"Building device tree blob(s)")
-	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
-		-C $$(LINUX_DIR) \
-		$$(LINUX_MAKE_FLAGS) \
-		$$($(2)_DTB_MAKE_OPTS) \
-		PWD=$$(@D)/dts \
-		M=$$(@D)/dts \
-		modules
-endef
-$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
-
-define $(2)_DTBS_INSTALL_TARGET
-	@$$(call MESSAGE,"Installing device tree blob(s)")
-	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
-		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
-		-C $$(@D)/dts \
-		DESTDIR="$$(TARGET_DIR)" \
-		install
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
-
-define $(2)_OVERLAY_INSTALL_TARGET
-	@test -d $$(@D)/rootfs && \
-	$$(call MESSAGE,"Copying overlay") && \
-	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
-	true
-endef
-$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
-
-endef
-
-ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))
-
+include $(BR2_EXTERNAL_INFIX_PATH)/package/board/ix-board.mk
 include $(sort $(wildcard $(BR2_EXTERNAL_INFIX_PATH)/package/board/*/*.mk))

package/board/freescale-imx8mp-evk/imx8mp-evk.mk

@@ -20,6 +20,26 @@ define FREESCALE_IMX8MP_EVK_LINUX_CONFIG_FIXUPS
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_INTERCONNECT_IMX8MP)
 	$(call KCONFIG_ENABLE_OPT,CONFIG_REALTEK_PHY)
+# For X
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_ETNAVIV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_DW_HDMI_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PHY_FSL_SAMSUNG_HDMI_PHY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX8MP_HDMI_PVI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_IMX_LCDIF)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSEDEV)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_HID_GENERIC)
+
+# For USB
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3)
+	$(call KCONFIG_DISABLE_OPT,CONFIG_USB_DWC3_GADGET)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_USB_DWC3_HOST)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARM_IMX_BUS_DEVFREQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_TCPCI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_TYPEC_SWITCH_GPIO)
 endef
 
 $(eval $(ix-board))

package/board/ix-board.mk

@@ -0,0 +1,51 @@
+define inner-ix-board
+
+$(2)_VERSION = ix-board
+$(2)_LICENSE = BSD-3-Clause
+$(2)_LICENSE_FILES = LICENSE
+$(2)_SITE_METHOD = local
+$(2)_SITE = $$(BR2_EXTERNAL_INFIX_PATH)/src/board/$(1)
+$(2)_REDISTRIBUTE = NO
+
+# The kernel must be built first.
+$(2)_DEPENDENCIES += \
+	linux \
+	$$(BR2_MAKE_HOST_DEPENDENCY)
+
+# This is only defined in some infrastructures (e.g. autotools, cmake),
+# but not in others (e.g. generic). So define it here as well.
+$(2)_MAKE ?= $$(BR2_MAKE)
+
+define $(2)_DTBS_BUILD
+	@$$(call MESSAGE,"Building device tree blob(s)")
+	$$(LINUX_MAKE_ENV) $$($$(PKG)_MAKE) \
+		-C $$(LINUX_DIR) \
+		$$(LINUX_MAKE_FLAGS) \
+		$$($(2)_DTB_MAKE_OPTS) \
+		PWD=$$(@D)/dts \
+		M=$$(@D)/dts \
+		modules
+endef
+$(2)_POST_BUILD_HOOKS += $(2)_DTBS_BUILD
+
+define $(2)_DTBS_INSTALL_TARGET
+	@$$(call MESSAGE,"Installing device tree blob(s)")
+	$$(TARGET_MAKE_ENV) $$(TARGET_CONFIGURE_OPTS) $$($$(PKG)_MAKE) \
+		-f $$(BR2_EXTERNAL_INFIX_PATH)/package/board/dtb-inst.makefile \
+		-C $$(@D)/dts \
+		DESTDIR="$$(TARGET_DIR)" \
+		install
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_DTBS_INSTALL_TARGET
+
+define $(2)_OVERLAY_INSTALL_TARGET
+	@test -d $$(@D)/rootfs && \
+	$$(call MESSAGE,"Copying overlay") && \
+	$$(call SYSTEM_RSYNC,$$(@D)/rootfs,$(TARGET_DIR)) || \
+	true
+endef
+$(2)_POST_INSTALL_TARGET_HOOKS += $(2)_OVERLAY_INSTALL_TARGET
+
+endef
+
+ix-board = $(call inner-ix-board,$(pkgname),$(call UPPERCASE,$(pkgname)))

package/board/raspberry-pi-4/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_RASPBERRY_PI_4
+	bool "Raspberry Pi 4"
+	depends on BR2_aarch64
+	select BR2_PACKAGE_FEATURE_WIFI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI
+	select BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI_WIFI
+
+	help
+	  Raspberry Pi 4

package/board/raspberry-pi-4/raspberry-pi-4.mk

@@ -0,0 +1,61 @@
+define RASPBERRY_PI_4_LINUX_CONFIG_FIXUPS
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SOUND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SND_SOC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_MOUSE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_KEYBOARD)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_INPUT_TOUCHSCREEN)
+	$(call KCONFIG_SET_OPT,CONFIG_INPUT_MOUSEDEV,m)
+	$(call KCONFIG_SET_OPT,CONFIG_HID_GENERIC,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_ARCH_BRCMSTB)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2835_MBOX,y)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BCM2835_WDT)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DMA_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_PINCTRL_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_GPIO_BCM2835)
+	$(call KCONFIG_SET_OPT,CONFIG_BRCMFMAC,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BRCMFMAC_SDIO)
+	$(call KCONFIG_SET_OPT,CONFIG_I2C_BCM2835,m)
+	$(call KCONFIG_SET_OPT,CONFIG_BCM2711_THERMAL,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_MMC_SDHCI_IPROC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_RASPBERRYPI_POWER)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_BCM2835AUX)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_EXTENDED)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_SERIAL_8250_SHARE_IRQ)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_NET_VENDOR_BROADCOM)
+	$(call KCONFIG_SET_OPT,CONFIG_BCMGENET,m)
+	$(call KCONFIG_SET_OPT,CONFIG_REGULATOR_RASPBERRYPI_TOUCHSCREEN_ATTINY,m)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_COMMON_CLK_BCM2835)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_CLK_RASPBERRYPI)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_KMS_HELPER)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_V3D,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_VC4,m)
+	$(call KCONFIG_SET_OPT,CONFIG_STAGING,y)
+	$(call KCONFIG_SET_OPT,CONFIG_SND_BCM2835,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_VC4_HDMI_CEC)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_LOAD_EDID_FIRMWARE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_PANEL_BRIDGE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_BRIDGE)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_TOSHIBA_TC358762,m)
+	$(call KCONFIG_SET_OPT,CONFIG_DRM_PANEL_SIMPLE,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FB)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY)
+	$(call KCONFIG_ENABLE_OPT,CONFIG_DRM_FBDEV_EMULATION)
+
+	$(call KCONFIG_SET_OPT,CONFIG_TOUCHSCREEN_EDT_FT5X06,m)
+
+	$(call KCONFIG_ENABLE_OPT,CONFIG_BACKLIGHT_CLASS_DEVICE)
+endef
+$(eval $(ix-board))
+$(eval $(generic-package))